flake.lock: Update

Flake lock file updates:

• Updated input 'home-manager':
    'github:nix-community/home-manager/7aae0ee71a17b19708b93b3ed448a1a0952bf111?narHash=sha256-gjN3j7joRvT3a8Zgcylnd4NFsnXeDBumqiu4HmY1RIg%3D' (2025-06-05)
  → 'github:nix-community/home-manager/366f00797b1efb70f2882d3da485e3c10fd3d557?narHash=sha256-Lh3dopA8DdY%2BZoaAJPrtkZOZaFEJGSYjOdAYYgOPgE4%3D' (2025-06-24)
• Updated input 'hyprland':
    'github:hyprwm/Hyprland/cf7e3aa448f8c9e0d9e8f407e6ed730da55acc69?narHash=sha256-uxIwiV1p2SVNIoP%2BoD025lZKfq4zNn7CmdaYVoskqnQ%3D' (2025-06-23)
  → 'github:hyprwm/Hyprland/5a348fb7dfaf398922c119d21acb7d7f831f8688?narHash=sha256-zQbFEl3XCfyKHHGcBY0f18F5YTsaV1fJz4C6BRL28z4%3D' (2025-06-24)
• Updated input 'hyprland-plugins':
    'github:hyprwm/hyprland-plugins/132e610b6526820fa1bcf33588be11538fb92ca7?narHash=sha256-ZA00aPfBtrSTz6UsZ6uoBfy2UYi49A9XpxxyKUjbQ2A%3D' (2025-06-23)
  → 'github:hyprwm/hyprland-plugins/c1fdf38bfcd716130ce022cf21a1fca7582482d1?narHash=sha256-Oqn6gHIVfgkzzuigwNk9UZbgKdyzAzU/JoywB6z1O%2BM%3D' (2025-06-24)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/b2485d56967598da068b5a6946dadda8bfcbcd37?narHash=sha256-3vkjFnxCOP6vm5Pm13wC/Zy6/VYgei/I/2DWgW4RFeA%3D' (2025-06-20)
  → 'github:NixOS/nixpkgs/c7ab75210cb8cb16ddd8f290755d9558edde7ee1?narHash=sha256-kMhs%2BYzV4vPGfuTpD3mwzibWUE6jotw5Al2wczI0Pv8%3D' (2025-06-22)
• Updated input 'pre-commit-hooks':
    'github:cachix/git-hooks.nix/fae816c55a75675f30d18c9cbdecc13b970d95d4?narHash=sha256-uLtw0iF9mQ94L831NOlQLPX9wm0qzd5yim3rcwACEoM%3D' (2025-06-23)
  → 'github:cachix/git-hooks.nix/16ec914f6fb6f599ce988427d9d94efddf25fe6d?narHash=sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg%3D' (2025-06-24)

README.md

@@ -7,7 +7,7 @@ System and user configuration for NixOS-based systems.
 | **Shell:** | zsh |
 | **DE:** | GNOME |
 | **Theme:** | Adwaita |
-| **Terminal:** | Ptyxis |
+| **Terminal:** | Ghostty |
 
 ## Provisioning a new host
 > [nixos-anywhere](https://github.com/nix-community/nixos-anywhere) is the module used

flake.nix

@@ -2,7 +2,7 @@
   description = "NixOS system configuration";
 
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-24.11";
+    nixpkgs.url = "nixpkgs/nixos-25.05";
     nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
     # nixpkgs-master.url = "nixpkgs";
     agenix.url = "github:ryantm/agenix";
@@ -12,9 +12,14 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.11";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    hyprland.url = "github:hyprwm/Hyprland";
+    hyprland-plugins = {
+      url = "github:hyprwm/hyprland-plugins";
+      inputs.hyprland.follows = "hyprland";
+    };
     firefox-gnome-theme = {
       url = "github:rafaelmardojai/firefox-gnome-theme";
       flake = false;
@@ -23,24 +28,20 @@
       url = "git+ssh://git@git.vimium.com/jordan/gitea-github-theme.git?ref=main";
       flake = false;
     };
+    impermanence.url = "github:nix-community/impermanence";
     kvlibadwaita = {
       url = "github:GabePoel/KvLibadwaita";
       flake = false;
     };
     nixos-hardware.url = "github:NixOS/nixos-hardware";
     nixos-mailserver = {
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixvim = {
-      url = "github:nix-community/nixvim/nixos-24.11";
+      url = "github:nix-community/nixvim/nixos-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    plasma-manager = {
-      url = "github:nix-community/plasma-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.home-manager.follows = "home-manager";
-    };
     pre-commit-hooks = {
       url = "github:cachix/git-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -98,7 +99,7 @@
         (lib.mapAttrs (
           name: value:
           lib.nixosSystem {
-            specialArgs = { inherit self; };
+            specialArgs = { inherit inputs; };
 
             modules = [
               {
@@ -135,6 +136,7 @@
               nixfmt-rfc-style.enable = true;
               trim-trailing-whitespace.enable = true;
             };
+            excludes = [ "pkgs/libcamera-rpi/libcamera-rpi-ipa-priv-key.pem" ];
           };
         }));
 
@@ -156,8 +158,8 @@
         sshUser = "root";
         nodes = lib.genAttrs [
           "mail"
-          # "pi"
+          "pi"
-          # "skycam"
+          "skycam"
           "vps1"
         ] mkDeployNode;
       };

hosts/atlas/default.nix

@@ -22,23 +22,6 @@
   users.extraGroups.vboxusers.members = [ "jordan" ];
 
   modules = {
-    programs = {
-      dev = {
-        node.enable = true;
-      };
-      firefox.enable = true;
-      git.enable = true;
-      gpg.enable = true;
-      graphics = {
-        raster.enable = true;
-        vector.enable = true;
-      };
-      libreoffice.enable = true;
-      neovim.enable = true;
-      pass.enable = true;
-      qbittorrent.enable = true;
-      thunderbird.enable = true;
-    };
     services = {
       borgmatic = {
         enable = true;
@@ -48,9 +31,6 @@
         repoPath = "ssh://uzu2y5b1@uzu2y5b1.repo.borgbase.com/./repo";
       };
     };
-    shell = {
-      zsh.enable = true;
-    };
   };
 
   system.stateVersion = "22.11";

hosts/common.nix

@@ -1,24 +1,32 @@
 {
+  inputs,
+  config,
   pkgs,
-  self,
   ...
 }:
 
 {
   imports = [
-    self.inputs.agenix.nixosModules.age
+    inputs.agenix.nixosModules.age
-    self.inputs.home-manager.nixosModule
+    inputs.home-manager.nixosModules.home-manager
-    ../modules/home-manager
     ../modules/nixos
   ];
 
-  nixpkgs.overlays = [
+  nixpkgs = {
-    self.inputs.agenix.overlays.default
+    config.allowUnfree = true;
+    overlays = [
+      inputs.agenix.overlays.default
       (import ../overlays/default.nix)
       (final: prev: {
-      unstable = import self.inputs.nixpkgs-unstable { system = final.system; };
+        unstable = import inputs.nixpkgs-unstable {
+          config = {
+            allowUnfree = true;
+          };
+          system = final.system;
+        };
       })
     ];
+  };
 
   time.timeZone = "Europe/London";
 
@@ -54,7 +62,12 @@
   '';
 
   users.defaultUserShell = pkgs.zsh;
-  programs.zsh.enable = true;
+  programs.zsh = {
+    enable = true;
+    enableCompletion = false;
+  };
+
+  environment.pathsToLink = [ "/share/zsh" ];
 
   nix = {
     package = pkgs.nixVersions.stable;
@@ -63,7 +76,7 @@
     '';
     buildMachines = [
       {
-        hostName = "10.0.1.79";
+        hostName = "10.0.1.235";
         sshUser = "root";
         system = "aarch64-linux";
         maxJobs = 6;
@@ -98,6 +111,20 @@
     };
   };
 
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    sharedModules = [
+      inputs.nixvim.homeManagerModules.nixvim
+      {
+        home.stateVersion = config.system.stateVersion;
+      }
+    ];
+    extraSpecialArgs = {
+      inherit inputs;
+    };
+  };
+
   environment.systemPackages = with pkgs; [
     git
     neovim

hosts/desktop.nix

@@ -1,18 +1,18 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ./common.nix
+    ../users/jordan
   ];
 
-  nixpkgs.overlays = [
+  services.printing.enable = true;
-    (import ../overlays/gnome.nix)
-  ];
-
-  services.printing.enable = false;
   services.openssh.startWhenNeeded = true;
 
-  hardware.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
   security.rtkit.enable = true;
   services.pipewire = {
     enable = true;
@@ -46,18 +46,6 @@
 
   systemd.services.NetworkManager-wait-online.enable = false;
 
-  fonts.packages = with pkgs; [
-    noto-fonts
-    (nerdfonts.override {
-      fonts = [
-        "BigBlueTerminal"
-        "ComicShannsMono"
-        "Terminus"
-        "UbuntuMono"
-      ];
-    })
-  ];
-
   modules = {
     system.desktop.gnome.enable = true;
     services.tailscale.enable = true;

hosts/eos/default.nix

@@ -18,28 +18,5 @@
     networkmanager.enable = true;
   };
 
-  dconf.settings = {
-    "org/gnome/desktop/interface" = {
-      show-battery-percentage = true;
-    };
-  };
-
-  modules = {
-    programs = {
-      dev = {
-        node.enable = true;
-      };
-      firefox.enable = true;
-      git.enable = true;
-      gpg.enable = true;
-      neovim.enable = true;
-      pass.enable = true;
-      qbittorrent.enable = true;
-    };
-    shell = {
-      zsh.enable = true;
-    };
-  };
-
   system.stateVersion = "22.11";
 }

hosts/helios/default.nix

@@ -1,5 +1,12 @@
-{ ... }:
+{
+  pkgs,
+  lib,
+  ...
+}:
 
+let
+  inherit (lib) mkForce;
+in
 {
   imports = [
     ./hardware-configuration.nix
@@ -21,18 +28,11 @@
     networkmanager.enable = true;
   };
 
+  environment.systemPackages = [
+    pkgs.moonlight-qt
+  ];
+
   modules = {
-    programs = {
-      dev = {
-        node.enable = true;
-      };
-      firefox.enable = true;
-      git.enable = true;
-      gpg.enable = true;
-      neovim.enable = true;
-      pass.enable = true;
-      qbittorrent.enable = true;
-    };
     services = {
       borgmatic = {
         enable = true;
@@ -42,8 +42,9 @@
         repoPath = "ssh://b9cjl9hq@b9cjl9hq.repo.borgbase.com/./repo";
       };
     };
-    shell = {
+    system.desktop = {
-      zsh.enable = true;
+      gnome.enable = mkForce false;
+      hyprland.enable = true;
     };
   };
 

hosts/helios/hardware-configuration.nix

@@ -28,6 +28,8 @@
     supportedFilesystems = [ "zfs" ];
   };
 
+  powerManagement.cpuFreqGovernor = "schedutil";
+
   fileSystems."/" = {
     device = "rpool/system/root";
     fsType = "zfs";

hosts/hypnos/default.nix

@@ -1,13 +1,13 @@
 {
-  config,
+  inputs,
   lib,
-  self,
+  pkgs,
   ...
 }:
 
 {
   imports = [
-    self.inputs.disko.nixosModules.disko
+    inputs.disko.nixosModules.disko
     ./hardware-configuration.nix
     ./disko-config.nix
     ../desktop.nix
@@ -16,7 +16,6 @@
   nixpkgs = {
     hostPlatform = "x86_64-linux";
     config = {
-      allowUnfree = true;
       nvidia.acceptLicense = true;
     };
   };
@@ -35,32 +34,16 @@
       videoDrivers = [ "nvidia" ];
     };
     displayManager = {
-      defaultSession = if config.modules.system.desktop.kde.enable then "plasmax11" else "gnome-xorg";
+      defaultSession = "gnome-xorg";
-      sddm.wayland.enable = lib.mkForce false;
     };
   };
 
   # Workaround for label rendering bug in GTK4 with nvidia 470 driver
   environment.sessionVariables.GSK_RENDERER = "gl";
 
-  modules = {
+  environment.systemPackages = [
-    programs = {
+    pkgs.moonlight-qt
-      dev = {
+  ];
-        node.enable = true;
-      };
-      firefox.enable = true;
-      git.enable = true;
-      gpg.enable = true;
-      neovim.enable = true;
-      pass.enable = true;
-      recording = {
-        audio.enable = true;
-      };
-    };
-    shell = {
-      zsh.enable = true;
-    };
-  };
 
   system.stateVersion = "22.11";
 }

hosts/library/README.md

@@ -8,12 +8,12 @@ Media and public file server.
 * Chipset - AMD B550
 * Memory - 64 GB DDR4
 * Motherboard - ASRock B550M Pro4
-* Case - Fractal Design Node 804
+* Case - JMCD-12S4
 
 ### Disks
 Device | Partitions _(filesystem, size, usage)_
 --- | ---
-Samsung 980 Evo | `/dev/nvme0n1p1` (EFI, 512 MiB, NixOS Boot) <br> `/dev/nvme0n1p2` (ZFS `rpool`, 200 GiB, NixOS Root)
+Samsung 970 Evo Plus | `/dev/nvme0n1p1` (EFI, 512 MiB, NixOS Boot) <br> `/dev/nvme0n1p2` (ZFS `rpool`, 200 GiB, NixOS Root)
 
