pkgs: add nix-init, nix-inspect, binutils

element-desktop + slack overlays, update nvfetcher

.gitignore

@@ -4,7 +4,7 @@ doc/index.html
 
 # Result of bud commands
 vm
-iso
+/iso
 doi
 
 pkgs/_sources/.shake*

flake.lock

@@ -3,18 +3,22 @@
     "agenix": {
       "inputs": {
         "darwin": [
-          "darwin"
+          "nix-darwin"
+        ],
+        "home-manager": [
+          "home-manager"
         ],
         "nixpkgs": [
-          "nixos"
-        ]
+          "nixpkgs"
+        ],
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1682101079,
-        "narHash": "sha256-MdAhtjrLKnk2uiqun1FWABbKpLH090oeqCSiWemtuck=",
+        "lastModified": 1714136352,
+        "narHash": "sha256-BtWQ2Th/jamO1SlD+2ASSW5Jaf7JhA/JLpQHk0Goqpg=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "2994d002dcff5353ca1ac48ec584c7f6589fe447",
+        "rev": "24a7ea390564ccd5b39b7884f597cfc8d7f6f44e",
         "type": "github"
       },
       "original": {
@@ -23,42 +27,22 @@
         "type": "github"
       }
     },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "nixos"
-        ]
-      },
-      "locked": {
-        "lastModified": 1688307440,
-        "narHash": "sha256-7PTjbN+/+b799YN7Tk2SS5Vh8A0L3gBo8hmB7Y0VXug=",
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "rev": "b06bab83bdf285ea0ae3c8e145a081eb95959047",
-        "type": "github"
-      },
-      "original": {
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "deploy": {
+    "deploy-rs": {
       "inputs": {
         "flake-compat": [
           "flake-compat"
         ],
         "nixpkgs": [
-          "nixos"
+          "nixpkgs"
         ],
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1686747123,
-        "narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=",
+        "lastModified": 1711973905,
+        "narHash": "sha256-UFKME/N1pbUtn+2Aqnk+agUt8CekbpuqwzljivfIme8=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "724463b5a94daa810abfc64a4f87faef4e00f984",
+        "rev": "88b3059b020da69cbe16526b8d639bd5e0b51c8b",
         "type": "github"
       },
       "original": {
@@ -69,18 +53,21 @@
     },
     "devshell": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": [
+          "tritonshell",
+          "flake-utils"
+        ],
         "nixpkgs": [
-          "digga",
+          "tritonshell",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1671489820,
-        "narHash": "sha256-qoei5HDJ8psd1YUPD7DhbHdhLIT9L2nadscp4Qk37uk=",
+        "lastModified": 1705332421,
+        "narHash": "sha256-USpGLPme1IuqG78JNqSaRabilwkCyHmVWY0M9vYyqEA=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "5aa3a8039c68b4bf869327446590f4cdf90bb634",
+        "rev": "83cb93d6d063ad290beee669f4badf9914cc16ec",
         "type": "github"
       },
       "original": {
@@ -89,54 +76,14 @@
         "type": "github"
       }
     },
-    "digga": {
-      "inputs": {
-        "darwin": [
-          "darwin"
-        ],
-        "deploy": [
-          "deploy"
-        ],
-        "devshell": "devshell",
-        "flake-compat": [
-          "flake-compat"
-        ],
-        "flake-utils": "flake-utils_2",
-        "flake-utils-plus": "flake-utils-plus",
-        "home-manager": [
-          "home"
-        ],
-        "nixlib": [
-          "nixos"
-        ],
-        "nixpkgs": [
-          "nixos"
-        ],
-        "nixpkgs-unstable": "nixpkgs-unstable"
-      },
-      "locked": {
-        "lastModified": 1674947971,
-        "narHash": "sha256-6gKqegJHs72jnfFP9g2sihl4fIZgtKgKuqU2rCkIdGY=",
-        "owner": "pub-solar",
-        "repo": "digga",
-        "rev": "2da608bd8afb48afef82c6b1b6d852a36094a497",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pub-solar",
-        "ref": "fix/bootstrap-iso",
-        "repo": "digga",
-        "type": "github"
-      }
-    },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -145,13 +92,31 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1712014858,
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
-        "lastModified": 1642700792,
-        "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
         "type": "github"
       },
       "original": {
@@ -160,35 +125,16 @@
         "type": "github"
       }
     },
-    "flake-utils-plus": {
-      "inputs": {
-        "flake-utils": [
-          "digga",
-          "flake-utils"
-        ]
-      },
-      "locked": {
-        "lastModified": 1654029967,
-        "narHash": "sha256-my3GQ3mQIw/1f6GPV1IhUZrcYQSWh0YJAMPNBjhXJDw=",
-        "owner": "gytis-ivaskevicius",
-        "repo": "flake-utils-plus",
-        "rev": "6271cf3842ff9c8a9af9e3508c547f86bc77d199",
-        "type": "github"
-      },
-      "original": {
-        "owner": "gytis-ivaskevicius",
-        "ref": "refs/pull/120/head",
-        "repo": "flake-utils-plus",
-        "type": "github"
-      }
-    },
     "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_3"
+      },
       "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
         "type": "github"
       },
       "original": {
@@ -197,34 +143,117 @@
         "type": "github"
       }
     },
-    "home": {
+    "home-manager": {
       "inputs": {
         "nixpkgs": [
-          "nixos"
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1687871164,
-        "narHash": "sha256-bBFlPthuYX322xOlpJvkjUBz0C+MOBjZdDOOJJ+G2jU=",
+        "lastModified": 1714203603,
+        "narHash": "sha256-eT7DENhYy7EPLOqHI9zkIMD9RvMCXcqh6gGqOK5BWYQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "07c347bb50994691d7b0095f45ebd8838cf6bc38",
+        "rev": "c1609d584a6b5e9e6a02010f51bd368cb4782f8e",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-23.05",
+        "ref": "master",
         "repo": "home-manager",
         "type": "github"
       }
     },
-    "latest": {
+    "master": {
       "locked": {
-        "lastModified": 1689850295,
-        "narHash": "sha256-fUYf6WdQlhd2H+3aR8jST5dhFH1d0eE22aes8fNIfyk=",
+        "lastModified": 1714330337,
+        "narHash": "sha256-65nCfo2G6Yjb6aBgdeMODuTRaydyCV3TOHPIWJ1GT3Y=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5df4d78d54f7a34e9ea1f84a22b4fd9baebc68d0",
+        "rev": "c5e4e2b2651d0e3bf28c26a44f640436688345bd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "master",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1713946171,
+        "narHash": "sha256-lc75rgRQLdp4Dzogv5cfqOg6qYc5Rp83oedF2t0kDp8=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "230a197063de9287128e2c68a7a4b0cd7d0b50a7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nixos-22-05": {
+      "locked": {
+        "lastModified": 1685573264,
+        "narHash": "sha256-Zffu01pONhs/pqH07cjlF10NnMDLok8ix5Uk4rhOnZQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "380be19fbd2d9079f677978361792cb25e8a3635",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-22.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixos-flake": {
+      "locked": {
+        "lastModified": 1711376798,
+        "narHash": "sha256-37wawZGSX/dD1rn7TwFJhUdpozC2VPEQXetpfpK/D+w=",
+        "owner": "srid",
+        "repo": "nixos-flake",
+        "rev": "7b19503e7f8c7cc0884fc2fbd669c0cc2e05aef5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "repo": "nixos-flake",
+        "type": "github"
+      }
+    },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1714201532,
+        "narHash": "sha256-nk0W4rH7xYdDeS7k1SqqNtBaNrcgIBYNmOVc8P2puEY=",
+        "owner": "nixos",
+        "repo": "nixos-hardware",
+        "rev": "53db5e1070d07e750030bf65f1b9963df8f0c678",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1714253743,
+        "narHash": "sha256-mdTQw2XlariysyScCv2tTE45QSU9v/ezLcHJ22f0Nxc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "58a1abdbae3217ca6b702f03d3b35125d88a2994",
         "type": "github"
       },
       "original": {
@@ -234,44 +263,31 @@
         "type": "github"
       }
     },
-    "nixos": {
+    "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1689680872,
-        "narHash": "sha256-brNix2+ihJSzCiKwLafbyejrHJZUP0Fy6z5+xMOC27M=",
-        "owner": "nixos",
+        "dir": "lib",
+        "lastModified": 1711703276,
+        "narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "08700de174bc6235043cb4263b643b721d936bdb",
+        "rev": "d8fe5e6c92d0d190646fb9f1056741a229980089",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-23.05",
+        "dir": "lib",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixos-hardware": {
+    "nixpkgs_2": {
       "locked": {
-        "lastModified": 1686838567,
-        "narHash": "sha256-aqKCUD126dRlVSKV6vWuDCitfjFrZlkwNuvj5LtjRRU=",
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "rev": "429f232fe1dc398c5afea19a51aad6931ee0fb89",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1672791794,
-        "narHash": "sha256-mqGPpGmwap0Wfsf3o2b6qHJW1w2kk/I6cGCGIU+3t6o=",
+        "lastModified": 1695644571,
+        "narHash": "sha256-asS9dCCdlt1lPq0DLwkVBbVoEKuEuz+Zi3DG7pR/RxA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9813adc7f7c0edd738c6bdd8431439688bb0cb3d",
+        "rev": "6500b4580c2a1f3d0f980d32d285739d8e156d92",
         "type": "github"
       },
       "original": {
@@ -284,23 +300,141 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "darwin": "darwin",
-        "deploy": "deploy",
-        "digga": "digga",
+        "deploy-rs": "deploy-rs",
         "flake-compat": "flake-compat",
-        "home": "home",
-        "latest": "latest",
-        "nixos": "nixos",
-        "nixos-hardware": "nixos-hardware"
+        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
+        "master": "master",
+        "nix-darwin": "nix-darwin",
+        "nixos-22-05": "nixos-22-05",
+        "nixos-flake": "nixos-flake",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs",
+        "triton-vmtools": "triton-vmtools",
+        "tritonshell": "tritonshell",
+        "wayland-pipewire-idle-inhibit": "wayland-pipewire-idle-inhibit"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1704649711,
+        "narHash": "sha256-+qxqJrZwvZGilGiLQj3QbYssPdYCwl7ejwMImgH7VBQ=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "04f25d7bec9fb29d2c3bacaa48a3304840000d36",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "triton-vmtools": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "dir": "vmtools",
+        "lastModified": 1698443513,
+        "narHash": "sha256-wX2JIJ3JmJn6MAurdyjwZU+FZjLCwBArMrVSeeCb/ZU=",
+        "ref": "main",
+        "rev": "0d039dcf06afb8cbddd7ac54bae4d0d185f3e88e",
+        "revCount": 85,
+        "type": "git",
+        "url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
+      },
+      "original": {
+        "dir": "vmtools",
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
+      }
+    },
+    "tritonshell": {
+      "inputs": {
+        "devshell": "devshell",
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1707219270,
+        "narHash": "sha256-I02sXCEVJbVRaRv8IZM+wyn2D6FAjNa8fv/n66s5FJ4=",
+        "ref": "main",
+        "rev": "d75b98bccc34a9b1a27d3d19623af4dbb446b9e7",
+        "revCount": 66,
+        "type": "git",
+        "url": "https://git.pub.solar/teutat3s/tritonshell"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pub.solar/teutat3s/tritonshell"
       }
     },
     "utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
       "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {
@@ -308,6 +442,30 @@
         "repo": "flake-utils",
         "type": "github"
       }
+    },
+    "wayland-pipewire-idle-inhibit": {
+      "inputs": {
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1712274476,
+        "narHash": "sha256-REwWVCN4VQB1XrxSk2nsggIw82OILzsU4Mq5FYXIIOU=",
+        "owner": "rafaelrc7",
+        "repo": "wayland-pipewire-idle-inhibit",
+        "rev": "5b8c23f28c1e4c2fde8477a1783d997d83f38f1d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rafaelrc7",
+        "repo": "wayland-pipewire-idle-inhibit",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,162 +1,102 @@
 {
-  description = "A highly structured configuration database.";
+  description = "teutat3s hosts in nix";
 
   nixConfig.extra-experimental-features = "nix-command flakes";
 
   inputs = {
     # Track channels with commits tested and built by hydra
-    nixos.url = "github:nixos/nixpkgs/nixos-23.05";
-    latest.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixos-22-05.url = "github:nixos/nixpkgs/nixos-22.05";
+    #nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    master.url = "github:nixos/nixpkgs/master";
+
+    #fork.url = "github:teutat3s/nixpkgs/fix-element-desktop-screen-sharing";
 
     flake-compat.url = "github:edolstra/flake-compat";
     flake-compat.flake = false;
 
-    digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
-    digga.inputs.nixpkgs.follows = "nixos";
-    digga.inputs.nixlib.follows = "nixos";
-    digga.inputs.home-manager.follows = "home";
-    digga.inputs.deploy.follows = "deploy";
-    digga.inputs.darwin.follows = "darwin";
-    digga.inputs.flake-compat.follows = "flake-compat";
+    nix-darwin.url = "github:lnl7/nix-darwin/master";
+    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
 
-    home.url = "github:nix-community/home-manager/release-23.05";
-    home.inputs.nixpkgs.follows = "nixos";
+    home-manager.url = "github:nix-community/home-manager/master";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    darwin.url = "github:LnL7/nix-darwin";
-    darwin.inputs.nixpkgs.follows = "nixos";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    nixos-flake.url = "github:srid/nixos-flake";
 
-    deploy.url = "github:serokell/deploy-rs";
-    deploy.inputs.nixpkgs.follows = "nixos";
-    deploy.inputs.flake-compat.follows = "flake-compat";
+    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    deploy-rs.inputs.flake-compat.follows = "flake-compat";
 
     agenix.url = "github:ryantm/agenix";
-    agenix.inputs.nixpkgs.follows = "nixos";
-    agenix.inputs.darwin.follows = "darwin";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
+    agenix.inputs.darwin.follows = "nix-darwin";
+    agenix.inputs.home-manager.follows = "home-manager";
 
     nixos-hardware.url = "github:nixos/nixos-hardware";
+
+    # PubSolarOS additions
+    triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools";
+    triton-vmtools.inputs.nixpkgs.follows = "nixpkgs";
+
+    tritonshell.url = "git+https://git.pub.solar/teutat3s/tritonshell?ref=main";
+    tritonshell.inputs.nixpkgs.follows = "nixpkgs";
+
+    wayland-pipewire-idle-inhibit.url = "github:rafaelrc7/wayland-pipewire-idle-inhibit";
+    wayland-pipewire-idle-inhibit.inputs.nixpkgs.follows = "nixpkgs";
+    wayland-pipewire-idle-inhibit.inputs.flake-parts.follows = "flake-parts";
   };
 
-  outputs = {
-    self,
-    digga,
-    nixos,
-    home,
-    nixos-hardware,
-    agenix,
-    deploy,
-    ...
-  } @ inputs:
-    digga.lib.mkFlake
-    {
-      inherit self inputs;
-
-      channelsConfig = {
-        # allowUnfree = true;
-      };
-
-      supportedSystems = ["x86_64-linux" "aarch64-linux" "aarch64-darwin"];
-
-      channels = {
-        nixos = {
-          imports = [(digga.lib.importOverlays ./overlays)];
-          overlays = [
-            (self: super: {
-              deploy-rs = {
-                inherit (inputs.nixos.legacyPackages.x86_64-linux) deploy-rs;
-                lib = inputs.deploy.lib.x86_64-linux;
-              };
-            })
-          ];
-        };
-        latest = {};
-      };
-
-      lib = import ./lib {lib = digga.lib // nixos.lib;};
-
-      sharedOverlays = [
-        (final: prev: {
-          __dontExport = true;
-          lib = prev.lib.extend (lfinal: lprev: {
-            our = self.lib;
-          });
-        })
-        agenix.overlays.default
-
-        (import ./pkgs)
+  outputs = inputs@{ self, ...}:
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
       ];
 
-      nixos = {
-        hostDefaults = {
-          system = "x86_64-linux";
-          channelName = "nixos";
-          imports = [(digga.lib.importExportableModules ./modules)];
-          modules = [
-            {lib.our = self.lib;}
-            # FIXME: upstream module causes a huge number of unnecessary
-            # dependencies to be pulled in for all systems -- many of them are
-            # graphical. should only be imported as needed.
-            # digga.nixosModules.bootstrapIso
-            digga.nixosModules.nixConfig
-            home.nixosModules.home-manager
-            agenix.nixosModules.age
+      imports = [
+        inputs.nixos-flake.flakeModule
+        ./lib
+        ./modules
+        ./hosts
+        ./users
+        ./overlays
+      ];
+
+      perSystem = args@{ system, pkgs, config, ... }: {
+        _module.args = {
+          inherit inputs;
+          pkgs = import inputs.nixpkgs {
+            inherit system;
+            overlays = [
+              inputs.agenix.overlays.default
+            ];
+          };
+          unstable = import inputs.unstable { inherit system; };
+          master = import inputs.master { inherit system; };
+        };
+
+        devShells.default = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            deploy-rs
+            nixpkgs-fmt
+            agenix
+            cachix
+            editorconfig-checker
+            nodePackages.prettier
+            nvfetcher
+            shellcheck
+            shfmt
+            treefmt
+            nixos-generators
           ];
         };
-
-        imports = [(digga.lib.importHosts ./hosts)];
-        hosts = {
-          # Set host-specific properties here
-          bootstrap = {
-            modules = [
-              digga.nixosModules.bootstrapIso
-            ];
-          };
-          PubSolarOS = {
-            tests = [
-              #(import ./tests/first-test.nix {
-              #  pkgs = nixos.legacyPackages.x86_64-linux;
-              #  lib = nixos.lib;
-              #})
-            ];
-          };
-        };
-        importables = rec {
-          profiles =
-            digga.lib.rakeLeaves ./profiles
-            // {
-              users = digga.lib.rakeLeaves ./users;
-            };
-          suites = with profiles; rec {
-            base = [users.pub-solar users.root];
-            iso = base ++ [base-user graphical pub-solar-iso];
-            pubsolaros = [full-install base-user users.root];
-            anonymous = [pubsolaros users.pub-solar];
-          };
-        };
       };
 
