fix: avoid endlessly compiling deploy-rs

Reviewed-on: #262

.drone.yml

@@ -1,7 +1,7 @@
 ---
 kind: pipeline
 type: exec
-name: Check
+name: Check and deploy
 node:
   hosttype: baremetal
 
@@ -17,7 +17,27 @@ steps:
       - nix $$NIX_FLAGS develop --command nix flake show
       - nix $$NIX_FLAGS develop --command treefmt --fail-on-change
       - nix $$NIX_FLAGS develop --command editorconfig-checker
-      - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
+      - nix $$NIX_FLAGS build ".#nixosConfigurations.pioneer-momo-koeln.config.system.build.toplevel"
+
+  - name: "Deploy"
+    when:
+      event:
+        - push
+      branch:
+        - momo/main
+    environment:
+      NIX_FLAGS: "--print-build-logs --verbose --accept-flake-config"
+      PRIVATE_SSH_KEY:
+        from_secret: ci_private_ssh_key
+      SSH_HOST_KEY: "80.244.242.4 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFAMFmC8BNq08QLKQLyT139qzh7jIF5yOY32fCHiCMg5"
+    commands:
+      - mkdir $$HOME/.ssh && chmod 700 $$HOME/.ssh
+      - echo "$$PRIVATE_SSH_KEY" > $$HOME/.ssh/id_ed25519 && chmod 600 $$HOME/.ssh/id_ed25519
+      - echo "$$SSH_HOST_KEY" > $$HOME/.ssh/known_hosts
+      # SSH uses HOME from /etc/passwd, not from the environment, so override it
+      - export SSHOPTS="-o UserKnownHostsFile=$$HOME/.ssh/known_hosts -i $$HOME/.ssh/id_ed25519"
+      - "echo DEBUG: Using NIX_FLAGS: $$NIX_FLAGS"
+      - nix $$NIX_FLAGS develop --command deploy --magic-rollback false --skip-checks --targets '.#pioneer-momo-koeln' --ssh-opts="$$SSHOPTS"
 
 ---
 kind: pipeline
@@ -78,9 +98,6 @@ steps:
         from_secret: matrix_password
       template: "Test run triggered by tag: {{ build.tag }}. Test run exit status: {{ build.status }}. Artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/ci/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}/foot_wayland_info.png"
 
-depends_on:
-  - Tests
-
 trigger:
   ref:
     - refs/tags/v*
@@ -134,9 +151,6 @@ steps:
       unlink_first: true
       strip_components: 3
 
-depends_on:
-  - Check
-
 trigger:
   branch:
     - main
@@ -149,6 +163,6 @@ volumes:
 
 ---
 kind: signature
-hmac: a116f78a0b22188052893bdb46aa40f8de66438826c10ced362ea183d7644d67
+hmac: 8648f3838e519e4b493107ed02efafd59670337346db7e198d4058437a9a5622
 
 ...

flake.lock

@@ -3,18 +3,22 @@
     "agenix": {
       "inputs": {
         "darwin": [
-          "darwin"
+          "nix-darwin"
+        ],
+        "home-manager": [
+          "home-manager"
         ],
         "nixpkgs": [
-          "nixos"
-        ]
+          "nixpkgs"
+        ],
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1682101079,
-        "narHash": "sha256-MdAhtjrLKnk2uiqun1FWABbKpLH090oeqCSiWemtuck=",
+        "lastModified": 1703433843,
+        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "2994d002dcff5353ca1ac48ec584c7f6589fe447",
+        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
         "type": "github"
       },
       "original": {
@@ -23,42 +27,22 @@
         "type": "github"
       }
     },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "nixos"
-        ]
-      },
-      "locked": {
-        "lastModified": 1696360011,
-        "narHash": "sha256-HpPv27qMuPou4acXcZ8Klm7Zt0Elv9dgDvSJaomWb9Y=",
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "rev": "8b6ea26d5d2e8359d06278364f41fbc4b903b28a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "deploy": {
+    "deploy-rs": {
       "inputs": {
         "flake-compat": [
           "flake-compat"
         ],
         "nixpkgs": [
-          "nixos"
+          "nixpkgs"
         ],
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1695052866,
-        "narHash": "sha256-agn7F9Oww4oU6nPiw+YiYI9Xb4vOOE73w8PAoBRP4AA=",
+        "lastModified": 1703087360,
+        "narHash": "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "e3f41832680801d0ee9e2ed33eb63af398b090e9",
+        "rev": "b709d63debafce9f5645a5ba550c9e0983b3d1f7",
         "type": "github"
       },
       "original": {
@@ -69,18 +53,21 @@
     },
     "devshell": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
-          "digga",
+          "erpnext",
           "nixpkgs"
+        ],
+        "systems": [
+          "erpnext",
+          "systems"
         ]
       },
       "locked": {
-        "lastModified": 1671489820,
-        "narHash": "sha256-qoei5HDJ8psd1YUPD7DhbHdhLIT9L2nadscp4Qk37uk=",
+        "lastModified": 1701787589,
+        "narHash": "sha256-ce+oQR4Zq9VOsLoh9bZT8Ip9PaMLcjjBUHVPzW5d7Cw=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "5aa3a8039c68b4bf869327446590f4cdf90bb634",
+        "rev": "44ddedcbcfc2d52a76b64fb6122f209881bd3e1e",
         "type": "github"
       },
       "original": {
@@ -89,54 +76,40 @@
         "type": "github"
       }
     },
-    "digga": {
+    "erpnext": {
       "inputs": {
-        "darwin": [
-          "darwin"
-        ],
-        "deploy": [
-          "deploy"
+        "agenix": [
+          "agenix"
         ],
         "devshell": "devshell",
-        "flake-compat": [
-          "flake-compat"
-        ],
-        "flake-utils": "flake-utils_2",
-        "flake-utils-plus": "flake-utils-plus",
-        "home-manager": [
-          "home"
-        ],
-        "nixlib": [
-          "nixos"
-        ],
         "nixpkgs": [
-          "nixos"
+          "nixpkgs"
         ],
-        "nixpkgs-unstable": "nixpkgs-unstable"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1674947971,
-        "narHash": "sha256-6gKqegJHs72jnfFP9g2sihl4fIZgtKgKuqU2rCkIdGY=",
-        "owner": "pub-solar",
-        "repo": "digga",
-        "rev": "2da608bd8afb48afef82c6b1b6d852a36094a497",
-        "type": "github"
+        "lastModified": 1704557841,
+        "narHash": "sha256-KpAkdJnY1NV21zRRd8Tncw6nBerSv50qmz6pSpjsxLg=",
+        "ref": "main",
+        "rev": "7fc327263630e2f5ce693e8569a1072bd0cea67b",
+        "revCount": 49,
+        "type": "git",
+        "url": "https://git.pub.solar/axeman/erpnext-nix"
       },
       "original": {
-        "owner": "pub-solar",
-        "ref": "fix/bootstrap-iso",
-        "repo": "digga",
-        "type": "github"
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pub.solar/axeman/erpnext-nix"
       }
     },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -145,134 +118,88 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "locked": {
-        "lastModified": 1642700792,
-        "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils-plus": {
+    "flake-parts": {
       "inputs": {
-        "flake-utils": [
-          "digga",
-          "flake-utils"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1654029967,
-        "narHash": "sha256-my3GQ3mQIw/1f6GPV1IhUZrcYQSWh0YJAMPNBjhXJDw=",
-        "owner": "gytis-ivaskevicius",
-        "repo": "flake-utils-plus",
-        "rev": "6271cf3842ff9c8a9af9e3508c547f86bc77d199",
+        "lastModified": 1704152458,
+        "narHash": "sha256-DS+dGw7SKygIWf9w4eNBUZsK+4Ug27NwEWmn2tnbycg=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "88a2cd8166694ba0b6cb374700799cec53aef527",
         "type": "github"
       },
       "original": {
-        "owner": "gytis-ivaskevicius",
-        "ref": "refs/pull/120/head",
-        "repo": "flake-utils-plus",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "fork": {
-      "locked": {
-        "lastModified": 1692960587,
-        "narHash": "sha256-39SKGdhn8jKKkdqhULbCvQOpdUPE9NNJpy5HTB++Jvg=",
-        "owner": "teutat3s",
-        "repo": "nixpkgs",
-        "rev": "312709dd70684f52496580e533d58645526b1c90",
-        "type": "github"
-      },
-      "original": {
-        "owner": "teutat3s",
-        "ref": "nvfetcher-fix",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "home": {
+    "home-manager": {
       "inputs": {
         "nixpkgs": [
-          "nixos"
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1695108154,
-        "narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=",
+        "lastModified": 1704099619,
+        "narHash": "sha256-QRVMkdxLmv+aKGjcgeEg31xtJEIsYq4i1Kbyw5EPS6g=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "07682fff75d41f18327a871088d20af2710d4744",
+        "rev": "7e398b3d76bc1503171b1364c9d4a07ac06f3851",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-23.05",
+        "ref": "release-23.11",
         "repo": "home-manager",
         "type": "github"
       }
     },
-    "latest": {
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1696604326,
-        "narHash": "sha256-YXUNI0kLEcI5g8lqGMb0nh67fY9f2YoJsILafh6zlMo=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "87828a0e03d1418e848d3dd3f3014a632e4a4f64",
+        "lastModified": 1704277720,
+        "narHash": "sha256-meAKNgmh3goankLGWqqpw73pm9IvXjEENJloF0coskE=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "0dd382b70c351f528561f71a0a7df82c9d2be9a4",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
         "type": "github"
       }
     },
-    "nixos": {
+    "nixos-flake": {
       "locked": {
-        "lastModified": 1696697597,
-        "narHash": "sha256-q26Qv4DQ+h6IeozF2o1secyQG0jt2VUT3V0K58jr3pg=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "5a237aecb57296f67276ac9ab296a41c23981f56",
+        "lastModified": 1702145288,
+        "narHash": "sha256-apVeRT0kOnDejwwBwbwNccm+qq1l6+qUOiRKE0vK5qk=",
+        "owner": "srid",
+        "repo": "nixos-flake",
+        "rev": "4e422edf6b511f8e214b392cf1a0d4707a0399a4",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-23.05",
-        "repo": "nixpkgs",
+        "owner": "srid",
+        "repo": "nixos-flake",
         "type": "github"
       }
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1696614066,
-        "narHash": "sha256-nAyYhO7TCr1tikacP37O9FnGr2USOsVBD3IgvndUYjM=",
+        "lastModified": 1704632650,
+        "narHash": "sha256-83J/nd/NoLqo3vj0S0Ppqe8L+ijIFiGL6HNDfCCUD/Q=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "bb2db418b616fea536b1be7f6ee72fb45c11afe0",
+        "rev": "c478b3d56969006e015e55aaece4931f3600c1b2",
         "type": "github"
       },
       "original": {
@@ -281,17 +208,35 @@
         "type": "github"
       }
     },
-    "nixpkgs-unstable": {
+    "nixpkgs": {
       "locked": {
-        "lastModified": 1672791794,
-        "narHash": "sha256-mqGPpGmwap0Wfsf3o2b6qHJW1w2kk/I6cGCGIU+3t6o=",
+        "lastModified": 1704420045,
+        "narHash": "sha256-C36QmoJd5tdQ5R9MC1jM7fBkZW9zBUqbUCsgwS6j4QU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9813adc7f7c0edd738c6bdd8431439688bb0cb3d",
+        "rev": "c1be43e8e837b8dbee2b3665a007e761680f0c3d",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "dir": "lib",
+        "lastModified": 1703961334,
+        "narHash": "sha256-M1mV/Cq+pgjk0rt6VxoyyD+O8cOUiai8t9Q6Yyq4noY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b0d36bd0a420ecee3bc916c91886caca87c894e9",
+        "type": "github"
+      },
+      "original": {
+        "dir": "lib",
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -300,24 +245,89 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "darwin": "darwin",
-        "deploy": "deploy",
-        "digga": "digga",
+        "deploy-rs": "deploy-rs",
+        "erpnext": "erpnext",
         "flake-compat": "flake-compat",
-        "fork": "fork",
-        "home": "home",
-        "latest": "latest",
-        "nixos": "nixos",
-        "nixos-hardware": "nixos-hardware"
+        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
+        "nix-darwin": "nix-darwin",
+        "nixos-flake": "nixos-flake",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs",
+        "unstable": "unstable"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "unstable": {
+      "locked": {
+        "lastModified": 1704538339,
+        "narHash": "sha256-1734d3mQuux9ySvwf6axRWZRBhtcZA9Q8eftD6EZg6U=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "46ae0210ce163b3cba6c7da08840c1d63de9c701",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
       "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,175 +1,100 @@
 {
-  description = "A highly structured configuration database.";
+  description = "Momo infra in nix";
 
   nixConfig.extra-experimental-features = "nix-command flakes";
 
   inputs = {
     # Track channels with commits tested and built by hydra
-    nixos.url = "github:nixos/nixpkgs/nixos-23.05";
-    latest.url = "github:nixos/nixpkgs/nixos-unstable";
-
-    fork.url = "github:teutat3s/nixpkgs/nvfetcher-fix";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
+    unstable.url = "github:nixos/nixpkgs/nixos-unstable";
 
     flake-compat.url = "github:edolstra/flake-compat";
     flake-compat.flake = false;
 
-    digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
-    digga.inputs.nixpkgs.follows = "nixos";
-    digga.inputs.nixlib.follows = "nixos";
-    digga.inputs.home-manager.follows = "home";
-    digga.inputs.deploy.follows = "deploy";
-    digga.inputs.darwin.follows = "darwin";
-    digga.inputs.flake-compat.follows = "flake-compat";
+    nix-darwin.url = "github:lnl7/nix-darwin/master";
+    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
 
-    home.url = "github:nix-community/home-manager/release-23.05";
-    home.inputs.nixpkgs.follows = "nixos";
+    home-manager.url = "github:nix-community/home-manager/release-23.11";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    darwin.url = "github:LnL7/nix-darwin";
-    darwin.inputs.nixpkgs.follows = "nixos";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    nixos-flake.url = "github:srid/nixos-flake";
 
-    deploy.url = "github:serokell/deploy-rs";
-    deploy.inputs.nixpkgs.follows = "nixos";
-    deploy.inputs.flake-compat.follows = "flake-compat";
+    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    deploy-rs.inputs.flake-compat.follows = "flake-compat";
 
     agenix.url = "github:ryantm/agenix";
-    agenix.inputs.nixpkgs.follows = "nixos";
-    agenix.inputs.darwin.follows = "darwin";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
+    agenix.inputs.darwin.follows = "nix-darwin";
+    agenix.inputs.home-manager.follows = "home-manager";
 
     nixos-hardware.url = "github:nixos/nixos-hardware";
+
+    erpnext.url = "git+https://git.pub.solar/axeman/erpnext-nix?ref=main";
+    erpnext.inputs.nixpkgs.follows = "nixpkgs";
+    erpnext.inputs.agenix.follows = "agenix";
   };
 
-  outputs = {
-    self,
-    digga,
-    nixos,
-    home,
-    nixos-hardware,
-    agenix,
-    deploy,
+  outputs = inputs @ {self, ...}:
+    inputs.flake-parts.lib.mkFlake {inherit inputs;} {
+      debug = true;
+      systems = [
+        "x86_64-linux"
+      ];
+
+      imports = [
+        inputs.nixos-flake.flakeModule
+        ./lib
+        ./modules
+        ./hosts
+        ./users
+        ./overlays
+      ];
+
+      perSystem = args @ {
+        system,
+        pkgs,
+        config,
         ...
-  } @ inputs:
-    digga.lib.mkFlake
-    {
-      inherit self inputs;
-
-      channelsConfig = {
-        # allowUnfree = true;
-      };
-
-      supportedSystems = ["x86_64-linux" "aarch64-linux" "aarch64-darwin"];
-
-      channels = {
-        nixos = {
-          imports = [(digga.lib.importOverlays ./overlays)];
+      }: {
+        _module.args = {
+          inherit inputs;
+          pkgs = import inputs.nixpkgs {
+            inherit system;
             overlays = [
-            (self: super: {
-              deploy-rs = {
-                inherit (inputs.nixos.legacyPackages.x86_64-linux) deploy-rs;
-                lib = inputs.deploy.lib.x86_64-linux;
-              };
-            })
+              inputs.agenix.overlays.default
             ];
           };
-        latest = {};
-        fork = {};
+          unstable = import inputs.unstable {inherit system;};
         };
 
-      lib = import ./lib {lib = digga.lib // nixos.lib;};
-
-      sharedOverlays = [
-        (final: prev: {
-          __dontExport = true;
-          lib = prev.lib.extend (lfinal: lprev: {
-            our = self.lib;
-          });
-        })
-        agenix.overlays.default
-
-        (import ./pkgs)
-      ];
-
-      nixos = {
-        hostDefaults = {
-          system = "x86_64-linux";
-          channelName = "nixos";
-          imports = [(digga.lib.importExportableModules ./modules)];
-          modules = [
-            {lib.our = self.lib;}
-            # FIXME: upstream module causes a huge number of unnecessary
-            # dependencies to be pulled in for all systems -- many of them are
-            # graphical. should only be imported as needed.
-            # digga.nixosModules.bootstrapIso
-            digga.nixosModules.nixConfig
-            home.nixosModules.home-manager
-            agenix.nixosModules.age
-          ];
-        };
-
-        imports = [(digga.lib.importHosts ./hosts)];
-        hosts = {
-          # Set host-specific properties here
-          bootstrap = {
-            modules = [
-              digga.nixosModules.bootstrapIso
-            ];
-          };
-          PubSolarOS = {
-            tests = [
-              #(import ./tests/first-test.nix {
-              #  pkgs = nixos.legacyPackages.x86_64-linux;
-              #  lib = nixos.lib;
-              #})
+        devShells.default = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            deploy-rs
+            drone-cli
+            nixpkgs-fmt
+            agenix
+            cachix
+            editorconfig-checker
+            nodePackages.prettier
+            nvfetcher
+            shellcheck
+            shfmt
+            alejandra
+            treefmt
+            nixos-generators
           ];
         };
       };
-        importables = rec {
-          profiles =
-            digga.lib.rakeLeaves ./profiles
-            // {
-              users = digga.lib.rakeLeaves ./users;
-            };
-          suites = with profiles; rec {
-            base = [users.pub-solar users.root];
-            iso = base ++ [base-user graphical pub-solar-iso];
-            pubsolaros = [full-install base-user users.root];
-            anonymous = [pubsolaros users.pub-solar];
-          };
-        };
-      };
 