 #### ZFS datasets
 ```

hosts/library/ai.nix

@@ -0,0 +1,38 @@
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}:
+
+{
+  age.secrets."files/services/open-webui/envfile" = {
+    file = "${inputs.secrets}/files/services/open-webui/envfile.age";
+  };
+
+  services.open-webui = {
+    enable = true;
+    package = pkgs.unstable.open-webui;
+    port = 8081;
+    environment =
+      let
+        clientId = "open-webui";
+        publicUrl = "https://chat.ai.vimium.com";
+      in
+      {
+        WEBUI_URL = publicUrl;
+        ENABLE_LOGIN_FORM = "False";
+        ENABLE_OAUTH_SIGNUP = "True";
+        ENABLE_OAUTH_ROLE_MANAGEMENT = "True";
+        OAUTH_CLIENT_ID = clientId;
+        OAUTH_PROVIDER_NAME = "Vimium";
+        OPENID_PROVIDER_URL = "https://auth.vimium.com/oauth2/openid/${clientId}/.well-known/openid-configuration";
+        OPENID_REDIRECT_URI = "${publicUrl}/oauth/oidc/callback";
+      };
+    environmentFile = config.age.secrets."files/services/open-webui/envfile".path;
+  };
+
+  modules.services.borgmatic.directories = [
+    "/var/lib/private/open-webui"
+  ];
+}

hosts/library/default.nix

@@ -1,8 +1,17 @@
-{ config, pkgs, ... }:
+{
+  ...
+}:
 
 {
   imports = [
     ./hardware-configuration.nix
+    ./ai.nix
+    ./grafana.nix
+    ./jellyfin.nix
+    ./jellysearch.nix
+    ./nginx.nix
+    ./prometheus.nix
+    ./tunnel.nix
     ../server.nix
   ];
 
@@ -11,11 +20,17 @@
   boot = {
     loader.systemd-boot.enable = true;
     loader.efi.canTouchEfiVariables = true;
-    zfs.extraPools = [ "library" ];
+    zfs.extraPools = [
+      "downloads"
+      "library"
+    ];
   };
 
   networking = {
     hostId = "d24ae953";
+    hosts = {
+      "100.64.0.1" = [ "auth.vimium.com" ];
+    };
     firewall = {
       enable = true;
       allowedTCPPorts = [
@@ -43,153 +58,12 @@
     enable = true;
   };
 
-  services.grafana = {
-    enable = true;
-    settings = {
-      server = {
-        domain = "library.mesh.vimium.net";
-        http_addr = "0.0.0.0";
-        http_port = 3000;
-      };
-    };
-  };
-
-  services.prometheus = {
-    enable = true;
-    port = 9001;
-    exporters = {
-      node = {
-        enable = true;
-        enabledCollectors = [ "systemd" ];
-        port = 9002;
-      };
-      zfs = {
-        enable = true;
-        port = 9003;
-      };
-    };
-    scrapeConfigs = [
-      {
-        job_name = "node";
-        static_configs = [
-          {
-            targets = [
-              "127.0.0.1:${toString config.services.prometheus.exporters.node.port}"
-              "127.0.0.1:${toString config.services.prometheus.exporters.zfs.port}"
-            ];
-          }
-        ];
-      }
-    ];
-  };
-
-  systemd.services.vps1-tunnel = {
-    enable = true;
-    description = "vps1.mesh.vimium.net SSH tunnel";
-    after = [
-      "network-online.target"
-      "jellyfin.service"
-    ];
-    wants = [ "network-online.target" ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = pkgs.lib.mkForce ''
-        ${pkgs.openssh}/bin/ssh \
-          -NT \
-          -o ExitOnForwardFailure=yes \
-          -o ServerAliveInterval=60 \
-          -o TCPKeepAlive=no \
-          -i %h/.ssh/id_jellyfin \
-          -R localhost:8000:localhost:8000 \
-          jellyfin@vps1.mesh.vimium.net
-      '';
-      Restart = "always";
-      RestartSec = 20;
-    };
-    wantedBy = [ "default.target" ];
-  };
-
-  services.nginx =
-    let
-      proxyConfig = ''
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header Host $host;
-
-        proxy_set_header Range $http_range;
-        proxy_set_header If-Range $http_if_range;
-
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-      '';
-    in
-    {
-      enable = true;
-      package = pkgs.openresty;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedTlsSettings = true;
-      clientMaxBodySize = "2G";
-      virtualHosts = {
-        "library.mesh.vimium.net" = {
-          locations."/" = {
-            root = "/mnt/library";
-            extraConfig = ''
-              autoindex on;
-            '';
-          };
-        };
-        "jellyfin.vimium.com" = {
-          default = true;
-          listen = [
-            {
-              addr = "127.0.0.1";
-              port = 8000;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://localhost:8096";
-            extraConfig = proxyConfig;
-          };
-          locations."/metrics" = {
-            return = "404";
-          };
-        };
-      };
-    };
-
-  hardware.graphics = {
-    enable = true;
-    extraPackages = with pkgs; [
-      vaapiVdpau
-    ];
-  };
-  users.users.jellyfin.extraGroups = [
-    "video"
-    "render"
-  ];
-  services.jellyfin = {
-    enable = true;
-    package = pkgs.unstable.jellyfin;
-    cacheDir = "/var/cache/jellyfin";
-    dataDir = "/var/lib/jellyfin";
-  };
-
   modules = {
     podman.enable = true;
-    programs = {
-      gpg.enable = true;
-    };
-    shell = {
-      zsh.enable = true;
-    };
     services = {
       borgmatic = {
         enable = true;
         directories = [
-          config.services.jellyfin.dataDir
           "/home/jordan"
         ];
         repoPath = "ssh://b61758r4@b61758r4.repo.borgbase.com/./repo";

hosts/library/grafana.nix

@@ -0,0 +1,16 @@
+{
+  ...
+}:
+
+{
+  services.grafana = {
+    enable = true;
+    settings = {
+      server = {
+        domain = "library.mesh.vimium.net";
+        http_addr = "0.0.0.0";
+        http_port = 3000;
+      };
+    };
+  };
+}

hosts/library/jellyfin.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+
+{
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [
+      vaapiVdpau
+    ];
+  };
+
+  users.users.jellyfin.extraGroups = [
+    "video"
+    "render"
+  ];
+
+  services.jellyfin = {
+    enable = true;
+    package = pkgs.unstable.jellyfin;
+    cacheDir = "/var/cache/jellyfin";
+    dataDir = "/var/lib/jellyfin";
+  };
+
+  modules.services.borgmatic.directories = [
+    config.services.jellyfin.dataDir
+  ];
+}

hosts/library/jellysearch.nix

@@ -0,0 +1,58 @@
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}:
+
+{
+  age.secrets."files/services/meilisearch/envfile" = {
+    file = "${inputs.secrets}/files/services/meilisearch/envfile.age";
+  };
+
+  services.meilisearch = {
+    enable = true;
+    package = pkgs.meilisearch;
+    masterKeyEnvironmentFile = config.age.secrets."files/services/meilisearch/envfile".path;
+  };
+
+  users.users.jellysearch = {
+    group = "jellysearch";
+    isSystemUser = true;
+  };
+
+  users.groups.jellysearch = { };
+
+  systemd.services.jellysearch = {
+    enable = true;
+    description = "JellySearch";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Restart = "on-failure";
+      ExecStart = "${pkgs.jellysearch}/bin/jellysearch";
+      StateDirectory = "jellysearch";
+      StateDirectoryMode = "0750";
+      WorkingDirectory = "/var/lib/jellysearch";
+      EnvironmentFile = config.age.secrets."files/services/meilisearch/envfile".path;
+
+      NoNewPrivileges = true;
+      SystemCallArchitectures = "native";
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      ProtectHostname = true;
+      LockPersonality = true;
+      PrivateDevices = true;
+      PrivateUsers = true;
+      RemoveIPC = true;
+    };
+    environment = {
+      DOTNET_ENVIRONMENT = "Production";
+      INDEX_CRON = "0 0 0/2 ? * * *";
+      JELLYFIN_URL = "http://localhost:8096";
+      JELLYFIN_CONFIG_DIR = "${toString config.services.jellyfin.dataDir}";
+      MEILI_URL = "http://localhost:${toString config.services.meilisearch.listenPort}";
+    };
+  };
+}

hosts/library/nginx.nix

@@ -0,0 +1,88 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  services.nginx =
+    let
+      proxyConfig = ''
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Host $host;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+      '';
+    in
+    {
+      enable = true;
+      package = pkgs.openresty;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedTlsSettings = true;
+      clientMaxBodySize = "2G";
+      virtualHosts = {
+        "library.mesh.vimium.net" = {
+          locations."/" = {
+            root = "/mnt/library";
+            extraConfig = ''
+              autoindex on;
+            '';
+          };
+        };
+        "chat.ai.vimium.com" = {
+          listen = [
+            {
+              addr = "127.0.0.1";
+              port = 8001;
+            }
+          ];
+          locations."/" = {
+            proxyPass = "http://localhost:8081";
+            extraConfig =
+              proxyConfig
+              + ''
+                # Disable proxy buffering for better streaming response from models
+                proxy_buffering off;
+
+                # Increase max request size for large attachments and long audio messages
+                client_max_body_size 20M;
+                proxy_read_timeout 10m;
+              '';
+          };
+        };
+        "jellyfin.vimium.com" = {
+          default = true;
+          listen = [
+            {
+              addr = "127.0.0.1";
+              port = 8000;
+            }
+          ];
+          locations."/" = {
+            extraConfig =
+              ''
+                # Proxy JellySearch first
+                if ($arg_searchTerm) {
+                  proxy_pass http://localhost:5000;
+                  break;
+                }
+
+                proxy_pass http://localhost:8096;
+              ''
+              + proxyConfig
+              + ''
+                proxy_set_header Range $http_range;
+                proxy_set_header If-Range $http_if_range;
+              '';
+          };
+          locations."/metrics" = {
+            return = "404";
+          };
+        };
+      };
+    };
+}

hosts/library/prometheus.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  ...
+}:
+
+{
+  services.prometheus = {
+    enable = true;
+    port = 9001;
+    exporters = {
+      node = {
+        enable = true;
+        enabledCollectors = [ "systemd" ];
+        port = 9002;
+      };
+      zfs = {
+        enable = true;
+        port = 9003;
+      };
+    };
+    scrapeConfigs = [
+      {
+        job_name = "node";
+        static_configs = [
+          {
+            targets = [
+              "127.0.0.1:${toString config.services.prometheus.exporters.node.port}"
+              "127.0.0.1:${toString config.services.prometheus.exporters.zfs.port}"
+            ];
+          }
+        ];
+      }
+    ];
+  };
+}

hosts/library/tunnel.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  systemd.services.vps1-tunnel = {
+    enable = true;
+    description = "vps1.mesh.vimium.net SSH tunnel";
+    after = [
+      "network-online.target"
+      "jellyfin.service"
+    ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = pkgs.lib.mkForce ''
+        ${pkgs.openssh}/bin/ssh \
+          -NT \
+          -o ExitOnForwardFailure=yes \
+          -o ServerAliveInterval=60 \
+          -o TCPKeepAlive=no \
+          -i %h/.ssh/id_jellyfin \
+          -R localhost:8000:localhost:8000 \
+          -R localhost:8001:localhost:8001 \
+          jellyfin@vps1.mesh.vimium.net
+      '';
+      Restart = "always";
+      RestartSec = 20;
+    };
+    wantedBy = [ "default.target" ];
+  };
+}

hosts/mail/default.nix

@@ -1,14 +1,14 @@
 {
-  lib,
+  inputs,
-  self,
   ...
 }:
 
 {
   imports = [
-    self.inputs.disko.nixosModules.disko
+    inputs.disko.nixosModules.disko
     ./hardware-configuration.nix
     ./disko-config.nix
+    ./mail.nix
     ../server.nix
   ];
 
@@ -24,18 +24,6 @@
     };
   };
 
-  users = {
-    users = {
-      root = {
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com"
-        ];
-      };
-    };
-  };
-
-  services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
-
   modules = {
     services = {
       borgmatic = {
@@ -47,7 +35,6 @@
         ];
         repoPath = "ssh://kg2mpt28@kg2mpt28.repo.borgbase.com/./repo";
       };
-      mail.enable = true;
     };
   };
 

hosts/mail/mail.nix

@@ -0,0 +1,88 @@
+{
+  inputs,
+  config,
+  ...
+}:
+
+let
+  sendingDomains = [
+    "jdholt.com"
+    "vimium.com"
+  ];
+  receiveOnlyDomains = [
+    "h0lt.com"
+    "jordanholt.xyz"
+    "vimium.co"
+    "vimium.co.uk"
+    "vimium.info"
+    "vimium.net"
+    "vimium.org"
+    "vimium.xyz"
+  ];
+  allDomains = sendingDomains ++ receiveOnlyDomains;
+in
+{
+  imports = [
+    inputs.nixos-mailserver.nixosModule
+  ];
+
+  age.secrets = {
+    "files/services/postfix/sasl_passwd".file =
+      "${inputs.secrets}/files/services/postfix/sasl_passwd.age";
+    "passwords/users/jordan".file = "${inputs.secrets}/passwords/users/jordan.age";
+  };
+
+  services.roundcube = {
+    enable = true;
+    hostName = config.mailserver.fqdn;
+    extraConfig = ''
+      $config['smtp_server'] = "tls://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+    '';
+    plugins = [ "contextmenu" ];
+  };
+
+  services.nginx.enable = true;
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  mailserver = {
+    enable = true;
+    fqdn = "mail.vimium.com";
+    domains = allDomains;
+    indexDir = "/var/lib/dovecot/indices";
+
+    certificateDomains = [
+      "imap.vimium.com"
+      "smtp.vimium.com"
+    ];
+    certificateScheme = "acme-nginx";
+
+    fullTextSearch.enable = true;
+
+    loginAccounts = {
+      "jordan@vimium.com" = {
+        hashedPasswordFile = config.age.secrets."passwords/users/jordan".path;
+        aliases = map (domain: "@" + domain) sendingDomains;
+        catchAll = receiveOnlyDomains;
+      };
+    };
+  };
+
+  services.postfix.config = {
+    relayhost = "[mail.smtp2go.com]:2525";
+
+    smtp_sasl_auth_enable = "yes";
+    smtp_sasl_password_maps = "texthash:${
+      config.age.secrets."files/services/postfix/sasl_passwd".path
+    }";
+    smtp_sasl_security_options = "noanonymous";
+
+    smtp_destination_concurrency_limit = "20";
+    header_size_limit = "4096000";
+  };
+}

hosts/odyssey/README.md

@@ -4,10 +4,10 @@
 Primary workstation.
 
 ## Specs
-* CPU - Intel Core i7-5930K @ 4.10GHz
+* CPU - AMD Ryzen 9 9950X3D @ 4.30GHz
-* Chipset - Intel X99
+* Chipset - AMD X870E
-* Memory - 64 GB DDR4
+* Memory - 96 GB DDR5
-* Motherboard - ASUS X99-A
+* Motherboard - ASUS ProArt X870E-Creator WiFi
 * GPU - NVIDIA RTX 3090
 * Case - Thermaltake A500
 

hosts/odyssey/default.nix

@@ -1,15 +1,20 @@
-{ config, ... }:
+{
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ./hardware-configuration.nix
+    ./gitea-runner.nix
+    ./nix-serve.nix
     ../desktop.nix
   ];
 
   nixpkgs = {
     hostPlatform = "x86_64-linux";
     config = {
-      allowUnfree = true;
       nvidia.acceptLicense = true;
     };
   };
@@ -37,53 +42,13 @@
     lxd.enable = true;
   };
 
-  services.nix-serve = {
+  services.sunshine = {
-    enable = true;
+    enable = false;
-    secretKeyFile = "/var/cache-priv-key.pem";
+    package = pkgs.unstable.sunshine;
-  };
+    capSysAdmin = true;
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    virtualHosts = {
-      "odyssey.mesh.vimium.net" = {
-        locations."/".proxyPass =
-          "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
-      };
-    };
   };
 
   modules = {
-    programs = {
-      dev = {
-        node.enable = true;
-      };
-      emulators = {
-        gamecube.enable = true;
-        ps2.enable = true;
-        ps3.enable = true;
-        psp.enable = true;
-        wii.enable = true;
-        xbox.enable = true;
-      };
-      firefox.enable = true;
-      git.enable = true;
-      gpg.enable = true;
-      graphics = {
-        modeling.enable = true;
-        raster.enable = true;
-        vector.enable = true;
-      };
-      libreoffice.enable = true;
-      lutris.enable = true;
-      pass.enable = true;
-      neovim.enable = true;
-      qbittorrent.enable = true;
-      recording = {
-        audio.enable = true;
-        video.enable = true;
-      };
-    };
     hardware.presonus-studio.enable = true;
     services = {
       borgmatic = {
@@ -99,10 +64,10 @@
         ];
         repoPath = "ssh://iqwu22oq@iqwu22oq.repo.borgbase.com/./repo";
       };
-      gitea-runner.enable = true;
     };
-    shell = {
+    system.desktop = {
-      zsh.enable = true;
+      gnome.enable = lib.mkForce false;
+      hyprland.enable = true;
     };
   };
 

hosts/odyssey/gitea-runner.nix

@@ -0,0 +1,228 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+
+# Based on: https://git.clan.lol/clan/clan-infra/src/branch/main/modules/web01/gitea/actions-runner.nix
+
+let
+  hostname = config.networking.hostName;
+  giteaUrl = "https://git.vimium.com";
+
+  storeDepsBins = with pkgs; [
+    coreutils
+    findutils
+    gnugrep
+    gawk
+    git
+    nix
+    nix-update
+    bash
+    jq
+    nodejs
+  ];
+
+  storeDeps = pkgs.runCommand "store-deps" { } ''
+    mkdir -p $out/bin
+    for dir in ${toString storeDepsBins}; do
+      for bin in "$dir"/bin/*; do
+        ln -s "$bin" "$out/bin/$(basename "$bin")"
+      done
+    done
+
+    # Add SSL CA certs
+    mkdir -p $out/etc/ssl/certs
+    cp -a "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" $out/etc/ssl/certs/ca-bundle.crt
+  '';
+in
+{
+  modules.podman.enable = true;
+
+  systemd.services = {
+    gitea-runner-nix-image = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "podman.service" ];
+      requires = [ "podman.service" ];
+      path = [
+        config.virtualisation.podman.package
+        pkgs.gnutar
+        pkgs.shadow
+        pkgs.getent
+      ];
+      script = ''
+        set -eux -o pipefail
+        mkdir -p etc/nix
+
+        # Create an unpriveleged user that we can use also without the run-as-user.sh script
+        touch etc/passwd etc/group
+        groupid=$(cut -d: -f3 < <(getent group nix-ci-user))
+        userid=$(cut -d: -f3 < <(getent passwd nix-ci-user))
+        groupadd --prefix $(pwd) --gid "$groupid" nix-ci-user
+        emptypassword='$6$1ero.LwbisiU.h3D$GGmnmECbPotJoPQ5eoSTD6tTjKnSWZcjHoVTkxFLZP17W9hRi/XkmCiAMOfWruUwy8gMjINrBMNODc7cYEo4K.'
+        useradd --prefix $(pwd) -p "$emptypassword" -m -d /tmp -u "$userid" -g "$groupid" -G nix-ci-user nix-ci-user
+
+        cat <<NIX_CONFIG > etc/nix/nix.conf
+        accept-flake-config = true
+        experimental-features = nix-command flakes
+        NIX_CONFIG
+
+        cat <<NSSWITCH > etc/nsswitch.conf
+        passwd:    files mymachines systemd
+        group:     files mymachines systemd
+        shadow:    files
+
+        hosts:     files mymachines dns myhostname
+        networks:  files
+
+        ethers:    files
+        services:  files
+        protocols: files
+        rpc:       files
+        NSSWITCH
+
+        # list the content as it will be imported into the container
+        tar -cv . | tar -tvf -
+        tar -cv . | podman import - gitea-runner-nix
+      '';
+      serviceConfig = {
+        RuntimeDirectory = "gitea-runner-nix-image";
+        WorkingDirectory = "/run/gitea-runner-nix-image";
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+    };
+
+    gitea-runner-nix = {
+      after = [ "gitea-runner-nix-image.service" ];
+      requires = [ "gitea-runner-nix-image.service" ];
+
+      serviceConfig = {
+        # Hardening (may overlap with DynamicUser=)
+        # The following options are only for optimizing output of systemd-analyze
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0066";
+        ProtectProc = "invisible";
+        SystemCallFilter = [
+          "~@clock"
+          "~@cpu-emulation"
+          "~@module"
+          "~@mount"
+          "~@obsolete"
+          "~@raw-io"
+          "~@reboot"
+          "~@swap"
+          # needed by go?
+          #"~@resources"
+          "~@privileged"
+          "~capset"
+          "~setdomainname"
+          "~sethostname"
+        ];
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+          "AF_NETLINK"
+        ];
+
+        # Needs network access
+        PrivateNetwork = false;
+        # Cannot be true due to Node
+        MemoryDenyWriteExecute = false;
+
+        # The more restrictive "pid" option makes `nix` commands in CI emit
+        # "GC Warning: Couldn't read /proc/stat"
+        # You may want to set this to "pid" if not using `nix` commands
+        ProcSubset = "all";
+        # Coverage programs for compiled code such as `cargo-tarpaulin` disable
+        # ASLR (address space layout randomization) which requires the
+        # `personality` syscall
+        # You may want to set this to `true` if not using coverage tooling on
+        # compiled code
+        LockPersonality = false;
+
+        # Note that this has some interactions with the User setting; so you may
+        # want to consult the systemd docs if using both.
+        DynamicUser = true;
+      };
+    };
+  };
+
+  users.users.nix-ci-user = {
+    group = "nix-ci-user";
+    description = "Used for running nix-based CI jobs";
+    home = "/var/empty";
+    isSystemUser = true;
+  };
+  users.groups.nix-ci-user = { };
+
+  age.secrets."files/services/gitea-runner/${hostname}-token" = {
+    file = "${inputs.secrets}/files/services/gitea-runner/${hostname}-token.age";
+    group = "podman";
+  };
+
+  services.gitea-actions-runner.instances = {
+    act = {
+      enable = true;
+      url = giteaUrl;
+      name = "act-runner-${hostname}";
+
+      tokenFile = config.age.secrets."files/services/gitea-runner/${hostname}-token".path;
+      settings = {
+        cache.enabled = true;
+        runner.capacity = 4;
+      };
+
+      labels = [
+        "debian-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+      ];
+    };
+    nix = {
+      enable = true;
+      url = giteaUrl;
+      name = "nix-runner-${hostname}";
+
+      tokenFile = config.age.secrets."files/services/gitea-runner/${hostname}-token".path;
+      settings = {
+        cache.enabled = true;
+        container = {
+          options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nix-ci-user";
+          network = "host";