-      home = {
-        imports = [(digga.lib.importExportableModules ./users/modules)];
-        modules = [];
-        importables = rec {
-          profiles = digga.lib.rakeLeaves ./users/profiles;
-          suites = with profiles; rec {
-            base = [direnv git];
-          };
-        };
-        users = {
-          pub-solar = {suites, ...}: {
-            imports = suites.base;
-
-            home.stateVersion = "21.03";
-          };
-        }; # digga.lib.importers.rakeLeaves ./users/hm;
-      };
-
-      devshell = ./shell;
-
-      homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
-
-      deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
+      flake = {
+        deploy.nodes = self.lib.deploy.mkDeployNodes self.nixosConfigurations {
         #example = {
         #  hostname = "example.com:22";
         #  sshUser = "bartender";
@@ -167,6 +107,21 @@
         #    path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.bartender;
         #  };
         #};
+
+        fae = {
+          hostname = "192.168.13.35";
+          sshUser = "pub-solar";
+        };
+        powder = {
+          hostname = "80.71.153.194";
+          sshUser = "root";
+          profilesOrder = ["system" "direnv"];
+          profiles.direnv = {
+            user = "pub-solar";
+            path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.pub-solar;
+          };
+        };
       };
     };
+  };
 }

hosts/default.nix

@@ -0,0 +1,98 @@
+{ withSystem, self, inputs, ...}:
+{
+  flake = {
+    nixosConfigurations = {
+      dumpyourvms = self.nixos-flake.lib.mkLinuxSystem {
+        nixpkgs.hostPlatform = "x86_64-linux";
+        imports = [
+          self.nixosModules.base
+          ./dumpyourvms
+          self.nixosModules.teutat3s
+          self.nixosModules.audio
+          self.nixosModules.bluetooth
+          self.nixosModules.desktop-extended
+          self.nixosModules.docker
+          self.nixosModules.graphical
+          self.nixosModules.nextcloud
+          self.nixosModules.office
+          self.nixosModules.printing
+        ];
+      };
+
+      ryzensun = self.nixos-flake.lib.mkLinuxSystem {
+        nixpkgs.hostPlatform = "x86_64-linux";
+        imports = [
+          self.nixosModules.base
+          ./ryzensun
+          self.nixosModules.teutat3s
+          self.nixosModules.audio
+          self.nixosModules.desktop-extended
+          self.nixosModules.docker
+          self.nixosModules.graphical
+          self.nixosModules.office
+          self.nixosModules.printing
+          self.nixosModules.virtualisation
+        ];
+      };
+
+      fae = self.nixos-flake.lib.mkLinuxSystem {
+        nixpkgs.hostPlatform = "aarch64-linux";
+        imports = [
+          self.nixosModules.base
+          inputs.nixos-hardware.nixosModules.raspberry-pi-4
+          ./fae
+          self.nixosModules.pub-solar
+          self.nixosModules.acme
+        ];
+      };
+
+      #powder = self.nixos-flake.lib.mkLinuxSystem {
+      #  nixpkgs.hostPlatform = "aarch64-linux";
+      #  imports = [
+      #    self.nixosModules.base
+      #    inputs.nixos-hardware.nixosModules.raspberry-pi-4
+      #    ./powder
+      #    self.nixosModules.teutat3s
+      #    self.nixosModules.docker
+      #    self.nixosModules.wireguard-client
+      #    self.nixosModules.invoiceplane
+      #  ];
+      #};
+
+      iso = self.nixos-flake.lib.mkLinuxSystem {
+        nixpkgs.hostPlatform = "x86_64-linux";
+        imports = [
+          "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
+          self.nixosModules.base
+          ./iso
+          self.nixosModules.nixos
+        ];
+      };
+
+      iso-arm = self.nixos-flake.lib.mkLinuxSystem {
+        nixpkgs.hostPlatform = "aarch64-linux";
+        nixpkgs.buildPlatform = "x86_64-linux";
+        imports = [
+          "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
+          self.nixosModules.base
+          ./iso
+          self.nixosModules.nixos
+        ];
+      };
+
+      iso-graphical = self.nixos-flake.lib.mkLinuxSystem {
+        nixpkgs.hostPlatform = "x86_64-linux";
+        imports = [
+          "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
+          self.nixosModules.base
+          ./iso
+          self.nixosModules.nixos
+          self.nixosModules.graphical
+          self.nixosModules.audio
+          self.nixosModules.bluetooth
+          ({ ... }: { pub-solar.graphical.wayland.software-renderer.enable = true; })
+        ];
+      };
+    };
+  };
+}

hosts/dumpyourvms/.config/sway/config.d/applications.conf

@@ -0,0 +1,12 @@
+# seahorse
+for_window [title="seahorse"] floating enabled
+
+# NetworkManager
+for_window [app_id="nm-connection-editor"] floating enabled
+
+# thunderbird
+for_window [title="New Task:*"] floating enabled
+for_window [title="Edit Task:*"] floating enabled
+for_window [title="New Event:*"] floating enabled
+for_window [title="Edit Event:*"] floating enabled
+

hosts/dumpyourvms/.config/sway/config.d/autostart.conf

@@ -0,0 +1,6 @@
+# Autostart applications
+#
+# Example:
+# exec swayidle
+
+exec qMasterPassword

hosts/dumpyourvms/.config/sway/config.d/custom-keybindings.conf

@@ -0,0 +1,3 @@
+# switch keyboard input language
+bindsym $mod+tab exec swaymsg input "1452:628:Apple_Inc._Apple_Internal_Keyboard_/_Trackpad" xkb_switch_layout next
+

hosts/dumpyourvms/.config/sway/config.d/input-defaults.conf

@@ -0,0 +1,37 @@
+### Input configuration
+#
+# You can get the names of your inputs by running: swaymsg -t get_inputs
+# Read `man 5 sway-input` for more information about this section.
+
+input "type:keyboard" {
+  xkb_layout us(intl),de
+  xkb_model pc105
+  xkb_options ctrl:nocaps
+}
+
+input "type:touchpad" {
+  tap enabled
+  natural_scroll enabled
+  # Disable while typing
+  dwt enabled
+}
+
+# Touchpad controls
+#bindsym XF86TouchpadToggle exec $HOME/Workspace/ben/toggletouchpad.sh # toggle touchpad
+
+# Screen brightness controls
+bindsym XF86MonBrightnessUp exec "brightnessctl -d acpi_video0 set +10%"
+bindsym XF86MonBrightnessDown exec "brightnessctl -d acpi_video0 set 10%-"
+
+# Keyboard backlight brightness controls
+bindsym XF86KbdBrightnessDown exec "brightnessctl -d smc::kbd_backlight set 10%-"
+bindsym XF86KbdBrightnessUp exec "brightnessctl -d smc::kbd_backlight set +10%"
+
+# Pulse Audio controls
+bindsym XF86AudioRaiseVolume exec pactl set-sink-volume @DEFAULT_SINK@ +5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #increase sound volume
+bindsym XF86AudioLowerVolume exec pactl set-sink-volume @DEFAULT_SINK@ -5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #decrease sound volume
+bindsym XF86AudioMute exec pactl set-sink-mute @DEFAULT_SINK@ toggle # mute sound
+# Media player controls
+bindsym XF86AudioPlay exec "playerctl play-pause; notify-send 'Play/Pause'"
+bindsym XF86AudioNext exec "playerctl next; notify-send 'Next'"
+bindsym XF86AudioPrev exec "playerctl previous; notify-send 'Prev.'"

hosts/dumpyourvms/.config/sway/config.d/screens.conf

@@ -0,0 +1,41 @@
+### Output configuration
+#
+# Example configuration:
+#
+#   output HDMI-A-1 resolution 1920x1080 position 1920,0
+#
+# You can get the names of your outputs by running: swaymsg -t get_outputs
+
+set $main_screen eDP-1
+set $displayport DP-1
+set $hmdi HDMI-A-1
+
+output $main_screen scale 2
+output $displayport scale 2
+output $hdmi scale 1
+
+output $main_screen pos 0 0
+output $displayport pos 0 -1080
+output $hdmi pos 1440 0
+
+#bindswitch lid:on output $main_screen disable
+#bindswitch lid:off output $main_screen enable
+bindsym $mod+Shift+x output $main_screen toggle
+
+# TODO when using more monitors
+## Manual management of external displays
+# Set the shortcuts and what they do
+#set $mode_display HDMI (i) top, (j) left, (k) bottom, (l) right, (o) off
+#mode "$mode_display" {
+#    bindsym i output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 1080, mode "default"
+#    bindsym j output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 1920 0, mode "default"
+#    bindsym k output HDMI-A-1 enable; output HDMI-A-1 pos 0 900 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym l output HDMI-A-1 enable; output HDMI-A-1 pos 1440 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym o output HDMI-A-1 disable, mode "default"
+#
+#    # back to normal: Enter or Escape
+#    bindsym Return mode "default"
+#    bindsym Escape mode "default"
+#}
+## Declare here the shortcut to bring the display selection menu
+#bindsym $mod+x mode "$mode_display"

hosts/dumpyourvms/consul-agent-ca.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDbzCCAxSgAwIBAgIRAMK20/fFF0YVThq8xm/YvBswCgYIKoZIzj0EAwIwgbkx
+CzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNj
+bzEaMBgGA1UECRMRMTAxIFNlY29uZCBTdHJlZXQxDjAMBgNVBBETBTk0MTA1MRcw
+FQYDVQQKEw5IYXNoaUNvcnAgSW5jLjFAMD4GA1UEAxM3Q29uc3VsIEFnZW50IENB
+IDI1ODgxOTUyODQyOTMwNjIxMjY4NDgwMTUxODE3OTM2NjUxNzc4NzAeFw0xOTEx
+MDYwMDI3MzVaFw0yNDExMDQwMDI3MzVaMIG5MQswCQYDVQQGEwJVUzELMAkGA1UE
+CBMCQ0ExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xGjAYBgNVBAkTETEwMSBTZWNv
+bmQgU3RyZWV0MQ4wDAYDVQQREwU5NDEwNTEXMBUGA1UEChMOSGFzaGlDb3JwIElu
+Yy4xQDA+BgNVBAMTN0NvbnN1bCBBZ2VudCBDQSAyNTg4MTk1Mjg0MjkzMDYyMTI2
+ODQ4MDE1MTgxNzkzNjY1MTc3ODcwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQE
+SZ2kc9rKUNX3czze+rFR/bZdLx3JEYrpcSXKkpv1wr68E1Jqhi/8Dm8b62Ei/Bc6
+ZhoJvtB2Shtl+6LbjccUo4H6MIH3MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8E
+BTADAQH/MGgGA1UdDgRhBF9hZjo4MzoyZTpiOToyZTozMzo5MDplOTpkMjpiNzpj
+NjpjYzpkYToxODoyYTphNzpjMzo5ZTozMTpmNTpkZTo4Mzo4YzozMDo0Mjo3OTo4
+ZDo0ZDpmZDozMjo2NzpiYjBqBgNVHSMEYzBhgF9hZjo4MzoyZTpiOToyZTozMzo5
+MDplOTpkMjpiNzpjNjpjYzpkYToxODoyYTphNzpjMzo5ZTozMTpmNTpkZTo4Mzo4
+YzozMDo0Mjo3OTo4ZDo0ZDpmZDozMjo2NzpiYjAKBggqhkjOPQQDAgNJADBGAiEA
+zKCV25P6HqFEa1iUVQnsNAp/WHUwxNlR0OctZSdiuIkCIQDiRK03ZYSK/hmY9kXV
+42nj6kO8MexfiYN4IE4URmzYnA==
+-----END CERTIFICATE-----

hosts/dumpyourvms/default.nix

@@ -0,0 +1,8 @@
+{ ... }: {
+  imports = [
+    ./dumpyourvms.nix
+    ./hardware-configuration.nix
+
+    ./networking.nix
+  ];
+}

hosts/dumpyourvms/dumpyourvms.nix

@@ -0,0 +1,187 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in {
+  pub-solar = {
+    terminal-life.full = true;
+    core.hibernation = {
+      enable = true;
+      resumeDevice = "/dev/mapper/cryptroot";
+      resumeOffset = 47366144;
+    };
+  };
+
+  # Fix backlight for keyboard and brightness, adjust function key binding,
+  # intel_pstate for cpu schedutil
+  # For now, the radeon driver seems to work better than amdgpu with Radeon R9 M370X
+  # Explicitly set amdgpu support in place of radeon
+  # Source: https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/southern-islands/default.nix
+  # Try again after https://lists.freedesktop.org/archives/amd-gfx/2023-March/090096.html lands
+  boot.kernelParams = ["acpi_backlight=video" "hid_apple.fnmode=2" "intel_pstate=passive" "radeon.si_support=0" "amdgpu.si_support=1"];
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Fix for Error switching console mode to 1: unsupported on startup
+  boot.loader.systemd-boot.consoleMode = mkForce "0";
+
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
+
+  systemd.sleep.extraConfig = ''
+    HibernateMode=shutdown
+  '';
+
+  hardware = {
+    cpu.intel.updateMicrocode = true;
+    facetimehd.enable = true;
+    opengl = {
+      extraPackages = with pkgs; [intel-media-driver];
+    };
+  };
+
+  services.fstrim.enable = true;
+
+  networking.hostName = "dumpyourvms";
+
+  services.resolved = {
+    enable = true;
+    extraConfig = ''
+      DNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 5.9.164.112#dns3.digitalcourage.de 89.233.43.71#unicast.censurfridns.dk 185.49.141.37#getdnsapi.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net 2a01:4f8:251:554::2#dns3.digitalcourage.de 2a01:3a0:53:53::0#unicast.censurfridns.dk 2a04:b900:0:100::38#getdnsapi.net
+      FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
+      Domains=~.
+      DNSOverTLS=yes
+    '';
+  };
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+  };
+  services.usbmuxd.enable = true;
+  programs.droidcam.enable = true;
+
+  security.pki.certificateFiles = [./consul-agent-ca.pem];
+
+  # Power off dedicated GPU, use only integrated Intel GPU to save battery
+  # https://github.com/NixOS/nixpkgs/pull/33915
+  # https://ubuntuforums.org/showthread.php?t=2409856
+  systemd.services."amd-hybrid-graphics-power-save" = {
+    path = [pkgs.bash];
+    description = "Power Off dedicated AMD Card to reduce power usage";
+    requires = ["sys-kernel-debug.mount"];
+    enable = true;
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.bash}/bin/sh -c 'sleep 7 && if grep --quiet 'IGD:+' /sys/kernel/debug/vgaswitcheroo/switch; then echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch; fi'";
+      ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch'";
+    };
+    wantedBy = ["multi-user.target"];
+  };
+
+  # Increase console font size for HiDPI display
+  console = {
+    earlySetup = true;
+    font = lib.mkForce "ter-i32b";
+    packages = [pkgs.terminus_font];
+  };
+
+  # Thunderbolt tools
+  services.hardware.bolt.enable = true;
+
+  # Enable udev rules for gnupg smart cards
+  hardware.gpgSmartcards.enable = true;
+
+  powerManagement = {
+    # Use new schedutil govenor
+    # https://github.com/NixOS/nixpkgs/pull/42330
+    # https://www.kernel.org/doc/html/v5.10/admin-guide/pm/cpufreq.html#schedutil
+    cpuFreqGovernor = lib.mkDefault "schedutil";
+
+    # brcmfmac being loaded during hibernation would inhibit a successful resume
+    # https://bugzilla.kernel.org/show_bug.cgi?id=101681#c116.
+    # Also brcmfmac could randomly crash on resume from sleep.
+    # To hibernate successfully using the amdgpu driver, the dedicated GPU needs
+    # to be powered on.
+    powerUpCommands = lib.mkBefore (
+      "${pkgs.kmod}/bin/modprobe brcmfmac"
+      + lib.optionalString
+      (lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2") " brcmfmac_wcc"
+    );
+    powerDownCommands = lib.mkBefore (
+      lib.optionalString
+      (lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2")
+      "${pkgs.kmod}/bin/rmmod brcmfmac_wcc\n"
+      + ''
+        ${pkgs.kmod}/bin/rmmod brcmfmac
+        ${pkgs.systemd}/bin/systemctl stop amd-hybrid-graphics-power-save.service
+      ''
+    );
+    resumeCommands =
+      if config.systemd.services."amd-hybrid-graphics-power-save".enable == true
+      then ''
+        ${pkgs.systemd}/bin/systemctl start amd-hybrid-graphics-power-save.service
+      ''
+      else "";
+  };
+
+  # Change lid switch behaviour
+  services.logind.lidSwitch = "hibernate";
+
+  # TLP for power management
+  services.tlp = {
+    enable = true;
+    settings = {
+      CPU_SCALING_GOVERNOR_ON_AC = "performance";
+      CPU_SCALING_GOVERNOR_ON_BAT = "schedutil";
+      CPU_BOOST_ON_AC = 1;
+      CPU_BOOST_ON_BAT = 0;
+    };
+  };
+
+  services.udev.extraRules =
+    # Disable XHC1 wakeup signal to avoid resume getting triggered some time
+    # after suspend. Reboot required for this to take effect.
+    lib.optionalString
+    (lib.versionAtLeast config.boot.kernelPackages.kernel.version "3.13")
+    ''SUBSYSTEM=="pci", KERNEL=="0000:00:14.0", ATTR{power/wakeup}="disabled"'';
+
+  home-manager = pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+    # Custom device sway configs
+    xdg.configFile = {
+      "sway/config.d/10-applications.conf".source = ./.config/sway/config.d/applications.conf;
+      "sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
+      "sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
+      "sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
+      "sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
+    };
+  };
+
+  # WLAN frequency compliance (e.g. check for radar with DFS)
+  hardware.firmware = with pkgs; [wireless-regdb];
+  boot.extraModprobeConfig = ''
+    options cfg80211 ieee80211_regdom="DE"
+
+    # Enable the integrated GPU (iGPU) Intel i915 by default if present
+    options apple-gmux force_igd=y
+
+    # Enable HD-Audio Codec-Specific Models
+    # https://www.kernel.org/doc/html/latest/sound/hd-audio/models.html
+    options snd-hda-intel model=mbp11
+
+    # https://bbs.archlinux.org/viewtopic.php?pid=1445636#p1445636
+    #
+    options snd-hda-intel index=1
+  '';
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
+}