-      home = {
-        imports = [(digga.lib.importExportableModules ./users/modules)];
-        modules = [];
-        importables = rec {
-          profiles = digga.lib.rakeLeaves ./users/profiles;
-          suites = with profiles; rec {
-            base = [direnv git];
+      flake = {
+        deploy.nodes = self.lib.deploy.mkDeployNodes self.nixosConfigurations {
+          pioneer-momo-koeln = {
+            hostname = "80.244.242.4";
+            sshUser = "barkeeper";
           };
         };
-        users = {
-          pub-solar = {suites, ...}: {
-            imports = suites.base;
-
-            home.stateVersion = "21.03";
-          };
-        }; # digga.lib.importers.rakeLeaves ./users/hm;
-      };
-
-      devshell = ./shell;
-
-      homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
-
-      deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
-        #example = {
-        #  hostname = "example.com:22";
-        #  sshUser = "bartender";
-        #  fastConnect = true;
-        #  profilesOrder = ["system" "direnv"];
-        #  profiles.direnv = {
-        #    user = "bartender";
-        #    path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.bartender;
-        #  };
-        #};
       };
     };
 }

hosts/PubSolarOS.nix

@@ -1,21 +0,0 @@
-{suites, ...}: {
-  ### root password is empty by default ###
-  ### default password: pub-solar, optional: add your SSH keys
-  imports =
-    suites.iso;
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.networkmanager.enable = true;
-
-  fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.05"; # Did you read the comment?
-}

hosts/bootstrap.nix

@@ -1,54 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  profiles,
-  ...
-}:
-with lib; let
-  # Gets hostname of host to be bundled inside iso
-  # Copied from https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L3-L11
-  getFqdn = config: let
-    net = config.networking;
-    fqdn =
-      if (net ? domain) && (net.domain != null)
-      then "${net.hostName}.${net.domain}"
-      else net.hostName;
-  in
-    fqdn;
-in {
-  # build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
-  imports = [
-    # profiles.networking
-    profiles.users.root # make sure to configure ssh keys
-    profiles.users.pub-solar
-    profiles.base-user
-    profiles.graphical
-    profiles.pub-solar-iso
-  ];
-
-  config = {
-    boot.loader.systemd-boot.enable = true;
-
-    # will be overridden by the bootstrapIso instrumentation
-    fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
-
-    system.nixos.label = "PubSolarOS-" + config.system.nixos.version;
-
-    # mkForce because a similar transformation gets double applied otherwise
-    # https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L17
-    # https://github.com/NixOS/nixpkgs/blob/aecd4d8349b94f9bd5718c74a5b789f233f67326/nixos/modules/installer/cd-dvd/installation-cd-base.nix#L21-L22
-    isoImage = {
-      isoBaseName = mkForce (getFqdn config);
-      isoName = mkForce "${config.system.nixos.label}-${config.isoImage.isoBaseName}-${pkgs.stdenv.hostPlatform.system}.iso";
-    };
-
-    # This value determines the NixOS release from which the default
-    # settings for stateful data, like file locations and database versions
-    # on your system were taken. It‘s perfectly fine and recommended to leave
-    # this value at the release version of the first install of this system.
-    # Before changing this value read the documentation for this option
-    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-    system.stateVersion = "21.05"; # Did you read the comment?
-  };
-}

hosts/default.nix

@@ -0,0 +1,19 @@
+{
+  self,
+  inputs,
+  ...
+}: {
+  flake = {
+    nixosConfigurations = {
+      pioneer-momo-koeln = self.nixos-flake.lib.mkLinuxSystem {
+        nixpkgs.hostPlatform = "x86_64-linux";
+        imports = [
+          self.nixosModules.base
+          ./pioneer-momo-koeln
+          self.nixosModules.barkeeper
+          inputs.erpnext.nixosModules.erpnext
+        ];
+      };
+    };
+  };
+}

hosts/pioneer-momo-koeln/caddy.nix

@@ -0,0 +1,18 @@
+{config, ...}: {
+  services.caddy = {
+    enable = true;
+    email = "wg-tooling@list.momo.koeln";
+    virtualHosts = {
+      "auth.momo.koeln" = {
+        logFormat = ''
+          output discard
+        '';
+        extraConfig = ''
+          reverse_proxy :8080
+        '';
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [80 443];
+}

hosts/pioneer-momo-koeln/configuration.nix

@@ -0,0 +1,37 @@
+{
+  config,
+  latestModulesPath,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    ./caddy.nix
+    ./keycloak.nix
+    ./erpnext.nix
+  ];
+
+  time.timeZone = "Europe/Berlin";
+
+  networking = {
+    useDHCP = false;
+
+    interfaces.enp1s0.ipv4.addresses = [
+      {
+        address = "80.244.242.4";
+        prefixLength = 29;
+      }
+    ];
+
+    defaultGateway = "80.244.242.1";
+    nameservers = ["95.129.51.51" "80.244.244.244"];
+  };
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  system.stateVersion = "22.05";
+}

hosts/pioneer-momo-koeln/default.nix

@@ -0,0 +1,6 @@
+{...}: {
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+  ];
+}

hosts/pioneer-momo-koeln/erpnext.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  inputs,
+  pkgs,
+  flake,
+  ...
+}: {
+  age.secrets.erpnext-admin-password = {
+    file = "${flake.self}/secrets/erpnext-admin-password.age";
+    mode = "700";
+    owner = "erpnext";
+  };
+  age.secrets.erpnext-db-root-password = {
+    file = "${flake.self}/secrets/erpnext-db-root-password.age";
+    mode = "700";
+    owner = "erpnext";
+  };
+  age.secrets.erpnext-db-user-password = {
+    file = "${flake.self}/secrets/erpnext-db-user-password.age";
+    mode = "700";
+    owner = "erpnext";
+  };
+
+  # erpnext
+  services.erpnext = {
+    enable = true;
+    domain = "erp.momo.koeln";
+
+    # Secrets
+    adminPasswordFile = config.age.secrets.erpnext-admin-password.path;
+    database.rootPasswordFile = config.age.secrets.erpnext-db-root-password.path;
+    database.userPasswordFile = config.age.secrets.erpnext-db-user-password.path;
+
+    # Required to enable caddy
+    caddy = {};
+  };
+}

hosts/pioneer-momo-koeln/hardware-configuration.nix

@@ -0,0 +1,54 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    devices = ["/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-1"];
+  };
+
+  boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.kernelModules = ["kvm-intel"];
+  boot.extraModulePackages = [];
+
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-uuid/bf890962-9f43-4c44-a0df-64cabd303662";
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/7eb8989a-6ec4-405f-8810-06486f7621c1";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/1fd053f8-725b-418d-aed1-aee71dac2b62";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    {device = "/dev/disk/by-uuid/2f114633-5b71-46ab-88be-997b27927269";}
+  ];
+
+  networking = {
+    defaultGateway = {
+      address = "80.244.242.1";
+      interface = "enp1s0";
+    };
+    nameservers = ["95.129.51.51" "80.244.244.244"];
+    interfaces.enp1s0 = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = "80.244.242.4";
+          prefixLength = 29;
+        }
+      ];
+    };
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/pioneer-momo-koeln/keycloak.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  inputs,
+  pkgs,
+  flake,
+  ...
+}: {
+  age.secrets.keycloak-database-password = {
+    file = "${flake.self}/secrets/keycloak-database-password.age";
+    mode = "700";
+  };
+
+  # keycloak
+  services.keycloak = {
+    enable = true;
+    database.passwordFile = config.age.secrets.keycloak-database-password.path;
+    settings = {
+      hostname = "auth.momo.koeln";
+      http-host = "127.0.0.1";
+      http-port = 8080;
+      proxy = "edge";
+    };
+  };
+}

lib/add-local-hostname.nix

@@ -0,0 +1,4 @@
+{lib}: hostnames: {
+  "127.0.0.1" = hostnames;
+  "::1" = hostnames;
+}

lib/default.nix

@@ -1,10 +1,21 @@
-{lib}:
-lib.makeExtensible (self: let
-  callLibs = file: import file {lib = self;};
+{
+  lib,
+  inputs,
+  ...
+}: {
+  # Configuration common to all Linux systems
+  flake = {
+    lib = let
+      callLibs = file: import file {inherit lib;};
     in rec {
       ## Define your own library functions here!
       #id = x: x;
       ## Or in files, containing functions that take {lib}
       #foo = callLibs ./foo.nix;
       ## In configs, they can be used under "lib.our"
-})
+
+      deploy = import ./deploy.nix {inherit inputs lib;};
+      addLocalHostname = callLibs ./add-local-hostname.nix;
+    };
+  };
+}

lib/deploy.nix

@@ -0,0 +1,74 @@
+/*
+* The contents of this file are adapted from digga
+* https://github.com/divnix/digga
+*
+* Licensed under the MIT license
+*/
+{
+  lib,
+  inputs,
+}: let
+  # https://github.com/serokell/deploy-rs#overall-usage
+  system = "x86_64-linux";
+  pkgs = import inputs.nixpkgs { inherit system; };
+  deployPkgs = import inputs.nixpkgs {
+    inherit system;
+    overlays = [
+      inputs.deploy-rs.overlay
+      (self: super: { deploy-rs = { inherit (pkgs) deploy-rs; lib = super.deploy-rs.lib; }; })
+    ];
+  };
+  getFqdn = c: let
+    net = c.config.networking;
+    fqdn =
+      if (net ? domain) && (net.domain != null)
+      then "${net.hostName}.${net.domain}"
+      else net.hostName;
+  in
+    fqdn;
+in {
+  mkDeployNodes = systemConfigurations: extraConfig:
+  /*
+  *
+  Synopsis: mkNodes _systemConfigurations_ _extraConfig_
+
+  Generate the `nodes` attribute expected by deploy-rs
+  where _systemConfigurations_ are `nodes`.
+
+  _systemConfigurations_ should take the form of a flake's
+  _nixosConfigurations_. Note that deploy-rs does not currently support
+  deploying to darwin hosts.
+
+  _extraConfig_, if specified, will be merged into each of the
+  nodes' configurations.
+
+  Example _systemConfigurations_ input:
+
+  ```
+  {
+  hostname-1 = {
+  fastConnection = true;
+  sshOpts = [ "-p" "25" ];
+  };
+  hostname-2 = {
+  sshOpts = [ "-p" "19999" ];
+  sshUser = "root";
+  };
+  }
+  ```
+  *
+  */
+    lib.recursiveUpdate
+    (lib.mapAttrs
+      (
+        _: c: {
+          hostname = getFqdn c;
+          profiles.system = {
+            user = "root";
+            path = deployPkgs.deploy-rs.lib.activate.nixos c;
+          };
+        }
+      )
+      systemConfigurations)
+    extraConfig;
+}

modules/adb/default.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  programs.adb.enable = true;
+
+  users.users."${psCfg.user.name}" = {
+    extraGroups = ["adbusers"];
+  };
+}

modules/arduino/default.nix

@@ -6,22 +6,12 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.devops;
 in {
-  options.pub-solar.arduino = {
-    enable = mkEnableOption "Life with home automation";
-  };
-  config = mkIf cfg.enable {
-    users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
+  users.users."${psCfg.user.name}" = {
     extraGroups = ["dialout"];
-    };
-
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
+    packages = with pkgs; [
       arduino
       arduino-cli
     ];
   };
-  };
 }

modules/audio/default.nix

@@ -6,31 +6,11 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.audio;
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 in {
-  options.pub-solar.audio = {
-    enable = mkEnableOption "Life in highs and lows";
-    mopidy.enable = mkEnableOption "Life with mopidy";
-    spotify.enable = mkEnableOption "Life in DRM";
-    spotify.username = mkOption {
-      description = "Spotify login username or email";
-      type = types.str;
-      example = "yourname@example.com";
-      default = "";
-    };
-    bluetooth.enable = mkEnableOption "Life with bluetooth";
-  };
-
-  config = mkIf cfg.enable {
-    users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
+  users.users."${psCfg.user.name}" = {
     extraGroups = ["audio"];
-    };
-
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages =
-          [
+    packages = with pkgs; [
       # easyeffects, e.g. for microphone noise filtering
       easyeffects
       mu
@@ -40,81 +20,20 @@ in {
       # Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
       pulseaudio
       vimpc
-          ]
-          ++ (
-            if cfg.spotify.enable
-            then [pkgs.spotify-tui]
-            else []
-          );
+    ];
+  };
+
+  home-manager.users."${psCfg.user.name}" = {
     xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
     systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
-
-        services.spotifyd = mkIf cfg.spotify.enable {
-          enable = true;
-          settings = {
-            global = {
-              username = cfg.spotify.username;
-              password_cmd = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1001/bus ${pkgs.libsecret}/bin/secret-tool lookup spotify password";
-              bitrate = 320;
-              volume_normalisation = true;
-              no_audio_cache = false;
-              max_cache_size = 1000000000;
-            };
-          };
-        };
   };
 
   # rtkit is optional but recommended
   security.rtkit.enable = true;
-    # Enable sound using pipewire-pulse, default config:
-    # https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire.conf.in
   services.pipewire = {
     enable = true;
     alsa.enable = true;
     alsa.support32Bit = true;
     pulse.enable = true;
   };
-
-    # Make pulseaudio listen on port 4713 for mopidy, extending the default
-    # config: https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire-pulse.conf.in
-    environment.etc = mkIf cfg.mopidy.enable {
-      "pipewire/pipewire-pulse.conf.d/99-custom.conf".text = ''
-        {
-          "context.modules": [
-            {
-              "name": "libpipewire-module-protocol-pulse",
-              "args": {
-                "server.address": ["unix:native", "tcp:4713"],
-                "vm.overrides": {
-                  "pulse.min.quantum": "1024/48000"
-                }
-              }
-            }
-          ]
-        }
-      '';
-    };
-
-    # Enable bluetooth
-    hardware.bluetooth = mkIf cfg.bluetooth.enable {
-      enable = true;
-      # Disable bluetooth on startup to save battery
-      powerOnBoot = false;
-      # Disable useless SIM Access Profile plugin
-      disabledPlugins = [
-        "sap"
-      ];
-      settings = {
-        General = {
-          # Enables experimental features and interfaces.
-          # Makes BlueZ Battery Provider available
-          Experimental = true;
-        };
-      };
-    };
-    services.blueman.enable = mkIf cfg.bluetooth.enable true;
-
-    # Enable audio server & client
-    services.mopidy = mkIf cfg.mopidy.enable ((import ./mopidy.nix) pkgs);
-  };
 }

modules/audio/mopidy.nix

@@ -1,18 +0,0 @@
-pkgs: {
-  enable = true;
-  extensionPackages = with pkgs; [
-    mopidy-mpd
-    mopidy-soundcloud
-    mopidy-youtube
-    mopidy-local
-    mopidy-jellyfin
-  ];
-
-  configuration = ''
-    [mpd]
-    hostname = ::
-
-    [audio]
-    output = pulsesink server=127.0.0.1:4713
-  '';
-}

modules/bluetooth/default.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  hardware.bluetooth = {
+    enable = true;
+    # Disable bluetooth on startup to save battery
+    powerOnBoot = false;
+    # Disable useless SIM Access Profile plugin
+    disabledPlugins = [
+      "sap"
+    ];
+    settings = {
+      General = {
+        # Enables experimental features and interfaces.
+        # Makes BlueZ Battery Provider available
+        Experimental = true;
+      };
+    };
+  };
+
+  services.blueman.enable = true;
+  environment.etc."wireplumber/bluetooth.lua.d/51-bluez-config.lua" = {
+    text = ''
+      bluez_monitor.properties = {
+        ["bluez5.enable-sbc-xq"] = true,
+        ["bluez5.enable-msbc"] = true,
+        ["bluez5.enable-hw-volume"] = true,
+        ["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
+      }
+    '';
+  };
+}

modules/ci-runner/default.nix

@@ -1,45 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  self,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.ci-runner;
-in {
-  options.pub-solar.ci-runner = {
-    enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
-  };
-
-  config = mkIf cfg.enable {
-    systemd.user.services.ci-runner = {
-      enable = true;
-
-      description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-      };
-
-      path = [
-        pkgs.git
-        pkgs.nix
-        pkgs.libvirt
-      ];
-
-      wantedBy = ["multi-user.target"];
-      after = ["network.target" "libvirtd.service"];
-
-      script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
-    };
-
-    age.secrets."drone-runner-exec-config" = {
-      file = "${self}/secrets/drone-runner-exec-config";
-      mode = "700";
-      owner = psCfg.user.name;
-    };
-  };
-}

modules/core/boot.nix

@@ -7,12 +7,6 @@
 with lib; let
   cfg = config.pub-solar.core;
 in {
-  options.pub-solar.core.iso-options.enable = mkOption {
-    type = types.bool;
-    default = false;
-    description = "Feature flag for iso builds";
-  };
-
   options.pub-solar.core.disk-encryption-active = mkOption {
     type = types.bool;
     default = true;
@@ -21,13 +15,9 @@ in {
 
   config = {
     boot = {
-      # Enable plymouth for better experience of booting
-      plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
-
       # Mount / luks device in initrd
       # Allow fstrim to work on it.
-      # The ! makes this enabled by default
-      initrd = mkIf (!cfg.iso-options.enable && cfg.disk-encryption-active) {
+      initrd = mkIf cfg.disk-encryption-active {
         luks.devices."cryptroot" = {
           allowDiscards = true;
         };
@@ -36,7 +26,7 @@ in {
       loader.systemd-boot.enable = lib.mkDefault true;
 
       # Use latest LTS linux kernel by default
-      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_1;
+      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_6;
 
       # Support ntfs drives
       supportedFilesystems = ["ntfs"];

modules/core/default.nix

@@ -5,38 +5,34 @@
 }:
 with lib; let
   cfg = config.pub-solar.core;
+  psCfg = config.pub-solar;
 in {
   imports = [
     ./boot.nix
     ./hibernation.nix
-    ./fonts.nix
     ./i18n.nix
     ./networking.nix
-    ./nix.nix
     ./packages.nix
-    ./services.nix
   ];
 
-  options.pub-solar.core = {
-    lite = mkOption {
-      description = ''
-        Enable a lite edition of core with less default modules and a reduced package set.
-      '';
-      default = false;
-      type = types.bool;
-    };
+  # Service that makes Out of Memory Killer more effective
+  services.earlyoom.enable = true;
+
+  services.logind.lidSwitch = "hibernate";
+
+  services.tor.settings = {
+    UseBridges = true;
   };
 