+          valid_volumes = [
+            "/nix"
+            "${storeDeps}/bin"
+            "${storeDeps}/etc/ssl"
+          ];
+        };
+        runner.capacity = 4;
+      };
+
+      labels = [
+        "nix:docker://gitea-runner-nix"
+      ];
+    };
+  };
+}

hosts/odyssey/hardware-configuration.nix

@@ -22,22 +22,29 @@
     ];
     initrd.kernelModules = [ ];
     initrd.supportedFilesystems = [ "zfs" ];
-    kernelModules = [ "kvm-intel" ];
+    kernelModules = [ "kvm-amd" ];
-    kernelPackages = pkgs.linuxPackages;
+    kernelPackages = pkgs.linuxPackages_6_12;
     supportedFilesystems = [ "ntfs" ];
     binfmt.emulatedSystems = [ "aarch64-linux" ];
   };
 
   hardware = {
-    cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+    bluetooth = {
+      enable = true;
+      powerOnBoot = true;
+    };
+    cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
     nvidia = {
       modesetting.enable = true;
       open = true;
       package = config.boot.kernelPackages.nvidiaPackages.beta;
       powerManagement.enable = true;
+      nvidiaSettings = false;
     };
   };
 
+  powerManagement.cpuFreqGovernor = "schedutil";
+
   services.xserver.videoDrivers = [ "nvidia" ];
 
   fileSystems."/" = {

hosts/odyssey/nix-serve.nix

@@ -0,0 +1,22 @@
+{
+  config,
+  ...
+}:
+
+{
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = "/var/cache-priv-key.pem";
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts = {
+      "odyssey.mesh.vimium.net" = {
+        locations."/".proxyPass =
+          "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+      };
+    };
+  };
+}

hosts/pi/default.nix

@@ -1,13 +1,15 @@
 {
+  inputs,
   pkgs,
-  self,
   ...
 }:
 
 {
   imports = [
-    self.inputs.nixos-hardware.nixosModules.raspberry-pi-4
+    inputs.nixos-hardware.nixosModules.raspberry-pi-4
     ./hardware-configuration.nix
+    ./home-assistant
+    ./snapcast.nix
     ../server.nix
   ];
 
@@ -124,7 +126,6 @@
         enable = true;
         repoPath = "ssh://qcw86s11@qcw86s11.repo.borgbase.com/./repo";
       };
-      home-assistant.enable = true;
     };
   };
 

hosts/pi/hardware-configuration.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  pkgs,
   modulesPath,
   ...
 }:
@@ -11,44 +10,6 @@
   ];
 
   boot = {
-    kernelPackages =
-      let
-        version = "6.1.73";
-        tag = "stable_20240124";
-        srcHash = "sha256-P4ExzxWqZj+9FZr9U2tmh7rfs/3+iHEv0m74PCoXVuM=";
-      in
-      pkgs.linuxPackagesFor (
-        pkgs.linux_rpi4.override {
-          argsOverride = {
-            src = pkgs.fetchFromGitHub {
-              owner = "raspberrypi";
-              repo = "linux";
-              rev = tag;
-              hash = srcHash;
-            };
-            version = version;
-            modDirVersion = version;
-            structuredExtraConfig = { };
-            kernelPatches = [
-              {
-                name = "drm-rp1-depends-on-instead-of-select-MFD_RP1.patch";
-                patch = pkgs.fetchpatch {
-                  url = "https://github.com/peat-psuwit/rpi-linux/commit/6de0bb51929cd3ad4fa27b2a421a2af12e6468f5.patch";
-                  hash = "sha256-9pHcbgWTiztu48SBaLPVroUnxnXMKeCGt5vEo9V8WGw=";
-                };
-              }
-              {
-                name = "iommu-bcm2712-don-t-allow-building-as-module.patch";
-                patch = pkgs.fetchpatch {
-                  url = "https://github.com/peat-psuwit/rpi-linux/commit/693a5e69bddbcbe1d1b796ebc7581c3597685b1b.patch";
-                  hash = "sha256-8BYYQDM5By8cTk48ASYKJhGVQnZBIK4PXtV70UtfS+A=";
-                };
-              }
-            ];
-          };
-        }
-      );
-
     # Stop ZFS kernel being built
     supportedFilesystems = lib.mkForce [
       "btrfs"
@@ -69,23 +30,6 @@
     (final: prev: {
       makeModulesClosure = x: prev.makeModulesClosure (x // { allowMissing = true; });
     })
-    (final: prev: {
-      raspberrypifw =
-        let
-          version = "1.20240529";
-          srcHash = "sha256-KsCo7ZG6vKstxRyFljZtbQvnDSqiAPdUza32xTY/tlA=";
-        in
-        pkgs.raspberrypifw.override {
-          argsOverride = {
-            src = prev.fetchFromGitHub {
-              owner = "raspberrypi";
-              repo = "firmware";
-              rev = "${version}";
-              hash = srcHash;
-            };
-          };
-        };
-    })
   ];
 
   fileSystems = {

hosts/pi/home-assistant/default.nix

@@ -0,0 +1,296 @@
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [
+    ./floorplan/default.nix
+    ./mqtt.nix
+  ];
+
+  age.secrets."files/services/home-assistant/secrets.yaml" = {
+    file = "${inputs.secrets}/files/services/home-assistant/secrets.yaml.age";
+    path = "${config.services.home-assistant.configDir}/secrets.yaml";
+    owner = "hass";
+    group = "hass";
+  };
+
+  services.home-assistant = {
+    enable = true;
+
+    config = {
+      automation = "!include automations.yaml";
+      backup = { };
+      binary_sensor = [ ];
+      default_config = { };
+      http = {
+        server_host = "::1";
+        trusted_proxies = [ "::1" ];
+        use_x_forwarded_for = true;
+      };
+      ffmpeg = { };
+      homeassistant = {
+        name = "Home";
+        latitude = "!secret latitude";
+        longitude = "!secret longitude";
+        country = "GB";
+        temperature_unit = "C";
+        time_zone = config.time.timeZone;
+        unit_system = "metric";
+        auth_providers = [
+          {
+            type = "trusted_networks";
+            trusted_networks = [
+              "100.64.0.0/10"
+              "127.0.0.1"
+            ];
+            allow_bypass_login = true;
+          }
+          {
+            type = "homeassistant";
+          }
+        ];
+      };
+      logger = {
+        default = "info";
+        logs = { };
+      };
+      lovelace = {
+        mode = "yaml";
+      };
+      media_player = [ ];
+      mobile_app = { };
+      open_meteo = { };
+      recorder = {
+        purge_keep_days = 365;
+      };
+      scene = "!include scenes.yaml";
+      script = "!include scripts.yaml";
+      sensor = [ ];
+      system_health = { };
+      zeroconf = { };
+    };
+
+    extraComponents = [
+      "air_quality"
+      "airly"
+      "alert"
+      "api"
+      "application_credentials"
+      "asuswrt"
+      "auth"
+      "automation"
+      "bayesian"
+      "binary_sensor"
+      # "blackbird"
+      "blueprint"
+      "bluetooth_adapters"
+      "bluetooth_le_tracker"
+      "button"
+      "calendar"
+      "camera"
+      "cast"
+      "cert_expiry"
+      "climate"
+      "co2signal"
+      "color_extractor"
+      "command_line"
+      "compensation"
+      "configurator"
+      "counter"
+      "cover"
+      "cpuspeed"
+      "default_config"
+      "demo"
+      "derivative"
+      "device_automation"
+      "device_sun_light_trigger"
+      "device_tracker"
+      "dlna_dmr"
+      "dlna_dms"
+      "dnsip"
+      "esphome"
+      "fail2ban"
+      "fan"
+      "feedreader"
+      "ffmpeg"
+      "file"
+      "file_upload"
+      "filesize"
+      "folder"
+      "folder_watcher"
+      "forecast_solar"
+      "frontend"
+      "gdacs"
+      "generic"
+      "generic_hygrostat"
+      "generic_thermostat"
+      "geo_json_events"
+      "geo_location"
+      "geo_rss_events"
+      "github"
+      "group"
+      "hardware"
+      "hdmi_cec"
+      "history_stats"
+      "homeassistant"
+      "homekit"
+      "homekit_controller"
+      "html5"
+      "http"
+      "humidifier"
+      "icloud"
+      "image_processing"
+      "input_boolean"
+      "input_button"
+      "input_datetime"
+      "input_number"
+      "input_select"
+      "input_text"
+      "integration"
+      "ios"
+      "jellyfin"
+      "light"
+      "local_calendar"
+      "local_file"
+      "local_ip"
+      "local_todo"
+      "lock"
+      "logentries"
+      "logger"
+      "lovelace"
+      "manual"
+      "manual_mqtt"
+      "matter"
+      "media_player"
+      "min_max"
+      "mjpeg"
+      "modern_forms"
+      "mold_indicator"
+      "moon"
+      "mysensors"
+      "network"
+      "nmap_tracker"
+      "notify"
+      "number"
+      "onboarding"
+      "onkyo"
+      "panel_custom"
+      "persistent_notification"
+      "person"
+      "ping"
+      "plant"
+      "prometheus"
+      "proximity"
+      "push"
+      "proximity"
+      "python_script"
+      "radio_browser"
+      "random"
+      "recorder"
+      "remote"
+      "repairs"
+      "rest"
+      "rest_command"
+      "rss_feed_template"
+      "scene"
+      "schedule"
+      "scrape"
+      "script"
+      "search"
+      "season"
+      "select"
+      "sense"
+      "sensor"
+      "sensorpush"
+      "shell_command"
+      "shopping_list"
+      "siren"
+      "smtp"
+      "snmp"
+      "sql"
+      "statistics"
+      "sun"
+      "switch"
+      "switch_as_x"
+      "system_health"
+      "system_log"
+      "systemmonitor"
+      "tag"
+      "tailscale"
+      "tcp"
+      "template"
+      "text"
+      "thread"
+      "threshold"
+      "time_date"
+      "timer"
+      "tod"
+      "todo"
+      "tomorrowio"
+      "trend"
+      "universal"
+      "upb"
+      "update"
+      "upnp"
+      "uptime"
+      "utility_meter"
+      "vacuum"
+      "vlc"
+      "vlc_telnet"
+      "wake_on_lan"
+      "water_heater"
+      "weather"
+      "websocket_api"
+      "wled"
+      "workday"
+      "worldclock"
+      "zone"
+    ];
+
+    extraPackages =
+      python3Packages: with python3Packages; [
+        onkyo-eiscp
+        zeroconf
+      ];
+
+    customComponents = with pkgs; [
+      home-assistant-browser-mod
+    ];
+
+    customLovelaceModules = with pkgs.home-assistant-custom-lovelace-modules; [
+      bubble-card
+      button-card
+      card-mod
+      light-entity-card
+      mini-graph-card
+      mini-media-player
+      mushroom
+      sankey-chart
+      universal-remote-card
+    ];
+
+    lovelaceConfigWritable = true;
+  };
+
+  modules.services.borgmatic.directories = [
+    config.services.home-assistant.configDir
+  ];
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."home.mesh.vimium.net" = {
+      forceSSL = false;
+      extraConfig = ''
+        proxy_buffering off;
+      '';
+      locations."/" = {
+        proxyPass = "http://[::1]:8123";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

hosts/pi/home-assistant/floorplan/default.nix

@@ -0,0 +1,87 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  services.home-assistant = {
+    customLovelaceModules = [
+      pkgs.lovelace-floorplan
+    ];
+  };
+
+  environment.etc."home-assistant/www/floorplan/style.css".source = ./style.css;
+  environment.etc."home-assistant/www/floorplan/config.yaml".text = builtins.toJSON {
+    image = {
+      location = "/local/floorplan/beetham.svg";
+      cache = false;
+    };
+    stylesheet = {
+      location = "/local/floorplan/style.css";
+      cache = false;
+    };
+
+    defaults = {
+      hover_action = "hover-info";
+      hold_action = "toggle";
+      tap_action = "more-info";
+    };
+
+    rules = [
+      {
+        name = "Rooms";
+        entities = [
+          {
+            entity = "light.bedroom_lamps";
+            element = "area.bedroom";
+          }
+          {
+            entity = "light.hallway_spots";
+            element = "area.hallway";
+          }
+          {
+            entity = "light.living_room_lamps";
+            element = "area.livingroom";
+          }
+          {
+            entity = "light.office_lamps";
+            element = "area.office";
+          }
+        ];
+        tap_action = "light.toggle";
+        state_action = {
+          service = "floorplan.class_set";
+          service_data = ''
+            if (entity.state === "on") {
+              return "light-on";
+            }
+            return "light-off";
+          '';
+        };
+      }
+      {
+        name = "Temperature";
+        entities = [
+          "sensor.motion_sensor_temperature"
+        ];
+        state_action = [
+          {
+            service = "floorplan.text_set";
+            service_data = ''
+              if (!isNaN(entity.state)) {
+                return Math.round(entity.state * 10) / 10 + "°";
+              }
+              return "Unknown";
+            '';
+          }
+          {
+            service = "floorplan.class_set";
+            service_data = {
+              class = "static-temp";
+            };
+          }
+        ];
+      }
+    ];
+  };
+}

hosts/pi/home-assistant/mqtt.nix

@@ -0,0 +1,87 @@
+{
+  inputs,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  services.mosquitto = {
+    enable = true;
+    listeners = [
+      {
+        acl = [ "pattern readwrite #" ];
+        omitPasswordAuth = true;
+        port = 1883;
+        settings = {
+          allow_anonymous = true;
+        };
+      }
+    ];
+  };
+
+  age.secrets."files/services/zigbee2mqtt/secret.yaml" = {
+    file = "${inputs.secrets}/files/services/zigbee2mqtt/secret.yaml.age";
+    path = "${config.services.zigbee2mqtt.dataDir}/secret.yaml";
+    owner = "zigbee2mqtt";
+    group = "zigbee2mqtt";
+  };
+
+  services.zigbee2mqtt = {
+    package = pkgs.unstable.zigbee2mqtt;
+    enable = true;
+    dataDir = "/var/lib/zigbee2mqtt";
+    settings = {
+      homeassistant = lib.optionalAttrs config.services.home-assistant.enable {
+        discovery_topic = "homeassistant";
+        status_topic = "hass/status";
+      };
+      availability = true;
+      frontend = true;
+      device_options = {
+        retain = true;
+      };
+      serial = {
+        port = "/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0";
+        adapter = "zstack";
+      };
+      advanced = {
+        channel = 20;
+        network_key = "!secret.yaml network_key";
+        pan_id = 13001;
+        ext_pan_id = [
+          79
+          1
+          73
+          47
+          250
+          136
+          124
+          222
+        ];
+        transmit_power = 20;
+      };
+      mqtt = {
+        version = 5;
+        server = "mqtt://localhost:1883";
+      };
+    };
+  };
+
+  modules.services.borgmatic.directories = [
+    config.services.mosquitto.dataDir
+    config.services.zigbee2mqtt.dataDir
+  ];
+
+  services.home-assistant = {
+    config.mqtt = { };
+    extraComponents = [
+      "mqtt"
+      "mqtt_eventstream"
+      "mqtt_json"
+      "mqtt_room"
+      "mqtt_statestream"
+    ];
+  };
+}

hosts/pi/music-assistant.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  ...
+}:
+
+{
+  services = {
+    nginx.virtualHosts."music-assistant.${config.networking.hostName}" = {
+      extraConfig = ''
+        proxy_buffering off;
+      '';
+      locations."/" = {
+        proxyPass = "http://[::1]:8095";
+        proxyWebsockets = true;
+      };
+    };
+    music-assistant = {
+      enable = true;
+      providers = [
+        "hass"
+        "jellyfin"
+      ];
+    };
+  };
+}

hosts/pi/snapcast.nix

@@ -0,0 +1,43 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  # Put all sinks in pipewire group
+  services.pipewire.systemWide = true;
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      domain = true;
+      addresses = true;
+    };
+  };
+
+  services.snapserver = {
+    enable = true;
+    streams = {
+      default = {
+        type = "file";
+        location = "/var/lib/snapserver/test.wav";
+        sampleFormat = "44100:16:2";
+        codec = "flac";
+      };
+    };
+  };
+
+  systemd.services.snapclient = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "pipewire.service" ];
+    requires = [ "pipewire.service" ];
+    description = "Snapcast client";
+    serviceConfig = {
+      ExecStart = "${pkgs.snapcast}/bin/snapclient -h 127.0.0.1 --player pulse --mixer hardware";
+      DynamicUser = true;
+      SupplementaryGroups = [ "pipewire" ];
+    };
+  };
+}

hosts/server.nix

@@ -1,7 +1,11 @@
 {
+  lib,
   ...
 }:
 
+let
+  inherit (lib) mkForce;
+in
 {
   imports = [
     ./common.nix
@@ -29,6 +33,16 @@
     # };
   };
 
+  users = {
+    users = {
+      root = {
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com"
+        ];
+      };
+    };
+  };
+
   systemd = {
     enableEmergencyMode = false;
 
@@ -36,11 +50,6 @@
       AllowSuspend=no
       AllowHibernation=no
     '';
-
-    watchdog = {
-      runtimeTime = "20s";
-      rebootTime = "30s";
-    };
   };
 
   services.fail2ban = {
@@ -56,6 +65,8 @@
     ];
   };
 
+  services.openssh.settings.PermitRootLogin = mkForce "prohibit-password";
+
   modules.services.tailscale = {
     enable = true;
     restrictSSH = false;

hosts/skycam/default.nix

@@ -1,78 +1,16 @@
 {
-  config,
-  lib,
   pkgs,
-  self,
   ...
 }:
 
 {
   imports = [
-    self.inputs.nixos-hardware.nixosModules.raspberry-pi-4
     ./hardware-configuration.nix
     ../server.nix
   ];
 
   nixpkgs.hostPlatform = "aarch64-linux";
 
-  hardware = {
-    raspberry-pi."4" = {
-      apply-overlays-dtmerge.enable = true;
-      audio.enable = false;
-      xhci.enable = false;
-    };
-    deviceTree = {
-      enable = true;
-      filter = "*rpi-4-*.dtb";
-      # From https://github.com/Electrostasy/dots/blob/3b81723feece67610a252ce754912f6769f0cd34/hosts/phobos/klipper.nix#L43-L65
-      overlays =
-        let
-          mkCompatibleDtsFile =
-            dtbo:
-            let
-              drv =
-                pkgs.runCommand "fix-dts"
-                  {
-                    nativeBuildInputs = with pkgs; [
-                      dtc
-                      gnused
-                    ];
-                  }
-                  ''
-                    mkdir "$out"
-                    dtc -I dtb -O dts ${dtbo} | sed -e 's/bcm2835/bcm2711/' > $out/overlay.dts
-                  '';
-            in
-            "${drv}/overlay.dts";
-
-          inherit (config.boot.kernelPackages) kernel;
-        in
-        [
-          {
-            name = "imx708.dtbo";
-            dtsFile = mkCompatibleDtsFile "${kernel}/dtbs/overlays/imx708.dtbo";
-          }
-          {
-            name = "vc4-kms-v3d-pi4.dtbo";
-            dtsFile = mkCompatibleDtsFile "${kernel}/dtbs/overlays/vc4-kms-v3d-pi4.dtbo";
-          }
-        ];
-    };
-    firmware = with pkgs; [
-      firmwareLinuxNonfree
-    ];
-  };
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="rpivid-*", GROUP="video", MODE="0660"
-    KERNEL=="vcsm-cma", GROUP="video", MODE="0660"
-    SUBSYSTEM=="dma_heap", GROUP="video", MODE="0660"
-  '';
-
-  nixpkgs.overlays = [
-    (import ./../../overlays/libcamera.nix)
-  ];
-
   networking = {
     hostId = "731d1660";
     firewall = {
@@ -82,45 +20,59 @@
     };
   };
 
-  users.users.root = {
+  services.go2rtc =
-    openssh.authorizedKeys.keys = [
+    let
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com"
+      rpicam-vid = "${pkgs.rpicam-apps}/bin/rpicam-vid";
-    ];
+    in
-  };
+    {
-
-  services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
-
-  systemd.services.ustreamer = {
       enable = true;
-    description = "uStreamer service";
+      settings = {
-    unitConfig = {
+        streams.rpicam = "exec:${rpicam-vid} -v1 -t0 -o- --inline --width=4608 --height=2592 --framerate=14 --codec mjpeg --quality 90 --denoise=cdn_off --sharpness 1.25 --exposure long --gain 3";
-      Type = "simple";
-      ConditionPathExists = "/sys/bus/i2c/drivers/imx708/10-001a/video4linux";
       };
-    serviceConfig = {
+    };
-      ExecStart = ''
+
-        ${pkgs.libcamera}/bin/libcamerify ${pkgs.unstable.ustreamer}/bin/ustreamer \
+  systemd.services.skycam-archiver =
-                --host=0.0.0.0 \
+    let
-                --resolution=4608x2592
+      snapshotScript = pkgs.writeShellScript "skycam-archiver" ''
+        ${pkgs.lib.getExe pkgs.curl} -s -o "/var/lib/skycam-archiver/snapshot-$(date +%Y%m%d-%H%M%S).jpg" "http://skycam.mesh.vimium.net:1984/api/frame.jpeg?src=rpicam"
       '';
-      DynamicUser = "yes";
+    in
-      SupplementaryGroups = [ "video" ];
+    {
-      Restart = "always";
+      description = "Capture skycam snapshot and save with timestamp";
-      RestartSec = 10;
+      serviceConfig = {
+        Type = "oneshot";
+        StateDirectory = "skycam-archiver";
+        ExecStart = "${snapshotScript}";
       };
-    wantedBy = [ "network-online.target" ];
+      requires = [ "go2rtc.service" ];
-    confinement.mode = "chroot-only";
+      after = [ "go2rtc.service" ];
+    };
+
+  systemd.timers.skycam-archiver = {
+    description = "Timer for capturing skycam snapshots every 30 minutes";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "5min";
+      OnUnitActiveSec = "30min";
+      Unit = "skycam-archiver.service";
+    };
+  };
+
+  modules.services.borgmatic = {
+    enable = true;
+    directories = [
+      "/var/lib/skycam-archiver"
+    ];
+    repoPath = "ssh://m94ekv2i@m94ekv2i.repo.borgbase.com/./repo";
   };
 
   environment.systemPackages = with pkgs; [
-    camera-streamer
     git
     neovim
     libcamera
     libraspberrypi
     raspberrypi-eeprom
-    v4l-utils
+    rpicam-apps
-    unstable.ustreamer
   ];
 
   system.stateVersion = "24.05";

hosts/skycam/hardware-configuration.nix

@@ -1,18 +1,20 @@
 {
+  inputs,
+  config,
   lib,
+  pkgs,
   modulesPath,
   ...
 }:
 
 {
   imports = [
+    inputs.nixos-hardware.nixosModules.raspberry-pi-4
     (modulesPath + "/installer/sd-card/sd-image-aarch64.nix")
   ];
 
   boot = {
-    kernelModules = [ "bcm2835-v4l2" ];
     kernelParams = [
-      "cma=512M"
       "panic=0"
     ];
     supportedFilesystems = lib.mkForce [
@@ -23,6 +25,61 @@
     tmp.cleanOnBoot = false;
   };
 
+  hardware = {
+    raspberry-pi."4" = {
+      apply-overlays-dtmerge.enable = true;
+      audio.enable = false;
+      xhci.enable = false;
+    };
+    deviceTree = {
+      enable = true;
+      filter = "*rpi-4-*.dtb";
+      # From https://github.com/Electrostasy/dots/blob/3b81723feece67610a252ce754912f6769f0cd34/hosts/phobos/klipper.nix#L43-L65