hosts/dumpyourvms/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    #(modulesPath + "/hardware/network/broadcom-43xx.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-intel"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/17bbb016-d27c-47da-8805-58c6395891e8";
+    fsType = "ext4";
+  };
+
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/c100b9a7-99d7-44d9-b7c2-3892a5f233c4";
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/06B8-5414";
+    fsType = "vfat";
+  };
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 18432;
+    }
+  ];
+}

hosts/dumpyourvms/networking.nix

@@ -0,0 +1,181 @@
+{
+  pkgs,
+  ...
+}:
+{
+  networking = {
+    networkmanager.dns = "systemd-resolved";
+
+    #networkmanager.dispatcherScripts = [
+    #  { source = "${pkgs.prison-break}/bin/prison-break"; }
+    #];
+
+    hosts = {
+      "10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"];
+      "10.0.0.66" = ["consul.service.cgn-1.consul"];
+      "10.0.1.9" = ["consul.service.lev-1.consul"];
+      "10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"];
+      "10.0.0.200" = ["headnode.cgn-1"];
+      "10.0.0.201" = ["cn01.cgn-1"];
+      "10.0.0.202" = ["cn02.cgn-1"];
+      "10.0.0.205" = ["cn05.cgn-1"];
+      "10.0.0.206" = ["cn06.cgn-1"];
+      "10.0.0.207" = ["cn07.cgn-1"];
+      "10.0.0.208" = ["cn08.cgn-1"];
+      "10.0.1.200" = ["headnode.lev-1"];
+      "10.0.1.201" = ["cn01.lev-1"];
+      "10.0.1.202" = ["cn02.lev-1"];
+      "10.0.1.203" = ["cn03.lev-1"];
+      "10.0.1.204" = ["cn04.lev-1"];
+      "10.0.1.205" = ["cn05.lev-1"];
+      "10.0.1.206" = ["cn00.lev-1"];
+      "10.0.1.207" = ["cn06.lev-1"];
+      "10.0.1.208" = ["cn07.lev-1"];
+      "10.101.64.10" = ["wifi.bahn.de"];
+      "80.71.153.29" = ["eu-central.manta.greenbaum.cloud"];
+      "85.88.23.37" = ["git.greenbaum.cloud"];
+      "10.0.1.17" = ["drone.greenbaum.cloud"];
+      "10.0.1.2" = ["lev-1.adminui.greenbaum.cloud"];
+      "80.71.153.10" = ["lev-1.api.greenbaum.cloud"];
+      "80.71.153.12" = ["lev-1.docker.greenbaum.cloud"];
+      "80.71.153.56" = ["lev-1.monitor.greenbaum.cloud"];
+      "192.168.13.35" = ["paperless.local"];
+    };
+
+    wireguard.enable = true;
+    wg-quick.interfaces = {
+      wg0 = {
+        address = ["10.8.8.6/32"];
+        privateKeyFile = "/etc/wireguard/wg0.privatekey";
+
+        peers = [
+          {
+            publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
+            allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
+            endpoint = "85.88.23.16:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+      wg1 = {
+        address = ["192.168.188.203/24"];
+        privateKeyFile = "/etc/wireguard/wg1.privatekey";
+
+        peers = [
+          {
+            publicKey = "iZkgeA/mFxBRclCa5SJYdqffClly/uho5krebcUloCY=";
+            allowedIPs = ["192.168.188.0/24"];
+            presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
+            #endpoint = "85.214.70.91:50163";
+            #endpoint = "7gwzft61sc8txc4r.myfritz.net:50163";
+            endpoint = "[2a00:6020:1000:47::2ded]:50163";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+      wg2 = {
+        address = ["10.6.6.4/32"];
+        privateKeyFile = "/etc/wireguard/wg2.privatekey";
+
+        peers = [
+          {
+            publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
+            presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
+            allowedIPs = ["10.6.6.1/32" "10.1.1.0/24"];
+            endpoint = "85.88.23.127:51820";
+            persistentKeepalive = 16;
+          }
+        ];
+      };
+      wg3 = {
+        address = ["10.11.11.2/32"];
+        privateKeyFile = "/etc/wireguard/wg3.privatekey";
+        mtu = 1300;
+
+        peers = [
+          {
+            publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
+            presharedKeyFile = "/etc/wireguard/wg3.presharedkey";
+            allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"];
+            endpoint = "80.71.153.1:51820";
+            persistentKeepalive = 16;
+          }
+        ];
+      };
+      wg4 = {
+        address = ["fdaa:1:3234:a7b:16a9:0:a:202/120"];
+        privateKeyFile = "/etc/wireguard/wg4.privatekey";
+        postUp = "resolvectl dns wg4 fdaa:1:3234::3; resolvectl domain wg4 ~internal";
+        preDown = "resolvectl revert wg4";
+        #dns = [
+        #  "fdaa:1:3234::3, internal"
+        #];
+
+        peers = [
+          {
+            publicKey = "yUyg63j5+17YeJ7gRhxoQuF6rvdX0JF59M6skytJFTQ=";
+            allowedIPs = ["fdaa:1:3234::/48"];
+            #endpoint = "ams1.gateway.6pn.dev:51820";
+            endpoint = "176.58.93.206:51820";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+      wg5 = {
+        autostart = false;
+        address = ["192.168.13.201/24"];
+        privateKeyFile = "/etc/wireguard/wg5.privatekey";
+        postUp = "resolvectl dnsovertls wg5 no; resolvectl dns wg5 192.168.13.1; resolvectl domain wg5 ~fritz.box";
+        preDown = "resolvectl revert wg5";
+
+        peers = [
+          {
+            publicKey = "UhPW8jebAPaMYqjJfSFO9QAMhk0E+dq4i6lB4Wjg91Q=";
+            presharedKeyFile = "/etc/wireguard/wg5.presharedkey";
+            allowedIPs = [ "192.168.13.0/24" ];
+            endpoint = "ktjh20jr89gkcqwr.myfritz.net:59538";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+      wg6 = {
+        address = ["10.7.6.201/32"];
+        privateKeyFile = "/etc/wireguard/wg6.privatekey";
+
+        peers = [
+          { # nachtigall.pub.solar
+            publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
+            allowedIPs = [ "10.7.6.1/32" "fd00:fae:fae:fae:fae:1::/96" ];
+            endpoint = "[2a01:4f8:172:1c25::1]:51820";
+            persistentKeepalive = 15;
+          }
+          { # flora-6.pub.solar
+            publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+            allowedIPs = [ "10.7.6.2/32" "fd00:fae:fae:fae:fae:2::/96" ];
+            endpoint = "80.71.153.210:51820";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+      # mozillavpn
+      moz0 = {
+        autostart = false;
+        address = ["10.142.131.196/32" "fc00:bbbb:bbbb:bb01:d:0:e:83c4/128"];
+        privateKeyFile = "/etc/wireguard/moz0.privatekey";
+        #postUp = "resolvectl dns wg4 fdaa:1:3234::3; resolvectl domain wg4 ~internal";
+        #preDown = "resolvectl revert wg4";
+        #dns = [
+        #  "fdaa:1:3234::3, internal"
+        #];
+
+        peers = [
+          {
+            publicKey = "ku1NYeOAGbY65YL/JKZhrqVzDJKXQiVj9USXbfkOBA0=";
+            allowedIPs = ["0.0.0.0/0" "::/0"];
+            endpoint = "185.254.75.3:36294";
+          }
+        ];
+      };
+    };
+  };
+}

hosts/dumpyourvms/unbound.nix

@@ -0,0 +1,52 @@
+{
+  enable = false;
+  localControlSocketPath = "/run/unbound/unbound.ctl";
+  settings = {
+    server = {
+      cache-max-ttl = 14400;
+      cache-min-ttl = 1200;
+      aggressive-nsec = true;
+      prefetch = false;
+      rrset-roundrobin = true;
+      use-caps-for-id = true;
+      do-ip6 = false;
+      hide-identity = true;
+      hide-version = true;
+      do-not-query-localhost = false;
+      tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt";
+    };
+
+    # fritz.box stub zone
+    stub-zone = {
+      name = "fritz.box";
+      stub-addr = "192.168.13.1";
+    };
+
+    # DNS over DLS forwarding
+    forward-zone = {
+      name = ".";
+      forward-tls-upstream = true;
+
+      forward-addr = [
+        "5.1.66.255@853#dot.ffmuc.net"
+        "185.150.99.255@853#dot.ffmuc.net"
+        "89.233.43.71@853#unicast.censurfridns.dk"
+        "94.130.110.185@853#ns1.dnsprivacy.at"
+
+        "2001:678:e68:f000::@853#dot.ffmuc.net"
+        "2001:678:ed0:f000::@853#dot.ffmuc.net"
+        "2a01:3a0:53:53::0@853#unicast.censurfridns.dk"
+        "2a01:4f8:c0c:3c03::2@853#ns1.dnsprivacy.at"
+        "2a01:4f8:c0c:3bfc::2@853#ns2.dnsprivacy.at"
+
+        "2001:610:1:40ba:145:100:185:15@853#dnsovertls.sinodun.com"
+        "2001:610:1:40ba:145:100:185:16@853#dnsovertls1.sinodun.com"
+        "2a04:b900:0:100::38@853#getdnsapi.net"
+
+        "145.100.185.15@853#dnsovertls.sinodun.com"
+        "145.100.185.16@853#dnsovertls1.sinodun.com"
+        "185.49.141.37@853#getdnsapi.net"
+      ];
+    };
+  };
+}

hosts/fae/default.nix

@@ -0,0 +1,6 @@
+{...}: {
+  imports = [
+    ./paperless.nix
+    ./fae.nix
+  ];
+}

hosts/fae/fae.nix

@@ -0,0 +1,69 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  config = {
+    pub-solar.core.disk-encryption-active = false;
+
+    fileSystems = {
+      "/" = {
+        device = "/dev/disk/by-label/NIXOS_SD";
+        fsType = "ext4";
+        options = ["noatime"];
+      };
+    };
+
+    networking.hostName = "paperless";
+
+    services.openssh = {
+      enable = true;
+      openFirewall = true;
+      allowSFTP = true;
+    };
+
+    boot.kernelParams = [
+	    "boot.shell_on_fail=1"
+    ];
+
+    # Would decrease closure size, but currenly broken (cairo)
+    #environment.noXlibs = true;
+
+    nix = {
+      gc.automatic = true;
+
+      optimise.automatic = true;
+
+      settings = {
+        auto-optimise-store = true;
+        sandbox = true;
+        allowed-users = ["@wheel"];
+        trusted-users = ["root" "@wheel"];
+      };
+
+      extraOptions = ''
+        min-free = 536870912
+        keep-outputs = true
+        keep-derivations = true
+        fallback = true
+      '';
+    };
+
+    # custom raspi boot loader is already present
+    boot.loader.systemd-boot.enable = false;
+    boot.loader.grub.enable = false;
+    boot.loader.generic-extlinux-compatible.enable = true;
+    boot.kernelPackages = pkgs.linuxPackages_6_6;
+
+    nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "23.11"; # Did you read the comment?
+  };
+}

hosts/fae/paperless.nix

@@ -0,0 +1,111 @@
+{
+  flake,
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+
+  dataDir = "${xdg.dataHome}/Paperless";
+  backupDir = "${xdg.dataHome}/PaperlessBackup";
+  consumptionDir = "/home/${psCfg.user.name}/.local/share/scandir";
+
+in {
+  services.paperless = {
+    enable = true;
+    user = psCfg.user.name;
+    consumptionDir = consumptionDir;
+    dataDir = dataDir;
+    address = "127.0.0.1";
+    extraConfig = {
+      PAPERLESS_ADMIN_USER = psCfg.user.name;
+      PAPERLESS_AUTO_LOGIN_USERNAME = psCfg.user.name;
+      PAPERLESS_URL = "https://paperless.faenix.eu";
+    };
+  };
+
+  hardware.sane = {
+    enable = true;
+    # No aarch64 support for now
+    #brscan5.enable = true;
+  };
+
+  home-manager.users."${psCfg.user.name}" = {
+    home.sessionVariables = {
+      SCANNER_OUTPUT_DIR = consumptionDir;
+    };
+    systemd.user.sessionVariables = {
+      SCANNER_OUTPUT_DIR = consumptionDir;
+    };
+  };
+
+  security.acme.certs = {
+    "paperless.faenix.eu" = {};
+  };
+
+  services.nginx = {
+    enable = true;
+
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+    clientMaxBodySize = "256m";
+
+    virtualHosts = {
+      "paperless.faenix.eu" = {
+        forceSSL = true;
+        useACMEHost = "paperless.faenix.eu";
+        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.paperless.port}";
+      };
+    };
+  };
+
+  #services.caddy = {
+  #  enable = true;
+  #  globalConfig = ''
+  #    local_certs
+  #  '';
+  #  virtualHosts = {
+  #    "paperless.fritz.box" = {
+  #      extraConfig = ''
+  #        reverse_proxy :${builtins.toString config.services.paperless.port}
+  #      '';
+  #    };
+  #  };
+  #};
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.tmpfiles.rules = [
+    "d /home/${psCfg.user.name}/.local 0700 ${psCfg.user.name} users - -"
+    "d /home/${psCfg.user.name}/.local/share 0700 ${psCfg.user.name} users - -"
+    "d '${backupDir}' 0700 ${psCfg.user.name} users - -"
+  ];
+
+  #age.secrets."rclone-pie.conf" = {
+  #  file = "${flake.self}/secrets/rclone-pie.conf.age";
+  #  path = "/root/.config/rclone/rclone.conf";
+  #  mode = "400";
+  #};
+
+  #age.secrets."restic-password" = {
+  #  file = "${flake.self}/secrets/restic-password.age";
+  #  mode = "400";
+  #};
+
+  #services.restic.backups = {
+  #  paperless = {
+  #    paths = [ backupDir ];
+  #    initialize = true;
+  #    passwordFile = config.age.secrets."restic-password".path;
+  #    # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
+  #    repository = "rclone:cloud.pub.solar:/backups/Paperless";
+  #    backupPrepareCommand = "${dataDir}/paperless-manage document_exporter ${backupDir} -c -p";
+  #    rcloneConfigFile = config.age.secrets."rclone-pie.conf".path;
+  #  };
+  #};
+}

hosts/iso/default.nix

@@ -0,0 +1,10 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  pub-solar.core.disk-encryption-active = false;
+  isoImage.squashfsCompression = "gzip -Xcompression-level 1";
+  systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
+  networking.networkmanager.enable = false;
+}

hosts/powder/default.nix

@@ -0,0 +1,5 @@
+{...}: {
+  imports = [
+    ./powder.nix
+  ];
+}

hosts/powder/hardware-configuration.nix

@@ -0,0 +1,43 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [];
+
+  boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    autoResize = true;
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "vfat";
+  };
+
+  fileSystems."/data" = {
+    device = "/dev/disk/by-label/ephemeral0";
+    fsType = "ext4";
+    options = [
+      "defaults"
+      "nofail"
+    ];
+  };
+
+  swapDevices = [];
+
+  networking.useDHCP = lib.mkDefault false;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/powder/powder.nix

@@ -0,0 +1,88 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  profiles,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+
+    profiles.users.root # make sure to configure ssh keys
+    profiles.users.pub-solar
+    profiles.base-user
+  ];
+
+  config = {
+    pub-solar.core.iso-options.enable = true;
+
+    # Use the systemd-boot EFI boot loader.
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    # Force getting the hostname from cloud-init
+    networking.hostName = lib.mkDefault "";
+
+    # Set your time zone.
+    # time.timeZone = "Europe/Amsterdam";
+
+    # Select internationalisation properties.
+    console = {
+      font = "Lat2-Terminus16";
+      keyMap = "us";
+    };
+
+    # List packages installed in system profile. To search, run:
+    # $ nix search wget
+    environment.systemPackages = with pkgs; [
+      git
+      vim
+      wget
+      caddy
+      # triton tools for retrieving metadata inside zones, e.g. mdata-get
+      inputs.triton-vmtools
+    ];
+
+    # Some programs need SUID wrappers, can be configured further or are
+    # started in user sessions.
+    # programs.mtr.enable = true;
+    # programs.gnupg.agent = {
+    #   enable = true;
+    #   enableSSHSupport = true;
+    # };
+
+    # List services that you want to enable:
+    services.cloud-init.enable = true;
+    services.cloud-init.ext4.enable = true;
+    services.cloud-init.network.enable = true;
+    # use the default NixOS cloud-init config, but add some SmartOS customization to it
+    environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
+      datasource_list: [ SmartOS ]
+
+      # Do not create the centos/ubuntu/debian user
+      users: [ ]
+
+      # mount second disk with label ephemeral0, gets formated by cloud-init
+      # this will fail to get added to /etc/fstab as it's read-only, but should
+      # mount at boot anyway
+      mounts:
+      - [ vdb, /data, auto, "defaults,nofail" ]
+    '';
+
+    # Enable the OpenSSH daemon.
+    services.openssh.enable = true;
+
+    # Triton manages firewall rules via the triton fwrule subcommand
+    networking.firewall.enable = false;
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "22.05"; # Did you read the comment?
+  };
+}

hosts/ryzensun/.config/sway/config.d/autostart.conf

@@ -0,0 +1,6 @@
+# Autostart applications
+#
+# Example:
+# exec swayidle
+
+exec qMasterPassword

hosts/ryzensun/.config/sway/config.d/custom-keybindings.conf

@@ -0,0 +1,2 @@
+# switch keyboard input language
+bindsym $mod+tab exec swaymsg input "1118:1896:Microsoft_Microsoft___SiderWinderTM_X4_Keyboard_Consumer_Control" xkb_switch_layout next

hosts/ryzensun/.config/sway/config.d/input-defaults.conf

@@ -0,0 +1,33 @@
+### Input configuration
+#
+# You can get the names of your inputs by running: swaymsg -t get_inputs
+# Read `man 5 sway-input` for more information about this section.
+
+input "type:keyboard" {
+  xkb_layout us(intl),de
+  xkb_options ctrl:nocaps
+}
+
+input "type:touchpad" {
+  natural_scroll enabled
+}
+
+# Touchpad controls
+#bindsym XF86TouchpadToggle exec $HOME/Workspace/ben/toggletouchpad.sh # toggle touchpad
+
+# Screen brightness controls
+bindsym XF86MonBrightnessUp exec "brightnessctl -d intel_backlight set +10%"
+bindsym XF86MonBrightnessDown exec "brightnessctl -d intel_backlight set 10%-"
+
+# Keyboard backlight brightness controls
+bindsym XF86KbdBrightnessDown exec "brightnessctl -d smc::kbd_backlight set 10%-"
+bindsym XF86KbdBrightnessUp exec "brightnessctl -d smc::kbd_backlight set +10%"
+
+# Pulse Audio controls
+bindsym XF86AudioRaiseVolume exec pactl set-sink-volume @DEFAULT_SINK@ +5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #increase sound volume
+bindsym XF86AudioLowerVolume exec pactl set-sink-volume @DEFAULT_SINK@ -5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #decrease sound volume
+bindsym XF86AudioMute exec pactl set-sink-mute @DEFAULT_SINK@ toggle # mute sound
+# Media player controls
+bindsym XF86AudioPlay exec "playerctl play-pause; notify-send 'Play/Pause'"
+bindsym XF86AudioNext exec "playerctl next; notify-send 'Next'"
+bindsym XF86AudioPrev exec "playerctl previous; notify-send 'Prev.'"

