Merge pull request 'Update flake inputs' (#258 ) from main-update-flake-inputs into main

Reviewed-on: #258 Reviewed-by: b12f <hello@benjaminbaedorf.eu>
chore: update blesh in nvfetcher
2023-10-13 11:26:39 +02:00 · 2023-10-09 21:11:31 +02:00 · 2023-10-09 19:15:11 +02:00 · 2023-09-13 13:13:57 +02:00 · 2023-09-13 12:38:31 +02:00 · 2023-09-13 12:38:12 +02:00
52 changed files with 237 additions and 2572 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -17,7 +17,7 @@ steps:
      - nix $$NIX_FLAGS develop --command nix flake show
      - nix $$NIX_FLAGS develop --command treefmt --fail-on-change
      - nix $$NIX_FLAGS develop --command editorconfig-checker
-      - nix $$NIX_FLAGS build ".#nixosConfigurations.flora-6.config.system.build.toplevel"
+      - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"

 ---
 kind: pipeline
@ -44,7 +44,7 @@ steps:
        from_secret: private_ssh_key
      MANTA_USER: pub_solar
      MANTA_URL: https://eu-central.manta.greenbaum.cloud
-      MANTA_KEY_ID: "59:9f:5a:6f:c4:e2:3b:32:7f:13:1f:de:b7:59:80:85"
+      MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67"
    commands:
      - export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
      - echo env var TARGET_DIR is set to $$TARGET_DIR
@ -149,6 +149,6 @@ volumes:

 ---
 kind: signature
-hmac: 17811add241edae457584ba78389886df02b5e51820d826ef5fb2d97de2430e2
+hmac: a116f78a0b22188052893bdb46aa40f8de66438826c10ced362ea183d7644d67