+      overlays =
+        let
+          mkCompatibleDtsFile =
+            dtbo:
+            let
+              drv =
+                pkgs.runCommand "fix-dts"
+                  {
+                    nativeBuildInputs = with pkgs; [
+                      dtc
+                      gnused
+                    ];
+                  }
+                  ''
+                    mkdir "$out"
+                    dtc -I dtb -O dts ${dtbo} | sed -e 's/bcm2835/bcm2711/' > $out/overlay.dts
+                  '';
+            in
+            "${drv}/overlay.dts";
+
+          inherit (config.boot.kernelPackages) kernel;
+        in
+        [
+          {
+            name = "imx708.dtbo";
+            dtsFile = mkCompatibleDtsFile "${kernel}/dtbs/overlays/imx708.dtbo";
+          }
+          {
+            name = "vc4-kms-v3d-pi4.dtbo";
+            dtsFile = mkCompatibleDtsFile "${kernel}/dtbs/overlays/vc4-kms-v3d-pi4.dtbo";
+          }
+        ];
+    };
+    firmware = with pkgs; [
+      firmwareLinuxNonfree
+    ];
+  };
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="rpivid-*", GROUP="video", MODE="0660"
+    KERNEL=="vcsm-cma", GROUP="video", MODE="0660"
+    SUBSYSTEM=="dma_heap", GROUP="video", MODE="0660"
+    SUBSYSTEM=="dma_heap", KERNEL=="linux,cma", SYMLINK+="dma_heap/vidbuf_cached", OPTIONS+="link_priority=-50"
+  '';
+
   nixpkgs.overlays = [
     (final: super: {
       makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });

hosts/vps1/coturn.nix

@@ -0,0 +1,117 @@
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  realm = "turn.vimium.com";
+  matrixIntegration = true;
+in
+{
+  networking.firewall =
+    let
+      range =
+        with config.services.coturn;
+        lib.singleton {
+          from = min-port;
+          to = max-port;
+        };
+    in
+    {
+      allowedTCPPorts = [
+        3478 # TURN listener
+        5349 # STUN TLS
+        5350 # STUN TLS alt
+      ];
+      allowedUDPPorts = [
+        3478 # TURN listener
+        5349 # TLS
+        5350 # TLS alt
+      ];
+      allowedUDPPortRanges = range; # TURN peer relays
+    };
+
+  security.acme.certs = {
+    "${config.services.coturn.realm}" = {
+      group = "turnserver";
+      reloadServices = [ "coturn" ];
+    };
+  };
+
+  age.secrets =
+    {
+      "passwords/services/coturn/static-auth-secret" = {
+        file = "${inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
+        owner = "turnserver";
+        group = "turnserver";
+      };
+    }
+    // (
+      if matrixIntegration then
+        {
+          "passwords/services/coturn/matrix-turn-config.yml" = {
+            file = "${inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
+            owner = "matrix-synapse";
+            group = "matrix-synapse";
+          };
+        }
+      else
+        { }
+    );
+
+  services.coturn = {
+    enable = true;
+    realm = realm;
+    use-auth-secret = true;
+    static-auth-secret-file = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
+    cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
+    pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
+    min-port = 49000;
+    max-port = 50000;
+    no-cli = true;
+    no-tcp-relay = true;
+    extraConfig = ''
+      cipher-list="HIGH"
+      no-multicast-peers
+
+      # Ban private CIDR blocks
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+    '';
+  };
+
+  services.matrix-synapse = lib.mkIf matrixIntegration {
+    settings = with config.services.coturn; {
+      turn_uris = [
+        "turn:${realm}:3478?transport=udp"
+        "turn:${realm}:3478?transport=tcp"
+      ];
+      turn_user_lifetime = "1h";
+    };
+    extraConfigFiles = [
+      config.age.secrets."passwords/services/coturn/matrix-turn-config.yml".path
+    ];
+  };
+}

hosts/vps1/default.nix

@@ -1,17 +1,24 @@
 {
-  config,
-  pkgs,
-  lib,
   ...
 }:
 
 {
   imports = [
     ./hardware-configuration.nix
+    ./coturn.nix
+    ./gitea.nix
+    ./headscale.nix
+    ./kanidm.nix
+    ./matrix.nix
+    ./nginx.nix
+    ./outline.nix
+    ./photoprism.nix
     ../server.nix
   ];
 
-  nixpkgs.hostPlatform = "x86_64-linux";
+  nixpkgs = {
+    hostPlatform = "x86_64-linux";
+  };
 
   networking = {
     hostId = "08bf6db3";
@@ -33,62 +40,13 @@
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOaaS+KMAEAymZhIJGC4LK8aMhUzhpmloUgvP2cxeBH4 jellyfin"
         ];
       };
-      root = {
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com"
-        ];
-      };
     };
     groups = {
       jellyfin = { };
     };
-    extraGroups.acme.members = [
-      "kanidm"
-      "nginx"
-    ];
   };
 
-  services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
+  modules = {
-
-  security.acme.certs."auth.vimium.com" = {
-    postRun = "systemctl restart kanidm.service";
-    group = "acme";
-  };
-
-  services.kanidm =
-    let
-      baseDomain = "vimium.com";
-      domain = "auth.${baseDomain}";
-      uri = "https://${domain}";
-    in
-    {
-      package = pkgs.unstable.kanidm;
-      enableClient = true;
-      enableServer = true;
-      clientSettings = {
-        inherit uri;
-      };
-      serverSettings = {
-        bindaddress = "[::1]:3013";
-        ldapbindaddress = "[::1]:636";
-        domain = baseDomain;
-        origin = uri;
-        tls_chain = "${config.security.acme.certs.${domain}.directory}/full.pem";
-        tls_key = "${config.security.acme.certs.${domain}.directory}/key.pem";
-      };
-    };
-
-  services.nginx.virtualHosts = {
-    "auth.vimium.com" = {
-      useACMEHost = "auth.vimium.com";
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "https://[::1]:3013";
-      };
-    };
-  };
-
-  modules = rec {
     services = {
       borgmatic = {
         enable = true;
@@ -99,23 +57,6 @@
         ];
         repoPath = "ssh://p91y8oh7@p91y8oh7.repo.borgbase.com/./repo";
       };
-      coturn = {
-        enable = true;
-        realm = "turn.vimium.com";
-        matrixIntegration = true;
-      };
-      gitea.enable = true;
-      headscale.enable = true;
-      matrix = {
-        enable = true;
-        bridges = {
-          signal = true;
-          whatsapp = true;
-        };
-        usePostgresql = services.postgresql.enable;
-      };
-      nginx.enable = true;
-      photoprism.enable = true;
       postgresql.enable = true;
     };
   };

hosts/vps1/gitea.nix

@@ -0,0 +1,89 @@
+{
+  inputs,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  domain = "git.vimium.com";
+in
+{
+  users = {
+    users.git = {
+      isSystemUser = true;
+      useDefaultShell = true;
+      group = "git";
+      extraGroups = [ "gitea" ];
+      home = config.services.gitea.stateDir;
+    };
+    groups.git = { };
+  };
+
+  services.nginx = {
+    upstreams.gitea = {
+      servers = {
+        "unix:${config.services.gitea.settings.server.HTTP_ADDR}" = { };
+      };
+    };
+    virtualHosts = {
+      "${domain}" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/".proxyPass = "http://gitea";
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d '${config.services.gitea.customDir}/public/assets/css' 0750 ${config.services.gitea.user} ${config.services.gitea.group} - -"
+    "L+ '${config.services.gitea.customDir}/public/assets/css/theme-github.css' - - - - ${inputs.gitea-github-theme}/theme-github.css"
+    "L+ '${config.services.gitea.customDir}/public/assets/css/theme-github-auto.css' - - - - ${inputs.gitea-github-theme}/theme-github-auto.css"
+    "L+ '${config.services.gitea.customDir}/public/assets/css/theme-github-dark.css' - - - - ${inputs.gitea-github-theme}/theme-github-dark.css"
+  ];
+
+  services.gitea = rec {
+    package = pkgs.unstable.gitea;
+    enable = true;
+    user = "git";
+    appName = "Vimium Git";
+    stateDir = "/var/lib/gitea";
+    repositoryRoot = "${stateDir}/repositories";
+    database = {
+      type = "sqlite3";
+      inherit user;
+      path = "${stateDir}/gitea.db";
+    };
+    lfs = {
+      enable = true;
+      contentDir = "${stateDir}/lfs";
+    };
+    settings = {
+      server = {
+        DOMAIN = config.networking.domain;
+        LANDING_PAGE = "explore";
+        OFFLINE_MODE = true;
+        PROTOCOL = "http+unix";
+        SSH_USER = "git";
+        SSH_DOMAIN = "${domain}";
+        SSH_PORT = lib.head config.services.openssh.ports;
+        ROOT_URL = "https://${domain}/";
+      };
+      service.DISABLE_REGISTRATION = true;
+      session.COOKIE_SECURE = true;
+      log = {
+        ROOT_PATH = "${stateDir}/log";
+        "logger.router.MODE" = "";
+      };
+      ui = {
+        THEMES = "gitea,arc-green,github,github-auto,github-dark";
+        DEFAULT_THEME = "github-dark";
+      };
+      actions.ENABLED = true;
+      indexer = {
+        REPO_INDEXER_ENABLED = true;
+      };
+      packages.CHUNKED_UPLOAD_PATH = lib.mkForce "${stateDir}/data/tmp/package-upload";
+    };
+  };
+}

hosts/vps1/headscale.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  domain = "headscale.vimium.net";
+in
+{
+  environment.systemPackages = [ pkgs.headscale ];
+
+  services.headscale = {
+    enable = true;
+
+    port = 8080;
+
+    settings = {
+      policy.path = null;
+      ip_prefixes = [
+        "100.64.0.0/10"
+      ];
+      server_url = "https://${domain}";
+      derp = {
+        auto_update_enable = false;
+        update_frequency = "24h";
+      };
+      dns = {
+        base_domain = "mesh.vimium.net";
+        extra_records = [
+          {
+            name = "grafana.mesh.vimium.net";
+            type = "A";
+            value = "100.64.0.6";
+          }
+          {
+            name = "home.mesh.vimium.net";
+            type = "A";
+            value = "100.64.0.7";
+          }
+        ];
+        magic_dns = true;
+        nameservers.global = [
+          "9.9.9.9"
+        ];
+      };
+      logtail.enabled = false;
+    };
+  };
+
+  services.nginx.virtualHosts = {
+    "${domain}" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.headscale.port}";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

hosts/vps1/kanidm.nix

@@ -0,0 +1,52 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  baseDomain = "vimium.com";
+  domain = "auth.${baseDomain}";
+in
+{
+  services.kanidm =
+    let
+      uri = "https://${domain}";
+    in
+    {
+      package = pkgs.unstable.kanidm;
+      enableClient = true;
+      enableServer = true;
+      clientSettings = {
+        inherit uri;
+      };
+      serverSettings = {
+        bindaddress = "127.0.0.1:3013";
+        ldapbindaddress = "100.64.0.1:636";
+        domain = baseDomain;
+        origin = uri;
+        tls_chain = "${config.security.acme.certs.${domain}.directory}/full.pem";
+        tls_key = "${config.security.acme.certs.${domain}.directory}/key.pem";
+        version = "2";
+      };
+    };
+
+  services.nginx.virtualHosts = {
+    "${domain}" = {
+      useACMEHost = "${domain}";
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "https://127.0.0.1:3013";
+      };
+    };
+  };
+
+  users.extraGroups.acme.members = [
+    "kanidm"
+    "nginx"
+  ];
+
+  security.acme.certs."${domain}" = {
+    postRun = "systemctl restart kanidm.service";
+    group = "acme";
+  };
+}

hosts/vps1/matrix.nix

@@ -0,0 +1,221 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  serverName = "vimium.com";
+  useElement = true;
+  usePostgresql = true;
+  bridges = {
+    signal = true;
+    whatsapp = true;
+  };
+  matrixSubdomain = "matrix.${serverName}";
+  elementSubdomain = "chat.${serverName}";
+  matrixClientConfig = {
+    "m.homeserver" = {
+      base_url = "https://${matrixSubdomain}";
+      server_name = serverName;
+    };
+    "m.identity_server" = {
+      "base_url" = "https://vector.im";
+    };
+  };
+  matrixServerConfig."m.server" = "${matrixSubdomain}:443";
+  commonBridgeSettings = bridge: {
+    appservice = {
+      database = lib.mkIf usePostgresql {
+        type = "postgres";
+        uri = "postgresql:///${bridge}?host=/run/postgresql";
+      };
+    };
+    bridge = {
+      encryption = {
+        allow = true;
+        default = true;
+        require = true;
+      };
+      permissions = {
+        "${serverName}" = "user";
+        "@jordan:${serverName}" = "admin";
+      };
+      provisioning = {
+        shared_secret = "disable";
+      };
+    };
+    homeserver = {
+      address = "https://${matrixSubdomain}";
+      domain = serverName;
+    };
+  };
+in
+{
+  networking.firewall.allowedTCPPorts = [
+    8448 # Matrix federation
+  ];
+
+  security.acme.certs = {
+    "${matrixSubdomain}" = {
+      reloadServices = [ "matrix-synapse" ];
+    };
+  };
+
+  services.nginx.virtualHosts =
+    {
+      "${matrixSubdomain}" = {
+        forceSSL = true;
+        enableACME = true;
+        listen = [
+          {
+            addr = "0.0.0.0";
+            port = 443;
+            ssl = true;
+          }
+          {
+            addr = "0.0.0.0";
+            port = 80;
+          }
+          {
+            addr = "0.0.0.0";
+            port = 8448;
+            ssl = true;
+          }
+          {
+            addr = "[::1]";
+            port = 443;
+            ssl = true;
+          }
+          {
+            addr = "[::1]";
+            port = 80;
+          }
+          {
+            addr = "[::1]";
+            port = 8448;
+            ssl = true;
+          }
+        ];
+        locations = {
+          "/" = {
+            proxyPass = "http://localhost:8008";
+            extraConfig = ''
+              proxy_set_header X-Forwarded-For $remote_addr;
+            '';
+          };
+          "/_matrix" = {
+            proxyPass = "http://localhost:8008";
+            extraConfig = ''
+              proxy_set_header X-Forwarded-For $remote_addr;
+              client_max_body_size 50M;
+            '';
+          };
+          "/_synapse/client".proxyPass = "http://localhost:8008";
+        };
+      };
+      "${serverName}" =
+        let
+          mkWellKnown = data: ''
+            more_set_headers 'Content-Type: application/json';
+            return 200 '${builtins.toJSON data}';
+          '';
+        in
+        {
+          locations."= /.well-known/matrix/server".extraConfig = (mkWellKnown matrixServerConfig);
+          locations."= /.well-known/matrix/client".extraConfig = (mkWellKnown matrixClientConfig);
+        };
+    }
+    // (
+      if useElement then
+        {
+          "${elementSubdomain}" = {
+            forceSSL = true;
+            enableACME = true;
+            root = pkgs.unstable.element-web.override {
+              conf = {
+                default_server_config = matrixClientConfig;
+                brand = "Vimium Chat";
+                branding = {
+                  auth_header_logo_url = "https://vimium.com/images/logo.svg";
+                  auth_footer_links = [
+                    {
+                      "text" = "Vimium.com";
+                      "url" = "https://vimium.com";
+                    }
+                  ];
+                };
+              };
+            };
+          };
+        }
+      else
+        { }
+    );
+
+  nixpkgs.config.permittedInsecurePackages = [
+    "jitsi-meet-1.0.8043"
+    "olm-3.2.16"
+  ];
+
+  services.matrix-synapse = {
+    enable = true;
+    enableRegistrationScript = true;
+    settings = {
+      database.name = (if usePostgresql then "psycopg2" else "sqlite3");
+      enable_metrics = false;
+      enable_registration = false;
+      max_upload_size = "100M";
+      report_stats = false;
+      server_name = serverName;
+    };
+  };
+  systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = (
+    lib.optional bridges.whatsapp config.systemd.services.mautrix-whatsapp.serviceConfig.Group
+  );
+
+  services.postgresql = lib.mkIf usePostgresql {
+    ensureUsers =
+      [
+        {
+          name = "matrix-synapse";
+          ensureDBOwnership = true;
+        }
+      ]
+      ++ (lib.optional bridges.signal {
+        name = "mautrix-signal";
+        ensureDBOwnership = true;
+      })
+      ++ (lib.optional bridges.whatsapp {
+        name = "mautrix-whatsapp";
+        ensureDBOwnership = true;
+      });
+    ensureDatabases =
+      [
+        "matrix-synapse"
+      ]
+      ++ (lib.optional bridges.signal "mautrix-signal")
+      ++ (lib.optional bridges.whatsapp "mautrix-whatsapp");
+  };
+
+  services.mautrix-signal = lib.mkIf bridges.signal {
+    enable = true;
+    settings = commonBridgeSettings "mautrix-signal";
+  };
+
+  services.mautrix-whatsapp = lib.mkIf bridges.whatsapp {
+    enable = true;
+    settings = {
+      bridge = {
+        history_sync = {
+          backfill = true;
+          max_initial_conversations = -1;
+          message_count = 50;
+          request_full_sync = true;
+        };
+        mute_bridging = true;
+      };
+    } // commonBridgeSettings "mautrix-whatsapp";
+  };
+}

hosts/vps1/nginx.nix

@@ -0,0 +1,207 @@
+{
+  pkgs,
+  ...
+}:
+
+let
+  nginxErrorPages = ''
+    location @error_pages {
+      rewrite ^.*$ /''${status}.html break;
+
+      root "/var/www/html/errors";
+    }
+  '';
+  nginxEdgeHeaders = ''
+    more_set_headers 'Server: Vimium';
+    more_set_headers 'Access-Control-Allow-Origin: *';
+    add_header Expect-CT max-age=30 always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header Vimium-Responding-Instance $hostname;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header X-Content-Type-Options nosniff always;
+  '';
+  nginxStrictHeaders = ''
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header Permissions-Policy "fullscreen=(self), sync-xhr=(self)" always;
+  '';
+  mkRedirect = from: to: {
+    "${from}" = {
+      forceSSL = true;
+      enableACME = true;
+      serverAliases = [ "www.${from}" ];
+      locations."/".return = "301 https://${to}$request_uri";
+      extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
+    };
+  };
+in
+{
+  networking.firewall.allowedTCPPorts = [
+    80 # HTTP
+    443 # HTTPS
+  ];
+
+  services.nginx = {
+    enable = true;
+    package = pkgs.openresty;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedTlsSettings = true;
+    clientMaxBodySize = "2G";
+    sslProtocols = "TLSv1.2 TLSv1.3";
+    sslCiphers = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+    appendHttpConfig = ''
+      error_page 400 @error_pages;
+      error_page 401 @error_pages;
+      error_page 403 @error_pages;
+      error_page 404 @error_pages;
+      error_page 405 @error_pages;
+      error_page 429 @error_pages;
+      error_page 500 @error_pages;
+      error_page 501 @error_pages;
+      error_page 502 @error_pages;
+      error_page 503 @error_pages;
+      error_page 504 @error_pages;
+
+      client_body_buffer_size 16k;
+      client_header_buffer_size 8k;
+    '';
+    appendConfig = ''
+      worker_processes auto;
+      worker_cpu_affinity auto;
+      worker_rlimit_nofile 50000;
+    '';
+    eventsConfig = ''
+      worker_connections 20000;
+      multi_accept off;
+    '';
+    proxyCachePath = {
+      "skycam" = {
+        enable = true;
+        keysZoneName = "skycam_cache";
+        maxSize = "100m";
+      };
+    };
+    virtualHosts =
+      {
+        ## Static sites
+        "chat.ai.vimium.com" = {
+          forceSSL = true;
+          enableACME = true;
+          extraConfig = nginxErrorPages + nginxEdgeHeaders;
+          locations."/" = {
+            proxyPass = "http://localhost:8001";
+            extraConfig = ''
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header Host $host;
+
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+
+              # Disable proxy buffering for better streaming response from models
+              proxy_buffering off;
+
+              # Increase max request size for large attachments and long audio messages
+              client_max_body_size 20M;
+              proxy_read_timeout 10m;
+            '';
+          };
+        };
+        "jellyfin.vimium.com" = {
+          forceSSL = true;
+          enableACME = true;
+          extraConfig = nginxErrorPages + nginxEdgeHeaders;
+          locations."/" = {
+            proxyPass = "http://localhost:8000";
+            extraConfig = ''
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header Host $host;
+
+              proxy_set_header Range $http_range;
+              proxy_set_header If-Range $http_if_range;
+
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+            '';
+          };
+        };
+        "jdholt.com" = {
+          forceSSL = true;
+          enableACME = true;
+          serverAliases = [ "www.jdholt.com" ];
+          extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
+          locations."/skycam" = {
+            root = "/var/www/jdholt.com";
+          };
+          locations."/skycam/snapshot.jpg" = {
+            extraConfig = ''
+              set $backend "skycam.mesh.vimium.net:1984";
+
+              resolver 100.100.100.100;
+
+              proxy_pass http://$backend/api/frame.jpeg?src=rpicam;
+              proxy_cache skycam_cache;
+              proxy_cache_valid any 10s;
+              proxy_ignore_headers Cache-Control Expires Set-Cookie;
+            '';
+          };
+          locations."/".return = "301 https://vimium.com$request_uri";
+        };
+        "pki.vimium.com" = {
+          addSSL = true;
+          forceSSL = false;
+          enableACME = true;
+          extraConfig = ''
+            ${nginxErrorPages}
+            more_set_headers 'Server: Vimium';
+          '';
+          locations."/" = {
+            root = "/var/www/pki.vimium.com";
+          };
+        };
+        "suhailhussain.com" = {
+          forceSSL = true;
+          enableACME = true;
+          serverAliases = [ "www.suhailhussain.com" ];
+          extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
+          locations."/" = {
+            root = "/var/www/suhailhussain.com";
+          };
+        };
+        "vimium.com" = {
+          default = true;