hosts/ryzensun/.config/sway/config.d/screens.conf

@@ -0,0 +1,33 @@
+### Output configuration
+#
+# Example configuration:
+#
+#   output HDMI-A-1 resolution 1920x1080 position 1920,0
+#
+# You can get the names of your outputs by running: swaymsg -t get_outputs
+
+set $main_screen HDMI-A-1
+
+output $main_screen scale 2
+
+#bindswitch lid:on output $main_screen disable
+#bindswitch lid:off output $main_screen enable
+bindsym $mod+Shift+x output $main_screen toggle
+
+# TODO when using more monitors
+## Manual management of external displays
+# Set the shortcuts and what they do
+#set $mode_display HDMI (i) top, (j) left, (k) bottom, (l) right, (o) off
+#mode "$mode_display" {
+#    bindsym i output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 1080, mode "default"
+#    bindsym j output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 1920 0, mode "default"
+#    bindsym k output HDMI-A-1 enable; output HDMI-A-1 pos 0 900 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym l output HDMI-A-1 enable; output HDMI-A-1 pos 1440 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym o output HDMI-A-1 disable, mode "default"
+#
+#    # back to normal: Enter or Escape
+#    bindsym Return mode "default"
+#    bindsym Escape mode "default"
+#}
+## Declare here the shortcut to bring the display selection menu
+#bindsym $mod+x mode "$mode_display"

hosts/ryzensun/default.nix

@@ -0,0 +1,8 @@
+{ ... }: {
+  imports = [
+    ./ryzensun.nix
+    ./hardware-configuration.nix
+
+    ./networking.nix
+  ];
+}

hosts/ryzensun/hardware-configuration.nix

@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "sd_mod" "sr_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-amd"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/bad2e49e-c8e7-4516-a6f8-77db999d12b0";
+    fsType = "ext4";
+  };
+
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/ef6c5bb0-0bcf-4af4-bbc9-02c849999e54";
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/2C62-C8B5";
+    fsType = "vfat";
+  };
+
+  swapDevices = [];
+}

hosts/ryzensun/networking.nix

@@ -0,0 +1,105 @@
+{
+  networking = {
+    hosts = {
+      "10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"];
+      "10.0.0.66" = ["consul.service.cgn-1.consul"];
+      "10.0.1.9" = ["consul.service.lev-1.consul"];
+      "10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"];
+      "10.0.0.200" = ["headnode.cgn-1"];
+      "10.0.0.201" = ["cn01.cgn-1"];
+      "10.0.0.202" = ["cn02.cgn-1"];
+      "10.0.0.205" = ["cn05.cgn-1"];
+      "10.0.0.206" = ["cn06.cgn-1"];
+      "10.0.0.207" = ["cn07.cgn-1"];
+      "10.0.0.208" = ["cn08.cgn-1"];
+      "10.0.1.200" = ["headnode.lev-1"];
+      "10.0.1.201" = ["cn01.lev-1"];
+      "10.0.1.202" = ["cn02.lev-1"];
+      "10.0.1.203" = ["cn03.lev-1"];
+      "10.0.1.204" = ["cn04.lev-1"];
+      "10.0.1.205" = ["cn05.lev-1"];
+      "10.0.1.206" = ["cn00.lev-1"];
+      "10.0.1.207" = ["cn06.lev-1"];
+      "10.0.1.208" = ["cn07.lev-1"];
+    };
+
+    wireguard.enable = true;
+    wg-quick.interfaces = {
+      wg0 = {
+        address = ["10.8.8.7/32"];
+        privateKeyFile = "/etc/wireguard/wg0.privatekey";
+
+        peers = [
+          {
+            publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
+            allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
+            endpoint = "85.88.23.16:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+      wg1 = {
+        address = ["10.11.11.6/32"];
+        privateKeyFile = "/etc/wireguard/wg1.privatekey";
+        mtu = 1300;
+
+        peers = [
+          {
+            publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
+            presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
+            allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"];
+            endpoint = "80.71.153.1:51820";
+            #persistentKeepalive = 16;
+          }
+        ];
+      };
+      wg2 = {
+        address = ["10.7.6.204/32"];
+        privateKeyFile = "/etc/wireguard/wg2.privatekey";
+
+        peers = [
+          { # nachtigall.pub.solar
+            publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
+            allowedIPs = [ "10.7.6.1/32" "fd00:fae:fae:fae:fae:1::/96" ];
+            endpoint = "[2a01:4f8:172:1c25::1]:51820";
+            persistentKeepalive = 15;
+          }
+          { # flora-6.pub.solar
+            publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+            allowedIPs = [ "10.7.6.2/32" "fd00:fae:fae:fae:fae:2::/96" ];
+            endpoint = "80.71.153.210:51820";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+      #wg1 = {
+      #  address = [ "10.13.0.1/32" ];
+      #  privateKeyFile = "/etc/wireguard/wg1.privatekey";
+      #  mtu = 1412;
+
+      #  peers = [
+      #    {
+      #      publicKey = "XS3TTIMU7Jp3JJANBpE14RsVDJk6/VUvZgjQgQP8kAs=";
+      #      allowedIPs = [ "10.13.0.100/32" "192.168.188.0/24" ];
+      #      endpoint = "[2a00:6020:48ad:dd00:dea6:32ff:fe85:3306]:51820";
+      #      persistentKeepalive = 25;
+      #    }
+      #  ];
+      #};
+      #wg2 = {
+      #  address = [ "10.6.6.4/32" ];
+      #  privateKeyFile = "/etc/wireguard/wg2.privatekey";
+
+      #  peers = [
+      #    {
+      #      publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
+      #      presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
+      #      allowedIPs = [ "10.6.6.1/32" "10.1.1.0/24" ];
+      #      endpoint = "85.88.23.127:51820";
+      #      persistentKeepalive = 16;
+      #    }
+      #  ];
+      #};
+    };
+  };
+}

hosts/ryzensun/ryzensun.nix

@@ -0,0 +1,52 @@
+{
+  config,
+  pkgs,
+  lib,
+  flake,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in {
+  config = {
+    age.secrets.docker-ci-runner-secrets = {
+      file = "${flake.self}/secrets/docker-ci-runner-secrets.age";
+      mode = "600";
+      owner = "999";
+    };
+
+    pub-solar.terminal-life.full = true;
+    #pub-solar.docker-ci-runner = {
+    #  enable = false;
+    #  runnerEnvironment = {
+    #    DRONE_RUNNER_CAPACITY = "1";
+    #    DRONE_RUNNER_LABELS = "hosttype:baremetal";
+    #  };
+    #  runnerVarsFile = config.age.secrets.docker-ci-runner-secrets.path;
+    #};
+
+    boot.binfmt.emulatedSystems = ["aarch64-linux"];
+
+    services.fstrim.enable = true;
+
+    services.tailscale.enable = true;
+
+    networking.hostName = "ryzensun";
+
+    home-manager.users."${psCfg.user.name}".xdg.configFile = {
+      "sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
+      "sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
+      "sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
+      "sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
+    };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "21.05"; # Did you read the comment?
+  };
+}

lib/add-local-hostname.nix

@@ -0,0 +1,5 @@
+{ lib }:
+hostnames: {
+  "127.0.0.1" = hostnames;
+  "::1" = hostnames;
+}

lib/default.nix

@@ -1,10 +1,18 @@
-{lib}:
-lib.makeExtensible (self: let
-  callLibs = file: import file {lib = self;};
-in rec {
-  ## Define your own library functions here!
-  #id = x: x;
-  ## Or in files, containing functions that take {lib}
-  #foo = callLibs ./foo.nix;
-  ## In configs, they can be used under "lib.our"
-})
+{ lib, inputs, ... }: {
+  # Configuration common to all Linux systems
+  flake = {
+    lib = let
+      callLibs = file: import file {inherit lib;};
+    in rec {
+      ## Define your own library functions here!
+      #id = x: x;
+      ## Or in files, containing functions that take {lib}
+      #foo = callLibs ./foo.nix;
+      ## In configs, they can be used under "lib.our"
+
+      deploy = import ./deploy.nix { inherit inputs lib; };
+      addLocalHostname = callLibs ./add-local-hostname.nix;
+      recursiveMerge = callLibs ./recursive-merge.nix;
+    };
+  };
+}

lib/deploy.nix

@@ -0,0 +1,62 @@
+/*
+ * The contents of this file are adapted from digga
+ * https://github.com/divnix/digga
+ *
+ * Licensed under the MIT license
+ */
+
+{ lib, inputs }: let
+  getFqdn = c: let
+    net = c.config.networking;
+    fqdn =
+      if (net ? domain) && (net.domain != null)
+      then "${net.hostName}.${net.domain}"
+      else net.hostName;
+  in
+    fqdn;
+in {
+  mkDeployNodes = systemConfigurations: extraConfig:
+  /*
+   *
+   Synopsis: mkNodes _systemConfigurations_ _extraConfig_
+
+   Generate the `nodes` attribute expected by deploy-rs
+   where _systemConfigurations_ are `nodes`.
+
+   _systemConfigurations_ should take the form of a flake's
+   _nixosConfigurations_. Note that deploy-rs does not currently support
+   deploying to darwin hosts.
+
+   _extraConfig_, if specified, will be merged into each of the
+   nodes' configurations.
+
+   Example _systemConfigurations_ input:
+
+   ```
+   {
+   hostname-1 = {
+   fastConnection = true;
+   sshOpts = [ "-p" "25" ];
+   };
+   hostname-2 = {
+   sshOpts = [ "-p" "19999" ];
+   sshUser = "root";
+   };
+   }
+   ```
+   *
+   */
+    lib.recursiveUpdate
+    (lib.mapAttrs
+      (
+        _: c: {
+          hostname = getFqdn c;
+          profiles.system = {
+            user = "root";
+            path = inputs.deploy-rs.lib.${c.pkgs.stdenv.hostPlatform.system}.activate.nixos c;
+          };
+        }
+      )
+      systemConfigurations)
+    extraConfig;
+}

lib/recursive-merge.nix

@@ -0,0 +1,16 @@
+{ lib }:
+attrList:
+let
+  f = attrPath:
+    zipAttrsWith (
+      n: values:
+        if tail values == []
+        then head values
+        else if all isList values
+        then unique (concatLists values)
+        else if all isAttrs values
+        then f (attrPath ++ [n]) values
+        else last values
+    );
+in
+  f [] attrList;

modules/acme/default.nix

@@ -0,0 +1,27 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  age.secrets."hosting-de-acme-secrets" = {
+    file = "${flake.self}/secrets/hosting-de-acme-secrets.age";
+    mode = "400";
+    owner = "acme";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+
+    defaults = {
+      email = "jfw@miom.space";
+      # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      dnsProvider = "hostingde";
+      dnsPropagationCheck = true;
+      environmentFile = config.age.secrets."hosting-de-acme-secrets".path;
+      group = "nginx";
+      webroot = null;
+    };
+  };
+}

modules/adb/default.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  programs.adb.enable = true;
+
+  users.users."${psCfg.user.name}" = {
+    extraGroups = ["adbusers"];
+  };
+}

modules/arduino/default.nix

@@ -6,22 +6,12 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.devops;
 in {
-  options.pub-solar.arduino = {
-    enable = mkEnableOption "Life with home automation";
-  };
-  config = mkIf cfg.enable {
-    users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
-      extraGroups = ["dialout"];
-    };
-
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          arduino
-          arduino-cli
-        ];
-      };
+  users.users."${psCfg.user.name}" = {
+    extraGroups = ["dialout"];
+    packages = with pkgs; [
+      arduino
+      arduino-cli
+    ];
   };
 }

modules/audio/default.nix

@@ -6,115 +6,46 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.audio;
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 in {
-  options.pub-solar.audio = {
-    enable = mkEnableOption "Life in highs and lows";
-    mopidy.enable = mkEnableOption "Life with mopidy";
-    spotify.enable = mkEnableOption "Life in DRM";
-    spotify.username = mkOption {
-      description = "Spotify login username or email";
-      type = types.str;
-      example = "yourname@example.com";
-      default = "";
-    };
-    bluetooth.enable = mkEnableOption "Life with bluetooth";
+  users.users."${psCfg.user.name}" = {
+    extraGroups = ["audio"];
+    packages = with pkgs; [
+      # easyeffects, e.g. for microphone noise filtering
+      easyeffects
+      mu
+      pavucontrol
+      pa_applet
+      playerctl
+      # Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
+      pulseaudio
+      vimpc
+    ];
   };
 
-  config = mkIf cfg.enable {
-    users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
-      extraGroups = ["audio"];
-    };
+  home-manager.users."${psCfg.user.name}" = {
+    xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
+    systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
+  };
 
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages =
-          [
-            # easyeffects, e.g. for microphone noise filtering
-            easyeffects
-            mu
-            pavucontrol
-            pa_applet
-            playerctl
-            # Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
-            pulseaudio
-            vimpc
-          ]
-          ++ (
-            if cfg.spotify.enable
-            then [pkgs.spotify-tui]
-            else []
-          );
-        xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
-        systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
+  # rtkit is optional but recommended
+  security.rtkit.enable = true;
 
-        services.spotifyd = mkIf cfg.spotify.enable {
-          enable = true;
-          settings = {
-            global = {
-              username = cfg.spotify.username;
-              password_cmd = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1001/bus ${pkgs.libsecret}/bin/secret-tool lookup spotify password";
-              bitrate = 320;
-              volume_normalisation = true;
-              no_audio_cache = false;
-              max_cache_size = 1000000000;
-            };
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-PipeWire#setting-sample-rates
+    extraConfig.pipewire = {
+      "10-clock-rate" = {
+        "context.properties" = {
+          default = {
+            "clock.rate" = 48000; # Pipewire default
+            "clock.allowed-rates" = [ 44100 48000 ];
           };
         };
       };
-
-    # rtkit is optional but recommended
-    security.rtkit.enable = true;
-    # Enable sound using pipewire-pulse, default config:
-    # https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire.conf.in
-    services.pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
     };
-
-    # Make pulseaudio listen on port 4713 for mopidy, extending the default
-    # config: https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire-pulse.conf.in
-    environment.etc = mkIf cfg.mopidy.enable {
-      "pipewire/pipewire-pulse.conf.d/99-custom.conf".text = ''
-        {
-          "context.modules": [
-            {
-              "name": "libpipewire-module-protocol-pulse",
-              "args": {
-                "server.address": ["unix:native", "tcp:4713"],
-                "vm.overrides": {
-                  "pulse.min.quantum": "1024/48000"
-                }
-              }
-            }
-          ]
-        }
-      '';
-    };
-
-    # Enable bluetooth
-    hardware.bluetooth = mkIf cfg.bluetooth.enable {
-      enable = true;
-      # Disable bluetooth on startup to save battery
-      powerOnBoot = false;
-      # Disable useless SIM Access Profile plugin
-      disabledPlugins = [
-        "sap"
-      ];
-      settings = {
-        General = {
-          # Enables experimental features and interfaces.
-          # Makes BlueZ Battery Provider available
-          Experimental = true;
-        };
-      };
-    };
-    services.blueman.enable = mkIf cfg.bluetooth.enable true;
-
-    # Enable audio server & client
-    services.mopidy = mkIf cfg.mopidy.enable ((import ./mopidy.nix) pkgs);
   };
 }

modules/audio/mopidy.nix

@@ -1,18 +0,0 @@
-pkgs: {
-  enable = true;
-  extensionPackages = with pkgs; [
-    mopidy-mpd
-    mopidy-soundcloud
-    mopidy-youtube
-    mopidy-local
-    mopidy-jellyfin
-  ];
-
-  configuration = ''
-    [mpd]
-    hostname = ::
-
-    [audio]
-    output = pulsesink server=127.0.0.1:4713
-  '';
-}

modules/bluetooth/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  hardware.bluetooth = {
+    enable = true;
+    # Disable bluetooth on startup to save battery
+    powerOnBoot = false;
+    # Disable useless SIM Access Profile plugin
+    disabledPlugins = [
+      "sap"
+    ];
+    settings = {
+      General = {
+        # Enables experimental features and interfaces.
+        # Makes BlueZ Battery Provider available
+        Experimental = true;
+      };
+    };
+  };
+
+  services.blueman.enable = true;
+  services.pipewire.wireplumber.configPackages = [
+    # https://pipewire.pages.freedesktop.org/wireplumber/daemon/configuration/bluetooth.html
+    (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/10-bluez.conf" ''
+      monitor.bluez.properties = {
+        bluez5.enable-hw-volume = true
+        bluez5.enable-msbc = true
+        bluez5.enable-sbc-xq = true
+        bluez5.headset-roles = [ hsp_hs hsp_ag hfp_hf hfp_ag ]
+      }
+    '')
+  ];
+}

modules/ci-runner/default.nix

@@ -1,45 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  self,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.ci-runner;
-in {
-  options.pub-solar.ci-runner = {
-    enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
-  };
-
-  config = mkIf cfg.enable {
-    systemd.user.services.ci-runner = {
-      enable = true;
-
-      description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-      };
-
-      path = [
-        pkgs.git
-        pkgs.nix
-        pkgs.libvirt
-      ];
-
-      wantedBy = ["multi-user.target"];
-      after = ["network.target" "libvirtd.service"];
-
-      script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
-    };
-
-    age.secrets."drone-runner-exec-config" = {
-      file = "${self}/secrets/drone-runner-exec-config";
-      mode = "700";
-      owner = psCfg.user.name;
-    };
-  };
-}

modules/core/boot.nix

@@ -7,12 +7,6 @@
 with lib; let
   cfg = config.pub-solar.core;
 in {
-  options.pub-solar.core.iso-options.enable = mkOption {
-    type = types.bool;
-    default = false;
-    description = "Feature flag for iso builds";
-  };
-
   options.pub-solar.core.disk-encryption-active = mkOption {
     type = types.bool;
     default = true;
@@ -21,13 +15,9 @@ in {
 
   config = {
     boot = {
-      # Enable plymouth for better experience of booting
-      plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
-
       # Mount / luks device in initrd
       # Allow fstrim to work on it.
-      # The ! makes this enabled by default
-      initrd = mkIf (!cfg.iso-options.enable && cfg.disk-encryption-active) {
+      initrd = mkIf cfg.disk-encryption-active {
         luks.devices."cryptroot" = {
           allowDiscards = true;
         };
@@ -36,7 +26,7 @@ in {
       loader.systemd-boot.enable = lib.mkDefault true;
 