 ...
--- a/flake.lock
+++ b/flake.lock
@ -30,11 +30,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1688307440,
-        "narHash": "sha256-7PTjbN+/+b799YN7Tk2SS5Vh8A0L3gBo8hmB7Y0VXug=",
+        "lastModified": 1696360011,
+        "narHash": "sha256-HpPv27qMuPou4acXcZ8Klm7Zt0Elv9dgDvSJaomWb9Y=",
        "owner": "LnL7",
        "repo": "nix-darwin",
-        "rev": "b06bab83bdf285ea0ae3c8e145a081eb95959047",
+        "rev": "8b6ea26d5d2e8359d06278364f41fbc4b903b28a",
        "type": "github"
      },
      "original": {
@ -54,11 +54,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1686747123,
-        "narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=",
+        "lastModified": 1695052866,
+        "narHash": "sha256-agn7F9Oww4oU6nPiw+YiYI9Xb4vOOE73w8PAoBRP4AA=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "724463b5a94daa810abfc64a4f87faef4e00f984",
+        "rev": "e3f41832680801d0ee9e2ed33eb63af398b090e9",
        "type": "github"
      },
      "original": {
@ -89,28 +89,6 @@
        "type": "github"
      }
    },
-    "devshell_2": {
-      "inputs": {
-        "nixpkgs": [
-          "keycloak-theme-pub-solar",
-          "nixpkgs"
-        ],
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1688380630,
-        "narHash": "sha256-8ilApWVb1mAi4439zS3iFeIT0ODlbrifm/fegWwgHjA=",
-        "owner": "numtide",
-        "repo": "devshell",
-        "rev": "f9238ec3d75cefbb2b42a44948c4e8fb1ae9a205",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "devshell",
-        "type": "github"
-      }
-    },
    "digga": {
      "inputs": {
        "darwin": [
@ -219,54 +197,19 @@
        "type": "github"
      }
    },
-    "flake-utils_3": {
-      "inputs": {
-        "systems": "systems_2"
-      },
+    "fork": {
      "locked": {
-        "lastModified": 1689068808,
-        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
+        "lastModified": 1692960587,
+        "narHash": "sha256-39SKGdhn8jKKkdqhULbCvQOpdUPE9NNJpy5HTB++Jvg=",
+        "owner": "teutat3s",
+        "repo": "nixpkgs",
+        "rev": "312709dd70684f52496580e533d58645526b1c90",
        "type": "github"
      },
      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_4": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1687171271,
-        "narHash": "sha256-BJlq+ozK2B1sJDQXS3tzJM5a+oVZmi1q0FlBK/Xqv7M=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "abfb11bd1aec8ced1c9bb9adfe68018230f4fb3c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_5": {
-      "locked": {
-        "lastModified": 1653893745,
-        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "teutat3s",
+        "ref": "nvfetcher-fix",
+        "repo": "nixpkgs",
        "type": "github"
      }
    },
@ -277,11 +220,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1687871164,
-        "narHash": "sha256-bBFlPthuYX322xOlpJvkjUBz0C+MOBjZdDOOJJ+G2jU=",
+        "lastModified": 1695108154,
+        "narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "07c347bb50994691d7b0095f45ebd8838cf6bc38",
+        "rev": "07682fff75d41f18327a871088d20af2710d4744",
        "type": "github"
      },
      "original": {
@ -291,36 +234,13 @@
        "type": "github"
      }
    },
-    "keycloak-theme-pub-solar": {
-      "inputs": {
-        "devshell": "devshell_2",
-        "flake-utils": "flake-utils_3",
-        "nixpkgs": [
-          "nixos"
-        ]
-      },
-      "locked": {
-        "lastModified": 1689875310,
-        "narHash": "sha256-gJxh8fVX24nZXBxstZcrzZhMRFG9jyOnQEfkgoRr39I=",
-        "ref": "main",
-        "rev": "c2c86bbf9855f16a231a596b75b443232a7b9395",