+          forceSSL = true;
+          enableACME = true;
+          serverAliases = [ "www.vimium.com" ];
+          extraConfig =
+            nginxErrorPages
+            + nginxEdgeHeaders
+            + nginxStrictHeaders
+            + ''
+              add_header Content-Security-Policy "default-src 'self' https://vimium.com https://www.vimium.com; style-src 'unsafe-inline'; object-src 'none'; upgrade-insecure-requests" always;
+            '';
+          locations."/" = {
+            root = "/var/www/vimium.com";
+          };
+        };
+      }
+      ## Redirects
+      // (mkRedirect "h0lt.com" "jdholt.com")
+      // (mkRedirect "jordanholt.xyz" "jdholt.com")
+      // (mkRedirect "omnimagic.com" "vimium.com")
+      // (mkRedirect "omnimagic.net" "vimium.com")
+      // (mkRedirect "thelostlegend.com" "suhailhussain.com")
+      // (mkRedirect "vimium.co" "vimium.com")
+      // (mkRedirect "vimium.co.uk" "vimium.com")
+      // (mkRedirect "vimium.info" "vimium.com")
+      // (mkRedirect "vimium.net" "vimium.com")
+      // (mkRedirect "vimium.org" "vimium.com")
+      // (mkRedirect "vimium.xyz" "vimium.com");
+  };
+}

hosts/vps1/outline.nix

@@ -0,0 +1,51 @@
+{
+  inputs,
+  config,
+  ...
+}:
+let
+  domain = "outline.vimium.com";
+in
+{
+  services.nginx.virtualHosts = {
+    "${domain}" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3000";
+        extraConfig = ''
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection "Upgrade";
+          proxy_set_header Host $host;
+
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Scheme $scheme;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_redirect off;
+        '';
+      };
+    };
+  };
+
+  age.secrets."passwords/services/outline/oidc-client-secret" = {
+    file = "${inputs.secrets}/passwords/services/outline/oidc-client-secret.age";
+    owner = "outline";
+    group = "outline";
+  };
+
+  services.outline = {
+    enable = true;
+    forceHttps = false;
+    oidcAuthentication = {
+      clientId = "outline";
+      clientSecretFile = config.age.secrets."passwords/services/outline/oidc-client-secret".path;
+      displayName = "Vimium";
+      authUrl = "https://auth.vimium.com/ui/oauth2";
+      tokenUrl = "https://auth.vimium.com/oauth2/token";
+      userinfoUrl = "https://auth.vimium.com/oauth2/openid/outline/userinfo";
+    };
+    publicUrl = "https://${domain}";
+    storage.storageType = "local";
+  };
+}

hosts/vps1/photoprism.nix

@@ -0,0 +1,49 @@
+{
+  inputs,
+  config,
+  ...
+}:
+let
+  domain = "gallery.vimium.com";
+in
+{
+  services.nginx.virtualHosts = {
+    "${domain}" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.photoprism.port}";
+        extraConfig = ''
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header Host $host;
+
+          proxy_buffering off;
+          proxy_http_version 1.1;
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection "upgrade";
+        '';
+      };
+    };
+  };
+
+  age.secrets."passwords/services/photoprism/admin" = {
+    file = "${inputs.secrets}/passwords/services/photoprism/admin.age";
+  };
+
+  services.photoprism = {
+    enable = true;
+    address = "localhost";
+    passwordFile = config.age.secrets."passwords/services/photoprism/admin".path;
+    originalsPath = "${config.services.photoprism.storagePath}/originals";
+    settings = {
+      PHOTOPRISM_APP_NAME = "Vimium Gallery";
+      PHOTOPRISM_SITE_AUTHOR = "Vimium";
+      PHOTOPRISM_SITE_TITLE = "Vimium Gallery";
+      PHOTOPRISM_SITE_CAPTION = "Vimium Gallery";
+      PHOTOPRISM_DISABLE_TLS = "true";
+      PHOTOPRISM_SPONSOR = "true";
+    };
+  };
+}

modules/home-manager/default.nix

@@ -1,33 +0,0 @@
-{
-  imports = [
-    ./options.nix
-    ./programs/brave.nix
-    ./programs/dev/cc.nix
-    ./programs/dev/java.nix
-    ./programs/dev/lua.nix
-    ./programs/dev/node.nix
-    ./programs/dev/python.nix
-    ./programs/dev/rust.nix
-    ./programs/dev/scala.nix
-    ./programs/dev/shell.nix
-    ./programs/dev/zig.nix
-    ./programs/emulators.nix
-    ./programs/firefox.nix
-    ./programs/forensics.nix
-    ./programs/git
-    ./programs/gpg.nix
-    ./programs/graphics.nix
-    ./programs/libreoffice.nix
-    ./programs/lutris.nix
-    ./programs/neovim.nix
-    ./programs/pass.nix
-    ./programs/qbittorrent.nix
-    ./programs/recording.nix
-    ./programs/slack.nix
-    ./programs/steam.nix
-    ./programs/thunderbird.nix
-    ./programs/vscode.nix
-    ./programs/zoom.nix
-    ./shell/zsh
-  ];
-}

modules/home-manager/options.nix

@@ -1,137 +0,0 @@
-{
-  config,
-  options,
-  lib,
-  self,
-  ...
-}:
-
-with lib;
-{
-  options = with types; {
-    user = mkOption {
-      type = attrs;
-      default = { };
-    };
-
-    home = {
-      configFile = mkOption {
-        type = attrs;
-        default = { };
-        description = "Files to place in $XDG_CONFIG_HOME";
-      };
-      dataFile = mkOption {
-        type = attrs;
-        default = { };
-        description = "Files to place in $XDG_DATA_HOME";
-      };
-      file = mkOption {
-        type = attrs;
-        default = { };
-        description = "Files to place directly in $HOME";
-      };
-      packages = mkOption {
-        type = attrs;
-        default = { };
-        description = "User-level installed packages";
-      };
-      programs = mkOption {
-        type = attrs;
-        default = { };
-        description = "Programs managed directly from home-manager";
-      };
-      services = mkOption {
-        type = attrs;
-        default = { };
-        description = "Services managed directly from home-manager";
-      };
-    };
-
-    dconf.settings = mkOption {
-      type = attrs;
-      default = { };
-      description = "dconf settings to enable";
-    };
-
-    env = mkOption {
-      type = attrsOf (oneOf [
-        str
-        path
-        (listOf (either str path))
-      ]);
-      apply = mapAttrs (
-        n: v: if isList v then concatMapStringsSep ":" (x: toString x) v else (toString v)
-      );
-      default = { };
-      description = "";
-    };
-  };
-
-  config = {
-    age.secrets."passwords/users/jordan".file = "${self.inputs.secrets}/passwords/users/jordan.age";
-    user =
-      let
-        user = builtins.getEnv "USER";
-        name =
-          if
-            elem user [
-              ""
-              "root"
-            ]
-          then
-            "jordan"
-          else
-            user;
-      in
-      {
-        inherit name;
-        isNormalUser = true;
-        extraGroups = [
-          "audio"
-          "lxd"
-          "networkmanager"
-          "wheel"
-        ];
-        description = "Jordan Holt";
-        useDefaultShell = true;
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com"
-        ];
-        hashedPasswordFile = config.age.secrets."passwords/users/jordan".path;
-        home = "/home/${name}";
-        group = "users";
-        uid = 1000;
-      };
-
-    home-manager = {
-      useGlobalPkgs = true;
-      useUserPackages = true;
-
-      users.${config.user.name} = {
-        home = {
-          file = mkAliasDefinitions options.home.file;
-          stateVersion = config.system.stateVersion;
-        };
-        programs = mkAliasDefinitions options.home.programs;
-        services = mkAliasDefinitions options.home.services;
-        xdg = {
-          enable = true;
-          configFile = mkAliasDefinitions options.home.configFile;
-          dataFile = mkAliasDefinitions options.home.dataFile;
-        };
-        dconf.settings = mkAliasDefinitions options.dconf.settings;
-      };
-
-      sharedModules = [
-        self.inputs.nixvim.homeManagerModules.nixvim
-        self.inputs.plasma-manager.homeManagerModules.plasma-manager
-      ];
-    };
-
-    users.users.${config.user.name} = mkAliasDefinitions options.user;
-
-    environment.extraInit = concatStringsSep "\n" (
-      mapAttrsToList (n: v: "export ${n}=\"${v}\"") config.env
-    );
-  };
-}

modules/home-manager/programs/brave.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.brave;
-in
-{
-  options.modules.programs.brave = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      brave
-    ];
-  };
-}

modules/home-manager/programs/dev/cc.nix

@@ -1,28 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.cc;
-in
-{
-  options.modules.programs.dev.cc = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      clang
-      gcc
-      gdb
-      cmake
-      llvmPackages.libcxx
-    ];
-  };
-}

modules/home-manager/programs/dev/java.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.java;
-in
-{
-  options.modules.programs.dev.java = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      jdk
-    ];
-  };
-}

modules/home-manager/programs/dev/lua.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.lua;
-in
-{
-  options.modules.programs.dev.lua = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      lua
-    ];
-  };
-}

modules/home-manager/programs/dev/node.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.node;
-in
-{
-  options.modules.programs.dev.node = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      nodejs_22
-    ];
-  };
-}

modules/home-manager/programs/dev/python.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.python;
-in
-{
-  options.modules.programs.dev.python = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      python310
-    ];
-  };
-}

modules/home-manager/programs/dev/rust.nix

@@ -1,27 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.rust;
-in
-{
-  options.modules.programs.dev.rust = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      rustc
-      rustup
-      rustfmt
-      rust-bindgen
-    ];
-  };
-}

modules/home-manager/programs/dev/scala.nix

@@ -1,26 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.scala;
-in
-{
-  options.modules.programs.dev.scala = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      jdk
-      sbt
-      scala
-    ];
-  };
-}

modules/home-manager/programs/dev/shell.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.shell;
-in
-{
-  options.modules.programs.dev.shell = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      shellcheck
-    ];
-  };
-}

modules/home-manager/programs/dev/zig.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.dev.zig;
-in
-{
-  options.modules.programs.dev.zig = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      zig
-    ];
-  };
-}

modules/home-manager/programs/emulators.nix

@@ -1,76 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.emulators;
-in
-{
-  options.modules.programs.emulators = {
-    ds.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    gb.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    gba.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    gamecube.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    ps1.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    ps2.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    ps3.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    psp.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    snes.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    switch.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    wii.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    xbox.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = {
-    user.packages = with pkgs; [
-      (lib.mkIf cfg.ps1.enable duckstation)
-      (lib.mkIf cfg.ps2.enable unstable.pcsx2)
-      (lib.mkIf cfg.ps3.enable rpcs3)
-      (lib.mkIf cfg.psp.enable unstable.ppsspp)
-      (lib.mkIf cfg.ds.enable desmume)
-      (lib.mkIf (cfg.gba.enable || cfg.gb.enable || cfg.snes.enable) higan)
-      (lib.mkIf cfg.switch.enable yuzuPackages.mainline)
-      (lib.mkIf (cfg.wii.enable || cfg.gamecube.enable) dolphin-emu)
-      (lib.mkIf cfg.xbox.enable unstable.xemu)
-    ];
-  };
-}

modules/home-manager/programs/firefox.nix

@@ -1,224 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.firefox;
-in
-{
-  options.modules.programs.firefox = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.file.".mozilla/firefox/Default/chrome/firefox-gnome-theme".source =
-      self.inputs.firefox-gnome-theme;
-
-    home.programs.firefox = {
-      enable = true;
-      profiles.Default = {
-        search = {
-          default = "DuckDuckGo";
-          force = true;
-        };
-        userChrome = ''
-          @import "firefox-gnome-theme/userChrome.css";
-        '';
-        userContent = ''
-          @import "firefox-gnome-theme/userContent.css";
-        '';
-        settings = {
-          ## GNOME theme
-          "toolkit.legacyUserProfileCustomizations.stylesheets" = true; # Enable customChrome.css
-          "browser.uidensity" = 0; # Set UI density to normal
-          "svg.context-properties.content.enabled" = true; # Enable SVG context-propertes
-          "browser.theme.dark-private-windows" = false; # Disable private window dark theme
-          "widget.gtk.rounded-bottom-corners.enabled" = true; # Enable rounded bottom window corners
-
-          ## Preferences
-          "browser.ctrlTab.sortByRecentlyUsed" = true;
-          "browser.discovery.enabled" = false;
-          "browser.download.open_pdf_attachments_inline" = true;
-          "browser.menu.showViewImageInfo" = true;
-          "browser.newtabpage.enabled" = false;
-          "browser.newtabpage.activity-stream.showSponsored" = false;
-          "browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
-          "browser.newtabpage.activity-stream.default.sites" = "";
-          "browser.privatebrowsing.forceMediaMemoryCache" = true;
-          "browser.search.widget.inNavBar" = true;
-          "browser.startup.page" = 3;
-          "browser.startup.homepage" = "https://www.vimium.com";
-          "browser.toolbars.bookmarks.visibility" = "never";
-          "browser.uitour.enabled" = false;
-          "browser.urlbar.suggest.engines" = false;
-          "browser.urlbar.suggest.calculator" = true;
-          "browser.urlbar.trending.featureGate" = false;
-          "browser.urlbar.unitConversion.enabled" = true;
-          "cookiebanners.service.mode" = 1;
-          "cookiebanners.service.mode.privateBrowsing" = 1;
-          "network.IDN_show_punycode" = true;
-
-          ## Performance
-          "browser.cache.jsbc_compression_level" = 3;
-          "content.notify.interval" = 100000;
-          "dom.enable_web_task_scheduling" = true;
-          "dom.security.sanitizer.enabled" = true;
-          "gfx.canvas.accelerated.cache-items" = 4096;
-          "gfx.canvas.accelerated.cache-size" = 512;
-          "gfx.content.skia-font-cache-size" = 20;
-          "gfx.webrender.all" = true;
-          "gfx.webrender.compositor" = true;
-          "gfx.webrender.enable" = true;
-          "image.mem.decode_bytes_at_a_time" = 32768;
-          "layers.acceleration.force-enabled" = true;
-          "layout.css.grid-template-masonry-value.enabled" = true;
-          "media.ffmpeg.vaapi.enabled" = true;
-          "media.memory_cache_max_size" = 65536;
-          "media.cache_readahead_limit" = 7200;
-          "media.cache_resume_threshold" = 3600;
-          "network.dns.disablePrefetch" = true;
-          "network.dns.disablePrefetchFromHTTPS" = true;
-          "network.dnsCacheExpiration" = 3600;
-          "network.http.max-connections" = 1800;
-          "network.http.max-persistent-connections-per-server" = 10;
-          "network.http.max-urgent-start-excessive-connections-per-host" = 5;
-          "network.http.pacing.requests.enabled" = false;
-          "network.predictor.enabled" = false;
-          "network.prefetch-next" = false;
-          "network.ssl_tokens_cache_capacity" = 10240;
-          "pdfjs.enableScripting" = false;
-          "security.mixed_content.block_display_content" = true;
-
-          ## Experiments
-          "app.normandy.enabled" = false;
-          "app.normandy.api_url" = "";
-          "app.normandy.user_id" = "";
-          "app.shield.optoutstudies.enabled" = false;
-          "browser.shopping.experience2023.active" = false;
-          "browser.shopping.experience2023.enabled" = false;
-          "extensions.screenshots.disabled" = true;
-          "extensions.screenshots.upload-disabled" = true;
-          "experiments.supported" = false;
-          "experiments.enabled" = false;
-          "experiments.manifest.uri" = "";
-          "network.allow-experiments" = false;
-
-          ## Privacy
-          "dom.private-attribution.submission.enabled" = false;
-          # "privacy.resistFingerprinting" = true;
-          "privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts" = false;
-          "privacy.trackingprotection.enabled" = true;
-          "privacy.trackingprotection.pbmode.enabled" = true;
-          "privacy.userContext.enabled" = true;
-
-          ## Geo
-          "geo.enabled" = false;
-          "geo.provider.use_gpsd" = false;
-          "geo.wifi.uri" = "";
-          "browser.search.geoip.url" = "";
-          "browser.search.geoSpecificDefaults" = false;
-          "browser.search.geoSpecificDefaults.url" = "";
-
-          ## Window meddling / popups
-          "dom.disable_window_open_feature.close" = true;
-          "dom.disable_window_open_feature.location" = true;
-          "dom.disable_window_open_feature.menubar" = true;
-          "dom.disable_window_open_feature.minimizable" = true;
-          "dom.disable_window_open_feature.personalbar" = true;
-          "dom.disable_window_open_feature.resizable" = true;
-          "dom.disable_window_open_feature.status" = true;
-          "dom.disable_window_open_feature.titlebar" = true;
-          "dom.disable_window_open_feature.toolbar" = true;
-          "dom.disable_window_move_resize" = true;
-          "browser.link.open_newwindow" = 3;
-          "browser.link.open_newwindow.restriction" = 0;
-          "dom.disable_open_during_load" = true;
-          "dom.popup_allowed_events" = "click dblclick";
-
-          ## Workers
-          # "dom.serviceWorkers.enabled" = false;
-          "dom.push.enabled" = false;
-          "dom.webnotifications.enabled" = false;
-          "dom.webnotifications.serviceworker.enabled" = false;
-          "permissions.default.desktop-notification" = 2;
-
-          ## DOM / JavaScript
-          # "dom.event.clipboardevents.enabled" = false;
-          "middlemouse.paste" = false;
-          # "dom.allow_cut_copy" = false;
-          "dom.disable_beforeunload" = true;
-          "dom.vibrator.enabled" = false;
-          # "javascript.options.asmjs" = false;
-          # "javascript.options.wasm" = false;
-          "dom.targetBlankNoOpener.enabled" = true;
-
-          ## Hardware fingerprinting
-          "dom.battery.enabled" = false;
-          "dom.vr.enabled" = false;
-          "media.navigator.enabled" = false;
-          # "dom.webaudio.enabled" = false;
-
-          ## Isolation
-          "privacy.firstparty.isolate" = true;
-          "privacy.firstparty.isolate.restrict_opener_access" = true;
-
-          ## Telemetry
-          "beacon.enabled" = false;
-          "browser.newtabpage.activity-stream.feeds.telemetry" = false;
-          "browser.newtabpage.activity-stream.telemetry" = false;
-          "browser.send_pings" = false;
-          "datareporting.policy.dataSubmissionEnabled" = false;
-          "datareporting.healthReport.uploadEnabled" = false;
-          "toolkit.coverage.opt-out" = true;
-          "toolkit.coverage.endpoint.base" = "";
-          "toolkit.telemetry.archive.enabled" = false;
-          "toolkit.telemetry.bhrPing.enabled" = false;
-          "toolkit.telemetry.coverage.opt-out" = true;
-          "toolkit.telemetry.enabled" = false;
-          "toolkit.telemetry.firstShutdownPing.enabled" = false;
-          "toolkit.telemetry.hybridContent.enabled" = false;
-          "toolkit.telemetry.newProfilePing.enabled" = false;
-          "toolkit.telemetry.reportingPolicy.firstRun" = false;
-          "toolkit.telemetry.server" = "data:,";
-          "toolkit.telemetry.shutdownPingSender.enabled" = false;
-          "toolkit.telemetry.unified" = false;
-          "toolkit.telemetry.updatePing.enabled" = false;
-
-          ## Pocket/Hello
-          "loop.enabled" = false;
-          "loop.feedback.baseUrl" = "";
-          "loop.gettingStarted.url" = "";
-          "loop.learnMoreUrl" = "";
-          "loop.legal.ToS_url" = "";
-          "loop.legal.privacy_url" = "";
-          "loop.oauth.google.redirect_uri" = "";
-          "loop.oauth.google.scope" = "";
-          "loop.server" = "";
-          "loop.soft_start_hostname" = "";
-          "loop.support_url" = "";
-          "loop.throttled2" = false;
-          "loop.logDomains" = false;
-          "browser.pocket.enabled" = false;
-          "browser.pocket.api" = "";
-          "browser.pocket.site" = "";
-          "browser.pocket.oAuthConsumerKey" = "";
-          "browser.pocket.useLocaleList" = false;
-          "brwoser.pocket.enabledLocales" = "";
-
-          ## Plugins
-          "plugin.state.flash" = 0;
-          "plugin.state.java" = 0;
-
-          ## Misc
-          "browser.selfsupport.url" = "";
-        };
-      };
-    };
-  };
-}

modules/home-manager/programs/forensics.nix

@@ -1,33 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.forensics;
-in
-{
-  options.modules.programs.forensics = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      acquire
-      afflib
-      autopsy
-      fatcat
-      foremost
-      hstsparser
-      networkminer
-      sleuthkit
-      testdisk-qt
-      tracee
-    ];
-  };
-}

modules/home-manager/programs/git/default.nix

@@ -1,45 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.git;
-in
-{
-  options.modules.programs.git = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.programs.git = {
-      enable = true;
-      aliases = {
-        amend = "commit --amend";
-        lg = "log --color --graph --abbrev-commit --";
-        ls = "ls-files";
-        unadd = "reset HEAD";
-        undo-commit = "reset --soft \"HEAD^\"";