       # Use latest LTS linux kernel by default
-      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_1;
+      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_6;
 
       # Support ntfs drives
       supportedFilesystems = ["ntfs"];

modules/core/default.nix

@@ -5,38 +5,34 @@
 }:
 with lib; let
   cfg = config.pub-solar.core;
+  psCfg = config.pub-solar;
 in {
   imports = [
     ./boot.nix
     ./hibernation.nix
-    ./fonts.nix
     ./i18n.nix
     ./networking.nix
-    ./nix.nix
     ./packages.nix
-    ./services.nix
   ];
 
-  options.pub-solar.core = {
-    lite = mkOption {
-      description = ''
-        Enable a lite edition of core with less default modules and a reduced package set.
-      '';
-      default = false;
-      type = types.bool;
-    };
+  # Service that makes Out of Memory Killer more effective
+  services.earlyoom.enable = true;
+
+  services.logind.lidSwitch = "hibernate";
+
+  services.tor.settings = {
+    UseBridges = true;
   };
 
-  config = {
-    pub-solar = {
-      audio.enable = mkIf (!cfg.lite) (mkDefault true);
-      crypto.enable = mkIf (!cfg.lite) (mkDefault true);
-      devops.enable = mkIf (!cfg.lite) (mkDefault true);
+  # The options below are directly taken from or inspired by
+  # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
 
-      terminal-life = {
-        enable = mkDefault true;
-        lite = cfg.lite;
-      };
-    };
-  };
+  # Limit the use of sudo to the group wheel
+  security.sudo.execWheelOnly = true;
+
+  # Remove the complete default environment of packages like
+  # nano, perl and rsync
+  environment.defaultPackages = lib.mkForce [];
+
+  # fileSystems."/".options = [ "noexec" ];
 }

modules/core/fonts.nix

@@ -1,14 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  fonts = {
-    fonts = with pkgs; [powerline-fonts dejavu_fonts];
-    fontconfig.defaultFonts = {
-      monospace = ["DejaVu Sans Mono for Powerline"];
-      sansSerif = ["DejaVu Sans"];
-    };
-  };
-}

modules/core/i18n.nix

@@ -15,6 +15,11 @@ with lib; {
     };
     i18n = {
       defaultLocale = "en_US.UTF-8";
+      supportedLocales = [
+        "C.UTF-8/UTF-8"
+        "en_US.UTF-8/UTF-8"
+        "de_DE.UTF-8/UTF-8"
+      ];
     };
   };
 }

modules/core/networking.nix

@@ -1,85 +1,39 @@
 {
+  flake,
   config,
   pkgs,
   lib,
   ...
-}:
-with lib; let
-  cfg = config.pub-solar.core;
-in {
-  options.pub-solar.core = {
-    enableCaddy = mkOption {
-      type = types.bool;
-      default = !cfg.lite;
-    };
-    enableHelp = mkOption {
-      type = types.bool;
-      default = !cfg.lite;
-    };
+}: {
+  # disable NetworkManager and systemd-networkd -wait-online by default
+  systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
+  systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
 
-    binaryCaches = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = "Binary caches to use.";
-    };
-    publicKeys = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = "Public keys of binary caches.";
-    };
+  networking.networkmanager = {
+    # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
+    enable = if config.programs.sway.enable then lib.mkDefault true else false;
+    # not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
+    #wifi.backend = "iwd";
   };
-  config = {
-    # disable NetworkManager and systemd-networkd -wait-online by default
-    systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
-    systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
 
-    networking.networkmanager = {
-      # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
-      enable = true;
-      wifi.backend = "iwd";
-    };
+  networking.firewall.enable = true;
 
-    networking.firewall.enable = true;
+  # For rage encryption, all hosts need a ssh key pair
+  services.openssh = {
+    enable = true;
+    allowSFTP = lib.mkDefault false;
 
-    # Customized binary caches list (with fallback to official binary cache)
-    nix.settings.substituters = cfg.binaryCaches;
-    nix.settings.trusted-public-keys = cfg.publicKeys;
+    openFirewall = lib.mkDefault false;
 
-    # These entries get added to /etc/hosts
-    networking.hosts = {
-      "127.0.0.1" =
-        []
-        ++ lib.optionals cfg.enableCaddy ["caddy.local"]
-        ++ lib.optionals config.pub-solar.printing.enable ["cups.local"]
-        ++ lib.optionals cfg.enableHelp ["help.local"];
-    };
+    settings.PasswordAuthentication = lib.mkDefault false;
+    settings.KbdInteractiveAuthentication = false;
 
-    # Caddy reverse proxy for local services like cups
-    services.caddy = {
-      enable = lib.mkDefault cfg.enableCaddy;
-      globalConfig = lib.mkDefault ''
-        default_bind 127.0.0.1
-        auto_https off
-      '';
-      extraConfig = lib.mkDefault (concatStringsSep "\n" [
-        (lib.optionalString
-          config.pub-solar.printing.enable
-          ''
-            cups.local:80 {
-              request_header Host localhost:631
-              reverse_proxy unix//run/cups/cups.sock
-            }
-          '')
-
-        (lib.optionalString
-          cfg.enableHelp
-          ''
-            help.local:80 {
-              root * ${pkgs.psos-docs}/lib/html
-              file_server
-            }
-          '')
-      ]);
-    };
+    extraConfig = ''
+      AllowTcpForwarding yes
+      X11Forwarding no
+      AllowAgentForwarding no
+      AllowStreamLocalForwarding no
+      AuthenticationMethods publickey
+    '';
   };
 }

modules/core/nix.nix

@@ -1,32 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  inputs,
-  ...
-}: {
-  nix = {
-    # Use default version alias for nix package
-    package = pkgs.nix;
-    gc.automatic = true;
-    optimise.automatic = true;
-    settings = {
-      # Improve nix store disk usage
-      auto-optimise-store = true;
-      # Prevents impurities in builds
-      sandbox = true;
-      # Give root and @wheel special privileges with nix
-      trusted-users = ["root" "@wheel"];
-      # Allow only group wheel to connect to the nix daemon
-      allowed-users = ["@wheel"];
-    };
-    # Generally useful nix option defaults
-    extraOptions = lib.mkForce ''
-      experimental-features = flakes nix-command
-      min-free = 536870912
-      keep-outputs = true
-      keep-derivations = true
-      fallback = true
-    '';
-  };
-}

modules/core/packages.nix

@@ -8,72 +8,25 @@ with lib; let
   psCfg = config.pub-solar;
   cfg = config.pub-solar.core;
 in {
-  environment = {
-    systemPackages = with pkgs;
-      [
-        # Core unix utility packages
-        coreutils-full
-        dnsutils
-        inetutils
-        progress
-        pciutils
-        usbutils
+  environment.systemPackages = with pkgs; [
+    # Core unix utility packages
+    coreutils-full
+    diffutils
+    dnsutils
+    exfat
+    file
+    findutils
+    inetutils
+    lsof
+    progress
+    pciutils
+    usbutils
 
-        wget
-        openssl
-        openssh
-        curl
-        htop
-        btop
-        lsof
-        psmisc
-        file
+    gitMinimal
 
-        # zippit
-        zip
-        unzip
-
-        # Modern modern utilities
-        p7zip
-        croc
-        jq
-      ]
-      ++ lib.optionals (!cfg.lite) [
-        mtr
-
-        gitFull
-        git-lfs
-        git-bug
-
-        xdg-utils
-        sysfsutils
-        renameutils
-        nfs-utils
-        moreutils
-        mailutils
-        keyutils
-        input-utils
-        elfutils
-        binutils
-        dateutils
-        diffutils
-        findutils
-        exfat
-
-        # Nix specific utilities
-        alejandra
-        niv
-        manix
-        nix-index
-        nix-tree
-        nixpkgs-review
-        # Build broken, python2.7-PyJWT-2.0.1.drv' failed
-        #nixops
-        psos
-        nvd
-
-        # Fun
-        neofetch
-      ];
-  };
+    btop
+    mtr
+    nmap
+    nload
+  ];
 }

modules/core/services.nix

@@ -1,18 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  # For rage encryption, all hosts need a ssh key pair
-  services.openssh = {
-    enable = true;
-    # If you don't want the host to have SSH actually opened up to the net,
-    # set `services.openssh.openFirewall` to false in your config.
-    openFirewall = lib.mkDefault true;
-    settings.PasswordAuthentication = lib.mkDefault false;
-  };
-
-  # Service that makes Out of Memory Killer more effective
-  services.earlyoom.enable = true;
-}

modules/crypto/default.nix

@@ -6,40 +6,28 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.crypto;
 in {
-  options.pub-solar.crypto = {
-    enable = mkEnableOption "Life in private";
-  };
+  services.udev.packages = [pkgs.yubikey-personalization];
+  services.dbus.packages = [pkgs.gcr];
+  services.pcscd.enable = true;
 
-  config = mkIf cfg.enable {
-    services.udev.packages = [pkgs.yubikey-personalization];
-    services.dbus.packages = [pkgs.gcr];
-    services.pcscd.enable = true;
+  services.gnome.gnome-keyring.enable = true;
 
-    services.gnome.gnome-keyring.enable = true;
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    libsecret
+  ];
 
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
+  home-manager.users."${psCfg.user.name}" = {
+    systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
 
-        services.gpg-agent = {
-          enable = true;
-          pinentryFlavor = "gnome3";
-          verbose = true;
-        };
+    services.gpg-agent = {
+      enable = true;
+      pinentryPackage = lib.mkDefault pkgs.pinentry-gnome3;
+      verbose = true;
+    };
 
-        programs.gpg = {
-          enable = true;
-        };
-
-        home.packages = [
-          gnome.seahorse
-          keepassxc
-          libsecret
-          qMasterPassword
-          restic
-        ];
-      };
+    programs.gpg = {
+      enable = true;
+    };
   };
 }

modules/ddclient/default.nix

@@ -0,0 +1,245 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.ddclient;
+  boolToStr = bool: if bool then "yes" else "no";
+  dataDir = "/var/lib/ddclient";
+  StateDirectory = builtins.baseNameOf dataDir;
+  RuntimeDirectory = StateDirectory;
+
+  usev4 = if cfg.usev4 != "" then "usev4=${cfg.usev4}" else "";
+  usev6 = if cfg.usev6 != "" then "usev6=${cfg.usev6}" else "";
+
+  configFile' = pkgs.writeText "ddclient.conf" ''
+    # This file can be used as a template for configFile or is automatically generated by Nix options.
+    use=no
+    ${usev4}
+    ${usev6}
+    cache=${dataDir}/ddclient.cache
+    foreground=yes
+    login=${cfg.username}
+    password=${if cfg.protocol == "nsupdate" then "/run/${RuntimeDirectory}/ddclient.key" else "@password_placeholder@"}
+    protocol=${cfg.protocol}
+    ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
+    ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
+    ${lib.optionalString (cfg.zone != "")   "zone=${cfg.zone}"}
+    ssl=${boolToStr cfg.ssl}
+    wildcard=yes
+    quiet=${boolToStr cfg.quiet}
+    verbose=${boolToStr cfg.verbose}
+    ${cfg.extraConfig}
+    ${lib.concatStringsSep "," cfg.domains}
+  '';
+  configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
+
+  preStart = ''
+    install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    ${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
+      install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
+    '' else if (cfg.passwordFile != null) then ''
+      "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
+    '' else ''
+      sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
+    '')}
+  '';
+in with lib; {
+  disabledModules = [
+    "services/networking/ddclient.nix"
+  ];
+
+  imports = [
+    (mkChangedOptionModule [ "services" "ddclient" "domain" ] [ "services" "ddclient" "domains" ]
+      (config:
+        let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;
+        in if value != "" then [ value ] else []))
+    (mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")
+    (mkRemovedOptionModule [ "services" "ddclient" "password" ] "Use services.ddclient.passwordFile instead.")
+  ];
+
+  ###### interface
+
+  options = {
+    services.ddclient = with lib.types; {
+      enable = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
+        '';
+      };
+
+      package = mkOption {
+        type = package;
+        default = pkgs.ddclient;
+        defaultText = lib.literalExpression "pkgs.ddclient";
+        description = lib.mdDoc ''
+          The ddclient executable package run by the service.
+        '';
+      };
+
+      domains = mkOption {
+        default = [ "" ];
+        type = listOf str;
+        description = lib.mdDoc ''
+          Domain name(s) to synchronize.
+        '';
+      };
+
+      username = mkOption {
+        # For `nsupdate` username contains the path to the nsupdate executable
+        default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
+        defaultText = "";
+        type = str;
+        description = lib.mdDoc ''
+          User name.
+        '';
+      };
+
+      passwordFile = mkOption {
+        default = null;
+        type = nullOr str;
+        description = lib.mdDoc ''
+          A file containing the password or a TSIG key in named format when using the nsupdate protocol.
+        '';
+      };
+
+      interval = mkOption {
+        default = "10min";
+        type = str;
+        description = lib.mdDoc ''
+          The interval at which to run the check and update.
+          See {command}`man 7 systemd.time` for the format.
+        '';
+      };
+
+      configFile = mkOption {
+        default = null;
+        type = nullOr path;
+        description = lib.mdDoc ''
+          Path to configuration file.
+          When set this overrides the generated configuration from module options.
+        '';
+        example = "/root/nixos/secrets/ddclient.conf";
+      };
+
+      protocol = mkOption {
+        default = "dyndns2";
+        type = str;
+        description = lib.mdDoc ''
+          Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
+        '';
+      };
+
+      server = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          Server address.
+        '';
+      };
+
+      ssl = mkOption {
+        default = true;
+        type = bool;
+        description = lib.mdDoc ''
+          Whether to use SSL/TLS to connect to dynamic DNS provider.
+        '';
+      };
+
+      quiet = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Print no messages for unnecessary updates.
+        '';
+      };
+
+      script = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          script as required by some providers.
+        '';
+      };
+
+      usev4 = mkOption {
+        default = "webv4, webv4=checkip.dyndns.com/, webv4-skip='Current IP Address: '";
+        type = str;
+        description = lib.mdDoc ''
+          Method to determine the IP address to send to the dynamic DNS provider.
+        '';
+      };
+
+      usev6 = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          Method to determine the IP address to send to the dynamic DNS provider.
+        '';
+      };
+
+      verbose = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Print verbose information.
+        '';
+      };
+
+      zone = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          zone as required by some providers.
+        '';
+      };
+
+      extraConfig = mkOption {
+        default = "";
+        type = lines;
+        description = lib.mdDoc ''
+          Extra configuration. Contents will be added verbatim to the configuration file.
+
+          ::: {.note}
+          `daemon` should not be added here because it does not work great with the systemd-timer approach the service uses.
+          :::
+        '';
+      };
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf config.services.ddclient.enable {
+    systemd.services.ddclient = {
+      description = "Dynamic DNS Client";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      restartTriggers = optional (cfg.configFile != null) cfg.configFile;
+
+      serviceConfig = {
+        DynamicUser = true;
+        RuntimeDirectoryMode = "0700";
+        inherit RuntimeDirectory;
+        inherit StateDirectory;
+        Type = "oneshot";
+        ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
+        ExecStart = "${lib.getBin cfg.package}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
+      };
+    };
+
+    systemd.timers.ddclient = {
+      description = "Run ddclient";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = cfg.interval;
+        OnUnitInactiveSec = cfg.interval;
+      };
+    };
+  };
+}