-  config = {
-    pub-solar = {
-      audio.enable = mkIf (!cfg.lite) (mkDefault true);
-      crypto.enable = mkIf (!cfg.lite) (mkDefault true);
-      devops.enable = mkIf (!cfg.lite) (mkDefault true);
+  # The options below are directly taken from or inspired by
+  # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
 
-      terminal-life = {
-        enable = mkDefault true;
-        lite = cfg.lite;
-      };
-    };
-  };
+  # Limit the use of sudo to the group wheel
+  security.sudo.execWheelOnly = true;
+
+  # Remove the complete default environment of packages like
+  # nano, perl and rsync
+  environment.defaultPackages = lib.mkForce [];
+
+  # fileSystems."/".options = [ "noexec" ];
 }

modules/core/fonts.nix

@@ -1,14 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  fonts = {
-    fonts = with pkgs; [powerline-fonts dejavu_fonts];
-    fontconfig.defaultFonts = {
-      monospace = ["DejaVu Sans Mono for Powerline"];
-      sansSerif = ["DejaVu Sans"];
-    };
-  };
-}

modules/core/networking.nix

@@ -1,85 +1,39 @@
 {
+  flake,
   config,
   pkgs,
   lib,
   ...
-}:
-with lib; let
-  cfg = config.pub-solar.core;
-in {
-  options.pub-solar.core = {
-    enableCaddy = mkOption {
-      type = types.bool;
-      default = !cfg.lite;
-    };
-    enableHelp = mkOption {
-      type = types.bool;
-      default = !cfg.lite;
-    };
-
-    binaryCaches = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = "Binary caches to use.";
-    };
-    publicKeys = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = "Public keys of binary caches.";
-    };
-  };
-  config = {
+}: {
   # disable NetworkManager and systemd-networkd -wait-online by default
   systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
   systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
 
   networking.networkmanager = {
     # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
-      enable = true;
-      wifi.backend = "iwd";
+    enable = lib.mkDefault true;
+    # not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
+    #wifi.backend = "iwd";
   };
 
   networking.firewall.enable = true;
 
-    # Customized binary caches list (with fallback to official binary cache)
-    nix.settings.substituters = cfg.binaryCaches;
-    nix.settings.trusted-public-keys = cfg.publicKeys;
+  # For rage encryption, all hosts need a ssh key pair
+  services.openssh = {
+    enable = true;
+    allowSFTP = lib.mkDefault false;
 
-    # These entries get added to /etc/hosts
-    networking.hosts = {
-      "127.0.0.1" =
-        []
-        ++ lib.optionals cfg.enableCaddy ["caddy.local"]
-        ++ lib.optionals config.pub-solar.printing.enable ["cups.local"]
-        ++ lib.optionals cfg.enableHelp ["help.local"];
-    };
+    openFirewall = lib.mkDefault false;
 
-    # Caddy reverse proxy for local services like cups
-    services.caddy = {
-      enable = lib.mkDefault cfg.enableCaddy;
-      globalConfig = lib.mkDefault ''
-        default_bind 127.0.0.1
-        auto_https off
+    settings.PasswordAuthentication = lib.mkDefault false;
+    settings.KbdInteractiveAuthentication = false;
+
+    extraConfig = ''
+      AllowTcpForwarding yes
+      X11Forwarding no
+      AllowAgentForwarding no
+      AllowStreamLocalForwarding no
+      AuthenticationMethods publickey
     '';
-      extraConfig = lib.mkDefault (concatStringsSep "\n" [
-        (lib.optionalString
-          config.pub-solar.printing.enable
-          ''
-            cups.local:80 {
-              request_header Host localhost:631
-              reverse_proxy unix//run/cups/cups.sock
-            }
-          '')
-
-        (lib.optionalString
-          cfg.enableHelp
-          ''
-            help.local:80 {
-              root * ${pkgs.psos-docs}/lib/html
-              file_server
-            }
-          '')
-      ]);
-    };
   };
 }

modules/core/packages.nix

@@ -8,9 +8,7 @@ with lib; let
   psCfg = config.pub-solar;
   cfg = config.pub-solar.core;
 in {
-  environment = {
-    systemPackages = with pkgs;
-      [
+  environment.systemPackages = with pkgs; [
     # Core unix utility packages
     coreutils-full
     dnsutils
@@ -18,62 +16,13 @@ in {
     progress
     pciutils
     usbutils
-
-        wget
-        openssl
-        openssh
-        curl
-        htop
-        btop
-        lsof
-        psmisc
-        file
-
-        # zippit
-        zip
-        unzip
-
-        # Modern modern utilities
-        p7zip
-        croc
-        jq
-      ]
-      ++ lib.optionals (!cfg.lite) [
-        mtr
-
-        gitFull
-        git-lfs
-        git-bug
-
-        xdg-utils
-        sysfsutils
-        renameutils
-        nfs-utils
-        moreutils
-        mailutils
-        keyutils
-        input-utils
-        elfutils
-        binutils
-        dateutils
     diffutils
     findutils
     exfat
 
-        # Nix specific utilities
-        alejandra
-        niv
-        manix
-        nix-index
-        nix-tree
-        nixpkgs-review
-        # Build broken, python2.7-PyJWT-2.0.1.drv' failed
-        #nixops
-        psos
-        nvd
+    gitMinimal
 
-        # Fun
-        neofetch
+    btop
+    mtr
   ];
-  };
 }

modules/core/services.nix

@@ -1,18 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  # For rage encryption, all hosts need a ssh key pair
-  services.openssh = {
-    enable = true;
-    # If you don't want the host to have SSH actually opened up to the net,
-    # set `services.openssh.openFirewall` to false in your config.
-    openFirewall = lib.mkDefault true;
-    settings.PasswordAuthentication = lib.mkDefault false;
-  };
-
-  # Service that makes Out of Memory Killer more effective
-  services.earlyoom.enable = true;
-}

modules/crypto/default.nix

@@ -6,21 +6,18 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.crypto;
 in {
-  options.pub-solar.crypto = {
-    enable = mkEnableOption "Life in private";
-  };
-
-  config = mkIf cfg.enable {
   services.udev.packages = [pkgs.yubikey-personalization];
   services.dbus.packages = [pkgs.gcr];
   services.pcscd.enable = true;
 
   services.gnome.gnome-keyring.enable = true;
 
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    libsecret
+  ];
+
+  home-manager.users."${psCfg.user.name}" = {
     systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
 
     services.gpg-agent = {
@@ -32,14 +29,5 @@ in {
     programs.gpg = {
       enable = true;
     };
-
-        home.packages = [
-          gnome.seahorse
-          keepassxc
-          libsecret
-          qMasterPassword
-          restic
-        ];
-      };
   };
 }

modules/ddclient/default.nix

@@ -0,0 +1,269 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.services.ddclient;
+  boolToStr = bool:
+    if bool
+    then "yes"
+    else "no";
+  dataDir = "/var/lib/ddclient";
+  StateDirectory = builtins.baseNameOf dataDir;
+  RuntimeDirectory = StateDirectory;
+
+  usev4 =
+    if cfg.usev4 != ""
+    then "usev4=${cfg.usev4}"
+    else "";
+  usev6 =
+    if cfg.usev6 != ""
+    then "usev6=${cfg.usev6}"
+    else "";
+
+  configFile' = pkgs.writeText "ddclient.conf" ''
+    # This file can be used as a template for configFile or is automatically generated by Nix options.
+    use=no
+    ${usev4}
+    ${usev6}
+    cache=${dataDir}/ddclient.cache
+    foreground=yes
+    login=${cfg.username}
+    password=${
+      if cfg.protocol == "nsupdate"
+      then "/run/${RuntimeDirectory}/ddclient.key"
+      else "@password_placeholder@"
+    }
+    protocol=${cfg.protocol}
+    ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
+    ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
+    ${lib.optionalString (cfg.zone != "") "zone=${cfg.zone}"}
+    ssl=${boolToStr cfg.ssl}
+    wildcard=yes
+    quiet=${boolToStr cfg.quiet}
+    verbose=${boolToStr cfg.verbose}
+    ${cfg.extraConfig}
+    ${lib.concatStringsSep "," cfg.domains}
+  '';
+  configFile =
+    if (cfg.configFile != null)
+    then cfg.configFile
+    else configFile';
+
+  preStart = ''
+    install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    ${lib.optionalString (cfg.configFile == null) (
+      if (cfg.protocol == "nsupdate")
+      then ''
+        install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
+      ''
+      else if (cfg.passwordFile != null)
+      then ''
+        "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
+      ''
+      else ''
+        sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
+      ''
+    )}
+  '';
+in
+  with lib; {
+    disabledModules = [
+      "services/networking/ddclient.nix"
+    ];
+
+    imports = [
+      (mkChangedOptionModule ["services" "ddclient" "domain"] ["services" "ddclient" "domains"]
+        (config: let
+          value = getAttrFromPath ["services" "ddclient" "domain"] config;
+        in
+          if value != ""
+          then [value]
+          else []))
+      (mkRemovedOptionModule ["services" "ddclient" "homeDir"] "")
+      (mkRemovedOptionModule ["services" "ddclient" "password"] "Use services.ddclient.passwordFile instead.")
+    ];
+
+    ###### interface
+
+    options = {
+      services.ddclient = with lib.types; {
+        enable = mkOption {
+          default = false;
+          type = bool;
+          description = lib.mdDoc ''
+            Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
+          '';
+        };
+
+        package = mkOption {
+          type = package;
+          default = pkgs.ddclient;
+          defaultText = lib.literalExpression "pkgs.ddclient";
+          description = lib.mdDoc ''
+            The ddclient executable package run by the service.
+          '';
+        };
+
+        domains = mkOption {
+          default = [""];
+          type = listOf str;
+          description = lib.mdDoc ''
+            Domain name(s) to synchronize.
+          '';
+        };
+
+        username = mkOption {
+          # For `nsupdate` username contains the path to the nsupdate executable
+          default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
+          defaultText = "";
+          type = str;
+          description = lib.mdDoc ''
+            User name.
+          '';
+        };
+
+        passwordFile = mkOption {
+          default = null;
+          type = nullOr str;
+          description = lib.mdDoc ''
+            A file containing the password or a TSIG key in named format when using the nsupdate protocol.
+          '';
+        };
+
+        interval = mkOption {
+          default = "10min";
+          type = str;
+          description = lib.mdDoc ''
+            The interval at which to run the check and update.
+            See {command}`man 7 systemd.time` for the format.
+          '';
+        };
+
+        configFile = mkOption {
+          default = null;
+          type = nullOr path;
+          description = lib.mdDoc ''
+            Path to configuration file.
+            When set this overrides the generated configuration from module options.
+          '';
+          example = "/root/nixos/secrets/ddclient.conf";
+        };
+
+        protocol = mkOption {
+          default = "dyndns2";
+          type = str;
+          description = lib.mdDoc ''
+            Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
+          '';
+        };
+
+        server = mkOption {
+          default = "";
+          type = str;
+          description = lib.mdDoc ''
+            Server address.
+          '';
+        };
+
+        ssl = mkOption {
+          default = true;
+          type = bool;
+          description = lib.mdDoc ''
+            Whether to use SSL/TLS to connect to dynamic DNS provider.
+          '';
+        };
+
+        quiet = mkOption {
+          default = false;
+          type = bool;
+          description = lib.mdDoc ''
+            Print no messages for unnecessary updates.
+          '';
+        };
+
+        script = mkOption {
+          default = "";
+          type = str;
+          description = lib.mdDoc ''
+            script as required by some providers.
+          '';
+        };
+
+        usev4 = mkOption {
+          default = "webv4, webv4=checkip.dyndns.com/, webv4-skip='Current IP Address: '";
+          type = str;
+          description = lib.mdDoc ''
+            Method to determine the IP address to send to the dynamic DNS provider.
+          '';
+        };
+
+        usev6 = mkOption {
+          default = "";
+          type = str;
+          description = lib.mdDoc ''
+            Method to determine the IP address to send to the dynamic DNS provider.
+          '';
+        };
+
+        verbose = mkOption {
+          default = false;
+          type = bool;
+          description = lib.mdDoc ''
+            Print verbose information.
+          '';
+        };
+
+        zone = mkOption {
+          default = "";
+          type = str;
+          description = lib.mdDoc ''
+            zone as required by some providers.
+          '';
+        };
+
+        extraConfig = mkOption {
+          default = "";
+          type = lines;
+          description = lib.mdDoc ''
+            Extra configuration. Contents will be added verbatim to the configuration file.
+
+            ::: {.note}
+            `daemon` should not be added here because it does not work great with the systemd-timer approach the service uses.
+            :::
+          '';
+        };
+      };
+    };
+
+    ###### implementation
+
+    config = mkIf config.services.ddclient.enable {
+      systemd.services.ddclient = {
+        description = "Dynamic DNS Client";
+        wantedBy = ["multi-user.target"];
+        after = ["network.target"];
+        restartTriggers = optional (cfg.configFile != null) cfg.configFile;
+
+        serviceConfig = {
+          DynamicUser = true;
+          RuntimeDirectoryMode = "0700";
+          inherit RuntimeDirectory;
+          inherit StateDirectory;
+          Type = "oneshot";
+          ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
+          ExecStart = "${lib.getBin cfg.package}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
+        };
+      };
+
+      systemd.timers.ddclient = {
+        description = "Run ddclient";
+        wantedBy = ["timers.target"];
+        timerConfig = {
+          OnBootSec = cfg.interval;
+          OnUnitInactiveSec = cfg.interval;
+        };
+      };
+    };
+  }

modules/default.nix

@@ -0,0 +1,42 @@
+{
+  self,
+  inputs,
+  ...
+}: {
+  flake = {
+    nixosModules = rec {
+      audio = import ./audio;
+      bluetooth = import ./bluetooth;
+      core = import ./core;
+      crypto = import ./crypto;
+      desktop-extended = import ./desktop-extended;
+      docker = import ./docker;
+      #email = import ./email;
+      #gaming = import ./gaming;
+      graphical = import ./graphical;
+      #invoiceplane = import ./invoiceplane;
+      nix = import ./nix;
+      nextcloud = import ./nextcloud;
+      office = import ./office;
+      printing = import ./printing;
+      terminal-life = import ./terminal-life;
+      user = import ./user;
+      virtualisation = import ./virtualisation;
+      #wireguard-client = import ./wireguard-client;
+
+      base.imports = [
+        self.nixosModules.home-manager
+        inputs.agenix.nixosModules.default
+
+        self.nixosModules.overlays
+        self.nixosModules.core
+        self.nixosModules.crypto
+        self.nixosModules.nix
+        self.nixosModules.terminal-life
+
+        self.nixosModules.root
+        self.nixosModules.user
+      ];
+    };
+  };
+}

modules/desktop-extended/default.nix

@@ -0,0 +1,49 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    ungoogled-chromium
+    wine
+
+    gimp
+    inkscape
+    tigervnc
+    nodejs
+
+    signal-desktop
+    tdesktop
+    element-desktop
+
+    # Nix specific utilities
+    alejandra
+    manix
+    nix-output-monitor
+    nix-tree
+    nvd
+    nixpkgs-review
+    nix-search-cli
+  ];
+
+  fonts = {
+    packages = with pkgs; [
+      dejavu_fonts
+      fira-code
+      fira-code-symbols
+      #google-fonts
+      lato
+      montserrat
+      nerdfonts
+      noto-fonts
+      noto-fonts-cjk
+      open-sans
+      powerline-fonts
+      source-sans-pro
+    ];
+  };
+}

modules/devops/default.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.devops;
-in {
-  options.pub-solar.devops = {
-    enable = mkEnableOption "Life automated";
-  };
-
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          drone-cli
-          nmap
-          pgcli
-          ansible
-          ansible-lint
-          restic
-          shellcheck
-          terraform
-        ];
-      };
-  };
-}

modules/docker-ci-runner/default.nix

@@ -1,114 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  self,
-  ...
-}:
-with lib; let
-  bootstrap = pkgs.writeScript "bootstrap.sh" ''
-    #!/usr/bin/env bash
-
-    set -e
-
-    apt update
-    apt install --yes curl git sudo xz-utils
-
-    adduser --system --uid 999 build
-    chown build /nix
-
-    sudo -u build curl -L https://nixos.org/nix/install > install
-    sudo -u build sh install
-
-    echo "export PATH=/nix/var/nix/profiles/per-user/build/profile/bin:''$PATH" >> /etc/profile
-
-    mkdir /etc/nix
-    echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
-
-    export nix_user_config_file="/home/build/.local/share/nix/trusted-settings.json"
-    mkdir -p $(dirname \\$nix_user_config_file)
-    echo '{"extra-experimental-features":{"nix-command flakes":true}}' > \\$nix_user_config_file
-    chown -R build /home/build/
-
-    curl -L https://github.com/drone-runners/drone-runner-exec/releases/latest/download/drone_runner_exec_linux_amd64.tar.gz | tar xz
-    sudo install -t /usr/local/bin drone-runner-exec
-
-    if [ ! -f /run/vars ]; then
-      exit 1
-    fi
-
-    cp -a /run/vars /run/runtime-vars
-    env | grep "DRONE" >> /run/runtime-vars
-
-    su - -s /bin/bash build sh -c "/usr/local/bin/drone-runner-exec daemon /run/runtime-vars"
-  '';
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.docker-ci-runner;
-in {
-  options.pub-solar.docker-ci-runner = {
-    enable = lib.mkEnableOption "Enables a docker container running a drone exec runner as unprivileged user.";
-
-    enableKvm = lib.mkOption {
-      description = ''
-        Enable kvm support.
-      '';
-      default = true;
-      type = types.bool;
-    };
-
-    nixCacheLocation = lib.mkOption {
-      description = ''
-        Location of nix cache that is shared between builds
-      '';
-      default = "/var/lib/docker-ci-runner";
-      type = types.path;
-    };
-
-    runnerEnvironment = lib.mkOption {
-      description = ''
-        Additional environment vars added to the vars file on container runtime
-      '';
-      default = {};
-    };
-
-    runnerVarsFile = lib.mkOption {
-      description = ''
-        Location of vars file passed to drone runner
-      '';
-      type = types.path;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation = {
-      docker = {
-        enable = true; # sadly podman is not supported rightnow
-      };
-
-      oci-containers = {
-        backend = "docker";
-        containers."drone-exec-runner" = {
-          image = "debian";
-          autoStart = true;
-          entrypoint = "bash";
-          cmd = ["/bootstrap.sh"];
-
-          volumes = [
-            "${cfg.runnerVarsFile}:/run/vars"
-            "${cfg.nixCacheLocation}:/nix"
-            "${bootstrap}:/bootstrap.sh"
-          ];
-
-          environment = cfg.runnerEnvironment;
-
-          extraOptions = lib.mkIf cfg.enableKvm ["--device=/dev/kvm"];
-        };
-      };
-    };
-    # Fix container not stopping correctly and holding the system 120s upon
-    # shutdown / reboot
-    systemd.services.docker-drone-exec-runner.preStop = ''
-      docker stop drone-exec-runner
-    '';
-  };
-}

modules/docker/default.nix

@@ -6,22 +6,15 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.docker;
 in {
-  options.pub-solar.docker = {
-    enable = mkEnableOption "Life in metal boxes";
-  };
-
-  config = mkIf cfg.enable {
   virtualisation.docker.enable = true;
   virtualisation.docker.package = pkgs.docker_24;
-    users.users = with pkgs;
-      pkgs.lib.setAttrByPath [psCfg.user.name] {
+
+  users.users."${psCfg.user.name}" = {
     extraGroups = ["docker"];
   };
 
   environment.systemPackages = with pkgs; [
     docker-compose
   ];
-  };
 }

modules/email/default.nix

@@ -6,16 +6,8 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.email;
 in {
-  options.pub-solar.email = {
-    enable = mkEnableOption "Life in headers";
-  };
-
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
+  users.users."${psCfg.user.name}".packages = with pkgs; [
     w3m
     urlscan
     neomutt
@@ -24,10 +16,39 @@ in {
     mailto-mutt
   ];
 