-        "revCount": 24,
-        "type": "git",
-        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
-      }
-    },
    "latest": {
      "locked": {
-        "lastModified": 1689192006,
-        "narHash": "sha256-QM0f0d8oPphOTYJebsHioR9+FzJcy1QNIzREyubB91U=",
+        "lastModified": 1696604326,
+        "narHash": "sha256-YXUNI0kLEcI5g8lqGMb0nh67fY9f2YoJsILafh6zlMo=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "2de8efefb6ce7f5e4e75bdf57376a96555986841",
+        "rev": "87828a0e03d1418e848d3dd3f3014a632e4a4f64",
        "type": "github"
      },
      "original": {
@ -332,11 +252,11 @@
    },
    "nixos": {
      "locked": {
-        "lastModified": 1689209875,
-        "narHash": "sha256-8AVcBV1DiszaZzHFd5iLc8HSLfxRAuqcU0QdfBEF3Ag=",
+        "lastModified": 1696697597,
+        "narHash": "sha256-q26Qv4DQ+h6IeozF2o1secyQG0jt2VUT3V0K58jr3pg=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "fcc147b1e9358a8386b2c4368bd928e1f63a7df2",
+        "rev": "5a237aecb57296f67276ac9ab296a41c23981f56",
        "type": "github"
      },
      "original": {
@ -348,11 +268,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1686838567,
-        "narHash": "sha256-aqKCUD126dRlVSKV6vWuDCitfjFrZlkwNuvj5LtjRRU=",
+        "lastModified": 1696614066,
+        "narHash": "sha256-nAyYhO7TCr1tikacP37O9FnGr2USOsVBD3IgvndUYjM=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "429f232fe1dc398c5afea19a51aad6931ee0fb89",
+        "rev": "bb2db418b616fea536b1be7f6ee72fb45c11afe0",
        "type": "github"
      },
      "original": {
@ -377,30 +297,6 @@
        "type": "github"
      }
    },
-    "nvfetcher": {
-      "inputs": {
-        "flake-compat": [
-          "flake-compat"
-        ],
-        "flake-utils": "flake-utils_4",
-        "nixpkgs": [
-          "nixos"
-        ]
-      },
-      "locked": {
-        "lastModified": 1687440270,
-        "narHash": "sha256-aOAXvfVn+MBSkU+xlQEiyoGpRaF6NvQdpWIhw5OH/Dc=",
-        "owner": "berberman",
-        "repo": "nvfetcher",
-        "rev": "44196458acc2c28c32e456c50277d6148e71e708",
-        "type": "github"
-      },
-      "original": {
-        "owner": "berberman",
-        "repo": "nvfetcher",
-        "type": "github"
-      }
-    },
    "root": {
      "inputs": {
        "agenix": "agenix",
@ -408,82 +304,11 @@
        "deploy": "deploy",
        "digga": "digga",
        "flake-compat": "flake-compat",
+        "fork": "fork",
        "home": "home",
-        "keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
        "latest": "latest",
        "nixos": "nixos",
-        "nixos-hardware": "nixos-hardware",
-        "nvfetcher": "nvfetcher",
-        "triton-vmtools": "triton-vmtools"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "triton-vmtools": {
-      "inputs": {
-        "flake-utils": "flake-utils_5",
-        "nixpkgs": [
-          "nixos"
-        ]
-      },
-      "locked": {
-        "dir": "vmtools",
-        "lastModified": 1669648111,
-        "narHash": "sha256-EKh7iM4fCyZ7L6+HmGn3QkZ1HuG9zMEkziOH3K13SbY=",
-        "ref": "main",
-        "rev": "d78c4afe040440437949ce581ae0dcdc5893553c",
-        "revCount": 28,
-        "type": "git",
-        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
-      },
-      "original": {
-        "dir": "vmtools",
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
+        "nixos-hardware": "nixos-hardware"
      }
    },
    "utils": {
--- a/flake.nix
+++ b/flake.nix
@ -8,6 +8,8 @@
    nixos.url = "github:nixos/nixpkgs/nixos-23.05";
    latest.url = "github:nixos/nixpkgs/nixos-unstable";