modules/default.nix

@@ -0,0 +1,43 @@
+{
+  self,
+  inputs,
+  ...
+}: {
+  flake = {
+    nixosModules = rec {
+      acme = import ./acme;
+      audio = import ./audio;
+      bluetooth = import ./bluetooth;
+      core = import ./core;
+      crypto = import ./crypto;
+      desktop-extended = import ./desktop-extended;
+      docker = import ./docker;
+      #email = import ./email;
+      #gaming = import ./gaming;
+      graphical = import ./graphical;
+      #invoiceplane = import ./invoiceplane;
+      nix = import ./nix;
+      nextcloud = import ./nextcloud;
+      office = import ./office;
+      printing = import ./printing;
+      terminal-life = import ./terminal-life;
+      user = import ./user;
+      virtualisation = import ./virtualisation;
+      #wireguard-client = import ./wireguard-client;
+
+      base.imports = [
+        self.nixosModules.home-manager
+        inputs.agenix.nixosModules.default
+
+        self.nixosModules.overlays
+        self.nixosModules.core
+        self.nixosModules.crypto
+        self.nixosModules.nix
+        self.nixosModules.terminal-life
+
+        self.nixosModules.root
+        self.nixosModules.user
+      ];
+    };
+  };
+}

modules/desktop-extended/default.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    ungoogled-chromium
+
+    gimp
+    inkscape
+    tigervnc
+    nodejs_20
+
+    signal-desktop
+    tdesktop
+    element-desktop
+
+    binutils
+
+    # Nix specific utilities
+    alejandra
+    manix
+    nix-init
+    nix-inspect
+    nix-output-monitor
+    nix-tree
+    nvd
+    nixpkgs-review
+    nix-update
+    nix-search-cli
+  ];
+
+  fonts = {
+    packages = with pkgs; [
+      dejavu_fonts
+      fira-code
+      fira-code-symbols
+      #google-fonts
+      lato
+      montserrat
+      nerdfonts
+      noto-fonts
+      noto-fonts-cjk
+      open-sans
+      powerline-fonts
+      source-sans-pro
+    ];
+  };
+}

modules/devops/default.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.devops;
-in {
-  options.pub-solar.devops = {
-    enable = mkEnableOption "Life automated";
-  };
-
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          drone-cli
-          nmap
-          pgcli
-          ansible
-          ansible-lint
-          restic
-          shellcheck
-          terraform
-        ];
-      };
-  };
-}

modules/docker-ci-runner/default.nix

@@ -1,114 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  self,
-  ...
-}:
-with lib; let
-  bootstrap = pkgs.writeScript "bootstrap.sh" ''
-    #!/usr/bin/env bash
-
-    set -e
-
-    apt update
-    apt install --yes curl git sudo xz-utils
-
-    adduser --system --uid 999 build
-    chown build /nix
-
-    sudo -u build curl -L https://nixos.org/nix/install > install
-    sudo -u build sh install
-
-    echo "export PATH=/nix/var/nix/profiles/per-user/build/profile/bin:''$PATH" >> /etc/profile
-
-    mkdir /etc/nix
-    echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
-
-    export nix_user_config_file="/home/build/.local/share/nix/trusted-settings.json"
-    mkdir -p $(dirname \\$nix_user_config_file)
-    echo '{"extra-experimental-features":{"nix-command flakes":true}}' > \\$nix_user_config_file
-    chown -R build /home/build/
-
-    curl -L https://github.com/drone-runners/drone-runner-exec/releases/latest/download/drone_runner_exec_linux_amd64.tar.gz | tar xz
-    sudo install -t /usr/local/bin drone-runner-exec
-
-    if [ ! -f /run/vars ]; then
-      exit 1
-    fi
-
-    cp -a /run/vars /run/runtime-vars
-    env | grep "DRONE" >> /run/runtime-vars
-
-    su - -s /bin/bash build sh -c "/usr/local/bin/drone-runner-exec daemon /run/runtime-vars"
-  '';
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.docker-ci-runner;
-in {
-  options.pub-solar.docker-ci-runner = {
-    enable = lib.mkEnableOption "Enables a docker container running a drone exec runner as unprivileged user.";
-
-    enableKvm = lib.mkOption {
-      description = ''
-        Enable kvm support.
-      '';
-      default = true;
-      type = types.bool;
-    };
-
-    nixCacheLocation = lib.mkOption {
-      description = ''
-        Location of nix cache that is shared between builds
-      '';
-      default = "/var/lib/docker-ci-runner";
-      type = types.path;
-    };
-
-    runnerEnvironment = lib.mkOption {
-      description = ''
-        Additional environment vars added to the vars file on container runtime
-      '';
-      default = {};
-    };
-
-    runnerVarsFile = lib.mkOption {
-      description = ''
-        Location of vars file passed to drone runner
-      '';
-      type = types.path;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation = {
-      docker = {
-        enable = true; # sadly podman is not supported rightnow
-      };
-
-      oci-containers = {
-        backend = "docker";
-        containers."drone-exec-runner" = {
-          image = "debian";
-          autoStart = true;
-          entrypoint = "bash";
-          cmd = ["/bootstrap.sh"];
-
-          volumes = [
-            "${cfg.runnerVarsFile}:/run/vars"
-            "${cfg.nixCacheLocation}:/nix"
-            "${bootstrap}:/bootstrap.sh"
-          ];
-
-          environment = cfg.runnerEnvironment;
-
-          extraOptions = lib.mkIf cfg.enableKvm ["--device=/dev/kvm"];
-        };
-      };
-    };
-    # Fix container not stopping correctly and holding the system 120s upon
-    # shutdown / reboot
-    systemd.services.docker-drone-exec-runner.preStop = ''
-      docker stop drone-exec-runner
-    '';
-  };
-}

modules/docker/default.nix

@@ -6,21 +6,15 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.docker;
 in {
-  options.pub-solar.docker = {
-    enable = mkEnableOption "Life in metal boxes";
+  virtualisation.docker.enable = true;
+  virtualisation.docker.package = pkgs.docker_24;
+
+  users.users."${psCfg.user.name}" = {
+    extraGroups = ["docker"];
   };
 
-  config = mkIf cfg.enable {
-    virtualisation.docker.enable = true;
-    users.users = with pkgs;
-      pkgs.lib.setAttrByPath [psCfg.user.name] {
-        extraGroups = ["docker"];
-      };
-
-    environment.systemPackages = with pkgs; [
-      docker-compose
-    ];
-  };
+  environment.systemPackages = with pkgs; [
+    docker-compose
+  ];
 }

modules/email/default.nix

@@ -6,28 +6,49 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.email;
 in {
-  options.pub-solar.email = {
-    enable = mkEnableOption "Life in headers";
-  };
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    w3m
+    urlscan
+    neomutt
+    offlineimap
+    msmtp
+    mailto-mutt
+  ];
 
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          w3m
-          urlscan
-          neomutt
-          offlineimap
-          msmtp
-          mailto-mutt
-        ];
+  home-manager.users."${psCfg.user.name}" = {
+    programs.offlineimap = {
+      enable = true;
+      pythonFile = builtins.readFile ./offlineimap.py;
+    };
 
-        programs.offlineimap = {
-          enable = true;
-          pythonFile = builtins.readFile ./offlineimap.py;
-        };
-      };
+    xdg.configFile."mutt/muttrc".source = ./.config/mutt/muttrc;
+    xdg.configFile."mutt/base16.muttrc".source = ./.config/mutt/base16.muttrc;
+    xdg.configFile."mutt/mailcap".source = ./.config/mutt/mailcap;
+    xdg.configFile."offlineimap/functions.py".source = ./.config/offlineimap/functions.py;
+
+    xdg.configFile."mutt/accounts.muttrc".text = ''
+      source ./hello@benjaminbaedorf.eu.muttrc
+
+      macro index <f1> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/hello@benjaminbaedorf.eu.muttrc<enter><change-folder>!<enter>'
+      macro index <f2> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/benjamin.baedorf@rwth-aachen.de.muttrc<enter><change-folder>!<enter>'
+      macro index <f3> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/byb@miom.space.muttrc<enter><change-folder>!<enter>'
+      macro index <f4> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/mail@b12f.io.muttrc<enter><change-folder>!<enter>'
+      macro index <f5> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/admins@pub.solar.muttrc<enter><change-folder>!<enter>'
+      macro index <f6> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/crew@pub.solar.muttrc<enter><change-folder>!<enter>'
+    '';
+    xdg.configFile."mutt/hello@benjaminbaedorf.eu.muttrc".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.muttrc";
+    xdg.configFile."mutt/benjamin.baedorf@rwth-aachen.de.muttrc".source = ./.config/mutt + "/benjamin.baedorf@rwth-aachen.de.muttrc";
+    xdg.configFile."mutt/hello@benjaminbaedorf.eu.signature".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.signature";
+    xdg.configFile."mutt/byb@miom.space.muttrc".source = ./.config/mutt + "/byb@miom.space.muttrc";
+    xdg.configFile."mutt/byb@miom.space.signature".source = ./.config/mutt + "/byb@miom.space.signature";
+    xdg.configFile."mutt/mail@b12f.io.muttrc".source = ./.config/mutt + "/mail@b12f.io.muttrc";
+    xdg.configFile."mutt/mail@b12f.io.signature".source = ./.config/mutt + "/mail@b12f.io.signature";
+    xdg.configFile."mutt/admins@pub.solar.muttrc".source = ./.config/mutt + "/admins@pub.solar.muttrc";
+    xdg.configFile."mutt/admins@pub.solar.signature".source = ./.config/mutt + "/admins@pub.solar.signature";
+    xdg.configFile."mutt/crew@pub.solar.muttrc".source = ./.config/mutt + "/crew@pub.solar.muttrc";
+    xdg.configFile."mutt/crew@pub.solar.signature".source = ./.config/mutt + "/crew@pub.solar.signature";
+    xdg.configFile."offlineimap/config".source = ./.config/offlineimap/config;
+    xdg.configFile."msmtp/config".source = ./.config/msmtp/config;
   };
 }

modules/gaming/default.nix

@@ -6,26 +6,16 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.gaming;
 in {
-  options.pub-solar.gaming = {
-    enable = mkEnableOption "Life in shooters";
+  programs.steam.enable = true;
+  nixpkgs.config.packageOverrides = pkgs: {
+    steam = pkgs.steam.override {};
   };
 
-  config = mkIf cfg.enable {
-    programs.steam.enable = true;
-    nixpkgs.config.packageOverrides = pkgs: {
-      steam = pkgs.steam.override {};
-    };
-
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          playonlinux
-          godot
-          obs-studio
-          obs-studio-plugins.wlrobs
-        ];
-      };
-  };
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    playonlinux
+    godot
+    obs-studio
+    obs-studio-plugins.wlrobs
+  ];
 }

modules/graphical/.config/swaync/config.json

@@ -0,0 +1,12 @@
+{
+  "positionX": "right",
+  "positionY": "top",
+  "timeout": 10,
+  "timeout-low": 5,
+  "timeout-critical": 0,
+  "notification-window-width": 500,
+  "keyboard-shortcuts": true,
+  "image-visibility": "always",
+  "transition-time": 200,
+  "hide-on-clear": false
+}

modules/graphical/.config/swaync/style.css

@@ -0,0 +1,149 @@
+/*
+ * vim: ft=less
+ */
+
+@define-color border-color rgb(7, 7, 7);
+@define-color bg rgb(58, 58, 58);
+@define-color bg-hover rgb(68, 68, 68);
+@define-color bg-focus rgba(68, 68, 68, 0.6);
+@define-color bg-selected rgb(0, 128, 255);
+
+.notification-row {
+  outline: none;
+}
+.notification-row:focus,
+.notification-row:hover {
+  background: @bg-focus;
+}
+
+.notification {
+  border-radius: 10px;
+  margin: 6px 12px;
+  box-shadow: 0px 2px 4px 2px rgba(0, 0, 0, 0.3);
+  padding: 0;
+}
+
+.notification-content {
+  background: transparent;
+  padding: 6px;
+  border-radius: 10px;
+}
+
+.close-button {
+  background: black;
+  color: white;
+  text-shadow: none;
+  padding: 0 2px;
+  box-shadow: 0px 2px 4px 2px rgba(0, 0, 0, 0.3);
+  border-radius: 100%;
+}
+.close-button:hover {
+  background: rgb(30, 30, 30);
+  transition: all 0.15s ease-in-out;
+}
+
+.notification-default-action,
+.notification-action {
+  padding: 4px;
+  margin: 0;
+  box-shadow: none;
+  background: @bg;
+  border: 1px solid @border-color;
+}
+
+.notification-default-action:hover,
+.notification-action:hover {
+  background: @bg-hover;
+}
+
+.notification-default-action {
+  border-radius: 10px;
+}
+
+/* When alternative actions are visible */
+.notification-default-action:not(:only-child) {
+  border-bottom-left-radius: 0px;
+  border-bottom-right-radius: 0px;
+}
+
+.notification-action {
+  border-radius: 0px;
+  border-top: none;
+  border-right: none;
+}
+
+/* add bottom border radius to eliminate clipping */
+.notification-action:first-child {
+  border-bottom-left-radius: 10px;
+}
+.notification-action:last-child {
+  border-bottom-right-radius: 10px;
+  border-right: 1px solid @border-color;
+}
+
+.image {
+}
+
+.body-image {
+  margin-top: 6px;
+  background-color: white;
+  border-radius: 10px;
+}
+
+.summary {
+  color: white;
+  text-shadow: none;
+}
+
+.time {
+  color: white;
+  text-shadow: none;
+}
+
+.body {
+  background: transparent;
+  color: white;
+  text-shadow: none;
+}
+
+.top-action-title {
+  color: white;
+  text-shadow: none;
+}
+
+.control-center-clear-all {
+  color: white;
+  text-shadow: none;
+  background: @bg;
+  border: 1px solid @border-color;
+  box-shadow: none;
+  border-radius: 10px;
+}
+.control-center-clear-all:hover {
+  background: @bg-hover;
+}
+
+.control-center-dnd {
+  border-radius: 10px;
+  background: @bg;
+  border: 1px solid @border-color;
+  box-shadow: none;
+}
+
+.control-center-dnd:checked {
+  background: @bg-selected;
+}
+.control-center-dnd slider {
+  background: @bg-hover;
+}
+
+.control-center {
+  background: rgba(0, 0, 0, 0.7);
+}
+.control-center-list {
+  background: transparent;
+}
+
+.floating-notifications {
+  background: transparent;
+}

modules/graphical/.config/waybar/config

@@ -0,0 +1,149 @@
+{
+  "layer": "top", // Waybar at top layer
+  // "position": "bottom", // Waybar position (top|bottom|left|right)
+
+  "height": 26, // Waybar height
+  "modules-left": ["sway/workspaces", "sway/mode"],
+  "modules-center": ["network"],
+  "modules-right": [
+    "sway/language",
+    "pulseaudio",
+    "idle_inhibitor",
+    "backlight",
+    "battery",
+    "clock",
+    "tray"
+  ],
+  "sway/workspaces": {
+      "disable-scroll": true
+  },
+  "sway/mode": {
+  "tooltip": false,
+      "format": "{}"
+  },
+  "sway/window": {
+  "tooltip": false,
+      "max-length": 96
+  },
+  "sway/language": {
+  "format": "{}",
+  "max-length": 50
+  },
+  "tray": {
+      "icon-size": 21,
+      "spacing": 10
+  },
+  "clock": {
+      "tooltip-format": "<tt><small>{calendar}</small></tt>",
+      "format": "{:%H:%M} ",
+      //"format-alt": "{:%a %d. %h %H:%M} ",
+      //"on-scroll": {
+      //    "calendar": 1
+      //}
+      "format-alt": "{:%A, %d. %B %Y %R} ",
+      "locale": "de_DE.UTF-8",
+      "smooth-scrolling-threshold": 1.0,
+      "calendar": {
+          "mode-mon-col"  : 3,
+          "on-scroll": -1,
+          "on-click-right": "mode",
+          "format": {
+              "months":     "<span color='#ffead3'><b>{}</b></span>",
+              "days":       "<span color='#ecc6d9'><b>{}</b></span>",
+              "weekdays":   "<span color='#ffcc66'><b>{}</b></span>",
+              "today":      "<span color='#ff6699'><b><u>{}</u></b></span>"
+          },
+      },
+      "actions":  {
+          "on-click-right": "mode",
+          "on-click-forward": "tz_up",
+          "on-click-backward": "tz_down",
+          "on-scroll-up": "shift_up",
+          "on-scroll-down": "shift_down"
+      }
+  },
+  "backlight": {
+      "device": "acpi_video0",
+      "format": "<span font='10'>{percent}%</span> {icon}",
+      "format-icons": ["", ""]
+  },
+  "cpu": {
+      "format": "{}% "
+  },
+  "memory": {
+      "format": "{}% "
+  },
+  "idle_inhibitor": {
+      "format": "{icon} ",
+      "format-icons": {
+          "activated": "",
+          "deactivated": ""
+      }
+  },
+  "battery": {
+      "tooltip": false,
+      "states": {
+          "critical": 25
+      },
+      //"full-at": 84,
+      "format": "{icon}<span font='10'> {capacity}%</span>",
+      "format-full": "{icon}",
+      "format-icons": ["", "", "", "", ""],
+  },
+  "network": {
+      "interval": 3,
+      "tooltip": true,
+      //"interface": "wlp4s0", // (Optional) To force the use of this interface          \uF2E7,
+      "format-wifi": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
+      "format-ethernet": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
+      "format-disconnected": "",
+      "tooltip-format-wifi": "{essid} ({signalStrength}%)  {ipaddr}",
+      "tooltip-format-ethernet": "{ifname}  {ipaddr}"
+  },
+  //\ue04f{volume}%
+  "pulseaudio": {
+      "tooltip": false,
+      "format": "<span font='10'>{volume}%</span> {icon}",
+      "format-bluetooth": "{volume}%<span font='10'> {icon}</span>",
+      "format-muted": "",
+      "on-click": "pavucontrol",
+      "format-alt": "{volume}% <span font='10'>{icon}</span>",
+      "format-icons": {
+          "headphones": "",
+          "handsfree": "",
+          "headset": "",
+          "phone": "",
+          "portable": "",
+          "car": "",
+          "default": ["","", ""]
+      }
+  },
+  "mpd": {
+    "format": "{artist} - {title} <span color=\"#999999\">[<span color=\"#ffffff\">{elapsedTime:%M:%S}</span> / {totalTime:%M:%S}]</span>",
+    "format-disconnected": "",
+    "format-stopped": "",
+    "interval": 1,
+    "state-icons": {
+      "paused": "",
+      "playing": ""
+    },
+    "tooltip-format": "MPD (connected)",
+    "tooltip-format-disconnected": "MPD (disconnected)"
+  },
+  "custom/notification": {
+    "tooltip": false,
+    "format": " {icon}",
+    "format-icons": {
+      "notification": "<span foreground='red'><sup></sup></span>",
+      "none": "",
+      "dnd-notification": "<span foreground='red'><sup></sup></span>",
+      "dnd-none": ""
+    },
+    "return-type": "json",
+    "exec-if": "which swaync-client",
+    "exec": "swaync-client -swb",
+    "on-click": "swaync-client -t -sw",
+    "on-click-right": "swaync-client -d -sw",
+    "escape": true
+  },
+}

modules/graphical/.config/waybar/style.css

@@ -1,19 +1,18 @@
 @import "./colorscheme.css";
 