+  home-manager.users."${psCfg.user.name}" = {
     programs.offlineimap = {
       enable = true;
       pythonFile = builtins.readFile ./offlineimap.py;
     };
-      };
+
+    xdg.configFile."mutt/muttrc".source = ./.config/mutt/muttrc;
+    xdg.configFile."mutt/base16.muttrc".source = ./.config/mutt/base16.muttrc;
+    xdg.configFile."mutt/mailcap".source = ./.config/mutt/mailcap;
+    xdg.configFile."offlineimap/functions.py".source = ./.config/offlineimap/functions.py;
+
+    xdg.configFile."mutt/accounts.muttrc".text = ''
+      source ./hello@benjaminbaedorf.eu.muttrc
+
+      macro index <f1> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/hello@benjaminbaedorf.eu.muttrc<enter><change-folder>!<enter>'
+      macro index <f2> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/benjamin.baedorf@rwth-aachen.de.muttrc<enter><change-folder>!<enter>'
+      macro index <f3> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/byb@miom.space.muttrc<enter><change-folder>!<enter>'
+      macro index <f4> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/mail@b12f.io.muttrc<enter><change-folder>!<enter>'
+      macro index <f5> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/admins@pub.solar.muttrc<enter><change-folder>!<enter>'
+      macro index <f6> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/crew@pub.solar.muttrc<enter><change-folder>!<enter>'
+    '';
+    xdg.configFile."mutt/hello@benjaminbaedorf.eu.muttrc".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.muttrc";
+    xdg.configFile."mutt/benjamin.baedorf@rwth-aachen.de.muttrc".source = ./.config/mutt + "/benjamin.baedorf@rwth-aachen.de.muttrc";
+    xdg.configFile."mutt/hello@benjaminbaedorf.eu.signature".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.signature";
+    xdg.configFile."mutt/byb@miom.space.muttrc".source = ./.config/mutt + "/byb@miom.space.muttrc";
+    xdg.configFile."mutt/byb@miom.space.signature".source = ./.config/mutt + "/byb@miom.space.signature";
+    xdg.configFile."mutt/mail@b12f.io.muttrc".source = ./.config/mutt + "/mail@b12f.io.muttrc";
+    xdg.configFile."mutt/mail@b12f.io.signature".source = ./.config/mutt + "/mail@b12f.io.signature";
+    xdg.configFile."mutt/admins@pub.solar.muttrc".source = ./.config/mutt + "/admins@pub.solar.muttrc";
+    xdg.configFile."mutt/admins@pub.solar.signature".source = ./.config/mutt + "/admins@pub.solar.signature";
+    xdg.configFile."mutt/crew@pub.solar.muttrc".source = ./.config/mutt + "/crew@pub.solar.muttrc";
+    xdg.configFile."mutt/crew@pub.solar.signature".source = ./.config/mutt + "/crew@pub.solar.signature";
+    xdg.configFile."offlineimap/config".source = ./.config/offlineimap/config;
+    xdg.configFile."msmtp/config".source = ./.config/msmtp/config;
   };
 }

modules/gaming/default.nix

@@ -6,26 +6,16 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.gaming;
 in {
-  options.pub-solar.gaming = {
-    enable = mkEnableOption "Life in shooters";
-  };
-
-  config = mkIf cfg.enable {
   programs.steam.enable = true;
   nixpkgs.config.packageOverrides = pkgs: {
     steam = pkgs.steam.override {};
   };
 
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
+  users.users."${psCfg.user.name}".packages = with pkgs; [
     playonlinux
     godot
     obs-studio
     obs-studio-plugins.wlrobs
   ];
-      };
-  };
 }

modules/graphical/.config/libinput-gestures.conf

@@ -0,0 +1,198 @@
+# Configuration file for libinput-gestures.
+# Mark Blakeney, Sep 2015
+#
+# The default configuration file exists at /etc/libinput-gestures.conf
+# but a user can create a personal custom configuration file at
+# ~/.config/libinput-gestures.conf.
+#
+# Lines starting with '#' and blank lines are ignored. Currently
+# "gesture" and "device" configuration keywords are supported as
+# described below. The keyword can optionally be appended with a ":" (to
+# maintain compatibility with original format configuration files).
+#
+# Each gesture line has 3 [or 4] arguments separated by whitespace:
+#
+# action motion [finger_count] command
+#
+# where action and motion is either:
+#     swipe up
+#     swipe down
+#     swipe left
+#     swipe right
+#     swipe left_up
+#     swipe left_down
+#     swipe right_up
+#     swipe right_down
+#     pinch in
+#     pinch out
+#     pinch clockwise
+#     pinch anticlockwise
+#
+# command is the remainder of the line and is any valid shell command +
+# arguments.
+#
+# finger_count is a single numeric digit and is optional (and is
+# typically 3 or 4). If specified then the command is executed when
+# exactly that number of fingers is used in the gesture. If not
+# specified then the command is executed when that gesture is executed
+# with any number of fingers. Gesture lines specified with finger_count
+# have priority over the same gesture specified without any
+# finger_count.
+#
+# Typically command will be xdotool, or wmctrl. See "man xdotool" for
+# the many things you can action with that tool. Note that unfortunately
+# xdotool does not work with native Wayland clients.
+
+###############################################################################
+# SWIPE GESTURES:
+###############################################################################
+
+# Note the default is an "internal" command that uses wmctrl to switch
+# workspaces and, unlike xdotool, works on both Xorg and Wayland (via
+# XWayland). It also can be configured for vertical and horizontal
+# switching over tabular workspaces, as per the example below. You can
+# also add "-w" to the internal command to allow wrapping workspaces.
+
+# Move to next workspace (works for GNOME/KDE/etc on Wayland and Xorg)
+#gesture swipe up	_internal ws_up
+
+# NOTE ABOUT FINGER COUNT:
+# The above command will configure this command for all fingers (i.e. 3
+# for 4) but to configure it for 3 fingers only, change it to:
+# gesture swipe up	3 _internal ws_up
+# Then you can configure something else for 4 fingers or leave 4 fingers
+# unconfigured. You can configure an explicit finger count like this for
+# all example commands in this configuration file.
+#
+gesture swipe up      3	ydotool key Super_L+Down
+gesture swipe up      4	ydotool key Super_L+Ctrl+Right
+
+# Move to prev workspace (works for GNOME/KDE/etc on Wayland and Xorg)
+#gesture swipe down	_internal ws_down
+gesture swipe down    3	ydotool key Super_L+Up
+gesture swipe down    4	ydotool key Super_L+Ctrl+Left
+
+# Browser go forward (works only for Xorg, and Xwayland clients)
+gesture swipe left    3	ydotool key ctrl+]
+
+# Browser go back (works only for Xorg, and Xwayland clients)
+gesture swipe right   3	ydotool key ctrl+[
+
+# NOTE: If you don't use "natural" scrolling direction for your touchpad
+# then you may want to swap the above default left/right and up/down
+# configurations.
+
+# Optional extended swipe gestures, e.g. for browser tab navigation:
+#
+# Jump to next open browser tab
+#gesture swipe right_up xdotool key control+Tab
+#gesture swipe right_up xdotool key control+Next
+gesture swipe right_up ydotool key ctrl+PageDown
+#
+# Jump to previous open browser tab
+#gesture swipe left_up xdotool key control+shift+Tab
+gesture swipe left_up ydotool key ctrl+PageUp
+#
+# Close current browser tab
+# gesture swipe left_down xdotool key control+w
+#
+# Reopen and jump to last closed browser tab
+# gesture swipe right_down xdotool key control+shift+t
+
+# Example of 8 static workspaces, e.g. using KDE virtual-desktops,
+# arranged in 2 rows of 4 columns across using swipe up/down/left/right
+# to navigate in fixed planes. You can also add the "-w/--wrap" option
+# to allow wrapping in any direction. You must configure your virtual
+# desktops with the same column dimension.
+# gesture swipe up	_internal --cols 4 ws_up
+# gesture swipe down	_internal --cols 4 ws_down
+# gesture swipe left	_internal --cols 4 ws_left
+# gesture swipe right	_internal --cols 4 ws_right
+#
+# Example of 16 static workspaces, e.g. using KDE virtual-desktops,
+# arranged in 4 rows of 4 columns across using swipe up/down/left/right
+# to navigate in fixed planes, and also using swipe
+# left_up/left_down/right_up/right_down to navigate diagonally. You can
+# also add the "-w/--wrap" option to allow wrapping in any direction
+# and/or diagonally. You must configure your virtual desktops with the
+# same column dimension.
+# gesture swipe up		_internal --cols 4 ws_up
+# gesture swipe down		_internal --cols 4 ws_down
+# gesture swipe left		_internal --cols 4 ws_left
+# gesture swipe right		_internal --cols 4 ws_right
+# gesture swipe left_up		_internal --cols 4 ws_left_up
+# gesture swipe left_down	_internal --cols 4 ws_left_down
+# gesture swipe right_up	_internal --cols 4 ws_right_up
+# gesture swipe right_down	_internal --cols 4 ws_right_down
+
+# Example virtual desktop switching for Ubuntu Unity/Compiz. The
+# _internal command does not work for Compiz but you can explicitly
+# configure the swipe commands to work for a Compiz virtual 2
+# dimensional desktop as follows:
+# gesture swipe up	xdotool key ctrl+alt+Up
+# gesture swipe down	xdotool key ctrl+alt+Down
+# gesture swipe left	xdotool key ctrl+alt+Left
+# gesture swipe right	xdotool key ctrl+alt+Right
+
+# Example to change audio volume:
+# Note this only works on an Xorg desktop (not Wayland).
+# gesture swipe up   xdotool key XF86AudioRaiseVolume
+# gesture swipe down xdotool key XF86AudioLowerVolume
+
+###############################################################################
+# PINCH GESTURES:
+###############################################################################
+
+# GNOME SHELL open/close overview (works for GNOME on Xorg only)
+gesture pinch in	ydotool key ctrl+-
+gesture pinch out	ydotool key ctrl+shift+=
+
+# KDE Plasma open/close overview
+# gesture pinch in	xdotool key ctrl+F9
+# gesture pinch out	xdotool key ctrl+F9
+
+# GNOME SHELL open/close overview (works for GNOME on Wayland and Xorg)
+# Note since GNOME 3.24 on Wayland this is implemented natively so no
+# real point configuring for Wayland.
+# gesture pinch in dbus-send --session --type=method_call --dest=org.gnome.Shell /org/gnome/Shell org.gnome.Shell.Eval string:'Main.overview.toggle();'
+# gesture pinch out dbus-send --session --type=method_call --dest=org.gnome.Shell /org/gnome/Shell org.gnome.Shell.Eval string:'Main.overview.toggle();'
+
+# Optional extended pinch gestures:
+# gesture pinch clockwise <whatever command>
+# gesture pinch anticlockwise <whatever command>
+
+###############################################################################
+# This application normally determines your touchpad device
+# automatically. Some users may have multiple touchpads but by default
+# we use only the first one found. However, you can choose to specify
+# the explicit device name to use. Run "libinput list-devices" to work
+# out the name of your device (from the "Device:" field). Then add a
+# device line specifying that name, e.g:
+#
+# device DLL0665:01 06CB:76AD Touchpad
+#
+# If the device name starts with a '/' then it is instead considered as
+# the explicit device path although since device paths can change
+# through reboots this is best to be a symlink. E.g. instead of specifying
+# /dev/input/event12, use the corresponding full path link under
+# /dev/input/by-path/ or /dev/input/by-id/.
+#
+# You can choose to use ALL touchpad devices by setting the device name
+# to "all". E.g. Do this if you have multiple touchpads which you want
+# to use in parallel. This reduces performance slightly so only set this
+# if you have to.
+#
+# device all
+
+###############################################################################
+# You can set a minimum travel distance threshold before swipe gestures
+# are actioned using the swipe_threshold configuration command.
+# Specify this value in dots. The default is 0.
+# E.g. set it to 100 dots with "swipe_threshold 100".
+# swipe_threshold 0
+
+###############################################################################
+# You can set a timeout on gestures from start to end. The default is
+# the value commented below. It can be any value in float secs >= 0.
+# 0 = no timeout. E.g. set it to 2 secs with "timeout 2".
+# timeout 1.5

modules/graphical/.config/mako/config

@@ -0,0 +1,22 @@
+padding=10
+margin=5,5,0
+default-timeout=5000
+
+## Base16 Burn
+# Author: Benjamin Bädorf
+#
+# You can use these variables anywhere in the mako configuration file.
+
+background-color=#1a181a
+text-color=#e3e1e4
+border-color=#ff5f5f
+
+[urgency=low]
+background-color=#1a181a
+text-color=#e3e1e4
+border-color=#ff5f5f
+
+[urgency=high]
+background-color=#ff5f5f
+text-color=#1a181a
+border-color=#1a181a

modules/graphical/.config/swaync/config.json

@@ -0,0 +1,12 @@
+{
+  "positionX": "right",
+  "positionY": "top",
+  "timeout": 10,
+  "timeout-low": 5,
+  "timeout-critical": 0,
+  "notification-window-width": 500,
+  "keyboard-shortcuts": true,
+  "image-visibility": "always",
+  "transition-time": 200,
+  "hide-on-clear": false
+}

modules/graphical/.config/swaync/style.css

@@ -0,0 +1,149 @@
+/*
+ * vim: ft=less
+ */
+
+@define-color border-color rgb(7, 7, 7);
+@define-color bg rgb(58, 58, 58);
+@define-color bg-hover rgb(68, 68, 68);
+@define-color bg-focus rgba(68, 68, 68, 0.6);
+@define-color bg-selected rgb(0, 128, 255);
+
+.notification-row {
+  outline: none;
+}
+.notification-row:focus,
+.notification-row:hover {
+  background: @bg-focus;
+}
+
+.notification {
+  border-radius: 10px;
+  margin: 6px 12px;
+  box-shadow: 0px 2px 4px 2px rgba(0, 0, 0, 0.3);
+  padding: 0;
+}
+
+.notification-content {
+  background: transparent;
+  padding: 6px;
+  border-radius: 10px;
+}
+
+.close-button {
+  background: black;
+  color: white;
+  text-shadow: none;
+  padding: 0 2px;
+  box-shadow: 0px 2px 4px 2px rgba(0, 0, 0, 0.3);
+  border-radius: 100%;
+}
+.close-button:hover {
+  background: rgb(30, 30, 30);
+  transition: all 0.15s ease-in-out;
+}
+
+.notification-default-action,
+.notification-action {
+  padding: 4px;
+  margin: 0;
+  box-shadow: none;
+  background: @bg;
+  border: 1px solid @border-color;
+}
+
+.notification-default-action:hover,
+.notification-action:hover {
+  background: @bg-hover;
+}
+
+.notification-default-action {
+  border-radius: 10px;
+}
+
+/* When alternative actions are visible */
+.notification-default-action:not(:only-child) {
+  border-bottom-left-radius: 0px;
+  border-bottom-right-radius: 0px;
+}
+
+.notification-action {
+  border-radius: 0px;
+  border-top: none;
+  border-right: none;
+}
+
+/* add bottom border radius to eliminate clipping */
+.notification-action:first-child {
+  border-bottom-left-radius: 10px;
+}
+.notification-action:last-child {
+  border-bottom-right-radius: 10px;
+  border-right: 1px solid @border-color;
+}
+
+.image {
+}
+
+.body-image {
+  margin-top: 6px;
+  background-color: white;
+  border-radius: 10px;
+}
+
+.summary {
+  color: white;
+  text-shadow: none;
+}
+
+.time {
+  color: white;
+  text-shadow: none;
+}
+
+.body {
+  background: transparent;
+  color: white;
+  text-shadow: none;
+}
+
+.top-action-title {
+  color: white;
+  text-shadow: none;
+}
+
+.control-center-clear-all {
+  color: white;
+  text-shadow: none;
+  background: @bg;
+  border: 1px solid @border-color;
+  box-shadow: none;
+  border-radius: 10px;
+}
+.control-center-clear-all:hover {
+  background: @bg-hover;
+}
+
+.control-center-dnd {
+  border-radius: 10px;
+  background: @bg;
+  border: 1px solid @border-color;
+  box-shadow: none;
+}
+
+.control-center-dnd:checked {
+  background: @bg-selected;
+}
+.control-center-dnd slider {
+  background: @bg-hover;
+}
+
+.control-center {
+  background: rgba(0, 0, 0, 0.7);
+}
+.control-center-list {
+  background: transparent;
+}
+
+.floating-notifications {
+  background: transparent;
+}