+    fork.url = "github:teutat3s/nixpkgs/nvfetcher-fix";
+
    flake-compat.url = "github:edolstra/flake-compat";
    flake-compat.flake = false;

@ -34,16 +36,6 @@
    agenix.inputs.darwin.follows = "darwin";

    nixos-hardware.url = "github:nixos/nixos-hardware";
-
-    nvfetcher.url = "github:berberman/nvfetcher";
-    nvfetcher.inputs.nixpkgs.follows = "nixos";
-    nvfetcher.inputs.flake-compat.follows = "flake-compat";
-
-    triton-vmtools.url = "git+https://git.b12f.io/pub-solar/infra?ref=main&dir=vmtools";
-    triton-vmtools.inputs.nixpkgs.follows = "nixos";
-
-    keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
-    keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixos";
  };

  outputs = {
@ -54,9 +46,6 @@
    nixos-hardware,
    agenix,
    deploy,
-    nvfetcher,
-    triton-vmtools,
-    keycloak-theme-pub-solar,
    ...
  } @ inputs:
    digga.lib.mkFlake
@ -82,6 +71,7 @@
          ];
        };
        latest = {};
+        fork = {};
      };

      lib = import ./lib {lib = digga.lib // nixos.lib;};
@ -94,7 +84,6 @@
          });
        })
        agenix.overlays.default
-        nvfetcher.overlays.default

        (import ./pkgs)
      ];
@ -125,14 +114,12 @@
            ];
          };
          PubSolarOS = {
-            # Broken since https://github.com/NixOS/nixpkgs/commit/5bcef4224928fe45312f0ee321ddf0f0e8feeb7b
-            # Needs a fix in https://github.com/divnix/digga/blob/main/src/tests.nix#L12-L21
-            #tests = [
+            tests = [
              #(import ./tests/first-test.nix {
              #  pkgs = nixos.legacyPackages.x86_64-linux;
              #  lib = nixos.lib;
              #})
-            #];
+            ];
          };
        };
        importables = rec {
@ -163,11 +150,6 @@
          pub-solar = {suites, ...}: {
            imports = suites.base;