-      };
-      userEmail = "jordan@vimium.com";
-      userName = "Jordan Holt";
-      signing = {
-        key = "B8CFFF61F1CCF520";
-        signByDefault = true;
-      };
-      extraConfig = {
-        rebase.autosquash = true;
-        push.default = "current";
-        pull.rebase = true;
-      };
-    };
-
-    home.configFile = {
-      "git/ignore".source = ./ignore;
-    };
-  };
-}

modules/home-manager/programs/git/ignore

@@ -1,24 +0,0 @@
-# CMake
-cmake-build-*/
-
-# Linux trash folder
-.Trash-*
-
-# Swap
-[._]*.s[a-v][a-z]
-[._]*.sw[a-p]
-[._]s[a-rt-v][a-z]
-[._]ss[a-gi-z]
-[._]sw[a-p]
-
-# Session
-Session.vim
-Sessionx.vim
-
-# Temporary
-.netrwhist
-*~
-# Auto-generated tag files
-tags
-# Persistent undo
-[._]*.un~

modules/home-manager/programs/gpg.nix

@@ -1,28 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.gpg;
-in
-{
-  options.modules.programs.gpg = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.programs.gpg = {
-      enable = true;
-    };
-
-    home.services.gpg-agent = {
-      enable = true;
-      enableSshSupport = true;
-    };
-  };
-}

modules/home-manager/programs/graphics.nix

@@ -1,35 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.graphics;
-in
-{
-  options.modules.programs.graphics = {
-    modeling.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    raster.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    vector.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = {
-    user.packages = with pkgs; [
-      (lib.mkIf cfg.modeling.enable blender)
-      (lib.mkIf cfg.raster.enable gimp)
-      (lib.mkIf cfg.raster.enable krita)
-      (lib.mkIf cfg.vector.enable inkscape)
-    ];
-  };
-}

modules/home-manager/programs/libreoffice.nix

@@ -1,44 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.libreoffice;
-in
-# libreoffice-gtk4 = pkgs.libreoffice.override {
-#   extraMakeWrapperArgs = [
-#     "--set SAL_USE_VCLPLUGIN gtk4"
-#   ];
-#   unwrapped = pkgs.libreoffice-unwrapped.overrideAttrs (oldAttrs: {
-#     buildInputs = oldAttrs.buildInputs ++ [
-#       pkgs.gtk4
-#     ];
-#     configureFlags = oldAttrs.configureFlags ++ [
-#       "--disable-werror"
-#       "--enable-gtk4"
-#     ];
-#     passthru = oldAttrs.passthru // {
-#       inherit (pkgs) gtk4;
-#     };
-#   });
-# };
-{
-  options.modules.programs.libreoffice = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      (if config.modules.system.desktop.kde.enable == true then libreoffice-qt else libreoffice)
-      hunspell
-      hunspellDicts.en-gb-large
-      hunspellDicts.en-us-large
-    ];
-  };
-}

modules/home-manager/programs/lutris.nix

@@ -1,36 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.lutris;
-in
-{
-  options.modules.programs.lutris = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      (lutris.override {
-        extraPkgs = pkgs: [
-          winePackages.staging
-          wine64Packages.staging
-        ];
-      })
-      vulkan-loader
-      vulkan-tools
-    ];
-
-    hardware.graphics = {
-      enable = true;
-      enable32Bit = true;
-    };
-  };
-}

modules/home-manager/programs/neovim.nix

@@ -1,146 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.neovim;
-in
-{
-  options.modules.programs.neovim = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.programs.nixvim.config = {
-      enable = true;
-      defaultEditor = true;
-
-      viAlias = true;
-      vimAlias = true;
-
-      options = {
-        number = true;
-        tabstop = 2;
-        shiftwidth = 2;
-        expandtab = true;
-        foldlevel = 99;
-        splitbelow = true;
-        splitright = true;
-        undofile = true;
-        updatetime = 100;
-        list = true;
-      };
-
-      globals = {
-        mapleader = ",";
-        maplocalleader = ",";
-      };
-
-      clipboard = {
-        register = "unnamedplus";
-
-        providers.wl-copy.enable = true;
-      };
-
-      plugins.comment.enable = true;
-
-      plugins.hmts.enable = true;
-
-      plugins.lightline.enable = true;
-
-      plugins.luasnip.enable = true;
-
-      plugins.lsp = {
-        enable = true;
-        servers = {
-          bashls.enable = true;
-          ccls.enable = true;
-          cssls.enable = true;
-          eslint.enable = true;
-          gopls.enable = true;
-          html.enable = true;
-          lua_ls.enable = true;
-          pylsp.enable = true;
-          nixd.enable = true;
-          rust_analyzer = {
-            enable = true;
-            installCargo = true;
-            installRustc = true;
-          };
-          ts_ls.enable = true;
-        };
-      };
-
-      plugins.nvim-autopairs.enable = true;
-
-      plugins.cmp = {
-        enable = true;
-        autoEnableSources = true;
-        settings = {
-          sources = [
-            { name = "nvim_lsp"; }
-            { name = "path"; }
-            { name = "buffer"; }
-          ];
-          mapping = {
-            "<Tab>" = "cmp.mapping(cmp.mapping.select_next_item(), {'i', 's'})";
-            "<S-Tab>" = "cmp.mapping(cmp.mapping.select_prev_item(), {'i', 's'})";
-            "<CR>" = "cmp.mapping.confirm({ select = true })";
-          };
-        };
-      };
-
-      plugins.telescope = {
-        enable = true;
-        keymaps = {
-          "<leader>ff" = "find_files";
-          "<leader>fg" = "live_grep";
-          "<leader>b" = "buffers";
-          "<leader>fh" = "help_tags";
-          "<C-p>" = "git_files";
-          "<C-f>" = "live_grep";
-        };
-      };
-
-      plugins.treesitter = {
-        enable = true;
-
-        nixvimInjections = true;
-
-        folding = true;
-        settings.indent.enable = true;
-      };
-
-      plugins.treesitter-refactor = {
-        enable = true;
-        highlightDefinitions = {
-          enable = true;
-          clearOnCursorMove = false;
-        };
-      };
-
-      plugins.undotree.enable = true;
-
-      plugins.web-devicons.enable = true;
-
-      # plugins.gitsigns.enable = true;
-      # plugins.gitgutter.enable = true;
-      # plugins.goyo.enable = true;
-      # plugins.fugitive.enable = true;
-      # plugins.fzf-lua.enable = true;
-      # plugins.neo-tree.enable = true;
-      # plugins.none-ls.enable = true;
-      # plugins.nvim-tree.enable = true;
-      # plugins.oil.enable = true;
-      # plugins.project-nvim.enable = true;
-      # plugins.surround.enable = true;
-    };
-
-    env.EDITOR = "nvim";
-  };
-}

modules/home-manager/programs/pass.nix

@@ -1,25 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.pass;
-in
-{
-  options.modules.programs.pass = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.programs.password-store = {
-      enable = true;
-      package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
-    };
-  };
-}

modules/home-manager/programs/qbittorrent.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.qbittorrent;
-in
-{
-  options.modules.programs.qbittorrent = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      qbittorrent
-    ];
-  };
-}

modules/home-manager/programs/recording.nix

@@ -1,46 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.recording;
-in
-{
-  options.modules.programs.recording = {
-    audio.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    video.enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = {
-    user.packages =
-      with pkgs;
-      (
-        if cfg.audio.enable then
-          [
-            ardour
-            audacity
-          ]
-        else
-          [ ]
-      )
-      ++ (
-        if cfg.video.enable then
-          [
-            handbrake
-            mkvtoolnix
-            obs-studio
-          ]
-        else
-          [ ]
-      );
-  };
-}

modules/home-manager/programs/slack.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.slack;
-in
-{
-  options.modules.programs.slack = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      slack
-    ];
-  };
-}

modules/home-manager/programs/steam.nix

@@ -1,23 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.steam;
-in
-{
-  options.modules.programs.steam = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    programs.steam.enable = true;
-
-    systemd.extraConfig = "DefaultLimitNOFILE=1048576";
-  };
-}

modules/home-manager/programs/thunderbird.nix

@@ -1,41 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.thunderbird;
-in
-{
-  options.modules.programs.thunderbird = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.file.".thunderbird/Default/chrome/thunderbird-gnome-theme".source =
-      self.inputs.thunderbird-gnome-theme;
-
-    home.programs.thunderbird = {
-      enable = true;
-      profiles.Default = {
-        isDefault = true;
-        userChrome = ''
-          @import "thunderbird-gnome-theme/userChrome.css";
-        '';
-        userContent = ''
-          @import "thunderbird-gnome-theme/userContent.css";
-        '';
-        settings = {
-          ## GNOME theme
-          "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
-          "svg.context-properties.content.enabled" = true;
-        };
-      };
-    };
-  };
-}

modules/home-manager/programs/vscode.nix

@@ -1,56 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.vscode;
-in
-{
-  options.modules.programs.vscode = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.sessionVariables.NIXOS_OZONE_WL = "1";
-
-    home.programs.vscode = {
-      enable = true;
-      extensions = with pkgs.vscode-extensions; [
-        asvetliakov.vscode-neovim
-        brettm12345.nixfmt-vscode
-        coolbear.systemd-unit-file
-        editorconfig.editorconfig
-        golang.go
-        graphql.vscode-graphql-syntax
-        mattn.lisp
-        # mkhl.direnv
-        ms-python.vscode-pylance
-        ms-vscode.cpptools
-        ms-vscode.hexeditor
-        piousdeer.adwaita-theme
-        # redhat.java
-        # sumneko.lua
-      ];
-      userSettings = {
-        "editor.renderLineHighlight" = "none";
-        "extensions.experimental.affinity" = {
-          "asvetliakov.vscode-neovim" = 1;
-        };
-        "files.autoSave" = "off";
-        "window.autoDetectColorScheme" = true;
-        "window.commandCenter" = true;
-        "window.titleBarStyle" = "custom";
-        "workbench.iconTheme" = null;
-        "workbench.preferredDarkColorTheme" = "Adwaita Dark";
-        "workbench.preferredLightColorTheme" = "Adwaita Light";
-        "workbench.tree.indent" = 12;
-      };
-    };
-  };
-}

modules/home-manager/programs/zoom.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.programs.zoom;
-in
-{
-  options.modules.programs.zoom = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    user.packages = with pkgs; [
-      zoom-us
-    ];
-  };
-}

modules/home-manager/shell/zsh/.zshrc

@@ -1,34 +0,0 @@
-source $ZDOTDIR/config.zsh
-
-if [ ! -d "$ZGEN_DIR" ]; then
-  echo "Installing jandamm/zgenom"
-  git clone https://github.com/jandamm/zgenom "$ZGEN_DIR"
-fi
-source $ZGEN_DIR/zgenom.zsh
-
-zgenom autoupdate
-
-if ! zgenom saved; then
-  echo "Initializing zgenom"
-  rm -f $ZDOTDIR/*.zwc(N) \
-        $XDG_CACHE_HOME/zsh/*(N) \
-        $ZGEN_INIT.zwc
-
-  zgenom load junegunn/fzf shell
-  zgenom load zdharma-continuum/fast-syntax-highlighting
-  zgenom load zsh-users/zsh-completions src
-  zgenom load zsh-users/zsh-history-substring-search
-  zgenom load softmoth/zsh-vim-mode
-
-  zgenom save
-  zgenom compile $ZDOTDIR
-fi
-
-## Bootstrap interactive sessions
-if [[ $TERM != dumb ]]; then
-  autoload -Uz compinit && compinit -u -d $ZSH_CACHE/zcompdump
-
-  source $ZDOTDIR/keybinds.zsh
-  source $ZDOTDIR/completion.zsh
-  source $ZDOTDIR/aliases.zsh
-fi

modules/home-manager/shell/zsh/aliases.zsh

@@ -1,25 +0,0 @@
-#!/bin/sh
-
-# Verbose file operations
-alias \
-    cp="cp -iv" \
-    mv="mv -iv" \
-    rm="rm -v" \
-    mkdir="mkdir -v"
-
-# Colorize commands
-alias \
-    ls="ls -h --color=auto --group-directories-first"
-
-# Abbreviations
-alias \
-    e="$EDITOR" \
-    f="$FILE" \
-    g="git" \
-    m="neomutt" \
-    n="$FILE" \
-    v="$EDITOR"
-
-# XDG fixes
-alias \
-    mbsync="mbsync -c $XDG_CONFIG_HOME/isync/mbsyncrc -a"

modules/home-manager/shell/zsh/completion.zsh

@@ -1,6 +0,0 @@
-fpath+=( $ZDOTDIR/completions )
-
-# Don't offer history completion; we have fzf, C-r, and
-# zsh-history-substring-search for that.
-ZSH_AUTOSUGGEST_STRATEGY=(completion)
-ZSH_AUTOSUGGEST_BUFFER_MAX_SIZE=30

modules/home-manager/shell/zsh/config.zsh

@@ -1,99 +0,0 @@
-####
-## zsh configuration
-####
-
-## Colors
-autoload -U colors && colors
-
-## Completion
-setopt HASH_LIST_ALL
-unsetopt AUTO_NAME_DIRS
-autoload -Uz compinit
-zstyle ':completion:*' menu select
-zmodload zsh/complist
-compinit
-_comp_options+=(globdots) # Include hidden files
-
-## Directories
-setopt AUTO_PUSHD
-setopt CDABLE_VARS
-setopt PUSHD_IGNORE_DUPS
-setopt PUSHD_SILENT
-setopt PUSHD_TO_HOME
-unsetopt AUTO_CD
-
-## Expansion and globbing
-setopt EXTENDED_GLOB
-unsetopt GLOB_DOTS
-unsetopt NOMATCH
-
-## History
-HISTFILE="${XDG_DATA_HOME:-${HOME}/.local/share}/zsh/history"
-HISTSIZE=1000000
-SAVEHIST=1000000
-[[ !( -f "${HISTFILE}" ) ]] && mkdir -p $(dirname ${HISTFILE})
-
-setopt APPEND_HISTORY
-setopt BANG_HIST
-setopt EXTENDED_HISTORY
-setopt HIST_IGNORE_ALL_DUPS
-setopt HIST_IGNORE_DUPS
-setopt HIST_IGNORE_SPACE
-setopt HIST_SAVE_NO_DUPS
-setopt HIST_VERIFY
-setopt INC_APPEND_HISTORY_TIME
-setopt SHARE_HISTORY
-
-## I/O
-setopt INTERACTIVE_COMMENTS
-setopt MULTIOS
-unsetopt CLOBBER
-
-## Jobs
-setopt LONG_LIST_JOBS
-setopt AUTO_RESUME
-unsetopt BG_NICE
-unsetopt NOTIFY
-unsetopt HUP
-unsetopt CHECK_JOBS
-
-## Shell emulation
-setopt APPEND_CREATE
-
-## Prompt
-PS1="%B%{$fg[magenta]%}%~%{$reset_color%} $%b "
-
-## Window title
-precmd () { print -Pn "\e]0;%n@%m: %~\a" }
-preexec () { print -Pn "\e]0;%n@%m: $1\a" }
-
-## Vi mode
-bindkey -v
-export KEYTIMEOUT=1
-
-## Zsh line editor
-unsetopt BEEP
-
-
-####
-## Plugins
-####
-
-export ZGEN_AUTOLOAD_COMPINIT=0
-
-# zsh-vim-mode
-export MODE_INDICATOR=""
-export MODE_CURSOR_VIINS="#b77ee0 blinking bar"
-export MODE_CURSOR_REPLACE="$MODE_CURSOR_VIINS #ff3334"
-export MODE_CURSOR_VICMD="#b77ee0 block"
-export MODE_CURSOR_SEARCH="#e7c547 steady underline"
-export MODE_CURSOR_VISUAL="$MODE_CURSOR_VICMD steady bar"
-export MODE_CURSOR_VLINE="$MODE_CURSOR_VISUAL #54ced6"
-
-# fzf
-if (( $+commands[fd] )); then
-  export FZF_DEFAULT_OPTS="--reverse --ansi"
-  export FZF_DEFAULT_COMMAND="fd ."
-  export FZF_CTRL_T_COMMAND="$FZF_DEFAULT_COMMAND"
-  export FZF_ALT_C_COMMAND="fd -t d . $HOME"
-fi

modules/home-manager/shell/zsh/default.nix

@@ -1,60 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.shell.zsh;
-in
-{
-  options.modules.shell.zsh = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.defaultUserShell = pkgs.zsh;
-
-    programs.zsh = {
-      enable = true;
-      enableCompletion = true;
-      enableGlobalCompInit = false;
-      promptInit = "";
-    };
-
-    user.packages = with pkgs; [
-      fd
-      unstable.fzf
-      jq
-      nix-zsh-completions
-      nnn
-      ripgrep
-      zsh
-    ];
-
-    env = {
-      ZDOTDIR = "$XDG_CONFIG_HOME/zsh";
-      ZSH_CACHE = "$XDG_CACHE_HOME/zsh";
-      ZGEN_DIR = "$XDG_DATA_HOME/zgenom";
-    };
-
-    home.configFile = {
-      "zsh/.zshrc".source = ./.zshrc;
-      "zsh/aliases.zsh".source = ./aliases.zsh;
-      "zsh/completion.zsh".source = ./completion.zsh;
-      "zsh/config.zsh".source = ./config.zsh;
-      "zsh/keybinds.zsh".source = ./keybinds.zsh;
-    };
-
-    system.userActivationScripts.cleanupZgen = ''
-      rm -rf $ZDOTDIR/.*.zwc
-      rm -f $ZDOTDIR/.zcompdump
-      rm -rf $ZSH_CACHE
-      rm -fv $ZGEN_DIR/init.zsh{,.zwc}
-    '';
-  };
-}

modules/home-manager/shell/zsh/keybinds.zsh

@@ -1,12 +0,0 @@
-####
-## Keybindings
-####
-stty stop undef
-bindkey -s '^f' 'cd "$(dirname "$(fzf)")"\n'
-
-bindkey -M vicmd 'k' history-substring-search-up
-bindkey -M vicmd 'j' history-substring-search-down
-
-if (( $+commands[fzf] )); then
-  bindkey '^R' fzf-history-widget
-fi

modules/nixos/default.nix

@@ -3,24 +3,10 @@
     ./hardware/presonus-studio
     ./podman.nix
     ./services/borgmatic.nix
-    ./services/chrony.nix
-    ./services/coturn.nix
-    ./services/gitea.nix
-    ./services/gitea-runner.nix
-    ./services/headscale.nix
-    ./services/home-assistant
-    ./services/mail.nix
-    ./services/matrix.nix
-    ./services/music-assistant.nix
-    ./services/netbird.nix
-    ./services/nginx.nix
-    ./services/photoprism.nix
     ./services/postgresql.nix
     ./services/tailscale.nix
     ./system/desktop/gnome.nix
     ./system/desktop/hyprland.nix
-    ./system/desktop/kde.nix
-    ./system/desktop/mimeapps.nix
     ./system/wireless.nix
   ];
 }

modules/nixos/hardware/presonus-studio/default.nix

@@ -100,7 +100,7 @@ in
         };
       };
       pipewire-pulse."40-upmix" = upmixConfig;
-      client-rt."40-upmix" = upmixConfig;
+      client."40-upmix" = upmixConfig;
     };
   };
 }

modules/nixos/podman.nix

@@ -21,8 +21,6 @@ in
 
   config = mkIf cfg.enable {
     virtualisation = {
-      docker.enable = false;
-
       podman = {
         enable = true;
         defaultNetwork.settings.dns_enabled = true;
@@ -40,7 +38,6 @@ in
         runroot = "/run/containers/storage";
       };
 
-      oci-containers.backend = "podman";
     };
 
     networking.firewall.interfaces."podman+" = {

modules/nixos/services/borgmatic.nix

@@ -1,7 +1,7 @@
 {
+  inputs,
   config,
   lib,
-  self,
   ...
 }:
 
@@ -33,7 +33,7 @@ in
 
   config = lib.mkIf cfg.enable {
     age.secrets."passwords/services/borg/${hostname}-passphrase" = {
-      file = "${self.inputs.secrets}/passwords/services/borg/${hostname}-passphrase.age";
+      file = "${inputs.secrets}/passwords/services/borg/${hostname}-passphrase.age";
     };
 
     services.borgmatic = {
@@ -64,7 +64,8 @@ in
     ];
 
     # Add `pg_dumpall` to unit environment
-    systemd.services.borgmatic.path = [ config.services.postgresql.package ];
+    systemd.services.borgmatic.path =
+      if config.services.postgresql.enable then [ config.services.postgresql.package ] else [ ];
 
     # Without this override, `cat` is unavailable for `encryption_passcommand`
     systemd.services.borgmatic.confinement.fullUnit = true;

modules/nixos/services/chrony.nix

@@ -1,46 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-with lib;
-
-let
-  cfg = config.modules.services.chrony;
-in
-{
-  options.modules.services.chrony = {
-    enable = mkOption {
-      default = false;
-      example = true;
-      description = "Enable chrony NTP deamon";
-    };
-
-    config = mkIf cfg.enable {
-      services.chrony = {
-        enable = true;
-
-        servers = [
-          "uk.pool.ntp.org"
-          "time.cloudflare.com"
-        ];
-
-        extraConfig = ''
-          makestep 1.0 3
-
-          bindaddress 0.0.0.0
-          port 123
-          allow
-        '';
-      };
-
-      services.timesyncd.enable = mkForce false;
-
-      networking.firewall = {
-        allowedUDPPorts = [ 123 ];
-        allowedTCPPorts = [ 123 ];
-      };
-    };
-  };
-}

modules/nixos/services/coturn.nix

@@ -1,135 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.services.coturn;
-in
-{
-  options.modules.services.coturn = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    realm = lib.mkOption {
-      type = lib.types.str;
-      description = "The realm to be used by the TURN server.";
-      example = "turn.vimium.com";
-    };
-    matrixIntegration = lib.mkOption {
-      default = false;
-      description = "Configure the matrix-synapse module to use this TURN server.";
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    networking.firewall =
-      let
-        range =
-          with config.services.coturn;
-          lib.singleton {
-            from = min-port;
-            to = max-port;
-          };
-      in
-      {
-        allowedTCPPorts = [
-          3478 # TURN listener
-          5349 # STUN TLS
-          5350 # STUN TLS alt
-        ];
-        allowedUDPPorts = [
-          3478 # TURN listener
-          5349 # TLS
-          5350 # TLS alt
-        ];
-        allowedUDPPortRanges = range; # TURN peer relays
-      };
-
-    security.acme.certs = {
-      "${config.services.coturn.realm}" = {
-        group = "turnserver";
-        reloadServices = [ "coturn" ];
-      };
-    };
-
-    age.secrets =
-      {
-        "passwords/services/coturn/static-auth-secret" = {
-          file = "${self.inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
-          owner = "turnserver";
-          group = "turnserver";
-        };
-      }
-      // (
-        if cfg.matrixIntegration then
-          {
-            "passwords/services/coturn/matrix-turn-config.yml" = {
-              file = "${self.inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
-              owner = "matrix-synapse";
-              group = "matrix-synapse";
-            };
-          }
-        else
-          { }
-      );
-
-    services.coturn = rec {
-      enable = true;
-      realm = cfg.realm;
-      use-auth-secret = true;
-      static-auth-secret-file = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
-      cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
-      pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
-      min-port = 49000;
-      max-port = 50000;
-      no-cli = true;
-      no-tcp-relay = true;
-      extraConfig = ''
-        cipher-list="HIGH"
-        no-multicast-peers
-
-        # Ban private CIDR blocks
-        denied-peer-ip=0.0.0.0-0.255.255.255
-        denied-peer-ip=10.0.0.0-10.255.255.255
-        denied-peer-ip=100.64.0.0-100.127.255.255
-        denied-peer-ip=127.0.0.0-127.255.255.255
-        denied-peer-ip=169.254.0.0-169.254.255.255
-        denied-peer-ip=172.16.0.0-172.31.255.255
-        denied-peer-ip=192.0.0.0-192.0.0.255
-        denied-peer-ip=192.0.2.0-192.0.2.255
-        denied-peer-ip=192.88.99.0-192.88.99.255
-        denied-peer-ip=192.168.0.0-192.168.255.255