modules/graphical/.config/user-dirs.dirs

@@ -0,0 +1,15 @@
+# This file is written by xdg-user-dirs-update
+# If you want to change or add directories, just edit the line you're
+# interested in. All local changes will be retained on the next run.
+# Format is XDG_xxx_DIR="$HOME/yyy", where yyy is a shell-escaped
+# homedir-relative path, or XDG_xxx_DIR="/yyy", where /yyy is an
+# absolute path. No other format is supported.
+
+XDG_DESKTOP_DIR="$HOME/"
+XDG_DOWNLOAD_DIR="$HOME/Downloads"
+XDG_TEMPLATES_DIR="$HOME/Templates"
+XDG_PUBLICSHARE_DIR="$HOME/Public"
+XDG_DOCUMENTS_DIR="$HOME/"
+XDG_MUSIC_DIR="$HOME/"
+XDG_PICTURES_DIR="$HOME/"
+XDG_VIDEOS_DIR="$HOME/"

modules/graphical/.config/user-dirs.locale

@@ -0,0 +1 @@
+en_US

modules/graphical/.config/waybar/colorscheme.css

@@ -0,0 +1,23 @@
+/*
+*
+* Base16 Burn
+* Author: Benjamin Bädorf
+*
+*/
+
+@define-color base00 #1a181a;
+@define-color base01 #2d2a2e;
+@define-color base02 #303030;
+@define-color base03 #949494;
+@define-color base04 #d3d1d4;
+@define-color base05 #e3e1e4;
+@define-color base06 #303030;
+@define-color base07 #ff5f5f;
+@define-color base08 #f85e84;
+@define-color base09 #df5923;
+@define-color base0A #e5c463;
+@define-color base0B #9ecd6f;
+@define-color base0C #ef9062;
+@define-color base0D #7accd7;
+@define-color base0E #ab9df2;
+@define-color base0F #d70000;

modules/graphical/.config/waybar/config

@@ -0,0 +1,148 @@
+{
+  "layer": "top", // Waybar at top layer
+  // "position": "bottom", // Waybar position (top|bottom|left|right)
+
+  "height": 26, // Waybar height
+  "modules-left": ["sway/workspaces", "sway/mode"],
+  "modules-center": ["network"],
+  "modules-right": [
+    "sway/language",
+    "backlight",
+    "custom/notification",
+    "pulseaudio",
+    "idle_inhibitor",
+    "battery",
+    "clock",
+    "tray"
+  ],
+  "sway/workspaces": {
+      "disable-scroll": true
+  },
+  "sway/mode": {
+  "tooltip": false,
+      "format": "{}"
+  },
+  "sway/window": {
+  "tooltip": false,
+      "max-length": 96
+  },
+  "sway/language": {
+  "format": "{}",
+  "max-length": 50
+  },
+  "tray": {
+      "icon-size": 21,
+      "spacing": 10
+  },
+  "clock": {
+      "tooltip-format": "<tt><small>{calendar}</small></tt>",
+      "format": "{:%H:%M} ",
+      "format-alt": "{:%a %d. %h %H:%M} ",
+      //"on-scroll": {
+      //    "calendar": 1
+      //}
+      "smooth-scrolling-threshold": 1.0,
+      "calendar": {
+          "mode-mon-col"  : 3,
+          "on-scroll": -1,
+          "on-click-right": "mode",
+          "format": {
+              "months":     "<span color='#ffead3'><b>{}</b></span>",
+              "days":       "<span color='#ecc6d9'><b>{}</b></span>",
+              "weekdays":   "<span color='#ffcc66'><b>{}</b></span>",
+              "today":      "<span color='#ff6699'><b><u>{}</u></b></span>"
+          },
+      },
+      "actions":  {
+          "on-click-right": "mode",
+          "on-click-forward": "tz_up",
+          "on-click-backward": "tz_down",
+          "on-scroll-up": "shift_up",
+          "on-scroll-down": "shift_down"
+      }
+  },
+  "backlight": {
+      "device": "acpi_video0",
+      "format": "<span font='10'> {percent}%</span> {icon}",
+      "format-icons": ["", ""]
+  },
+  "cpu": {
+      "format": "{}% "
+  },
+  "memory": {
+      "format": "{}% "
+  },
+  "idle_inhibitor": {
+      "format": "{icon} ",
+      "format-icons": {
+          "activated": "",
+          "deactivated": ""
+      }
+  },
+  "battery": {
+      "tooltip": false,
+      "states": {
+          "critical": 25
+      },
+      //"full-at": 84,
+      "format": "{icon}<span font='10'> {capacity}%</span>",
+      "format-full": "{icon}",
+      "format-icons": ["", "", "", "", ""],
+  },
+  "network": {
+      "interval": 3,
+      "tooltip": true,
+      //"interface": "wlp4s0", // (Optional) To force the use of this interface          \uF2E7,
+      "format-wifi": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
+      "format-ethernet": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
+      "format-disconnected": "",
+      "tooltip-format-wifi": "{essid} ({signalStrength}%)  {ipaddr}",
+      "tooltip-format-ethernet": "{ifname}  {ipaddr}"
+  },
+  //\ue04f{volume}%
+  "pulseaudio": {
+      "tooltip": false,
+      "format": "<span font='10'>{volume}%</span> {icon}",
+      "format-bluetooth": "{volume}% <span font='10'>{icon}</span>",
+      "format-muted": "",
+      "on-click": "pavucontrol",
+      "format-alt": "{volume}% <span font='10'>{icon}</span>",
+      "format-icons": {
+          "headphones": "",
+          "handsfree": "",
+          "headset": "",
+          "phone": "",
+          "portable": "",
+          "car": "",
+          "default": ["","", ""]
+      }
+  },
+  "mpd": {
+    "format": "{artist} - {title} <span color=\"#999999\">[<span color=\"#ffffff\">{elapsedTime:%M:%S}</span> / {totalTime:%M:%S}]</span>",
+    "format-disconnected": "",
+    "format-stopped": "",
+    "interval": 1,
+    "state-icons": {
+      "paused": "",
+      "playing": ""
+    },
+    "tooltip-format": "MPD (connected)",
+    "tooltip-format-disconnected": "MPD (disconnected)"
+  },
+  "custom/notification": {
+    "tooltip": false,
+    "format": " {icon}",
+    "format-icons": {
+      "notification": "<span foreground='red'><sup></sup></span>",
+      "none": "",
+      "dnd-notification": "<span foreground='red'><sup></sup></span>",
+      "dnd-none": ""
+    },
+    "return-type": "json",
+    "exec-if": "which swaync-client",
+    "exec": "swaync-client -swb",
+    "on-click": "swaync-client -t -sw",
+    "on-click-right": "swaync-client -d -sw",
+    "escape": true
+  },
+}

modules/graphical/.config/waybar/style.css

@@ -0,0 +1,80 @@
+@import "./colorscheme.css";
+
+window#waybar {
+    font-family: Hack, FontAwesome;
+    font-weight: 500;
+    font-size: 14px;
+    /*background: rgba(11, 12, 13, 0.90);*/
+    background-color: rgba(0, 0, 0, 0);
+    border-bottom: 1px solid  rgba(0, 0, 2, 0.53);
+    color: @base04;
+}
+
+window#waybar.hidden {
+    opacity: 0.2;
+}
+
+#workspaces button {
+    font-size: 14px;
+    box-shadow: none;
+    text-shadow: none;
+    padding: 0px 3px 0px 3px;
+    color: @base04;
+}
+
+#workspaces button.focused {
+    color: #f85e84;
+    color: @base07;
+    /* margin: 2px 0px 2px 0px; */
+}
+
+#workspaces button:hover {
+    background: rgba(255, 255, 255, 0.00);
+    /* margin: 2px 0px 2px 0px; */
+}
+
+#clock, #backlight, #battery, #cpu, #memory, #network, #pulseaudio, #custom-spotify, #tray, #mode {
+    font-size: 14px;
+    margin: 0px 10px 0px 5px;
+}
+
+#pulseaudio {
+    /* border-top: 1px solid transparent; */
+    font-size: 12px;
+    margin-left: 15px;
+}
+
+#battery {
+    font-size: 12px;
+}
+
+#battery.critical {
+    color: @base07;
+}
+
+#battery.charging {
+    color: @base0B;
+}
+
+#battery.full {
+    margin: 0px 0px 0px 0px;
+}
+
+#network {
+    border-top: 1px solid transparent;
+    color: rgba(255,255,255,0.3);
+}
+
+#network.disconnected {
+    margin: 0px 0px 0px 0px;
+    color: rgba(75, 81, 98, 0);
+}
+
+#pulseaudio.muted {
+    margin: 0px 0px 0px 0px;
+    color: rgba(75, 81, 98, 0);
+}
+
+#custom-notification {
+  font-family: "NotoSansMono Nerd Font";
+}

modules/graphical/.config/xmodmap

@@ -0,0 +1,8 @@
+! Swap Caps_Lock and Control_L
+!
+remove Lock = Caps_Lock
+remove Control = Control_L
+!keysym Control_L = Caps_Lock
+keysym Caps_Lock = Control_L
+add Lock = Caps_Lock
+add Control = Control_L

modules/graphical/.config/xsettingsd/xsettingsd.conf

@@ -0,0 +1,18 @@
+Gtk/ButtonImages 1
+Gtk/CanChangeAccels 1
+Gtk/CursorThemeName "default"
+Gtk/CursorThemeSize 0
+Gtk/EnableEventSounds 0
+Gtk/EnableInputFeedbackSounds 0
+Gtk/FontName "Lato"
+Gtk/ThemeName "Matcha-dark-aliz"
+Gtk/IconThemeName "Papirus-Adapta-Nokto-Maia"
+Gtk/MenuBarAccel "F10"
+Gtk/MenuImages 1
+Gtk/ToolbarIconSize 3
+Gtk/ToolbarStyle "icons"
+Xft/Antialias 1
+Xft/DPI 102400
+Xft/Hinting 1
+Xft/HintStyle "hintslight"
+Xft/RGBA "rgb"

modules/graphical/.xinitrc

@@ -0,0 +1,75 @@
+#!/bin/sh
+#
+# ~/.xinitrc
+#
+# Executed by startx (run your window manager from here)
+
+userresources=$HOME/.Xresources
+usermodmap=$HOME/.config/xmodmap
+sysresources=/etc/X11/xinit/.Xresources
+sysmodmap=/etc/X11/xinit/.Xmodmap
+
+DEFAULT_SESSION='i3 --shmlog-size 0'
+
+xset -b
+
+if [ -d $HOME/.fonts ]; then
+    xset +fp $HOME/.fonts
+    xset fp rehash
+fi
+
+# merge in defaults and keymaps
+
+if [ -f $sysresources ]; then
+    xrdb -merge $sysresources
+fi
+
+if [ -f $sysmodmap ]; then
+    xmodmap $sysmodmap
+fi
+
+if [ -f "$userresources" ]; then
+    xrdb -merge "$userresources"
+fi
+
+if [ -f "$usermodmap" ]; then
+    xmodmap "$usermodmap"
+fi
+
+# start some nice programs
+
+if [ -d /etc/X11/xinit/xinitrc.d ] ; then
+    for f in /etc/X11/xinit/xinitrc.d/?*.sh ; do
+        [ -x "$f" ] && . "$f"
+    done
+    unset f
+fi
+
+get_session(){
+  local dbus_args=(--sh-syntax --exit-with-session)
+  case $1 in
+    awesome) dbus_args+=(awesome) ;;
+    bspwm) dbus_args+=(bspwm-session) ;;
+    budgie) dbus_args+=(budgie-desktop) ;;
+    cinnamon) dbus_args+=(cinnamon-session) ;;
+    deepin) dbus_args+=(startdde) ;;
+    enlightenment) dbus_args+=(enlightenment_start) ;;
+    fluxbox) dbus_args+=(startfluxbox) ;;
+    gnome) dbus_args+=(gnome-session) ;;
+    i3|i3wm) dbus_args+=(i3 --shmlog-size 0) ;;
+    jwm) dbus_args+=(jwm) ;;
+    kde) dbus_args+=(startkde) ;;
+    lxde) dbus_args+=(startlxde) ;;
+    lxqt) dbus_args+=(lxqt-session) ;;
+    mate) dbus_args+=(mate-session) ;;
+    xfce) dbus_args+=(xfce4-session) ;;
+    openbox) dbus_args+=(openbox-session) ;;
+    *) dbus_args+=($DEFAULT_SESSION) ;;
+  esac
+
+  echo "dbus-launch ${dbus_args[*]}"
+}
+
+exec $(get_session)
+xset r rate 660 25
+

modules/graphical/alacritty.nix

@@ -55,7 +55,7 @@
       style = "Italic";
     };
 
-    size = 16.0;
+    size = 12.0;
 
     offset = {
       x = 0;
@@ -69,6 +69,16 @@
   };
 
   key_bindings = [
+    {
+      key = "V";
+      mods = "Control|Super";
+      action = "Paste";
+    }
+    {
+      key = "C";
+      mods = "Control|Super";
+      action = "Copy";
+    }
     {
       key = "V";
       mods = "Control|Alt";

modules/graphical/default.nix

@@ -6,36 +6,22 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.graphical;
   yamlFormat = pkgs.formats.yaml {};
-  recursiveMerge = attrList: let
-    f = attrPath:
-      zipAttrsWith (
-        n: values:
-          if tail values == []
-          then head values
-          else if all isList values
-          then unique (concatLists values)
-          else if all isAttrs values
-          then f (attrPath ++ [n]) values
-          else last values
-      );
-  in
-    f [] attrList;
+  sessionVariables = {
+    WLR_RENDERER =
+      if psCfg.graphical.wayland.software-renderer.enable
+      then "pixman"
+      else "gles2";
+    # Fix KeepassXC rendering issue
+    # https://github.com/void-linux/void-packages/issues/23517
+    QT_AUTO_SCREEN_SCALE_FACTOR = "0";
+  };
 in {
+  imports = [
+    ./sway
+  ];
+
   options.pub-solar.graphical = {
-    enable = mkEnableOption "Life in color";
-    alacritty = {
-      settings = mkOption {
-        type = yamlFormat.type;
-        default = {};
-      };
-    };
-    autologin.enable = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Feature flag enabling autologin after boot.";
-    };
     wayland.software-renderer.enable = mkOption {
       type = types.bool;
       default = false;
@@ -43,8 +29,9 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = {
     hardware.opengl.enable = true;
+
     environment = {
       systemPackages = with pkgs; [
         gtk-engine-murrine
@@ -55,16 +42,20 @@ in {
         papirus-maia-icon-theme
 
         glib
+        xdg-utils
       ];
+
       etc = {
         "xdg/PubSolar.conf".text = ''
           [Qt]
           style=GTK+
         '';
       };
+
+      variables = sessionVariables;
     };
 
-    services.getty.autologinUser = mkIf cfg.autologin.enable (mkForce "${psCfg.user.name}");
+    services.getty.autologinUser = psCfg.user.name;
 
     qt = {
       enable = true;
@@ -72,58 +63,67 @@ in {
       style = "gtk2";
     };
 
-    # Required for running Gnome apps outside the Gnome DE, see https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME
-    programs.dconf.enable = true;
     services.udev.packages = with pkgs; [gnome3.gnome-settings-daemon];
     # Enable Sushi, a quick previewer for nautilus
     services.gnome.sushi.enable = true;
     # Enable GVfs, a userspace virtual filesystem
     services.gvfs.enable = true;
+    services.yubikey-agent.enable = true;
 
-    fonts.enableDefaultFonts = true;
-    fonts.fonts = with pkgs; [
-      fira-code
-      fira-code-symbols
-      google-fonts
-      lato
-      montserrat
-      nerdfonts
-      noto-fonts
-      noto-fonts-cjk
-      open-sans
+    fonts = {
+      packages = with pkgs; [
+        dejavu_fonts
         powerline-fonts
-      source-sans-pro
       ];
+      enableDefaultPackages = true;
+      fontconfig.enable = true;
+      fontconfig.defaultFonts = {
+        monospace = ["DejaVu Sans Mono for Powerline"];
+        sansSerif = ["DejaVu Sans"];
+      };
+    };
 
-    home-manager = with pkgs;
-      setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
+    users.users."${psCfg.user.name}".packages = with pkgs; [
       alacritty
-          foot
-          ungoogled-chromium
       firefox-wayland
-
       flameshot
-          libnotify
       gnome.adwaita-icon-theme
       gnome.eog
       gnome.nautilus
+      gnome.seahorse
       gnome.yelp
       hicolor-icon-theme
-
-          wine
-
-          toggle-kbd-layout
-
-          wcwd
-
+      keepassxc
+      qMasterPassword-wayland
+      libnotify
       vlc
-
-          gimp
     ];
 
-        xdg.configFile."alacritty/alacritty.yml" = {
-          source = yamlFormat.generate "alacritty.yml" (recursiveMerge [(import ./alacritty.nix) cfg.alacritty.settings]);
+    home-manager.users."${psCfg.user.name}" = {
+      home.file."xinitrc".source = ./.xinitrc;
+      xdg.configFile."alacritty/alacritty.yml".source = yamlFormat.generate "alacritty.yml" (import ./alacritty.nix);
+      xdg.configFile."xmodmap".source = ./.config/xmodmap;
+      xdg.configFile."user-dirs.dirs".source = ./.config/user-dirs.dirs;
+      xdg.configFile."user-dirs.locale".source = ./.config/user-dirs.locale;
+      xdg.configFile."xsettingsd/xsettingsd.conf".source = ./.config/xsettingsd/xsettingsd.conf;
+      xdg.configFile."mako/config".source = ./.config/mako/config;
+      xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
+      xdg.configFile."swaync/config.json".source = ./.config/swaync/config.json;
+      xdg.configFile."swaync/style.css".source = ./.config/swaync/style.css;
+      xdg.configFile."waybar/config".source = ./.config/waybar/config;
+      xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
+      xdg.configFile."waybar/colorscheme.css".source = ./.config/waybar/colorscheme.css;
+      xdg.configFile."wallpaper.jpg".source = ./assets/wallpaper.jpg;
+
+      # Required for running Gnome apps outside the Gnome DE, see
+      # https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME
+      dconf = {
+        enable = true;
+        settings = {
+          "org/gnome/desktop/interface" = {
+            color-scheme = "prefer-dark";
+          };
+        };
       };
 
       gtk = {
@@ -145,15 +145,22 @@ in {
           gtk-xft-rgba = "rgb";
           gtk-application-prefer-dark-theme = "true";
         };
-        };
 