-* {
-    min-height: 0;
-    border: none;
-}
-
 window#waybar {
     font-family: Hack, FontAwesome;
     font-weight: 500;
     font-size: 14px;
-    background: rgba(11, 12, 13, 0.90);
+    /*background: rgba(11, 12, 13, 0.90);*/
+    background-color: rgba(0, 0, 0, 0);
     border-bottom: 1px solid  rgba(0, 0, 2, 0.53);
     color: @base04;
 }
 
+window#waybar.hidden {
+    opacity: 0.2;
+}
 
 #workspaces button {
     font-size: 14px;
@@ -23,7 +22,6 @@ window#waybar {
     color: @base04;
 }
 
-
 #workspaces button.focused {
     color: #f85e84;
     color: @base07;
@@ -47,32 +45,36 @@ window#waybar {
 }
 
 #battery {
-  font-size: 12px;
+    font-size: 12px;
 }
 
 #battery.critical {
-  color: @base07;
+    color: @base07;
 }
+
 #battery.charging {
     color: @base0B;
 }
+
 #battery.full {
     margin: 0px 0px 0px 0px;
 }
 
-
 #network {
     border-top: 1px solid transparent;
+    color: rgba(255,255,255,0.3);
 }
+
 #network.disconnected {
     margin: 0px 0px 0px 0px;
     color: rgba(75, 81, 98, 0);
 }
 
-
 #pulseaudio.muted {
     margin: 0px 0px 0px 0px;
     color: rgba(75, 81, 98, 0);
 }
 
-
+#custom-notification {
+  font-family: "NotoSansMono Nerd Font";
+}

modules/graphical/alacritty.nix

@@ -30,9 +30,6 @@
     multiplier = 3;
   };
 
-  # When true, bold text is drawn using the bright variant of colors.
-  draw_bold_text_with_bright_colors = true;
-
   font = {
     # The normal (roman) font face to use.
     normal = {
@@ -55,7 +52,7 @@
       style = "Italic";
     };
 
-    size = 16.0;
+    size = 12.0;
 
     offset = {
       x = 0;
@@ -68,7 +65,17 @@
     };
   };
 
-  key_bindings = [
+  keyboard.bindings = [
+    {
+      key = "V";
+      mods = "Control|Super";
+      action = "Paste";
+    }
+    {
+      key = "C";
+      mods = "Control|Super";
+      action = "Copy";
+    }
     {
       key = "V";
       mods = "Control|Alt";
@@ -162,6 +169,9 @@
   # Base16 Burn 256 - alacritty color config
   # Benjamin Bädorf
   colors = {
+    # When true, bold text is drawn using the bright variant of colors.
+    draw_bold_text_with_bright_colors = true;
+
     # Default colors
     primary = {
       background = "0x1a181a";

modules/graphical/default.nix

@@ -6,36 +6,22 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.graphical;
-  yamlFormat = pkgs.formats.yaml {};
-  recursiveMerge = attrList: let
-    f = attrPath:
-      zipAttrsWith (
-        n: values:
-          if tail values == []
-          then head values
-          else if all isList values
-          then unique (concatLists values)
-          else if all isAttrs values
-          then f (attrPath ++ [n]) values
-          else last values
-      );
-  in
-    f [] attrList;
+  tomlFormat = pkgs.formats.toml {};
+  sessionVariables = {
+    WLR_RENDERER =
+      if psCfg.graphical.wayland.software-renderer.enable
+      then "pixman"
+      else "gles2";
+    # Fix KeepassXC rendering issue
+    # https://github.com/void-linux/void-packages/issues/23517
+    QT_AUTO_SCREEN_SCALE_FACTOR = "0";
+  };
 in {
+  imports = [
+    ./sway
+  ];
+
   options.pub-solar.graphical = {
-    enable = mkEnableOption "Life in color";
-    alacritty = {
-      settings = mkOption {
-        type = yamlFormat.type;
-        default = {};
-      };
-    };
-    autologin.enable = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Feature flag enabling autologin after boot.";
-    };
     wayland.software-renderer.enable = mkOption {
       type = types.bool;
       default = false;
@@ -43,8 +29,9 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = {
     hardware.opengl.enable = true;
+
     environment = {
       systemPackages = with pkgs; [
         gtk-engine-murrine
@@ -55,16 +42,20 @@ in {
         papirus-maia-icon-theme
 
         glib
+        xdg-utils
       ];
+
       etc = {
         "xdg/PubSolar.conf".text = ''
           [Qt]
           style=GTK+
         '';
       };
+
+      variables = sessionVariables;
     };
 
-    services.getty.autologinUser = mkIf cfg.autologin.enable (mkForce "${psCfg.user.name}");
+    services.getty.autologinUser = psCfg.user.name;
 
     qt = {
       enable = true;
@@ -72,88 +63,104 @@ in {
       style = "gtk2";
     };
 
-    # Required for running Gnome apps outside the Gnome DE, see https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME
-    programs.dconf.enable = true;
     services.udev.packages = with pkgs; [gnome3.gnome-settings-daemon];
     # Enable Sushi, a quick previewer for nautilus
     services.gnome.sushi.enable = true;
     # Enable GVfs, a userspace virtual filesystem
     services.gvfs.enable = true;
+    services.yubikey-agent.enable = true;
 
-    fonts.enableDefaultFonts = true;
-    fonts.fonts = with pkgs; [
-      fira-code
-      fira-code-symbols
-      google-fonts
-      lato
-      montserrat
-      nerdfonts
-      noto-fonts
-      noto-fonts-cjk
-      open-sans
-      powerline-fonts
-      source-sans-pro
+    fonts = {
+      packages = with pkgs; [
+        dejavu_fonts
+        powerline-fonts
+      ];
+      enableDefaultPackages = true;
+      fontconfig.enable = true;
+      fontconfig.defaultFonts = {
+        monospace = ["DejaVu Sans Mono for Powerline"];
+        sansSerif = ["DejaVu Sans"];
+      };
+    };
+
+    users.users."${psCfg.user.name}".packages = with pkgs; [
+      alacritty
+      firefox-wayland
+      flameshot
+      gnome.adwaita-icon-theme
+      gnome.eog
+      gnome.nautilus
+      gnome.seahorse
+      gnome.yelp
+      hicolor-icon-theme
+      keepassxc
+      qMasterPassword
+      libnotify
+      vlc
     ];
 
-    home-manager = with pkgs;
-      setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          alacritty
-          foot
-          ungoogled-chromium
-          firefox-wayland
+    home-manager.users."${psCfg.user.name}" = {
+      home.file."xinitrc".source = ./.xinitrc;
+      xdg.configFile."alacritty/alacritty.toml".source = tomlFormat.generate "alacritty.toml" (import ./alacritty.nix);
+      xdg.configFile."xmodmap".source = ./.config/xmodmap;
+      xdg.configFile."user-dirs.dirs".source = ./.config/user-dirs.dirs;
+      xdg.configFile."user-dirs.locale".source = ./.config/user-dirs.locale;
+      xdg.configFile."xsettingsd/xsettingsd.conf".source = ./.config/xsettingsd/xsettingsd.conf;
+      xdg.configFile."mako/config".source = ./.config/mako/config;
+      xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
+      xdg.configFile."swaync/config.json".source = ./.config/swaync/config.json;
+      xdg.configFile."swaync/style.css".source = ./.config/swaync/style.css;
+      xdg.configFile."waybar/config".source = ./.config/waybar/config;
+      xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
+      xdg.configFile."waybar/colorscheme.css".source = ./.config/waybar/colorscheme.css;
+      xdg.configFile."wallpaper.jpg".source = ./assets/wallpaper.jpg;
 
-          flameshot
-          libnotify
-          gnome.adwaita-icon-theme
-          gnome.eog
-          gnome.nautilus
-          gnome.yelp
-          hicolor-icon-theme
-
-          wine
-
-          toggle-kbd-layout
-
-          wcwd
-
-          vlc
-
-          gimp
-        ];
-
-        xdg.configFile."alacritty/alacritty.yml" = {
-          source = yamlFormat.generate "alacritty.yml" (recursiveMerge [(import ./alacritty.nix) cfg.alacritty.settings]);
-        };
-
-        gtk = {
-          enable = true;
-          font.name = "Lato";
-          iconTheme = {
-            package = pkgs.papirus-icon-theme;
-            name = "Papirus-Adapta-Nokto-Maia";
-          };
-          theme = {
-            package = pkgs.matcha-gtk-theme;
-            name = "Matcha-dark-aliz";
-          };
-
-          gtk3.extraConfig = {
-            gtk-xft-antialias = "1";
-            gtk-xft-hinting = "1";
-            gtk-xft-hintstyle = "hintfull";
-            gtk-xft-rgba = "rgb";
-            gtk-application-prefer-dark-theme = "true";
+      # Required for running Gnome apps outside the Gnome DE, see
+      # https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME
+      dconf = {
+        enable = true;
+        settings = {
+          "org/gnome/desktop/interface" = {
+            color-scheme = "prefer-dark";
           };
         };
-
-        # Fix KeepassXC rendering issue
-        # https://github.com/void-linux/void-packages/issues/23517
-        systemd.user.sessionVariables.QT_AUTO_SCREEN_SCALE_FACTOR = "0";
-
-        xresources.extraConfig = builtins.readFile ./.Xdefaults;
-
-        systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
       };
+
+      gtk = {
+        enable = true;
+        font.name = "Lato";
+        iconTheme = {
+          package = pkgs.papirus-icon-theme;
+          name = "Papirus-Adapta-Nokto-Maia";
+        };
+        theme = {
+          package = pkgs.matcha-gtk-theme;
+          name = "Matcha-dark-aliz";
+        };
+
+        gtk3.extraConfig = {
+          gtk-xft-antialias = "1";
+          gtk-xft-hinting = "1";
+          gtk-xft-hintstyle = "hintfull";
+          gtk-xft-rgba = "rgb";
+          gtk-application-prefer-dark-theme = "true";
+        };
+
+        gtk4.extraConfig = {
+          gtk-xft-antialias = "1";
+          gtk-xft-hinting = "1";
+          gtk-xft-hintstyle = "hintfull";
+          gtk-xft-rgba = "rgb";
+          gtk-application-prefer-dark-theme = "true";
+        };
+      };
+
+      xresources.extraConfig = builtins.readFile ./.Xdefaults;
+
+      systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
+
+      home.sessionVariables = sessionVariables;
+      systemd.user.sessionVariables = sessionVariables;
+    };
   };
 }

modules/graphical/sway/config/config.d/custom-keybindings.conf

@@ -2,7 +2,7 @@
 bindsym $mod+z exec --no-startup-id morc_menu
 
 # switch keyboard input language
-bindsym $mod+tab exec toggle-kbd-layout
+#bindsym $mod+tab exec toggle-kbd-layout
 
 ################################################################################################
 ## sound-section -  ##
@@ -21,6 +21,10 @@ bindsym $mod+F2 exec firefox
 bindsym $mod+F4 exec nautilus -w
 bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon
 
+# Notifications with swaynotificationcenter
+# Toggle control center
+bindsym $mod+Shift+n exec swaync-client -t -sw
+
 bindsym $mod+Shift+m exec qMasterPassword
 
 # Screenshots and screen recordings
@@ -33,3 +37,11 @@ bindsym $mod+Ctrl+r exec record-screen
 # Launcher
 set $menu exec alacritty --class launcher -e env TERMINAL_COMMAND="alacritty -e" sway-launcher
 bindsym $mod+Space exec $menu
+
+set $mode_vncclient In VNCClient mode. Press $mod+Num_Lock or $mod+Shift+Escape to return.
+bindsym $mod+Num_Lock mode "$mode_vncclient"
+bindsym $mod+Shift+Escape mode "$mode_vncclient"
+mode "$mode_vncclient" {
+    bindsym $mod+Num_Lock mode "default"
+    bindsym $mod+Shift+Escape mode "default"
+}

modules/graphical/sway/config/config.d/mode_system.conf.nix

@@ -7,22 +7,19 @@
   # Set shut down, restart and locking features
 ''
 + (
-  if psCfg.core.hibernation.enable && !psCfg.paranoia.enable
+  if psCfg.core.hibernation.enable
   then ''
     set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
   ''
-  else if psCfg.paranoia.enable
-  then ''
-    set $mode_system (e)xit, (h)ibernate, (r)eboot, (Shift+s)hutdown
-  ''
   else ''
     set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
   ''
 )
 + ''
   bindsym $mod+0 mode "$mode_system"
+
   mode "$mode_system" {
-      bindsym e exec swaymsg exit, mode "default"
+    bindsym e exec swaymsg exit, mode "default"
 ''
 + (
   if psCfg.core.hibernation.enable
@@ -31,20 +28,14 @@
   ''
   else ""
 )
-+ (
-  if !psCfg.paranoia.enable
-  then ''
++ ''
     bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
     bindsym s exec systemctl suspend, mode "default"
-  ''
-  else ""
-)
-+ ''
-      bindsym r exec systemctl reboot, mode "default"
-      bindsym Shift+s exec systemctl poweroff, mode "default"
+    bindsym r exec systemctl reboot, mode "default"
+    bindsym Shift+s exec systemctl poweroff, mode "default"
 
-      # exit system mode: "Enter" or "Escape"
-      bindsym Return mode "default"
-      bindsym Escape mode "default"
-  }
+    # exit system mode: "Enter" or "Escape"
+    bindsym Return mode "default"
+    bindsym Escape mode "default"
+}
 ''

modules/graphical/sway/config/config.d/systemd.conf

@@ -5,4 +5,5 @@
 # https://github.com/swaywm/sway/wiki/Systemd-integration
 # Also, import the most important environment variables into the D-Bus and systemd
 # user environments (e.g. required for screen sharing and Pinentry prompts):
-exec "systemctl --user import-environment; systemctl --user start sway-session.target; exec dbus-update-activation-environment --systemd $IMPORT_ENVIRONMENT_ENV_LIST DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP; systemd-cat --identifier=sway sway"
+exec "systemctl --user import-environment DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP; systemctl --user start sway-session.target; dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP"
+exec swaymsg -t subscribe '["shutdown"]' && systemctl --user stop sway-session.target

modules/graphical/sway/config/config.nix

@@ -19,7 +19,7 @@
   set $up i
   set $right l
   # Your preferred terminal emulator
-  set $term ${config.pub-solar.sway.terminal}
+  set $term ${pkgs.alacritty}/bin/alacritty
   # Your preferred application launcher
   # Note: pass the final command to swaymsg so that the resulting window can be opened
   # on the original workspace that the command was run on.