-        denied-peer-ip=198.18.0.0-198.19.255.255
-        denied-peer-ip=198.51.100.0-198.51.100.255
-        denied-peer-ip=203.0.113.0-203.0.113.255
-        denied-peer-ip=240.0.0.0-255.255.255.255
-        denied-peer-ip=::1
-        denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
-        denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
-        denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
-        denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
-        denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-        denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-        denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-      '';
-    };
-
-    services.matrix-synapse = lib.mkIf cfg.matrixIntegration {
-      settings = with config.services.coturn; {
-        turn_uris = [
-          "turn:${realm}:3478?transport=udp"
-          "turn:${realm}:3478?transport=tcp"
-        ];
-        turn_user_lifetime = "1h";
-      };
-      extraConfigFiles = [
-        config.age.secrets."passwords/services/coturn/matrix-turn-config.yml".path
-      ];
-    };
-  };
-}

modules/nixos/services/gitea-runner.nix

@@ -1,242 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  self,
-  ...
-}:
-
-# Based on: https://git.clan.lol/clan/clan-infra/src/branch/main/modules/web01/gitea/actions-runner.nix
-
-with lib;
-
-let
-  cfg = config.modules.services.gitea-runner;
-  hostname = config.networking.hostName;
-  giteaUrl = "https://git.vimium.com";
-
-  storeDepsBins = with pkgs; [
-    coreutils
-    findutils
-    gnugrep
-    gawk
-    git
-    nix
-    nix-update
-    bash
-    jq
-    nodejs
-  ];
-
-  storeDeps = pkgs.runCommand "store-deps" { } ''
-    mkdir -p $out/bin
-    for dir in ${toString storeDepsBins}; do
-      for bin in "$dir"/bin/*; do
-        ln -s "$bin" "$out/bin/$(basename "$bin")"
-      done
-    done
-
-    # Add SSL CA certs
-    mkdir -p $out/etc/ssl/certs
-    cp -a "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" $out/etc/ssl/certs/ca-bundle.crt
-  '';
-in
-{
-  options.modules.services.gitea-runner = {
-    enable = mkOption {
-      default = false;
-      example = true;
-      description = mdDoc "Enable a runner for Gitea Actions on this host";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    modules.podman.enable = true;
-
-    systemd.services = {
-      gitea-runner-nix-image = {
-        wantedBy = [ "multi-user.target" ];
-        after = [ "podman.service" ];
-        requires = [ "podman.service" ];
-        path = [
-          config.virtualisation.podman.package
-          pkgs.gnutar
-          pkgs.shadow
-          pkgs.getent
-        ];
-        script = ''
-          set -eux -o pipefail
-          mkdir -p etc/nix
-
-          # Create an unpriveleged user that we can use also without the run-as-user.sh script
-          touch etc/passwd etc/group
-          groupid=$(cut -d: -f3 < <(getent group nix-ci-user))
-          userid=$(cut -d: -f3 < <(getent passwd nix-ci-user))
-          groupadd --prefix $(pwd) --gid "$groupid" nix-ci-user
-          emptypassword='$6$1ero.LwbisiU.h3D$GGmnmECbPotJoPQ5eoSTD6tTjKnSWZcjHoVTkxFLZP17W9hRi/XkmCiAMOfWruUwy8gMjINrBMNODc7cYEo4K.'
-          useradd --prefix $(pwd) -p "$emptypassword" -m -d /tmp -u "$userid" -g "$groupid" -G nix-ci-user nix-ci-user
-
-          cat <<NIX_CONFIG > etc/nix/nix.conf
-          accept-flake-config = true
-          experimental-features = nix-command flakes
-          NIX_CONFIG
-
-          cat <<NSSWITCH > etc/nsswitch.conf
-          passwd:    files mymachines systemd
-          group:     files mymachines systemd
-          shadow:    files
-
-          hosts:     files mymachines dns myhostname
-          networks:  files
-
-          ethers:    files
-          services:  files
-          protocols: files
-          rpc:       files
-          NSSWITCH
-
-          # list the content as it will be imported into the container
-          tar -cv . | tar -tvf -
-          tar -cv . | podman import - gitea-runner-nix
-        '';
-        serviceConfig = {
-          RuntimeDirectory = "gitea-runner-nix-image";
-          WorkingDirectory = "/run/gitea-runner-nix-image";
-          Type = "oneshot";
-          RemainAfterExit = true;
-        };
-      };
-
-      gitea-runner-nix = {
-        after = [ "gitea-runner-nix-image.service" ];
-        requires = [ "gitea-runner-nix-image.service" ];
-
-        serviceConfig = {
-          # Hardening (may overlap with DynamicUser=)
-          # The following options are only for optimizing output of systemd-analyze
-          AmbientCapabilities = "";
-          CapabilityBoundingSet = "";
-          # ProtectClock= adds DeviceAllow=char-rtc r
-          DeviceAllow = "";
-          NoNewPrivileges = true;
-          PrivateDevices = true;
-          PrivateMounts = true;
-          PrivateTmp = true;
-          PrivateUsers = true;
-          ProtectClock = true;
-          ProtectControlGroups = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          ProtectSystem = "strict";
-          RemoveIPC = true;
-          RestrictNamespaces = true;
-          RestrictRealtime = true;
-          RestrictSUIDSGID = true;
-          UMask = "0066";
-          ProtectProc = "invisible";
-          SystemCallFilter = [
-            "~@clock"
-            "~@cpu-emulation"
-            "~@module"
-            "~@mount"
-            "~@obsolete"
-            "~@raw-io"
-            "~@reboot"
-            "~@swap"
-            # needed by go?
-            #"~@resources"
-            "~@privileged"
-            "~capset"
-            "~setdomainname"
-            "~sethostname"
-          ];
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-            "AF_UNIX"
-            "AF_NETLINK"
-          ];
-
-          # Needs network access
-          PrivateNetwork = false;
-          # Cannot be true due to Node
-          MemoryDenyWriteExecute = false;
-
-          # The more restrictive "pid" option makes `nix` commands in CI emit
-          # "GC Warning: Couldn't read /proc/stat"
-          # You may want to set this to "pid" if not using `nix` commands
-          ProcSubset = "all";
-          # Coverage programs for compiled code such as `cargo-tarpaulin` disable
-          # ASLR (address space layout randomization) which requires the
-          # `personality` syscall
-          # You may want to set this to `true` if not using coverage tooling on
-          # compiled code
-          LockPersonality = false;
-
-          # Note that this has some interactions with the User setting; so you may
-          # want to consult the systemd docs if using both.
-          DynamicUser = true;
-        };
-      };
-    };
-
-    users.users.nix-ci-user = {
-      group = "nix-ci-user";
-      description = "Used for running nix-based CI jobs";
-      home = "/var/empty";
-      isSystemUser = true;
-    };
-    users.groups.nix-ci-user = { };
-
-    age.secrets."files/services/gitea-runner/${hostname}-token" = {
-      file = "${self.inputs.secrets}/files/services/gitea-runner/${hostname}-token.age";
-      group = "podman";
-    };
-
-    services.gitea-actions-runner.instances = {
-      act = {
-        enable = true;
-        url = giteaUrl;
-        name = "act-runner-${hostname}";
-
-        tokenFile = config.age.secrets."files/services/gitea-runner/${hostname}-token".path;
-        settings = {
-          cache.enabled = true;
-          runner.capacity = 4;
-        };
-
-        labels = [
-          "debian-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
-          "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
-        ];
-      };
-      nix = {
-        enable = true;
-        url = giteaUrl;
-        name = "nix-runner-${hostname}";
-
-        tokenFile = config.age.secrets."files/services/gitea-runner/${hostname}-token".path;
-        settings = {
-          cache.enabled = true;
-          container = {
-            options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nix-ci-user";
-            network = "host";
-            valid_volumes = [
-              "/nix"
-              "${storeDeps}/bin"
-              "${storeDeps}/etc/ssl"
-            ];
-          };
-          runner.capacity = 4;
-        };
-
-        labels = [
-          "nix:docker://gitea-runner-nix"
-        ];
-      };
-    };
-  };
-}

modules/nixos/services/gitea.nix

@@ -1,100 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.services.gitea;
-in
-{
-  options.modules.services.gitea = {
-    enable = lib.mkEnableOption "gitea";
-    domain = lib.mkOption {
-      type = lib.types.string;
-      default = "git.vimium.com";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users = {
-      users.git = {
-        isSystemUser = true;
-        useDefaultShell = true;
-        group = "git";
-        extraGroups = [ "gitea" ];
-        home = config.services.gitea.stateDir;
-      };
-      groups.git = { };
-    };
-
-    services.nginx = {
-      upstreams.gitea = {
-        servers = {
-          "unix:${config.services.gitea.settings.server.HTTP_ADDR}" = { };
-        };
-      };
-      virtualHosts = {
-        "${cfg.domain}" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/".proxyPass = "http://gitea";
-        };
-      };
-    };
-
-    systemd.tmpfiles.rules = [
-      "d '${config.services.gitea.customDir}/public/assets/css' 0750 ${config.services.gitea.user} ${config.services.gitea.group} - -"
-      "L+ '${config.services.gitea.customDir}/public/assets/css/theme-github.css' - - - - ${self.inputs.gitea-github-theme}/theme-github.css"
-      "L+ '${config.services.gitea.customDir}/public/assets/css/theme-github-auto.css' - - - - ${self.inputs.gitea-github-theme}/theme-github-auto.css"
-      "L+ '${config.services.gitea.customDir}/public/assets/css/theme-github-dark.css' - - - - ${self.inputs.gitea-github-theme}/theme-github-dark.css"
-    ];
-
-    services.gitea = rec {
-      package = pkgs.unstable.gitea;
-      enable = true;
-      user = "git";
-      appName = "Vimium Git";
-      stateDir = "/var/lib/gitea";
-      repositoryRoot = "${stateDir}/repositories";
-      database = {
-        type = "sqlite3";
-        inherit user;
-        path = "${stateDir}/gitea.db";
-      };
-      lfs = {
-        enable = true;
-        contentDir = "${stateDir}/lfs";
-      };
-      settings = {
-        server = {
-          DOMAIN = config.networking.domain;
-          LANDING_PAGE = "explore";
-          OFFLINE_MODE = true;
-          PROTOCOL = "http+unix";
-          SSH_USER = "git";
-          SSH_DOMAIN = "${cfg.domain}";
-          SSH_PORT = lib.head config.services.openssh.ports;
-          ROOT_URL = "https://${cfg.domain}/";
-        };
-        service.DISABLE_REGISTRATION = true;
-        session.COOKIE_SECURE = true;
-        log = {
-          ROOT_PATH = "${stateDir}/log";
-          "logger.router.MODE" = "";
-        };
-        ui = {
-          THEMES = "gitea,arc-green,github,github-auto,github-dark";
-          DEFAULT_THEME = "github-dark";
-        };
-        actions.ENABLED = true;
-        indexer = {
-          REPO_INDEXER_ENABLED = true;
-        };
-        packages.CHUNKED_UPLOAD_PATH = lib.mkForce "${stateDir}/data/tmp/package-upload";
-      };
-    };
-  };
-}

modules/nixos/services/headscale.nix

@@ -1,72 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.services.headscale;
-  fqdn = "headscale.vimium.net";
-in
-{
-  options.modules.services.headscale = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.headscale ];
-
-    services.headscale = {
-      enable = true;
-
-      port = 8080;
-
-      settings = {
-        policy.path = null;
-        ip_prefixes = [
-          "100.64.0.0/10"
-        ];
-        server_url = "https://${fqdn}";
-        derp = {
-          auto_update_enable = false;
-          update_frequency = "24h";
-        };
-        dns = {
-          base_domain = "mesh.vimium.net";
-          extra_records = [
-            {
-              name = "grafana.mesh.vimium.net";
-              type = "A";
-              value = "100.64.0.6";
-            }
-            {
-              name = "home.mesh.vimium.net";
-              type = "A";
-              value = "100.64.0.7";
-            }
-          ];
-          magic_dns = true;
-          nameservers.global = [
-            "9.9.9.9"
-          ];
-        };
-        logtail.enabled = false;
-      };
-    };
-
-    services.nginx.virtualHosts = {
-      "${fqdn}" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = {
-          proxyPass = "http://localhost:${toString config.services.headscale.port}";
-          proxyWebsockets = true;
-        };
-      };
-    };
-  };
-}

modules/nixos/services/home-assistant/default.nix

@@ -1,307 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.services.home-assistant;
-in
-{
-  imports = [
-    ./floorplan/default.nix
-    ./mqtt.nix
-  ];
-
-  options.modules.services.home-assistant.enable = lib.mkEnableOption "home-assistant";
-
-  config = lib.mkIf cfg.enable {
-
-    age.secrets."files/services/home-assistant/secrets.yaml" = {
-      file = "${self.inputs.secrets}/files/services/home-assistant/secrets.yaml.age";
-      path = "${config.services.home-assistant.configDir}/secrets.yaml";
-      owner = "hass";
-      group = "hass";
-    };
-
-    services.home-assistant = {
-      enable = true;
-
-      config = {
-        automation = "!include automations.yaml";
-        backup = { };
-        binary_sensor = [ ];
-        default_config = { };
-        http = {
-          server_host = "::1";
-          trusted_proxies = [ "::1" ];
-          use_x_forwarded_for = true;
-        };
-        ffmpeg = { };
-        homeassistant = {
-          name = "Home";
-          latitude = "!secret latitude";
-          longitude = "!secret longitude";
-          country = "GB";
-          temperature_unit = "C";
-          time_zone = config.time.timeZone;
-          unit_system = "metric";
-          auth_providers = [
-            {
-              type = "trusted_networks";
-              trusted_networks = [
-                "100.64.0.0/10"
-                "127.0.0.1"
-              ];
-              allow_bypass_login = true;
-            }
-            {
-              type = "homeassistant";
-            }
-          ];
-        };
-        logger = {
-          default = "info";
-          logs = { };
-        };
-        lovelace = {
-          resources = [
-            {
-              url = "/local/nixos-lovelace-modulels/mushroom.js";
-              type = "module";
-            }
-          ];
-        };
-        media_player = [ ];
-        mobile_app = { };
-        onkyo = { };
-        open_meteo = { };
-        recorder = {
-          purge_keep_days = 365;
-        };
-        scene = "!include scenes.yaml";
-        script = "!include scripts.yaml";
-        sensor = [ ];
-        system_health = { };
-        zeroconf = { };
-      };
-
-      extraComponents = [
-        "air_quality"
-        "airly"
-        "alert"
-        "api"
-        "application_credentials"
-        "asuswrt"
-        "auth"
-        "automation"
-        "bayesian"
-        "binary_sensor"
-        # "blackbird"
-        "blueprint"
-        "bluetooth_adapters"
-        "bluetooth_le_tracker"
-        "button"
-        "calendar"
-        "camera"
-        "cast"
-        "cert_expiry"
-        "climate"
-        "co2signal"
-        "color_extractor"
-        "command_line"
-        "compensation"
-        "configurator"
-        "counter"
-        "cover"
-        "cpuspeed"
-        "default_config"
-        "demo"
-        "derivative"
-        "device_automation"
-        "device_sun_light_trigger"
-        "device_tracker"
-        "dlna_dmr"
-        "dlna_dms"
-        "dnsip"
-        "esphome"
-        "fail2ban"
-        "fan"
-        "feedreader"
-        "ffmpeg"
-        "file"
-        "file_upload"
-        "filesize"
-        "folder"
-        "folder_watcher"
-        "forecast_solar"
-        "frontend"
-        "gdacs"
-        "generic"
-        "generic_hygrostat"
-        "generic_thermostat"
-        "geo_json_events"
-        "geo_location"
-        "geo_rss_events"
-        "github"
-        "group"
-        "hardware"
-        "hdmi_cec"
-        "history_stats"
-        "homeassistant"
-        "homekit"
-        "homekit_controller"
-        "html5"
-        "http"
-        "humidifier"
-        "icloud"
-        "image_processing"
-        "input_boolean"
-        "input_button"
-        "input_datetime"
-        "input_number"
-        "input_select"
-        "input_text"
-        "integration"
-        "ios"
-        "jellyfin"
-        "light"
-        "local_calendar"
-        "local_file"
-        "local_ip"
-        "local_todo"
-        "lock"
-        "logentries"
-        "logger"
-        "lovelace"
-        "manual"
-        "manual_mqtt"
-        "matter"
-        "media_player"
-        "min_max"
-        "mjpeg"
-        "modern_forms"
-        "mold_indicator"
-        "moon"
-        "mysensors"
-        "network"
-        "nmap_tracker"
-        "notify"
-        "number"
-        "onboarding"
-        "onkyo"
-        "panel_custom"
-        "persistent_notification"
-        "person"
-        "ping"
-        "plant"
-        "prometheus"
-        "proximity"
-        "push"
-        "proximity"
-        "python_script"
-        "radio_browser"
-        "random"
-        "recorder"
-        "remote"
-        "repairs"
-        "rest"
-        "rest_command"
-        "rss_feed_template"
-        "scene"
-        "schedule"
-        "scrape"
-        "script"
-        "search"
-        "season"
-        "select"
-        "sense"
-        "sensor"
-        "sensorpush"
-        "shell_command"
-        "shopping_list"
-        "siren"
-        "smtp"
-        "snmp"
-        "sql"
-        "statistics"
-        "sun"
-        "switch"
-        "switch_as_x"
-        "system_health"
-        "system_log"
-        "systemmonitor"
-        "tag"
-        "tailscale"
-        "tcp"
-        "template"
-        "text"
-        "thread"
-        "threshold"
-        "time_date"
-        "timer"
-        "tod"
-        "todo"
-        "tomorrowio"
-        "trend"
-        "universal"
-        "upb"
-        "update"
-        "upnp"
-        "uptime"
-        "utility_meter"
-        "vacuum"
-        "vlc"
-        "vlc_telnet"
-        "wake_on_lan"
-        "water_heater"
-        "weather"
-        "websocket_api"
-        "wled"
-        "workday"
-        "worldclock"
-        "zone"
-      ];
-
-      extraPackages =
-        python3Packages: with python3Packages; [
-          onkyo-eiscp
-          zeroconf
-        ];
-
-      customComponents = with pkgs; [
-        hass-browser-mod
-        ui-lovelace-minimalist
-      ];
-
-      customLovelaceModules = with pkgs.home-assistant-custom-lovelace-modules; [
-        bubble-card
-        button-card
-        mushroom
-        sankey-chart
-        universal-remote-card
-        # zigbee2mqtt-networkmap
-      ];
-    };
-
-    modules.services.borgmatic.directories = [
-      config.services.home-assistant.configDir
-    ];
-
-    services.nginx = {
-      enable = true;
-      virtualHosts."home.mesh.vimium.net" = {
-        forceSSL = false;
-        extraConfig = ''
-          proxy_buffering off;
-        '';
-        locations."/" = {
-          proxyPass = "http://[::1]:8123";
-          proxyWebsockets = true;
-        };
-      };
-    };
-  };
-}

modules/nixos/services/home-assistant/floorplan/default.nix

@@ -1,100 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.services.home-assistant;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.home-assistant = {
-      config.lovelace.resources = [
-        {
-          url = "/local/nixos-lovelace-modules/floorplan.js";
-          type = "module";
-        }
-      ];
-      customLovelaceModules = [
-        pkgs.ha-floorplan
-      ];
-    };
-
-    environment.etc."home-assistant/www/floorplan/style.css".source = ./style.css;
-    environment.etc."home-assistant/www/floorplan/config.yaml".text = builtins.toJSON {
-      image = {
-        location = "/local/floorplan/beetham.svg";
-        cache = false;
-      };
-      stylesheet = {
-        location = "/local/floorplan/style.css";
-        cache = false;
-      };
-
-      defaults = {
-        hover_action = "hover-info";
-        hold_action = "toggle";
-        tap_action = "more-info";
-      };
-
-      rules = [
-        {
-          name = "Rooms";
-          entities = [
-            {
-              entity = "light.bedroom_lamps";
-              element = "area.bedroom";
-            }
-            {
-              entity = "light.hallway_spots";
-              element = "area.hallway";
-            }
-            {
-              entity = "light.living_room_lamps";
-              element = "area.livingroom";
-            }
-            {
-              entity = "light.office_lamps";
-              element = "area.office";
-            }
-          ];
-          tap_action = "light.toggle";
-          state_action = {
-            service = "floorplan.class_set";
-            service_data = ''
-              if (entity.state === "on") {
-                return "light-on";
-              }
-              return "light-off";
-            '';
-          };
-        }
-        {
-          name = "Temperature";
-          entities = [
-            "sensor.motion_sensor_temperature"
-          ];
-          state_action = [
-            {
-              service = "floorplan.text_set";
-              service_data = ''
-                if (!isNaN(entity.state)) {
-                  return Math.round(entity.state * 10) / 10 + "°";
-                }
-                return "Unknown";
-              '';
-            }
-            {
-              service = "floorplan.class_set";
-              service_data = {
-                class = "static-temp";
-              };
-            }