-        # Fix KeepassXC rendering issue
-        # https://github.com/void-linux/void-packages/issues/23517
-        systemd.user.sessionVariables.QT_AUTO_SCREEN_SCALE_FACTOR = "0";
+        gtk4.extraConfig = {
+          gtk-xft-antialias = "1";
+          gtk-xft-hinting = "1";
+          gtk-xft-hintstyle = "hintfull";
+          gtk-xft-rgba = "rgb";
+          gtk-application-prefer-dark-theme = "true";
+        };
+      };
 
       xresources.extraConfig = builtins.readFile ./.Xdefaults;
 
       systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
+
+      home.sessionVariables = sessionVariables;
+      systemd.user.sessionVariables = sessionVariables;
     };
   };
 }

modules/graphical/sway/config/config.d/custom-keybindings.conf

@@ -2,7 +2,7 @@
 bindsym $mod+z exec --no-startup-id morc_menu
 
 # switch keyboard input language
-bindsym $mod+tab exec toggle-kbd-layout
+#bindsym $mod+tab exec toggle-kbd-layout
 
 ################################################################################################
 ## sound-section -  ##
@@ -21,6 +21,10 @@ bindsym $mod+F2 exec firefox
 bindsym $mod+F4 exec nautilus -w
 bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon
 
+# Notifications with swaynotificationcenter
+# Toggle control center
+bindsym $mod+Shift+n exec swaync-client -t -sw
+
 bindsym $mod+Shift+m exec qMasterPassword
 
 # Screenshots and screen recordings
@@ -33,3 +37,11 @@ bindsym $mod+Ctrl+r exec record-screen
 # Launcher
 set $menu exec alacritty --class launcher -e env TERMINAL_COMMAND="alacritty -e" sway-launcher
 bindsym $mod+Space exec $menu
+
+set $mode_vncclient In VNCClient mode. Press $mod+Num_Lock or $mod+Shift+Escape to return.
+bindsym $mod+Num_Lock mode "$mode_vncclient"
+bindsym $mod+Shift+Escape mode "$mode_vncclient"
+mode "$mode_vncclient" {
+    bindsym $mod+Num_Lock mode "default"
+    bindsym $mod+Shift+Escape mode "default"
+}

modules/graphical/sway/config/config.d/mode_system.conf.nix

@@ -7,20 +7,17 @@
   # Set shut down, restart and locking features
 ''
 + (
-  if psCfg.core.hibernation.enable && !psCfg.paranoia.enable
+  if psCfg.core.hibernation.enable
   then ''
     set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
   ''
-  else if psCfg.paranoia.enable
-  then ''
-    set $mode_system (e)xit, (h)ibernate, (r)eboot, (Shift+s)hutdown
-  ''
   else ''
     set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
   ''
 )
 + ''
   bindsym $mod+0 mode "$mode_system"
+
   mode "$mode_system" {
     bindsym e exec swaymsg exit, mode "default"
 ''
@@ -31,15 +28,9 @@
   ''
   else ""
 )
-+ (
-  if !psCfg.paranoia.enable
-  then ''
++ ''
       bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
       bindsym s exec systemctl suspend, mode "default"
-  ''
-  else ""
-)
-+ ''
       bindsym r exec systemctl reboot, mode "default"
       bindsym Shift+s exec systemctl poweroff, mode "default"
 

modules/graphical/sway/config/config.nix

@@ -19,7 +19,7 @@
   set $up i
   set $right l
   # Your preferred terminal emulator
-  set $term ${config.pub-solar.sway.terminal}
+  set $term ${pkgs.alacritty}/bin/alacritty
   # Your preferred application launcher
   # Note: pass the final command to swaymsg so that the resulting window can be opened
   # on the original workspace that the command was run on.

modules/graphical/sway/config/wayvnc/config.nix

@@ -0,0 +1,11 @@
+{
+  psCfg,
+  pkgs,
+}: "
+address=0.0.0.0
+enable_auth=true
+username=${psCfg.user.name}
+password=testtest
+private_key_file=/run/agenix/vnc-key.pem
+certificate_file=/run/agenix/vnc-cert.pem
+"

modules/graphical/sway/default.nix

@@ -0,0 +1,101 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  options.pub-solar.graphical = {
+    v4l2loopback.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "WebCam streaming tool";
+    };
+  };
+
+  config = {
+    boot = mkIf psCfg.graphical.v4l2loopback.enable {
+      extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
+      kernelModules = ["v4l2loopback"];
+      extraModprobeConfig = ''
+        options v4l2loopback exclusive_caps=1 devices=3
+      '';
+    };
+
+    environment.systemPackages = with pkgs;
+      mkIf psCfg.graphical.v4l2loopback.enable [
+        linuxPackages.v4l2loopback
+      ];
+
+    programs.sway.enable = true;
+
+    xdg.portal = {
+      enable = true;
+      wlr = {
+        enable = true;
+        settings = {
+          screencast = {
+            max_fps = 30;
+            chooser_type = "simple";
+            chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
+          };
+        };
+      };
+      extraPortals = with pkgs; [xdg-desktop-portal-gtk];
+    };
+
+    services.pipewire.enable = true;
+
+    users.users."${psCfg.user.name}".packages = with pkgs; [
+      sway
+      grim
+      kanshi
+      slurp
+      swaybg
+      swayidle
+      swaynotificationcenter
+      xwayland
+
+      libappindicator-gtk3
+
+      wl-clipboard
+      wf-recorder
+      brightnessctl
+      gammastep
+      geoclue2
+      xsettingsd
+      ydotool
+
+      sway-launcher
+      record-screen
+      import-gtk-settings
+      # Unused on teutat3s hosts, see custom-keybindings.conf
+      #toggle-kbd-layout
+      s
+      wcwd
+    ];
+
+    home-manager.users."${psCfg.user.name}" = {
+      programs.waybar.enable = true;
+      #programs.waybar.systemd.enable = true;
+
+      systemd.user.services.swaynotificationcenter = import ./swaynotificationcenter.service.nix pkgs;
+      systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
+      systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
+      systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
+      systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
+      systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
+
+      xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
+      xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
+      xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
+      xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
+      xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
+      xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
+      xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
+      xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
+    };
+  };
+}

modules/graphical/sway/swayidle.service.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  psCfg,
+  ...
+}: {
+  Unit = {
+    Description = "Idle manager for Wayland";
+    Documentation = ["man:swayidle(1)"];
+    BindsTo = ["graphical-session.target"];
+    Wants = ["graphical-session-pre.target"];
+    After = ["graphical-session-pre.target"];
+  };
+  Service = {
+    Type = "simple";
+    ExecStart = ''
+      ${pkgs.swayidle}/bin/swayidle -w \
+      timeout 300 '${pkgs.swaylock-bg}/bin/swaylock-bg' \
+      timeout 600 '${pkgs.sway}/bin/swaymsg "output * dpms off"' \
+        resume '${pkgs.sway}/bin/swaymsg "output * dpms on"' \
+      before-sleep '${pkgs.swaylock-bg}/bin/swaylock-bg'
+    '';
+  };
+  Install = {
+    WantedBy = ["sway-session.target"];
+  };
+}

modules/graphical/sway/swaynotificationcenter.service.nix

@@ -0,0 +1,21 @@
+pkgs: {
+  Unit = {
+    Description = "Swaync notification daemon";
+    Documentation = "https://github.com/ErikReider/SwayNotificationCenter";
+    BindsTo = ["sway-session.target"];
+    After = ["sway-session.target"];
+    Requisite = ["graphical-session.target"];
+    # ConditionEnvironment requires systemd v247 to work correctly
+    ConditionEnvironment = ["WAYLAND_DISPLAY"];
+  };
+  Service = {
+    Type = "dbus";
+    BusName = "org.freedesktop.Notifications";
+    ExecStart = "${pkgs.swaynotificationcenter}/bin/swaync";
+    ExecReload = "${pkgs.swaynotificationcenter}/bin/swaync-client --reload-config ; ${pkgs.swaynotificationcenter}/bin/swaync-client --reload-css";
+    Restart = "on-failure";
+  };
+  Install = {
+    WantedBy = ["sway-session.target"];
+  };
+}

modules/invoiceplane/default.nix

@@ -0,0 +1,377 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.services.invoiceplane;
+  eachSite = cfg.sites;
+  user = "invoiceplane";
+  webserver = config.services.${cfg.webserver};
+
+  invoiceplane-config = hostName: cfg:
+    pkgs.writeText "ipconfig.php" ''
+      IP_URL=http://${hostName}
+      ENABLE_DEBUG=false
+      DISABLE_SETUP=false
+      REMOVE_INDEXPHP=false
+      DB_HOSTNAME=${cfg.database.host}
+      DB_USERNAME=${cfg.database.user}
+      # NOTE: file_get_contents adds newline at the end of returned string
+      DB_PASSWORD=${
+        if cfg.database.passwordFile == null
+        then ""
+        else "trim(file_get_contents('${cfg.database.passwordFile}'),\"\\r\\n\")"
+      }
+      DB_DATABASE=${cfg.database.name}
+      DB_PORT=${toString cfg.database.port}
+      SESS_EXPIRATION=864000
+      ENABLE_INVOICE_DELETION=false
+      DISABLE_READ_ONLY=false
+      ENCRYPTION_KEY=
+      ENCRYPTION_CIPHER=AES-256
+      SETUP_COMPLETED=false
+      REMOVE_INDEXPHP=true
+    '';
+
+  extraConfig = hostName: cfg:
+    pkgs.writeText "extraConfig.php" ''
+      ${toString cfg.extraConfig}
+    '';
+
+  pkg = hostName: cfg:
+    pkgs.stdenv.mkDerivation rec {
+      pname = "invoiceplane-${hostName}";
+      version = src.version;
+      src = pkgs.invoiceplane;
+
+      postPhase = ''
+        # Patch index.php file to load additional config file
+        substituteInPlace index.php \
+          --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
+      '';
+
+      installPhase = ''
+        mkdir -p $out
+        cp -r * $out/
+
+        # symlink uploads and log directories
+        rm -r $out/uploads $out/application/logs $out/vendor/mpdf/mpdf/tmp
+        ln -sf ${cfg.stateDir}/uploads $out/
+        ln -sf ${cfg.stateDir}/logs $out/application/
+        ln -sf ${cfg.stateDir}/tmp $out/vendor/mpdf/mpdf/
+
+        # symlink the InvoicePlane config
+        ln -s ${cfg.stateDir}/ipconfig.php $out/ipconfig.php
+
+        # symlink the extraConfig file
+        ln -s ${extraConfig hostName cfg} $out/extraConfig.php
+
+        # symlink additional templates
+        ${concatMapStringsSep "\n" (template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/") cfg.invoiceTemplates}
+      '';
+    };
+
+  siteOpts = {
+    lib,
+    name,
+    ...
+  }: {
+    options = {
+      enable = mkEnableOption (lib.mdDoc "InvoicePlane web application");
+
+      stateDir = mkOption {
+        type = types.path;
+        default = "/var/lib/invoiceplane/${name}";
+        description = lib.mdDoc ''
+          This directory is used for uploads of attachments and cache.
+          The directory passed here is automatically created and permissions
+          adjusted as required.
+        '';
+      };
+
+      database = {
+        host = mkOption {
+          type = types.str;
+          default = "localhost";
+          description = lib.mdDoc "Database host address.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 3306;
+          description = lib.mdDoc "Database host port.";
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "invoiceplane";
+          description = lib.mdDoc "Database name.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "invoiceplane";
+          description = lib.mdDoc "Database user.";
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/keys/invoiceplane-dbpassword";
+          description = lib.mdDoc ''
+            A file containing the password corresponding to
+            {option}`database.user`.
+          '';
+        };
+
+        createLocally = mkOption {
+          type = types.bool;
+          default = true;
+          description = lib.mdDoc "Create the database and database user locally.";
+        };
+      };
+
+      invoiceTemplates = mkOption {
+        type = types.listOf types.path;
+        default = [];
+        description = lib.mdDoc ''
+          List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
+
+          ::: {.note}
+          These templates need to be packaged before use, see example.
+          :::
+        '';
+        example = literalExpression ''
+          let
+            # Let's package an example template
+            template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+              name = "vtdirektmarketing";
+              # Download the template from a public repository
+              src = pkgs.fetchgit {
+                url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+              };
+              sourceRoot = ".";
+              # Installing simply means copying template php file to the output directory
+              installPhase = ""
+                mkdir -p $out
+                cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+              "";
+            };
+          # And then pass this package to the template list like this:
+          in [ template-vtdirektmarketing ]
+        '';
+      };
+
+      poolConfig = mkOption {
+        type = with types; attrsOf (oneOf [str int bool]);
+        default = {
+          "pm" = "dynamic";
+          "pm.max_children" = 32;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 2;
+          "pm.max_spare_servers" = 4;
+          "pm.max_requests" = 500;
+        };
+        description = lib.mdDoc ''
+          Options for the InvoicePlane PHP pool. See the documentation on `php-fpm.conf`
+          for details on configuration directives.
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.nullOr types.lines;
+        default = null;
+        example = ''
+          SETUP_COMPLETED=true
+          DISABLE_SETUP=true
+          IP_URL=https://invoice.example.com
+        '';
+        description = lib.mdDoc ''
+          InvoicePlane configuration. Refer to
+          <https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
+          for details on supported values.
+        '';
+      };
+
+      cron = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = lib.mdDoc ''
+            Enable cron service which periodically runs Invoiceplane tasks.
+            Requires key taken from the administration page. Refer to
+            <https://wiki.invoiceplane.com/en/1.0/modules/recurring-invoices>
+            on how to configure it.
+          '';
+        };
+
+        key = mkOption {
+          type = types.str;
+          description = lib.mdDoc "Cron key taken from the administration page.";
+        };
+      };
+    };
+  };
+in {
+  disabledModules = [
+    "services/web-apps/invoiceplane.nix"
+  ];
+
+  # interface
+  options = {
+    services.invoiceplane = mkOption {
+      type = types.submodule {
+        options.sites = mkOption {
+          type = types.attrsOf (types.submodule siteOpts);
+          default = {};
+          description = lib.mdDoc "Specification of one or more WordPress sites to serve";
+        };
+
+        options.webserver = mkOption {
+          type = types.enum ["caddy"];
+          default = "caddy";
+          description = lib.mdDoc ''
+            Which webserver to use for virtual host management. Currently only
+            caddy is supported.
+          '';
+        };
+      };
+      default = {};
+      description = lib.mdDoc "InvoicePlane configuration.";
+    };
+  };
+
+  # implementation
+  config = mkIf (eachSite != {}) (mkMerge [
+    {
+      assertions = flatten (mapAttrsToList (hostName: cfg: [
+          {
+            assertion = cfg.database.createLocally -> cfg.database.user == user;
+            message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
+          }
+          {
+            assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+            message = ''services.invoiceplane.sites."${hostName}".database.passwordFile cannot be specified if services.invoiceplane.sites."${hostName}".database.createLocally is set to true.'';
+          }
+          {
+            assertion = cfg.cron.enable -> cfg.cron.key != null;
+            message = ''services.invoiceplane.sites."${hostName}".cron.key must be set in order to use cron service.'';
+          }
+        ])
+        eachSite);
+
+      services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
+        enable = true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = mapAttrsToList (hostName: cfg: cfg.database.name) eachSite;
+        ensureUsers =
+          mapAttrsToList (
+            hostName: cfg: {
+              name = cfg.database.user;
+              ensurePermissions = {"${cfg.database.name}.*" = "ALL PRIVILEGES";};
+            }
+          )
+          eachSite;
+      };
+
+      services.phpfpm = {
+        phpPackage = pkgs.php81;
+        pools =
+          mapAttrs' (hostName: cfg: (
+            nameValuePair "invoiceplane-${hostName}" {
+              inherit user;
+              group = webserver.group;
+              settings =
+                {
+                  "listen.owner" = webserver.user;
+                  "listen.group" = webserver.group;
+                }
+                // cfg.poolConfig;
+            }
+          ))
+          eachSite;
+      };
+    }
+
+    {
+      systemd.tmpfiles.rules = flatten (mapAttrsToList (hostName: cfg: [
+          "d ${cfg.stateDir} 0750 ${user} ${webserver.group} - -"
+          "f ${cfg.stateDir}/ipconfig.php 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/logs 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/archive 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/customer_files 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/temp 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/uploads/temp/mpdf 0750 ${user} ${webserver.group} - -"
+          "d ${cfg.stateDir}/tmp 0750 ${user} ${webserver.group} - -"
+        ])
+        eachSite);
+
+      systemd.services.invoiceplane-config = {
+        serviceConfig.Type = "oneshot";
+        script = concatStrings (mapAttrsToList (hostName: cfg: ''
+            mkdir -p ${cfg.stateDir}/logs \
+                      ${cfg.stateDir}/uploads
+            if ! grep -q IP_URL "${cfg.stateDir}/ipconfig.php"; then
+              cp "${invoiceplane-config hostName cfg}" "${cfg.stateDir}/ipconfig.php"
+            fi
+          '')
+          eachSite);
+        wantedBy = ["multi-user.target"];
+      };
+
+      users.users.${user} = {
+        group = webserver.group;
+        isSystemUser = true;
+      };
+    }
+    {
+      # Cron service implementation
+
+      systemd.timers =
+        mapAttrs' (hostName: cfg: (
+          nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
+            wantedBy = ["timers.target"];
+            timerConfig = {
+              OnBootSec = "5m";
+              OnUnitActiveSec = "5m";
+              Unit = "invoiceplane-cron-${hostName}.service";
+            };
+          })
+        ))
+        eachSite;
+
+      systemd.services =
+        mapAttrs' (hostName: cfg: (
+          nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
+            serviceConfig = {
+              Type = "oneshot";
+              User = user;
+              ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
+            };
+          })
+        ))
+        eachSite;
+    }
+
+    (mkIf (cfg.webserver == "caddy") {
+      services.caddy = {
+        enable = true;
+        virtualHosts =
+          mapAttrs' (hostName: cfg: (
+            nameValuePair "http://${hostName}" {
+              extraConfig = ''
+                root * ${pkg hostName cfg}
+                file_server
+                php_fastcgi unix/${config.services.phpfpm.pools."invoiceplane-${hostName}".socket}
+              '';
+            }
+          ))
+          eachSite;
+      };
+    })
+  ]);
+}

modules/nextcloud/default.nix

@@ -6,16 +6,8 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.nextcloud;
 in {
-  options.pub-solar.nextcloud = {
-    enable = mkEnableOption "Life in sync";
-  };
-
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+  home-manager.users."${psCfg.user.name}" = {
     systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
   };
-  };
 }