modules/graphical/sway/config/wayvnc/config.nix

@@ -0,0 +1,11 @@
+{
+  psCfg,
+  pkgs,
+}: "
+address=0.0.0.0
+enable_auth=true
+username=${psCfg.user.name}
+password=testtest
+private_key_file=/run/agenix/vnc-key.pem
+certificate_file=/run/agenix/vnc-cert.pem
+"

modules/graphical/sway/default.nix

@@ -0,0 +1,124 @@
+{
+  lib,
+  config,
+  pkgs,
+  flake,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  options.pub-solar.graphical = {
+    v4l2loopback.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "WebCam streaming tool";
+    };
+  };
+
+  config = {
+    boot = mkIf psCfg.graphical.v4l2loopback.enable {
+      extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
+      kernelModules = ["v4l2loopback"];
+      extraModprobeConfig = ''
+        options v4l2loopback exclusive_caps=1 devices=3
+      '';
+    };
+
+    environment.systemPackages = with pkgs; mkIf psCfg.graphical.v4l2loopback.enable [
+      linuxPackages.v4l2loopback
+    ];
+
+    programs.sway.enable = true;
+
+    xdg.portal = {
+      enable = true;
+      wlr = {
+        enable = true;
+        settings = {
+          screencast = {
+            max_fps = 30;
+            chooser_type = "simple";
+            chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
+          };
+        };
+      };
+      extraPortals = with pkgs; [xdg-desktop-portal-gtk];
+    };
+
+    services.pipewire.enable = true;
+
+    users.users."${psCfg.user.name}".packages = with pkgs; [
+      sway
+      grim
+      kanshi
+      slurp
+      swaybg
+      swayidle
+      swaynotificationcenter
+      xwayland
+
+      libappindicator-gtk3
+
+      wl-clipboard
+      wl-mirror
+      wf-recorder
+      brightnessctl
+      gammastep
+      geoclue2
+      xsettingsd
+      ydotool
+
+      sway-launcher
+      record-screen
+      import-gtk-settings
+      # Unused on teutat3s hosts, see custom-keybindings.conf
+      #toggle-kbd-layout
+      s
+      wcwd
+    ];
+
+    home-manager.users."${psCfg.user.name}" = {
+      imports = [
+        flake.self.inputs.wayland-pipewire-idle-inhibit.homeModules.default
+      ];
+
+      services.wayland-pipewire-idle-inhibit = {
+        enable = true;
+        package = pkgs.wayland-pipewire-idle-inhibit;
+        systemdTarget = "sway-session.target";
+        settings = {
+          verbosity = "INFO";
+          media_minimum_duration = 10;
+          idle_inhibitor = "wayland";
+          sink_whitelist = [
+            { name = "Starship/Matisse HD Audio Controller Analog Stereo"; }
+            { name = "Built-in Audio Analog Stereo"; }
+          ];
+          node_blacklist = [
+            { name = "spotify"; }
+            { app_name = "Music Player Daemon"; }
+          ];
+        };
+      };
+      programs.waybar.enable = true;
+      #programs.waybar.systemd.enable = true;
+
+      systemd.user.services.swaynotificationcenter = import ./swaynotificationcenter.service.nix pkgs;
+      systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
+      systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
+      systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
+      systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
+      systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
+
+      xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
+      xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
+      xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
+      xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
+      xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
+      xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
+      xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
+      xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
+    };
+  };
+}

modules/graphical/sway/swayidle.service.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  psCfg,
+  ...
+}: {
+  Unit = {
+    Description = "Idle manager for Wayland";
+    Documentation = ["man:swayidle(1)"];
+    BindsTo = ["graphical-session.target"];
+    Wants = ["graphical-session-pre.target"];
+    After = ["graphical-session-pre.target"];
+  };
+  Service = {
+    Type = "simple";
+    ExecStart = ''
+      ${pkgs.swayidle}/bin/swayidle -w \
+      timeout 300 '${pkgs.swaylock-bg}/bin/swaylock-bg' \
+      timeout 600 '${pkgs.sway}/bin/swaymsg "output * dpms off"' \
+        resume '${pkgs.sway}/bin/swaymsg "output * dpms on"' \
+      before-sleep '${pkgs.swaylock-bg}/bin/swaylock-bg'
+    '';
+  };
+  Install = {
+    WantedBy = ["sway-session.target"];
+  };
+}

modules/graphical/sway/swaynotificationcenter.service.nix

@@ -0,0 +1,21 @@
+pkgs: {
+  Unit = {
+    Description = "Swaync notification daemon";
+    Documentation = "https://github.com/ErikReider/SwayNotificationCenter";
+    BindsTo = ["sway-session.target"];
+    After = ["sway-session.target"];
+    Requisite = ["graphical-session.target"];
+    # ConditionEnvironment requires systemd v247 to work correctly
+    ConditionEnvironment = ["WAYLAND_DISPLAY"];
+  };
+  Service = {
+    Type = "dbus";
+    BusName = "org.freedesktop.Notifications";
+    ExecStart = "${pkgs.swaynotificationcenter}/bin/swaync";
+    ExecReload = "${pkgs.swaynotificationcenter}/bin/swaync-client --reload-config ; ${pkgs.swaynotificationcenter}/bin/swaync-client --reload-css";
+    Restart = "on-failure";
+  };
+  Install = {
+    WantedBy = ["sway-session.target"];
+  };
+}

modules/invoiceplane/default.nix

@@ -0,0 +1,362 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.invoiceplane;
+  eachSite = cfg.sites;
+  user = "invoiceplane";
+  webserver = config.services.${cfg.webserver};
+
+  invoiceplane-config = hostName: cfg: pkgs.writeText "ipconfig.php" ''
+    IP_URL=http://${hostName}
+    ENABLE_DEBUG=false
+    DISABLE_SETUP=false
+    REMOVE_INDEXPHP=false
+    DB_HOSTNAME=${cfg.database.host}
+    DB_USERNAME=${cfg.database.user}
+    # NOTE: file_get_contents adds newline at the end of returned string
+    DB_PASSWORD=${if cfg.database.passwordFile == null then "" else "trim(file_get_contents('${cfg.database.passwordFile}'),\"\\r\\n\")"}
+    DB_DATABASE=${cfg.database.name}
+    DB_PORT=${toString cfg.database.port}
+    SESS_EXPIRATION=864000
+    ENABLE_INVOICE_DELETION=false
+    DISABLE_READ_ONLY=false
+    ENCRYPTION_KEY=
+    ENCRYPTION_CIPHER=AES-256
+    SETUP_COMPLETED=false
+    REMOVE_INDEXPHP=true
+  '';
+
+  extraConfig = hostName: cfg: pkgs.writeText "extraConfig.php" ''
+    ${toString cfg.extraConfig}
+  '';
+
+  pkg = hostName: cfg: pkgs.stdenv.mkDerivation rec {
+    pname = "invoiceplane-${hostName}";
+    version = src.version;
+    src = pkgs.invoiceplane;
+
+    postPhase = ''
+      # Patch index.php file to load additional config file
+      substituteInPlace index.php \
+        --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r * $out/
+
+      # symlink uploads and log directories
+      rm -r $out/uploads $out/application/logs $out/vendor/mpdf/mpdf/tmp
+      ln -sf ${cfg.stateDir}/uploads $out/
+      ln -sf ${cfg.stateDir}/logs $out/application/
+      ln -sf ${cfg.stateDir}/tmp $out/vendor/mpdf/mpdf/
+
+      # symlink the InvoicePlane config
+      ln -s ${cfg.stateDir}/ipconfig.php $out/ipconfig.php
+
+      # symlink the extraConfig file
+      ln -s ${extraConfig hostName cfg} $out/extraConfig.php
+
+      # symlink additional templates
+      ${concatMapStringsSep "\n" (template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/") cfg.invoiceTemplates}
+    '';
+  };
+
+  siteOpts = { lib, name, ... }:
+    {
+      options = {
+
+        enable = mkEnableOption (lib.mdDoc "InvoicePlane web application");
+
+        stateDir = mkOption {
+          type = types.path;
+          default = "/var/lib/invoiceplane/${name}";
+          description = lib.mdDoc ''
+            This directory is used for uploads of attachments and cache.
+            The directory passed here is automatically created and permissions
+            adjusted as required.
+          '';
+        };
+
+        database = {
+          host = mkOption {
+            type = types.str;
+            default = "localhost";
+            description = lib.mdDoc "Database host address.";
+          };
+
+          port = mkOption {
+            type = types.port;
+            default = 3306;
+            description = lib.mdDoc "Database host port.";
+          };
+
+          name = mkOption {
+            type = types.str;
+            default = "invoiceplane";
+            description = lib.mdDoc "Database name.";
+          };
+
+          user = mkOption {
+            type = types.str;
+            default = "invoiceplane";
+            description = lib.mdDoc "Database user.";
+          };
+
+          passwordFile = mkOption {
+            type = types.nullOr types.path;
+            default = null;
+            example = "/run/keys/invoiceplane-dbpassword";
+            description = lib.mdDoc ''
+              A file containing the password corresponding to
+              {option}`database.user`.
+            '';
+          };
+
+          createLocally = mkOption {
+            type = types.bool;
+            default = true;
+            description = lib.mdDoc "Create the database and database user locally.";
+          };
+        };
+
+        invoiceTemplates = mkOption {
+          type = types.listOf types.path;
+          default = [];
+          description = lib.mdDoc ''
+            List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
+
+            ::: {.note}
+            These templates need to be packaged before use, see example.
+            :::
+          '';
+          example = literalExpression ''
+            let
+              # Let's package an example template
+              template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+                name = "vtdirektmarketing";
+                # Download the template from a public repository
+                src = pkgs.fetchgit {
+                  url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                  sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+                };
+                sourceRoot = ".";
+                # Installing simply means copying template php file to the output directory
+                installPhase = ""
+                  mkdir -p $out
+                  cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+                "";
+              };
+            # And then pass this package to the template list like this:
+            in [ template-vtdirektmarketing ]
+          '';
+        };
+
+        poolConfig = mkOption {
+          type = with types; attrsOf (oneOf [ str int bool ]);
+          default = {
+            "pm" = "dynamic";
+            "pm.max_children" = 32;
+            "pm.start_servers" = 2;
+            "pm.min_spare_servers" = 2;
+            "pm.max_spare_servers" = 4;
+            "pm.max_requests" = 500;
+          };
+          description = lib.mdDoc ''
+            Options for the InvoicePlane PHP pool. See the documentation on `php-fpm.conf`
+            for details on configuration directives.
+          '';
+        };
+
+        extraConfig = mkOption {
+          type = types.nullOr types.lines;
+          default = null;
+          example = ''
+            SETUP_COMPLETED=true
+            DISABLE_SETUP=true
+            IP_URL=https://invoice.example.com
+          '';
+          description = lib.mdDoc ''
+            InvoicePlane configuration. Refer to
+            <https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
+            for details on supported values.
+          '';
+        };
+
+        cron = {
+
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = lib.mdDoc ''
+              Enable cron service which periodically runs Invoiceplane tasks.
+              Requires key taken from the administration page. Refer to
+              <https://wiki.invoiceplane.com/en/1.0/modules/recurring-invoices>
+              on how to configure it.
+            '';
+          };
+
+          key = mkOption {
+            type = types.str;
+            description = lib.mdDoc "Cron key taken from the administration page.";
+          };
+
+        };
+
+      };
+
+    };
+in
+{
+  disabledModules = [
+    "services/web-apps/invoiceplane.nix"
+  ];
+
+  # interface
+  options = {
+    services.invoiceplane = mkOption {
+      type = types.submodule {
+
+        options.sites = mkOption {
+          type = types.attrsOf (types.submodule siteOpts);
+          default = {};
+          description = lib.mdDoc "Specification of one or more WordPress sites to serve";
+        };
+
+        options.webserver = mkOption {
+          type = types.enum [ "caddy" ];
+          default = "caddy";
+          description = lib.mdDoc ''
+            Which webserver to use for virtual host management. Currently only
+            caddy is supported.
+          '';
+        };
+      };
+      default = {};
+      description = lib.mdDoc "InvoicePlane configuration.";
+    };
+
+  };
+
+  # implementation
+  config = mkIf (eachSite != {}) (mkMerge [{
+
+    assertions = flatten (mapAttrsToList (hostName: cfg:
+      [{ assertion = cfg.database.createLocally -> cfg.database.user == user;
+        message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = ''services.invoiceplane.sites."${hostName}".database.passwordFile cannot be specified if services.invoiceplane.sites."${hostName}".database.createLocally is set to true.'';
+      }
+      { assertion = cfg.cron.enable -> cfg.cron.key != null;
+        message = ''services.invoiceplane.sites."${hostName}".cron.key must be set in order to use cron service.'';
+      }
+    ]) eachSite);
+
+    services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = mapAttrsToList (hostName: cfg: cfg.database.name) eachSite;
+      ensureUsers = mapAttrsToList (hostName: cfg:
+        { name = cfg.database.user;
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+        }
+      ) eachSite;
+    };
+
+    services.phpfpm = {
+      phpPackage = pkgs.php81;
+      pools = mapAttrs' (hostName: cfg: (
+        nameValuePair "invoiceplane-${hostName}" {
+          inherit user;
+          group = webserver.group;
+          settings = {
+            "listen.owner" = webserver.user;
+            "listen.group" = webserver.group;
+          } // cfg.poolConfig;
+        }
+      )) eachSite;
+    };
+
+  }
+
+  {
+
+    systemd.tmpfiles.rules = flatten (mapAttrsToList (hostName: cfg: [
+      "d ${cfg.stateDir} 0750 ${user} ${webserver.group} - -"
+      "f ${cfg.stateDir}/ipconfig.php 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/logs 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads/archive 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads/customer_files 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads/temp 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads/temp/mpdf 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/tmp 0750 ${user} ${webserver.group} - -"
+    ]) eachSite);
+
+    systemd.services.invoiceplane-config = {
+      serviceConfig.Type = "oneshot";
+      script = concatStrings (mapAttrsToList (hostName: cfg:
+        ''
+          mkdir -p ${cfg.stateDir}/logs \
+                   ${cfg.stateDir}/uploads
+          if ! grep -q IP_URL "${cfg.stateDir}/ipconfig.php"; then
+            cp "${invoiceplane-config hostName cfg}" "${cfg.stateDir}/ipconfig.php"
+          fi
+        '') eachSite);
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    users.users.${user} = {
+      group = webserver.group;
+      isSystemUser = true;
+    };
+
+  }
+  {
+
+    # Cron service implementation
+
+    systemd.timers = mapAttrs' (hostName: cfg: (
+      nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnBootSec = "5m";
+          OnUnitActiveSec = "5m";
+          Unit = "invoiceplane-cron-${hostName}.service";
+        };
+      })
+    )) eachSite;
+
+    systemd.services =
+      mapAttrs' (hostName: cfg: (
+        nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
+          serviceConfig = {
+            Type = "oneshot";
+            User = user;
+            ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
+          };
+        })
+    )) eachSite;
+
+  }
+
+  (mkIf (cfg.webserver == "caddy") {
+    services.caddy = {
+      enable = true;
+      virtualHosts = mapAttrs' (hostName: cfg: (
+        nameValuePair "http://${hostName}" {
+          extraConfig = ''
+            root * ${pkg hostName cfg}
+            file_server
+            php_fastcgi unix/${config.services.phpfpm.pools."invoiceplane-${hostName}".socket}
+          '';
+        }
+      )) eachSite;
+    };
+  })
+
+  ]);
+}

modules/nextcloud/default.nix

@@ -6,16 +6,8 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.nextcloud;
 in {
-  options.pub-solar.nextcloud = {
-    enable = mkEnableOption "Life in sync";
-  };
-
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
-      };
+  home-manager.users."${psCfg.user.name}" = {
+    systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
   };
 }

modules/nix-path.nix

@@ -1,11 +0,0 @@
-{
-  channel,
-  inputs,
-  ...
-}: {
-  nix.nixPath = [
-    "nixpkgs=${channel.input}"
-    "nixos-config=${../lib/compat/nixos}"
-    "home-manager=${inputs.home}"
-  ];
-}

modules/nix/default.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  lib,
+  flake,
+  ...
+}: {
+  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+    "1password"
+    "1password-cli"
+    "brscan5"
+    "brscan5-etc-files"
+    "facetimehd-firmware"
+    "slack"
+    "veracrypt"
+    "zoom"
+  ];
+
+  system.activationScripts.diff-closures = {
+    text =''
+      if [[ -e /run/current-system ]]; then
+        ${config.nix.package}/bin/nix store diff-closures \
+          /run/current-system "$systemConfig" \
+          --extra-experimental-features nix-command
+      fi
+    '';
+    supportsDryActivation = true;
+  };
+
+  nix = {
+    # Use default version alias for nix package
+    package = pkgs.nixVersions.nix_2_21;
+    gc.automatic = true;
+    optimise.automatic = true;
+
+    registry = {
+      nixpkgs.flake = flake.inputs.nixpkgs;
+      #unstable.flake = flake.inputs.unstable;
+      master.flake = flake.inputs.master;
+      system.flake = flake.self;
+    };
+
+
+    settings = {
+      # Improve nix store disk usage
+      auto-optimise-store = true;
+      # Prevents impurities in builds
+      sandbox = true;
+      # Give root and @wheel special privileges with nix
+      trusted-users = ["root" "@wheel"];
+      # Allow only group wheel to connect to the nix daemon
+      allowed-users = ["@wheel"];
+
+      substituters = [
+        "https://pub-solar.cachix.org/"
+      ];
+
+      trusted-public-keys = [
+        "pub-solar.cachix.org-1:ZicXIxKgdxMtgSJECWR8iihZxHRvu8ObL4n2cuBmtos="
+      ];
+    };
+
+    # Generally useful nix option defaults
+    extraOptions = lib.mkForce ''
+      experimental-features = flakes nix-command
+      min-free = 536870912
+      keep-outputs = true
+      keep-derivations = true
+      fallback = true
+    '';
+
+    nixPath = [
+      "nixpkgs=${flake.inputs.nixpkgs}"
+      "nixos-config=${../../lib/compat/nixos}"
+      "home-manager=${flake.inputs.home-manager}"
+    ];
+  };
+}

modules/office/default.nix

@@ -6,27 +6,15 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.office;
 in {
-  options.pub-solar.office = {
-    enable = mkEnableOption "Install office programs, also enables printing server";
-  };
+  programs.evince.enable = true;
 
-  config = mkIf cfg.enable {
-    pub-solar.printing.enable = true;
-
-    # Gnome PDF viewer
-    programs.evince.enable = true;
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          libreoffice-fresh
-          gnome.simple-scan
-          # Tools like pdfunite
-          poppler_utils
-          # tool for annotating PDFs
-          xournalpp
-        ];
-      };
-  };
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    libreoffice-fresh
+    gnome.simple-scan
+    # Tools like pdfunite
+    poppler_utils
+    # tool for annotating PDFs
+    xournalpp
+  ];
 }

modules/paranoia/default.nix

@@ -1,53 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.paranoia;
-in {
-  options.pub-solar.paranoia = {
-    enable = mkOption {
-      description = ''
-        Only offer hibernation instead of screen locking and sleeping. This only makes sense
-        if your hard drive is encrypted, and ensures that the contents of your drive are
-        encrypted if you are not actively using the device.
-      '';
-      default = false;
-      type = types.bool;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    pub-solar.core.hibernation.enable = true;
-    services.logind.lidSwitch = "hibernate";
-
-    # The options below are directly taken from or inspired by
-    # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
-
-    # Don't set this if you need sftp
-    services.openssh.allowSFTP = false;
-    services.openssh.openFirewall = false; # Lock yourself out
-
-    # Limit the use of sudo to the group wheel
-    security.sudo.execWheelOnly = true;
-
-    # Remove the complete default environment of packages like
-    # nano, perl and rsync
-    environment.defaultPackages = lib.mkForce [];
-
-    # fileSystems."/".options = [ "noexec" ];
-
-    services.openssh = {
-      kbdInteractiveAuthentication = false;
-      extraConfig = ''
-        AllowTcpForwarding yes
-        X11Forwarding no
-        AllowAgentForwarding no
-        AllowStreamLocalForwarding no
-        AuthenticationMethods publickey
-      '';
-    };
-  };
-}