-          ];
-        }
-      ];
-    };
-  };
-}

modules/nixos/services/home-assistant/mqtt.nix

@@ -1,92 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.services.home-assistant;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.mosquitto = {
-      enable = true;
-      listeners = [
-        {
-          acl = [ "pattern readwrite #" ];
-          omitPasswordAuth = true;
-          port = 1883;
-          settings = {
-            allow_anonymous = true;
-          };
-        }
-      ];
-    };
-
-    age.secrets."files/services/zigbee2mqtt/secret.yaml" = {
-      file = "${self.inputs.secrets}/files/services/zigbee2mqtt/secret.yaml.age";
-      path = "${config.services.zigbee2mqtt.dataDir}/secret.yaml";
-      owner = "zigbee2mqtt";
-      group = "zigbee2mqtt";
-    };
-
-    services.zigbee2mqtt = {
-      package = pkgs.unstable.zigbee2mqtt;
-      enable = true;
-      dataDir = "/var/lib/zigbee2mqtt";
-      settings = {
-        homeassistant = lib.optionalAttrs config.services.home-assistant.enable {
-          discovery_topic = "homeassistant";
-          status_topic = "hass/status";
-        };
-        availability = true;
-        frontend = true;
-        device_options = {
-          retain = true;
-        };
-        serial = {
-          port = "/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0";
-          adapter = "zstack";
-        };
-        advanced = {
-          channel = 20;
-          network_key = "!secret.yaml network_key";
-          pan_id = 13001;
-          ext_pan_id = [
-            79
-            1
-            73
-            47
-            250
-            136
-            124
-            222
-          ];
-          transmit_power = 20;
-        };
-        mqtt = {
-          version = 5;
-          server = "mqtt://localhost:1883";
-        };
-      };
-    };
-
-    modules.services.borgmatic.directories = [
-      config.services.mosquitto.dataDir
-      config.services.zigbee2mqtt.dataDir
-    ];
-
-    services.home-assistant = {
-      config.mqtt = { };
-      extraComponents = [
-        "mqtt"
-        "mqtt_eventstream"
-        "mqtt_json"
-        "mqtt_room"
-        "mqtt_statestream"
-      ];
-    };
-  };
-}

modules/nixos/services/mail.nix

@@ -1,83 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.services.mail;
-  domains = [
-    "h0lt.com"
-    "jdholt.com"
-    "jordanholt.xyz"
-    "vimium.co"
-    "vimium.com"
-    "vimium.co.uk"
-    "vimium.info"
-    "vimium.net"
-    "vimium.org"
-    "vimium.xyz"
-  ];
-in
-{
-  options.modules.services.mail = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  imports = [
-    self.inputs.nixos-mailserver.nixosModule
-  ];
-
-  config = lib.mkIf cfg.enable {
-    services.roundcube = {
-      enable = true;
-      hostName = config.mailserver.fqdn;
-      extraConfig = ''
-        $config['smtp_server'] = "tls://${config.mailserver.fqdn}";
-        $config['smtp_user'] = "%u";
-        $config['smtp_pass'] = "%p";
-      '';
-      plugins = [ "contextmenu" ];
-    };
-
-    services.nginx.enable = true;
-
-    networking.firewall.allowedTCPPorts = [
-      80
-      443
-    ];
-
-    mailserver = {
-      enable = true;
-      fqdn = "mail.vimium.com";
-      domains = domains;
-      indexDir = "/var/lib/dovecot/indices";
-
-      certificateDomains = [
-        "imap.vimium.com"
-        "smtp.vimium.com"
-      ];
-      certificateScheme = "acme-nginx";
-
-      fullTextSearch.enable = true;
-
-      loginAccounts = {
-        "jordan@vimium.com" = {
-          hashedPasswordFile = config.users.users.jordan.hashedPasswordFile;
-          catchAll = domains;
-        };
-      };
-
-      extraVirtualAliases = {
-        "hostmaster@vimium.com" = "jordan@vimium.com";
-        "postmaster@vimium.com" = "jordan@vimium.com";
-        "webmaster@vimium.com" = "jordan@vimium.com";
-        "abuse@vimium.com" = "jordan@vimium.com";
-      };
-    };
-  };
-}

modules/nixos/services/matrix.nix

@@ -1,248 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.modules.services.matrix;
-in
-{
-  options.modules.services.matrix = {
-    enable = lib.mkEnableOption "matrix";
-    element = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-      };
-    };
-    bridges = {
-      signal = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Enable Signal bridge.";
-      };
-      whatsapp = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Enable WhatsApp bridge.";
-      };
-    };
-    serverName = lib.mkOption {
-      type = lib.types.str;
-      default = "vimium.com";
-      example = "vimium.com";
-    };
-    usePostgresql = lib.mkEnableOption "postgresql";
-  };
-
-  config =
-    let
-      matrixSubdomain = "matrix.${cfg.serverName}";
-      elementSubdomain = "chat.${cfg.serverName}";
-      matrixClientConfig = {
-        "m.homeserver" = {
-          base_url = "https://${matrixSubdomain}";
-          server_name = cfg.serverName;
-        };
-        "m.identity_server" = {
-          "base_url" = "https://vector.im";
-        };
-      };
-      matrixServerConfig."m.server" = "${matrixSubdomain}:443";
-      commonBridgeSettings = bridge: {
-        appservice = {
-          database = lib.mkIf cfg.usePostgresql {
-            type = "postgres";
-            uri = "postgresql:///${bridge}?host=/run/postgresql";
-          };
-        };
-        bridge = {
-          encryption = {
-            allow = true;
-            default = true;
-            require = true;
-          };
-          permissions = {
-            "${cfg.serverName}" = "user";
-            "@jordan:${cfg.serverName}" = "admin";
-          };
-          provisioning = {
-            shared_secret = "disable";
-          };
-        };
-        homeserver = {
-          address = "https://${matrixSubdomain}";
-          domain = cfg.serverName;
-        };
-      };
-    in
-    lib.mkIf cfg.enable {
-      networking.firewall.allowedTCPPorts = [
-        8448 # Matrix federation
-      ];
-
-      security.acme.certs = {
-        "${matrixSubdomain}" = {
-          reloadServices = [ "matrix-synapse" ];
-        };
-      };
-
-      services.nginx.virtualHosts =
-        {
-          "${matrixSubdomain}" = {
-            forceSSL = true;
-            enableACME = true;
-            listen = [
-              {
-                addr = "0.0.0.0";
-                port = 443;
-                ssl = true;
-              }
-              {
-                addr = "0.0.0.0";
-                port = 80;
-              }
-              {
-                addr = "0.0.0.0";
-                port = 8448;
-                ssl = true;
-              }
-              {
-                addr = "[::1]";
-                port = 443;
-                ssl = true;
-              }
-              {
-                addr = "[::1]";
-                port = 80;
-              }
-              {
-                addr = "[::1]";
-                port = 8448;
-                ssl = true;
-              }
-            ];
-            locations = {
-              "/" = {
-                proxyPass = "http://localhost:8008";
-                extraConfig = ''
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                '';
-              };
-              "/_matrix" = {
-                proxyPass = "http://localhost:8008";
-                extraConfig = ''
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                  client_max_body_size 50M;
-                '';
-              };
-              "/_synapse/client".proxyPass = "http://localhost:8008";
-            };
-          };
-          "${cfg.serverName}" =
-            let
-              mkWellKnown = data: ''
-                more_set_headers 'Content-Type: application/json';
-                return 200 '${builtins.toJSON data}';
-              '';
-            in
-            {
-              locations."= /.well-known/matrix/server".extraConfig = (mkWellKnown matrixServerConfig);
-              locations."= /.well-known/matrix/client".extraConfig = (mkWellKnown matrixClientConfig);
-            };
-        }
-        // (
-          if cfg.element.enable then
-            {
-              "${elementSubdomain}" = {
-                forceSSL = true;
-                enableACME = true;
-                root = pkgs.unstable.element-web.override {
-                  conf = {
-                    default_server_config = matrixClientConfig;
-                    brand = "Vimium Chat";
-                    branding = {
-                      auth_header_logo_url = "https://vimium.com/images/logo.svg";
-                      auth_footer_links = [
-                        {
-                          "text" = "Vimium.com";
-                          "url" = "https://vimium.com";
-                        }
-                      ];
-                    };
-                  };
-                };
-              };
-            }
-          else
-            { }
-        );
-
-      nixpkgs.config.permittedInsecurePackages = [
-        "jitsi-meet-1.0.8043"
-        "olm-3.2.16"
-      ];
-
-      services.matrix-synapse = {
-        enable = true;
-        enableRegistrationScript = true;
-        settings = {
-          database.name = (if cfg.usePostgresql then "psycopg2" else "sqlite3");
-          enable_metrics = false;
-          enable_registration = false;
-          max_upload_size = "100M";
-          report_stats = false;
-          server_name = cfg.serverName;
-        };
-      };
-      systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = (
-        lib.optional cfg.bridges.whatsapp config.systemd.services.mautrix-whatsapp.serviceConfig.Group
-      );
-
-      services.postgresql = lib.mkIf cfg.usePostgresql {
-        ensureUsers =
-          [
-            {
-              name = "matrix-synapse";
-              ensureDBOwnership = true;
-            }
-          ]
-          ++ (lib.optional cfg.bridges.signal {
-            name = "mautrix-signal";
-            ensureDBOwnership = true;
-          })
-          ++ (lib.optional cfg.bridges.whatsapp {
-            name = "mautrix-whatsapp";
-            ensureDBOwnership = true;
-          });
-        ensureDatabases =
-          [
-            "matrix-synapse"
-          ]
-          ++ (lib.optional cfg.bridges.signal "mautrix-signal")
-          ++ (lib.optional cfg.bridges.whatsapp "mautrix-whatsapp");
-      };
-
-      services.mautrix-signal = lib.mkIf cfg.bridges.signal {
-        enable = true;
-        settings = commonBridgeSettings "mautrix-signal";
-      };
-
-      services.mautrix-whatsapp = lib.mkIf cfg.bridges.whatsapp {
-        enable = true;
-        settings = {
-          bridge = {
-            history_sync = {
-              backfill = true;
-              max_initial_conversations = -1;
-              message_count = 50;
-              request_full_sync = true;
-            };
-            mute_bridging = true;
-          };
-        } // commonBridgeSettings "mautrix-whatsapp";
-      };
-    };
-}

modules/nixos/services/music-assistant.nix

@@ -1,37 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-let
-  inherit (lib)
-    mkEnableOption
-    mkIf
-    ;
-  cfg = config.modules.services.music-assistant;
-in
-{
-  options.modules.services.music-assistant.enable = mkEnableOption "music-assistant";
-
-  config = mkIf cfg.enable {
-    services = {
-      nginx.virtualHosts."music-assistant.${config.networking.hostName}" = {
-        extraConfig = ''
-          proxy_buffering off;
-        '';
-        locations."/" = {
-          proxyPass = "http://[::1]:8095";
-          proxyWebsockets = true;
-        };
-      };
-      music-assistant = {
-        enable = true;
-        providers = [
-          "hass"
-          "jellyfin"
-        ];
-      };
-    };
-  };
-}

modules/nixos/services/netbird.nix

@@ -1,77 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.services.netbird;
-in
-{
-  options.modules.services.netbird = {
-    enable = lib.mkEnableOption "netbird";
-    coordinatorDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "netbird.vimium.net";
-    };
-    meshDomain = lib.mkOption {
-      type = lib.types.str;
-      default = "mesh.vimium.net";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    age.secrets."passwords/services/netbird/data-store-encryption-key" = {
-      file = "${self.inputs.secrets}/passwords/services/netbird/data-store-encryption-key.age";
-    };
-
-    services.netbird = {
-      enable = true;
-    };
-
-    services.netbird.server = {
-      domain = cfg.coordinatorDomain;
-      enable = true;
-      enableNginx = true;
-      dashboard.settings = {
-        AUTH_AUTHORITY = "https://auth.vimium.com/oauth2/openid/netbird";
-      };
-      management = rec {
-        disableAnonymousMetrics = true;
-        dnsDomain = cfg.meshDomain;
-        oidcConfigEndpoint = "https://auth.vimium.com/oauth2/openid/netbird/.well-known/openid-configuration";
-        settings = {
-          DataStoreEncryptionKey = {
-            _secret = config.age.secrets."passwords/services/netbird/data-store-encryption-key".path;
-          };
-          HttpConfig = {
-            AuthAudience = "netbird";
-          };
-          StoreConfig = {
-            Engine = "sqlite";
-          };
-          TURNConfig = {
-            Secret._secret = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
-            TimeBasedCredentials = true;
-          };
-          PKCEAuthorizationFlow.ProviderConfig = {
-            AuthorizationEndpoint = "https://auth.vimium.com/ui/oauth2";
-            TokenEndpoint = "https://auth.vimium.com/oauth2/token";
-          };
-        };
-        singleAccountModeDomain = dnsDomain;
-        turnDomain = config.services.coturn.realm;
-        turnPort = config.services.coturn.listening-port;
-      };
-    };
-
-    systemd.services.netbird-signal.serviceConfig.RestartSec = "60";
-    systemd.services.netbird-management.serviceConfig.RestartSec = "60";
-
-    services.nginx.virtualHosts."netbird.vimium.net" = {
-      enableACME = true;
-      forceSSL = true;
-    };
-  };
-}

modules/nixos/services/nginx.nix

@@ -1,193 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-
-let
-  cfg = config.modules.services.nginx;
-  nginxErrorPages = ''
-    location @error_pages {
-      rewrite ^.*$ /''${status}.html break;
-
-      root "/var/www/html/errors";
-    }
-  '';
-  nginxEdgeHeaders = ''
-    more_set_headers 'Server: Vimium';
-    more_set_headers 'Access-Control-Allow-Origin: *';
-    add_header Expect-CT max-age=30 always;
-    add_header Referrer-Policy strict-origin-when-cross-origin always;
-    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
-    add_header Vimium-Responding-Instance $hostname;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header X-Content-Type-Options nosniff always;
-  '';
-  nginxStrictHeaders = ''
-    add_header X-Frame-Options SAMEORIGIN always;
-    add_header Permissions-Policy "fullscreen=(self), sync-xhr=(self)" always;
-  '';
-  mkRedirect = from: to: {
-    "${from}" = {
-      forceSSL = true;
-      enableACME = true;
-      serverAliases = [ "www.${from}" ];
-      locations."/".return = "301 https://${to}$request_uri";
-      extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
-    };
-  };
-in
-{
-  options.modules.services.nginx = {
-    enable = mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [
-      80 # HTTP
-      443 # HTTPS
-    ];
-
-    services.nginx = {
-      enable = true;
-      package = pkgs.openresty;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedTlsSettings = true;
-      clientMaxBodySize = "2G";
-      sslProtocols = "TLSv1.2 TLSv1.3";
-      sslCiphers = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
-      appendHttpConfig = ''
-        error_page 400 @error_pages;
-        error_page 401 @error_pages;
-        error_page 403 @error_pages;
-        error_page 404 @error_pages;
-        error_page 405 @error_pages;
-        error_page 429 @error_pages;
-        error_page 500 @error_pages;
-        error_page 501 @error_pages;
-        error_page 502 @error_pages;
-        error_page 503 @error_pages;
-        error_page 504 @error_pages;
-
-        client_body_buffer_size 16k;
-        client_header_buffer_size 8k;
-      '';
-      appendConfig = ''
-        worker_processes auto;
-        worker_cpu_affinity auto;
-        worker_rlimit_nofile 50000;
-      '';
-      eventsConfig = ''
-        worker_connections 20000;
-        multi_accept off;
-      '';
-      proxyCachePath = {
-        "skycam" = {
-          enable = true;
-          keysZoneName = "skycam_cache";
-          maxSize = "100m";
-        };
-      };
-      virtualHosts =
-        {
-          ## Static sites
-          "jellyfin.vimium.com" = {
-            forceSSL = true;
-            enableACME = true;
-            extraConfig = nginxErrorPages + nginxEdgeHeaders;
-            locations."/" = {
-              proxyPass = "http://localhost:8000";
-              extraConfig = ''
-                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                proxy_set_header X-Forwarded-Proto $scheme;
-                proxy_set_header X-Real-IP $remote_addr;
-                proxy_set_header Host $host;
-
-                proxy_set_header Range $http_range;
-                proxy_set_header If-Range $http_if_range;
-
-                proxy_http_version 1.1;
-                proxy_set_header Upgrade $http_upgrade;
-                proxy_set_header Connection "upgrade";
-              '';
-            };
-          };
-          "jdholt.com" = {
-            forceSSL = true;
-            enableACME = true;
-            serverAliases = [ "www.jdholt.com" ];
-            extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
-            locations."/skycam/snapshot.jpg" = {
-              extraConfig = ''
-                set $backend "skycam.mesh.vimium.net:8080";
-
-                resolver 100.100.100.100;
-
-                proxy_pass http://$backend/snapshot;
-                proxy_cache skycam_cache;
-                proxy_cache_valid any 10s;
-                proxy_ignore_headers Cache-Control Expires Set-Cookie;
-              '';
-            };
-            locations."/".return = "301 https://vimium.com$request_uri";
-          };
-          "pki.vimium.com" = {
-            addSSL = true;
-            forceSSL = false;
-            enableACME = true;
-            extraConfig = ''
-              ${nginxErrorPages}
-              more_set_headers 'Server: Vimium';
-            '';
-            locations."/" = {
-              root = "/var/www/pki.vimium.com";
-            };
-          };
-          "suhailhussain.com" = {
-            forceSSL = true;
-            enableACME = true;
-            serverAliases = [ "www.suhailhussain.com" ];
-            extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
-            locations."/" = {
-              root = "/var/www/suhailhussain.com";
-            };
-          };
-          "vimium.com" = {
-            default = true;
-            forceSSL = true;
-            enableACME = true;
-            serverAliases = [ "www.vimium.com" ];
-            extraConfig =
-              nginxErrorPages
-              + nginxEdgeHeaders
-              + nginxStrictHeaders
-              + ''
-                add_header Content-Security-Policy "default-src 'self' https://vimium.com https://www.vimium.com; style-src 'unsafe-inline'; object-src 'none'; upgrade-insecure-requests" always;
-              '';
-            locations."/" = {
-              root = "/var/www/vimium.com";
-            };
-          };
-        }
-        ## Redirects
-        // (mkRedirect "h0lt.com" "jdholt.com")
-        // (mkRedirect "jordanholt.xyz" "jdholt.com")
-        // (mkRedirect "omnimagic.com" "vimium.com")
-        // (mkRedirect "omnimagic.net" "vimium.com")
-        // (mkRedirect "thelostlegend.com" "suhailhussain.com")
-        // (mkRedirect "vimium.co" "vimium.com")
-        // (mkRedirect "vimium.co.uk" "vimium.com")
-        // (mkRedirect "vimium.info" "vimium.com")
-        // (mkRedirect "vimium.net" "vimium.com")
-        // (mkRedirect "vimium.org" "vimium.com")
-        // (mkRedirect "vimium.xyz" "vimium.com");
-    };
-  };
-}

modules/nixos/services/photoprism.nix

@@ -1,64 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}:
-
-with lib;
-
-let
-  cfg = config.modules.services.photoprism;
-in
-{
-  options.modules.services.photoprism = {
-    enable = mkOption {
-      default = false;
-      example = true;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.nginx = {
-      virtualHosts = {
-        "gallery.vimium.com" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://localhost:${toString config.services.photoprism.port}";
-            extraConfig = ''
-              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-              proxy_set_header X-Forwarded-Proto $scheme;
-              proxy_set_header X-Real-IP $remote_addr;
-              proxy_set_header Host $host;
-
-              proxy_buffering off;
-              proxy_http_version 1.1;
-              proxy_set_header Upgrade $http_upgrade;
-              proxy_set_header Connection "upgrade";
-            '';
-          };
-        };
-      };
-    };
-
-    age.secrets."passwords/services/photoprism/admin" = {
-      file = "${self.inputs.secrets}/passwords/services/photoprism/admin.age";
-    };
-
-    services.photoprism = {
-      enable = true;
-      address = "localhost";
-      passwordFile = config.age.secrets."passwords/services/photoprism/admin".path;
-      originalsPath = "${config.services.photoprism.storagePath}/originals";
-      settings = {
-        PHOTOPRISM_APP_NAME = "Vimium Gallery";
-        PHOTOPRISM_SITE_AUTHOR = "Vimium";
-        PHOTOPRISM_SITE_TITLE = "Vimium Gallery";
-        PHOTOPRISM_SITE_CAPTION = "Vimium Gallery";
-        PHOTOPRISM_DISABLE_TLS = "true";
-        PHOTOPRISM_SPONSOR = "true";
-      };
-    };
-  };
-}