modules/nix-path.nix

@@ -1,11 +0,0 @@
-{
-  channel,
-  inputs,
-  ...
-}: {
-  nix.nixPath = [
-    "nixpkgs=${channel.input}"
-    "nixos-config=${../lib/compat/nixos}"
-    "home-manager=${inputs.home}"
-  ];
-}

modules/nix/default.nix

@@ -2,14 +2,32 @@
   config,
   pkgs,
   lib,
-  inputs,
+  flake,
   ...
 }: {
+  nixpkgs.config.allowUnfreePredicate = pkg:
+    builtins.elem (lib.getName pkg) [
+      "1password"
+      "1password-cli"
+      "cups-brother-hl3140cw"
+      "facetimehd-firmware"
+      "slack"
+      "veracrypt"
+      "zoom"
+    ];
+
   nix = {
     # Use default version alias for nix package
     package = pkgs.nix;
     gc.automatic = true;
     optimise.automatic = true;
+
+    registry = {
+      nixpkgs.flake = flake.inputs.nixpkgs;
+      unstable.flake = flake.inputs.unstable;
+      system.flake = flake.self;
+    };
+
     settings = {
       # Improve nix store disk usage
       auto-optimise-store = true;
@@ -19,7 +37,16 @@
       trusted-users = ["root" "@wheel"];
       # Allow only group wheel to connect to the nix daemon
       allowed-users = ["@wheel"];
+
+      substituters = [
+        "https://pub-solar.cachix.org/"
+      ];
+
+      trusted-public-keys = [
+        "pub-solar.cachix.org-1:ZicXIxKgdxMtgSJECWR8iihZxHRvu8ObL4n2cuBmtos="
+      ];
     };
+
     # Generally useful nix option defaults
     extraOptions = lib.mkForce ''
       experimental-features = flakes nix-command
@@ -28,5 +55,11 @@
       keep-derivations = true
       fallback = true
     '';
+
+    nixPath = [
+      "nixpkgs=${flake.inputs.nixpkgs}"
+      "nixos-config=${../../lib/compat/nixos}"
+      "home-manager=${flake.inputs.home-manager}"
+    ];
   };
 }

modules/office/default.nix

@@ -6,20 +6,10 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.office;
 in {
-  options.pub-solar.office = {
-    enable = mkEnableOption "Install office programs, also enables printing server";
-  };
-
-  config = mkIf cfg.enable {
-    pub-solar.printing.enable = true;
-
-    # Gnome PDF viewer
   programs.evince.enable = true;
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
+
+  users.users."${psCfg.user.name}".packages = with pkgs; [
     libreoffice-fresh
     gnome.simple-scan
     # Tools like pdfunite
@@ -27,6 +17,4 @@ in {
     # tool for annotating PDFs
     xournalpp
   ];
-      };
-  };
 }

modules/paranoia/default.nix

@@ -1,53 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.paranoia;
-in {
-  options.pub-solar.paranoia = {
-    enable = mkOption {
-      description = ''
-        Only offer hibernation instead of screen locking and sleeping. This only makes sense
-        if your hard drive is encrypted, and ensures that the contents of your drive are
-        encrypted if you are not actively using the device.
-      '';
-      default = false;
-      type = types.bool;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    pub-solar.core.hibernation.enable = true;
-    services.logind.lidSwitch = "hibernate";
-
-    # The options below are directly taken from or inspired by
-    # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
-
-    # Don't set this if you need sftp
-    services.openssh.allowSFTP = false;
-    services.openssh.openFirewall = false; # Lock yourself out
-
-    # Limit the use of sudo to the group wheel
-    security.sudo.execWheelOnly = true;
-
-    # Remove the complete default environment of packages like
-    # nano, perl and rsync
-    environment.defaultPackages = lib.mkForce [];
-
-    # fileSystems."/".options = [ "noexec" ];
-
-    services.openssh = {
-      kbdInteractiveAuthentication = false;
-      extraConfig = ''
-        AllowTcpForwarding yes
-        X11Forwarding no
-        AllowAgentForwarding no
-        AllowStreamLocalForwarding no
-        AuthenticationMethods publickey
-      '';
-    };
-  };
-}

modules/printing/default.nix

@@ -1,33 +1,40 @@
 {
-  lib,
+  flake,
   config,
   pkgs,
+  lib,
   ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.printing;
-in {
-  options.pub-solar.printing = {
-    enable = mkEnableOption "CUPSSSss";
-  };
-
-  config = mkIf cfg.enable {
+}: {
   services.avahi.enable = true;
+  services.avahi.ipv6 = true;
   services.avahi.nssmdns = true;
   services.avahi.publish.enable = true;
   services.avahi.publish.userServices = true;
+
   services.printing.enable = true;
   services.printing.browsing = true;
   services.printing.listenAddresses = ["localhost:631"];
-    services.printing.allowFrom = ["all"];
-    services.printing.defaultShared = false;
-    services.printing.drivers = [
+  services.printing.defaultShared = lib.mkDefault false;
+
+  services.printing.drivers =
+    [
       pkgs.gutenprint
-    ];
-    hardware.sane = {
+    ]
+    ++ (
+      if (pkgs.system == "x86_64-linux")
+      then [pkgs.cups-brother-hl3140cw]
+      else []
+    );
+
+  networking.hosts = flake.self.lib.addLocalHostname ["cups.local"];
+
+  services.caddy = {
     enable = true;
-      brscan4.enable = true;
-    };
+    extraConfig = ''
+      cups.local {
+        request_header Host localhost:631
+        reverse_proxy unix//run/cups/cups.sock
+      }
+    '';
   };
 }

modules/social/default.nix

@@ -1,26 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.social;
-in {
-  options.pub-solar.social = {
-    enable = mkEnableOption "Life with others";
-  };
-
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          signal-desktop
-          tdesktop
-          element-desktop
-          irssi
-        ];
-      };
-  };
-}

modules/sway/default.nix

@@ -1,110 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-in {
-  options.pub-solar.sway = {
-    enable = mkEnableOption "Life in boxes";
-
-    terminal = mkOption {
-      type = types.nullOr types.str;
-      default = "alacritty";
-      description = "Choose sway's default terminal";
-    };
-
-    v4l2loopback.enable = mkOption {
-      type = types.bool;
-      default = true;
-      description = "WebCam streaming tool";
-    };
-  };
-
-  config = mkIf psCfg.sway.enable (mkMerge [
-    (mkIf (psCfg.sway.v4l2loopback.enable) {
-      boot.extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
-      boot.kernelModules = ["v4l2loopback"];
-      boot.extraModprobeConfig = ''
-        options v4l2loopback exclusive_caps=1 devices=3
-      '';
-    })
-
-    {
-      environment.systemPackages = with pkgs; [
-        linuxPackages.v4l2loopback
-      ];
-
-      programs.sway.enable = true;
-
-      xdg.portal = {
-        enable = true;
-        wlr = {
-          enable = true;
-          settings = {
-            screencast = {
-              max_fps = 30;
-              chooser_type = "simple";
-              chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
-            };
-          };
-        };
-        extraPortals = with pkgs; [xdg-desktop-portal-gtk];
-      };
-
-      services.pipewire.enable = true;
-
-      home-manager = with pkgs;
-        pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-          home.packages = with pkgs; [
-            sway
-            grim
-            kanshi
-            mako
-            slurp
-            swayidle
-            swaylock
-            swaybg
-            xwayland
-
-            libappindicator-gtk3
-
-            wl-clipboard
-            wf-recorder
-            brightnessctl
-            gammastep
-            geoclue2
-            xsettingsd
-            ydotool
-
-            sway-launcher
-            record-screen
-            import-gtk-settings
-            s
-            wcwd
-          ];
-
-          programs.waybar.enable = true;
-          #programs.waybar.systemd.enable = true;
-
-          systemd.user.services.mako = import ./mako.service.nix {inherit pkgs psCfg;};
-          systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
-          systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
-          systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
-          systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
-          systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
-
-          xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
-          xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
-          xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
-          xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
-          xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
-          xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
-          xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
-          xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
-        };
-    }
-  ]);
-}

modules/sway/swayidle.service.nix

@@ -1,35 +0,0 @@
-{
-  pkgs,
-  psCfg,
-  ...
-}: {
-  Unit = {
-    Description = "Idle manager for Wayland";
-    Documentation = ["man:swayidle(1)"];
-    BindsTo = ["graphical-session.target"];
-    Wants = ["graphical-session-pre.target"];
-    After = ["graphical-session-pre.target"];
-  };
-  Service = {
-    Type = "simple";
-    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
-    ExecStart =
-      ''        swayidle -w \
-                after-resume 'swaymsg "output * dpms on"' \
-                before-sleep 'swaylock-bg' ''
-      + (
-        if psCfg.paranoia.enable
-        then ''          \
-                timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
-                timeout 150 'systemctl hibernate'
-        ''
-        else ''          \
-                timeout 600 'swaylock-bg' \
-                timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
-        ''
-      );
-  };
-  Install = {
-    WantedBy = ["sway-session.target"];
-  };
-}

modules/terminal-life/.config/git/config.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  user = config.pub-solar.user;
+  xdg = config.home-manager.users."${user.name}".xdg;
+in ''  [user]
+    ${
+    if user.email != null
+    then "email = ${user.email}"
+    else ""
+  }
+    ${
+    if user.fullName != null
+    then "name = ${user.fullName}"
+    else ""
+  }
+    ${
+    if user.gpgKeyId != null
+    then "signingkey = ${user.gpgKeyId}"
+    else ""
+  }
+  [core]
+    editor = /etc/profiles/per-user/${config.pub-solar.user.name}/bin/nvim
+    excludesFile = /home/${config.pub-solar.user.name}/.config/git/global_gitignore
+  [alias]
+    pol = pull
+    ack = -c color.grep.linenumber=\"bold yellow\"\n    -c color.grep.filename=\"bold green\"\n    -c color.grep.match=\"reverse yellow\"\n    grep --break --heading --line-number
+  # define command which will be used when "nvim"is set as a merge tool
+
+  [mergetool]
+    prompt = false
+  [merge]
+    tool = nvim
+  [mergetool "nvim"]
+    cmd = /etc/profiles/per-user/${config.pub-solar.user.name}/bin/nvim -f -c \"Gdiffsplit!\" \"$MERGED\"
+
+  [commit]
+    gpgsign = true
+    template = ${xdg.configHome}/git/gitmessage
+  [tag]
+    gpgsign = true
+  [init]
+    defaultBranch = main
+  [pull]
+    rebase = false''

modules/terminal-life/.config/git/gitmessage.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  user = config.pub-solar.user;
+  xdg = config.home-manager.users."${user.name}".xdg;
+in ''
+# What happened?
+#
+# fix feat build chore ci docs style refactor perf test
+#
+# type!(optional scope): <summary> --------------#
+#
+
+
+# ^\n
+# What exactly was done and why? --------------------------------------#
+#
+
+
+# ^\n
+#
+# Any issue numbers or links?
+#
+# Ref: #123
+
+
+# ^\n
+#
+# Co-authored-by: Example Name <email@example.com>
+''

modules/terminal-life/.config/git/global_gitignore.nix

@@ -0,0 +1,6 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+in ''tags''

modules/terminal-life/.local/share/scripts/base16.sh

@@ -0,0 +1,126 @@
+#!/bin/sh
+# base16-shell (https://github.com/chriskempson/base16-shell)
+# Base16 Shell template by Chris Kempson (http://chriskempson.com)
+# Burn scheme by Benjamin Bädorf
+
+color00="1a/18/1a"          # Base 00 - Black
+color01="f8/5e/84"          # Base 08 - Red
+color02="9e/cd/6f"          # Base 0B - Green
+color03="e5/c4/63"          # Base 0A - Yellow
+color04="7a/cc/d7"          # Base 0D - Blue
+color05="ab/9d/f2"          # Base 0E - Magenta
+color06="ef/90/62"          # Base 0C - Cyan
+color07="e3/e1/e4"          # Base 05 - White
+color08="94/94/94"          # Base 03 - Bright Black
+color09=$color01            # Base 08 - Bright Red
+color10=$color02            # Base 0B - Bright Green
+color11=$color03            # Base 0A - Bright Yellow
+color12=$color04            # Base 0D - Bright Blue
+color13=$color05            # Base 0E - Bright Magenta
+color14=$color06            # Base 0C - Bright Cyan
+color15="ff/5f/5f"          # Base 07 - Bright White
+color16="df/59/23"          # Base 09
+color17="d7/00/00"          # Base 0F
+color18="2d/2a/2e"          # Base 01
+color19="30/30/30"          # Base 02
+color20="d3/d1/d4"          # Base 04
+color21="30/30/30"          # Base 06
+color_foreground="e3/e1/e4" # Base 05
+color_background="1a/18/1a" # Base 00
+
+if [ -n "$TMUX" ]; then
+  # Tell tmux to pass the escape sequences through
+  # (Source: http://permalink.gmane.org/gmane.comp.terminal-emulators.tmux.user/1324)
+  put_template() { printf '\033Ptmux;\033\033]4;%d;rgb:%s\033\033\\\033\\' $@; }
+  put_template_var() { printf '\033Ptmux;\033\033]%d;rgb:%s\033\033\\\033\\' $@; }
+  put_template_custom() { printf '\033Ptmux;\033\033]%s%s\033\033\\\033\\' $@; }
+elif [ "${TERM%%[-.]*}" = "screen" ]; then
+  # GNU screen (screen, screen-256color, screen-256color-bce)
+  put_template() { printf '\033P\033]4;%d;rgb:%s\007\033\\' $@; }
+  put_template_var() { printf '\033P\033]%d;rgb:%s\007\033\\' $@; }
+  put_template_custom() { printf '\033P\033]%s%s\007\033\\' $@; }
+elif [ "${TERM%%-*}" = "linux" ]; then
+  put_template() { [ $1 -lt 16 ] && printf "\e]P%x%s" $1 $(echo $2 | sed 's/\///g'); }
+  put_template_var() { true; }
+  put_template_custom() { true; }
+else
+  put_template() { printf '\033]4;%d;rgb:%s\033\\' $@; }
+  put_template_var() { printf '\033]%d;rgb:%s\033\\' $@; }
+  put_template_custom() { printf '\033]%s%s\033\\' $@; }
+fi
+
+# 16 color space
+put_template 0 $color00
+put_template 1 $color01
+put_template 2 $color02
+put_template 3 $color03
+put_template 4 $color04
+put_template 5 $color05
+put_template 6 $color06
+put_template 7 $color07
+put_template 8 $color08
+put_template 9 $color09
+put_template 10 $color10
+put_template 11 $color11
+put_template 12 $color12
+put_template 13 $color13
+put_template 14 $color14
+put_template 15 $color15
+
+# 256 color space
+put_template 16 $color16
+put_template 17 $color17
+put_template 18 $color18
+put_template 19 $color19
+put_template 20 $color20
+put_template 21 $color21
+
+# foreground / background / cursor color
+if [ -n "$ITERM_SESSION_ID" ]; then
+  # iTerm2 proprietary escape codes
+  put_template_custom Pg e3e1e4 # foreground
+  put_template_custom Ph 1a181a # background
+  put_template_custom Pi e3e1e4 # bold color
+  put_template_custom Pj 303030 # selection color
+  put_template_custom Pk e3e1e4 # selected text color
+  put_template_custom Pl e3e1e4 # cursor
+  put_template_custom Pm 1a181a # cursor text
+else
+  put_template_var 10 $color_foreground
+  if [ "$BASE16_SHELL_SET_BACKGROUND" != false ]; then
+    put_template_var 11 $color_background
+    if [ "${TERM%%-*}" = "rxvt" ]; then
+      put_template_var 708 $color_background # internal border (rxvt)
+    fi
+  fi
+  put_template_custom 12 ";7" # cursor (reverse video)
+fi
+
+# clean up
+unset -f put_template
+unset -f put_template_var
+unset -f put_template_custom
+unset color00
+unset color01
+unset color02
+unset color03
+unset color04
+unset color05
+unset color06
+unset color07
+unset color08
+unset color09
+unset color10
+unset color11
+unset color12
+unset color13
+unset color14
+unset color15
+unset color16
+unset color17
+unset color18
+unset color19
+unset color20
+unset color21
+unset color_foreground
+unset color_background

modules/terminal-life/bash/default.nix

@@ -1,7 +1,7 @@
 {
   config,
+  flake,
   pkgs,
-  self,
   ...
 }: let
   psCfg = config.pub-solar;
@@ -18,11 +18,13 @@ in {
 
   # Run when initializing an interactive shell
   initExtra = ''
+    # Use fzf's CTRL-R history widget
+    source ${pkgs.fzf}/share/fzf/key-bindings.bash
     # Show current directory at the top in Alacritty
     PROMPT_COMMAND='echo -e -n "\e]2;$(basename "$PWD" | sed "s/${psCfg.user.name}/~/")\e\\"'
 
     # If a command is not found, show me where it is
-    source ${pkgs.nix-index}/etc/profile.d/command-not-found.sh
+    source ${pkgs.nix-index}/etc/profile.d/command-not-found.bash
 
     # Helps you navigate directories faster
     # https://github.com/gsamokovarov/jump
@@ -98,14 +100,14 @@ in {
     vi = "nvim";
     vim = "nvim";
     mutt = "neomutt";
-    ls = "exa";
-    la = "exa --group-directories-first -lag";
+    ls = "eza";
+    la = "eza --group-directories-first -lag";
     wget = "wget --hsts-file=$XDG_CACHE_HOME/wget-hsts";
     irssi = "irssi --config=$XDG_CONFIG_HOME/irssi/config --home=$XDG_DATA_HOME/irssi";
     drone = "DRONE_TOKEN=$(secret-tool lookup drone token) drone";
     no = "manix \"\" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview=\"manix '{}'\" | xargs manix";
     # fix nixos-option
-    nixos-option = "nixos-option -I nixpkgs=${self}/lib/compat";
+    nixos-option = "nixos-option -I nixpkgs=${flake.self}/lib/compat";
     myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
     nnn = "nnn -d -e -H -r";
   };

modules/terminal-life/default.nix

@@ -2,7 +2,7 @@
   lib,
   config,
   pkgs,
-  self,
+  flake,
   ...
 }:
 with lib; let
@@ -10,42 +10,29 @@ with lib; let
   cfg = config.pub-solar.terminal-life;
 in {
   options.pub-solar.terminal-life = {
-    enable = mkEnableOption "Life in black and white";
-
-    lite = mkOption {
+    full = mkOption {
       description = ''
-        Enable a lite edition of terminal-life with less modules and a reduced package set.
+        Enable a full version, which includes more nvim plugins and lsps.
       '';
       default = false;
       type = types.bool;
     };
   };
 
-  config = mkIf cfg.enable {
+  config = {
     programs.command-not-found.enable = false;
+    programs.nix-index.enable = true;
+    # We do this manually in modules/terminal-life/bash/default.nix
+    # until https://github.com/nix-community/nix-index/pull/227 is merged
+    programs.nix-index.enableBashIntegration = false;
 
-    environment.systemPackages = with pkgs; [
-      screen
-    ];
-
-    # Starship is a fast and featureful shell prompt
-    # starship.toml has sane defaults that can be changed there
-    programs.starship = {
-      enable = true;
-      settings = import ./starship.toml.nix;
-    };
-
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
+    users.users."${psCfg.user.name}".packages = with pkgs; [
       ack
       asciinema
       bat
       blesh
-          exa
+      eza
       fd
-          gh
-          glow
       jump
       (nnn.overrideAttrs (o: {
         patches =
@@ -55,24 +42,72 @@ in {
           ];
       }))
       powerline
+      screen
       silver-searcher
       watson
     ];
 
+    home-manager.users."${psCfg.user.name}" = {
+      xdg.dataFile."scripts/base16.sh".source = .local/share/scripts/base16.sh;
+
+      programs.less = {
+        enable = true;
+        keys = ''
+          k forw-line
+          i back-line
+          K forw-scroll
+          I back-scroll
+        '';
+      };
+
+      # Starship is a fast and featureful shell prompt
+      # starship.toml has sane defaults that can be changed there
+      programs.starship = {
+        enable = true;
+        settings = import ./starship.toml.nix;
+      };
+
       programs.bash = import ./bash {
         inherit config;
         inherit pkgs;
-          inherit self;
+        inherit lib;
+        inherit flake;
       };
+
       programs.fzf = import ./fzf {
         inherit config;
         inherit pkgs;
       };
+
       programs.neovim = import ./nvim {
         inherit config;
         inherit pkgs;
         inherit lib;
       };
+      # Ensure nvim backup directory gets created
+      # Workaround for E510: Can't make backup file (add ! to override)
+      xdg.dataFile."nvim/backup/.keep".text = "";
+      xdg.dataFile."nvim/json-schemas/.keep".text = "";
+      # Generated with:
+      # docker run -it --name caddy-json-schema registry.greenbaum.cloud/gc/caddy-l4:2.5.2 caddy json-schema -output /srv/caddy_schema.json
+      xdg.dataFile."nvim/json-schemas/caddy_schema.json".source = .local/share/nvim/json-schemas/caddy_schema.json;
+      xdg.dataFile."nvim/templates/.keep".text = "";
+
+      programs.git = import ./git {};
+      xdg.configFile."git/config".text = import ./.config/git/config.nix {
+        inherit config;
+        inherit pkgs;
+      };
+      xdg.configFile."git/gitmessage".text = import ./.config/git/gitmessage.nix {
+        inherit config;
+        inherit pkgs;
+      };
+      xdg.configFile."git/global_gitignore".text = import ./.config/git/global_gitignore.nix {
+        inherit config;
+        inherit pkgs;
+      };
+
+      programs.direnv = import ./direnv {};
     };
   };
 }

modules/terminal-life/direnv/default.nix

@@ -0,0 +1,6 @@
+{...}: {
+  enable = true;
+  nix-direnv = {
+    enable = true;
+  };
+}

modules/terminal-life/fzf/default.nix

@@ -10,5 +10,8 @@
     "--color=fg:#d3d1d4,header:#7accd7,info:#e5c463,pointer:#ef9062"
     "--color=marker:#ef9062,fg+:#303030,prompt:#e5c463,hl+:#7accd7"
   ];
-  enableBashIntegration = true;
+  # Use ble.sh for completions, see
+  # modules/terminal-life/bash/default.nix -> bleopt complete_menu_style=desc
+  # and https://github.com/akinomyoga/ble.sh/wiki/Manual-%C2%A77-Completion
+  enableBashIntegration = false;
 }

modules/terminal-life/git/default.nix

@@ -0,0 +1,40 @@
+{...}: {
+  enable = true;
+
+  extraConfig = {
+    pull.rebase = false;
+  };
+
+  aliases = {
+    a = "add -p";
+    co = "checkout";
+    cob = "checkout -b";
+    f = "fetch -p";
+    c = "commit";
+    p = "push";
+    ba = "branch -a";
+    bd = "branch -d";
+    bD = "branch -D";
+    d = "diff";
+    dc = "diff --cached";
+    ds = "diff --staged";
+    r = "restore";
+    rs = "restore --staged";
+    st = "status -sb";
+
+    # reset
+    soft = "reset --soft";
+    hard = "reset --hard";
+    s1ft = "soft HEAD~1";
+    h1rd = "hard HEAD~1";
+
+    # logging
+    lg = "log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
+    plog = "log --graph --pretty='format:%C(red)%d%C(reset) %C(yellow)%h%C(reset) %ar %C(green)%aN%C(reset) %s'";
+    tlog = "log --stat --since='1 Day Ago' --graph --pretty=oneline --abbrev-commit --date=relative";
+    rank = "shortlog -sn --no-merges";
+
+    # delete merged branches
+    bdm = "!git branch --merged | grep -v '*' | xargs -n 1 git branch -d";
+  };
+}

modules/terminal-life/nvim/default.nix

@@ -21,7 +21,7 @@ in {
   withPython3 = true;
 
   extraPackages = with pkgs;
-    lib.mkIf (!cfg.lite) [
+    lib.mkIf (cfg.full) [
       ansible-language-server
       ccls
       gopls
@@ -45,8 +45,7 @@ in {
     ];
 
   plugins = with pkgs.vimPlugins;
-    []
-    ++ lib.optionals (!cfg.lite) [
+    lib.mkIf cfg.full [
       (pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [
         p.ini
         p.json
@@ -171,6 +170,9 @@ in {
       emmet-vim
       # Caddyfile syntax support for Vim
       vim-caddyfile-nvfetcher
+
+      # Fix TOFU hashes when writing nix derivations without leaving neovim
+      vim-nixhash
     ];
 
   extraConfig = builtins.concatStringsSep "\n" [

modules/terminal-life/nvim/init.vim

@@ -14,6 +14,8 @@ set shiftwidth=2
 set number
 set relativenumber
 set mouse=
+set autoindent
+set smartindent
 
 set undolevels=1000
 set undoreload=10000

modules/terminal-life/nvim/lsp.vim

@@ -74,6 +74,8 @@ lua <<EOF
 
   -- Add additional capabilities supported by nvim-cmp
   local capabilities = require('cmp_nvim_lsp').default_capabilities()
+  -- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
+  capabilities.textDocument.completion.completionItem.snippetSupport = true
 
   -- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
   capabilities.textDocument.completion.completionItem.snippetSupport = true
@@ -172,6 +174,13 @@ lua <<EOF
     end
   end -- ‡
 
+  -- configure floating diagnostics appearance, symbols
+  local signs = { Error = " ", Warn = " ", Hint = " ", Info = " " }
+  for type, icon in pairs(signs) do
+    local hl = "DiagnosticSign" .. type
+    vim.fn.sign_define(hl, { text = icon, texthl = hl, numhl = hl })
+  end
+
   -- Set completeopt to have a better completion experience
   vim.o.completeopt = 'menuone,noselect'
 

modules/terminal-life/nvim/ui.vim

@@ -1,18 +1,18 @@
-let g:base16_shell_path = $XDG_DATA_HOME . "/scripts/base16.sh"
-let base16colorspace = 256
+"let g:base16_shell_path = $XDG_DATA_HOME . "/scripts/base16.sh"
+"let base16colorspace = 256
 set termguicolors
-let g:sonokai_style = 'shusia'
-let g:sonokai_enable_italic = 1
-let g:sonokai_disable_italic_comment = 1
-let g:sonokai_transparent_background = 1
-colorscheme sonokai
+"let g:sonokai_style = 'shusia'
+"let g:sonokai_enable_italic = 1
+"let g:sonokai_disable_italic_comment = 1
+"let g:sonokai_transparent_background = 1
 set background=dark
+colorscheme apprentice
 
 let g:airline#extensions#tabline#enabled = 1 " Enable the list of buffers
 let g:airline#extensions#tabline#fnamemod = ':t' " Show just the filename
 let g:airline#extensions#tabline#formatter = 'unique_tail_improved'
 let g:airline_powerline_fonts = 1 " Use powerline fonts
-let g:airline_theme = 'sonokai'
+let g:airline_theme = 'apprentice'
 
 " Customize fzf colors to match your color scheme
 " - fzf#wrap translates this to a set of `--color` options

modules/uhk/default.nix

@@ -1,31 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.uhk;
-in {
-  options.pub-solar.uhk = {
-    enable = mkEnableOption "Ultimate Hacking Keyboard";
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      uhk-agent
-    ];
-
-    # Ultimate Hacking Keyboard rules
-    # These are the udev rules for accessing the USB interfaces of the UHK as non-root users.
-    services.udev.packages = with pkgs; [
-      uhk-agent
-    ];
-    services.udev.extraRules = ''
-      SUBSYSTEM=="input", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", GROUP="input", MODE="0660"
-      SUBSYSTEMS=="usb", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", TAG+="uaccess"
-      KERNEL=="hidraw*", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", TAG+="uaccess"
-    '';
-  };
-}

modules/user/.config/dircolors

@@ -0,0 +1,243 @@
+# Configuration file for dircolors, a utility to help you set the
+# LS_COLORS environment variable used by GNU ls with the --color option.
+
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
+# Copying and distribution of this file, with or without modification,
+# are permitted provided the copyright notice and this notice are preserved.
+
+# The keywords COLOR, OPTIONS, and EIGHTBIT (honored by the
+# slackware version of dircolors) are recognized but ignored.
+
+# You can copy this file to .dir_colors in your $HOME directory to override
+# the system defaults.
+
+# Below, there should be one TERM entry for each termtype that is colorizable
+TERM Eterm
+TERM ansi
+TERM color-xterm
+TERM con132x25
+TERM con132x30
+TERM con132x43
+TERM con132x60
+TERM con80x25
+TERM con80x28
+TERM con80x30
+TERM con80x43
+TERM con80x50
+TERM con80x60
+TERM cons25
+TERM console
+TERM cygwin
+TERM dtterm
+TERM eterm-color
+TERM gnome
+TERM gnome-256color
+TERM hurd
+TERM jfbterm
+TERM konsole
+TERM kterm
+TERM linux
+TERM linux-c
+TERM mach-color
+TERM mach-gnu-color
+TERM mlterm
+TERM putty
+TERM putty-256color
+TERM rxvt
+TERM rxvt-256color
+TERM rxvt-cygwin
+TERM rxvt-cygwin-native
+TERM rxvt-unicode
+TERM rxvt-unicode-256color
+TERM rxvt-unicode256
+TERM screen
+TERM screen-256color
+TERM screen-256color-bce
+TERM screen-bce
+TERM screen-w
+TERM screen.Eterm
+TERM screen.rxvt
+TERM screen.linux
+TERM st
+TERM st-256color
+TERM terminator
+TERM vt100
+TERM xterm
+TERM xterm-16color
+TERM xterm-256color
+TERM xterm-88color
+TERM xterm-color
+TERM xterm-debian
+
+# Below are the color init strings for the basic file types. A color init
+# string consists of one or more of the following numeric codes:
+# Attribute codes:
+# 00=none 01=bold 04=underscore 05=blink 07=reverse 08=concealed
+# Text color codes:
+# 30=black 31=red 32=green 33=yellow 34=blue 35=magenta 36=cyan 37=white
+# Background color codes:
+# 40=black 41=red 42=green 43=yellow 44=blue 45=magenta 46=cyan 47=white
+#NORMAL 00	# no color code at all
+#FILE 00	# regular file: use no color at all
+RESET 0		# reset to "normal" color
+DIR 01;34	# directory
+LINK 01;36	# symbolic link.  (If you set this to 'target' instead of a
+                # numerical value, the color is as for the file pointed to.)
+MULTIHARDLINK 00	# regular file with more than one link
+FIFO 40;33	# pipe
+SOCK 01;35	# socket
+DOOR 01;35	# door
+BLK 40;33;01	# block device driver
+CHR 40;33;01	# character device driver
+ORPHAN 01;05;37;41  # orphaned syminks
+MISSING 01;05;37;41 # ... and the files they point to
+SETUID 37;41	# file that is setuid (u+s)
+SETGID 30;43	# file that is setgid (g+s)
+CAPABILITY 30;41	# file with capability
+STICKY_OTHER_WRITABLE 30;42 # dir that is sticky and other-writable (+t,o+w)
+OTHER_WRITABLE 34;42 # dir that is other-writable (o+w) and not sticky
+STICKY 37;44	# dir with the sticky bit set (+t) and not other-writable
+
+# This is for files with execute permission:
+EXEC 01;32
+
+# List any file extensions like '.gz' or '.tar' that you would like ls
+# to colorize below. Put the extension, a space, and the color init string.
+# (and any comments you want to add after a '#')
+
+# If you use DOS-style suffixes, you may want to uncomment the following:
+#.cmd 01;32 # executables (bright green)
+#.exe 01;32
+#.com 01;32
+#.btm 01;32
+#.bat 01;32
+# Or if you want to colorize scripts even if they do not have the
+# executable bit actually set.
+#.sh  01;32
+#.csh 01;32
+
+# archives or compressed (bright red)
+.tar 01;31
+.tgz 01;31
+.arc 01;31
+.arj 01;31
+.taz 01;31
+.lha 01;31
+.lz4 01;31
+.lzh 01;31
+.lzma 01;31
+.tlz 01;31
+.txz 01;31
+.tzo 01;31
+.t7z 01;31
+.zip 01;31
+.z   01;31
+.Z   01;31
+.dz  01;31
+.gz  01;31
+.lrz 01;31
+.lz  01;31
+.lzo 01;31
+.xz  01;31
+.bz2 01;31
+.bz  01;31
+.tbz 01;31
+.tbz2 01;31
+.tz  01;31
+.deb 01;31
+.rpm 01;31
+.jar 01;31
+.war 01;31
+.ear 01;31
+.sar 01;31
+.rar 01;31
+.alz 01;31
+.ace 01;31
+.zoo 01;31
+.cpio 01;31
+.7z  01;31
+.rz  01;31
+.cab 01;31
+
+# image formats
+.jpg 01;35
+.jpeg 01;35
+.gif 01;35
+.bmp 01;35
+.pbm 01;35
+.pgm 01;35
+.ppm 01;35
+.tga 01;35
+.xbm 01;35
+.xpm 01;35
+.tif 01;35
+.tiff 01;35
+.png 01;35
+.svg 01;35
+.svgz 01;35
+.mng 01;35
+.pcx 01;35
+.mov 01;35
+.mpg 01;35
+.mpeg 01;35
+.m2v 01;35
+.mkv 01;35
+.webm 01;35
+.ogm 01;35
+.mp4 01;35
+.m4v 01;35
+.mp4v 01;35
+.vob 01;35
+.qt  01;35
+.nuv 01;35
+.wmv 01;35
+.asf 01;35
+.rm  01;35
+.rmvb 01;35
+.flc 01;35
+.avi 01;35
+.fli 01;35
+.flv 01;35
+.gl 01;35
+.dl 01;35
+.xcf 01;35
+.xwd 01;35
+.yuv 01;35
+.cgm 01;35
+.emf 01;35
+
+# http://wiki.xiph.org/index.php/MIME_Types_and_File_Extensions
+.axv 01;35
+.anx 01;35
+.ogv 01;35
+.ogx 01;35
+
+# Document files
+.pdf 00;32
+.ps 00;32
+.txt 00;32
+.patch 00;32
+.diff 00;32
+.log 00;32
+.tex 00;32
+.doc 00;32
+
+# audio formats
+.aac 00;36
+.au 00;36
+.flac 00;36
+.m4a 00;36
+.mid 00;36
+.midi 00;36
+.mka 00;36
+.mp3 00;36
+.mpc 00;36
+.ogg 00;36
+.ra 00;36
+.wav 00;36
+
+# http://wiki.xiph.org/index.php/MIME_Types_and_File_Extensions
+.axa 00;36
+.oga 00;36
+.spx 00;36
+.xspf 00;36

modules/user/default.nix

@@ -1,12 +1,16 @@
 {
-  lib,
   config,
   pkgs,
+  lib,
   ...
-}:
-with lib; let
-  cfg = config.pub-solar;
-in {
+}: let
+  psCfg = config.pub-solar;
+in
+  with lib; {
+    imports = [
+      ./home.nix
+    ];
+
     options.pub-solar = {
       user = {
         name = mkOption {
@@ -24,6 +28,11 @@ in {
           type = types.nullOr types.str;
           default = null;
         };
+        passwordlessSudo = mkOption {
+          description = "Whether this user can use sudo without entering a password";
+          type = types.bool;
+          default = false;
+        };
         publicKeys = mkOption {
           description = "User SSH public keys";
           type = types.listOf types.str;
@@ -46,4 +55,47 @@ in {
         };
       };
     };
+
+    config = {
+      users = {
+        mutableUsers = false;
+
+        users."${psCfg.user.name}" = {
+          # Indicates whether this is an account for a “real” user.
+          # This automatically sets group to users, createHome to true,
+          # home to /home/username, useDefaultShell to true, and isSystemUser to false.
+          isNormalUser = true;
+          description = psCfg.user.description;
+          extraGroups = [
+            "input"
+            "lp"
+            "networkmanager"
+            "scanner"
+            "video"
+            "wheel"
+          ];
+          shell = pkgs.bash;
+          initialHashedPassword =
+            if psCfg.user.password != null
+            then psCfg.user.password
+            else "";
+          openssh.authorizedKeys.keys =
+            if psCfg.user.publicKeys != null
+            then psCfg.user.publicKeys
+            else [];
+        };
+      };
+
+      security.sudo.extraRules = mkIf psCfg.user.passwordlessSudo [
+        {
+          users = ["${psCfg.user.name}"];
+          commands = [
+            {
+              command = "ALL";
+              options = ["NOPASSWD"];
+            }
+          ];
+        }
+      ];
+    };
   }