-            home.stateVersion = "21.03";
-          };
-          barkeeper = {suites, ...}: {
-            imports = suites.base;
-
            home.stateVersion = "21.03";
          };
        }; # digga.lib.importers.rakeLeaves ./users/hm;
@ -178,27 +160,6 @@
      homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;

      deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
-        flora-6 = {
-          sshUser = "barkeeper";
-          hostname = "flora-6.pub.solar";
-          fastConnect = true;
-          profilesOrder = ["system" "direnv"];
-          profiles.direnv = {
-            user = "barkeeper";
-            path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.barkeeper;
-          };
-        };
-
-        nougat-2 = {
-          sshUser = "barkeeper";
-          hostname = "nougat-2.b12f.io";
-          fastConnect = true;
-          profilesOrder = ["system" "direnv"];
-          profiles.direnv = {
-            user = "barkeeper";
-            path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.barkeeper;
-          };
-        };
        #example = {
        #  hostname = "example.com:22";
        #  sshUser = "bartender";
--- a/hosts/flora-6/README.md
+++ b/hosts/flora-6/README.md
@ -1,16 +0,0 @@
-# Mailman on NixOS docs
-
- add reverse DNS record for IP
-
-Manual setup done for mailman, adapted from https://nixos.wiki/wiki/Mailman:
-
-```
-# Add DNS records in infra repo using terraform:
-# https://git.pub.solar/pub-solar/infra/commit/db234cdb5b55758a3d74387ada0760e06e166b9d
-
-# Generate initial postfix_domains.db and postfix_lmtp.db databases for Postfix
-sudo -u mailman mailman aliases
-# Create a django superuser account
-sudo -u mailman-web mailman-web createsuperuser
-# Followed outlined steps in web UI
-```
--- a/hosts/flora-6/caddy.nix
+++ b/hosts/flora-6/caddy.nix
@ -1,140 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: {
-  systemd.tmpfiles.rules = [
-    "d '/data/srv/www/os/download/' 0750 hakkonaut hakkonaut - -"
-  ];
-
-  services.caddy = {
-    enable = lib.mkForce true;
-    group = "hakkonaut";
-    email = "admins@pub.solar";
-    enableReload = true;
-    globalConfig = lib.mkForce ''
-      grace_period 60s
-    '';
-    virtualHosts = {
-      "pub.solar" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          # Named matcher, used below for Mastodon webfinger
-          @query query resource=*
-
-          # PubSolarOS images
-          handle /os/download/* {
-            root * /data/srv/www
-            file_server /os/download/* browse
-          }
-          # serve base domain pub.solar for mastodon.pub.solar
-          # https://masto.host/mastodon-usernames-different-from-the-domain-used-for-installation/
-          handle /.well-known/host-meta {
-            redir https://mastodon.pub.solar{uri}
-          }
-
-          # Tailscale OIDC webfinger requirement plus Mastodon webfinger redirect
-          handle /.well-known/webfinger {
-            # Redirect requests that match /.well-known/webfinger?resource=* to Mastodon
-            handle @query {
-              redir https://mastodon.pub.solar{uri}
-            }
-            respond 200 {
-              body `{
-                "subject": "acct:admins@pub.solar",
-                "links": [
-                  {
-                    "rel": "http://openid.net/specs/connect/1.0/issuer",
-                    "href": "https://auth.pub.solar/realms/pub.solar"
-                  }
-                ]
-              }`
-            }
-          }
-
-          # redirect to statutes
-          redir /satzung https://cloud.pub.solar/s/2tRCP9aZFCiWxQy temporary
-
-          # pub.solar website
-          handle {
-            root * /srv/www/pub.solar
-            try_files {path}.html {path}
-            file_server
-          }
-          # minimal error handling, respond with status code and text
-          handle_errors {
-            respond "{http.error.status_code} {http.error.status_text}"
-          }
-        '';
-      };
-      "www.pub.solar" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          redir https://pub.solar{uri}
-        '';
-      };
-      "auth.pub.solar" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          redir / /realms/pub.solar/account temporary
-          reverse_proxy :8080
-        '';
-      };
-      "git.pub.solar" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          redir /user/login /user/oauth2/keycloak temporary
-          reverse_proxy :3000
-        '';
-      };
-      "ci.pub.solar" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          reverse_proxy :4000
-        '';
-      };
-      "stream.pub.solar" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          reverse_proxy :5000
-        '';
-      };
-      "list.pub.solar" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          handle_path /static/* {
-            root * /var/lib/mailman-web-static
-            file_server
-          }
-
-          reverse_proxy :18507
-        '';
-      };
-      "obs-portal.pub.solar" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          reverse_proxy obs-portal.svc.e5756d08-36fd-424b-f8bc-acdb92ca7b82.lev-1.int.greenbaum.zone:3000
-        '';
-      };
-    };
-  };
-  networking.firewall.allowedTCPPorts = [80 443];
-}
--- a/hosts/flora-6/default.nix
+++ b/hosts/flora-6/default.nix
@ -1,5 +0,0 @@
-{...}: {
-  imports = [
-    ./flora-6.nix
-  ];
-}
--- a/hosts/flora-6/drone.nix
+++ b/hosts/flora-6/drone.nix
@ -1,114 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: {
-  age.secrets.drone-secrets = {
-    file = "${self}/secrets/drone-secrets.age";
-    mode = "600";
-    owner = "drone";
-  };
-  age.secrets.drone-db-secrets = {
-    file = "${self}/secrets/drone-db-secrets.age";
-    mode = "600";
-    owner = "drone";
-  };
-
-  users.users.drone = {
-    description = "Drone Service";
-    home = "/var/lib/drone";
-    useDefaultShell = true;
-    uid = 994;
-    group = "drone";
-    isSystemUser = true;
-  };
-
-  users.groups.drone = {};
-
-  systemd.tmpfiles.rules = [
-    "d '/var/lib/drone-db' 0750 drone drone - -"
-  ];
-
-  systemd.services."docker-network-drone" = let
-    docker = config.virtualisation.oci-containers.backend;
-    dockerBin = "${pkgs.${docker}}/bin/${docker}";
-  in {
-    serviceConfig.Type = "oneshot";
-    before = ["docker-drone-server.service"];
-    script = ''
-      ${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
-    '';
-  };
-
-  virtualisation = {
-    docker = {
-      enable = true; # sadly podman is not supported rightnow
-      extraOptions = ''
-        --data-root /data/docker
-      '';
-    };
-
-    oci-containers = {
-      backend = "docker";
-      containers."drone-db" = {
-        image = "postgres:14";
-        autoStart = true;
-        user = "994";
-        volumes = [
-          "/var/lib/drone-db:/var/lib/postgresql/data"
-        ];
-        extraOptions = [
-          "--network=drone-net"
-        ];
-        environmentFiles = [
-          config.age.secrets.drone-db-secrets.path
-        ];
-      };
-      containers."drone-server" = {
-        image = "drone/drone:2";
-        autoStart = true;
-        user = "994";
-        ports = [
-          "4000:80"
-        ];
-        dependsOn = ["drone-db"];
-        extraOptions = [
-          "--network=drone-net"
-        ];
-        environment = {
-          DRONE_GITEA_SERVER = "https://git.pub.solar";
-          DRONE_SERVER_HOST = "ci.pub.solar";
-          DRONE_SERVER_PROTO = "https";
-          DRONE_DATABASE_DRIVER = "postgres";
-        };
-        environmentFiles = [
-          config.age.secrets.drone-secrets.path
-        ];
-      };
-      containers."drone-docker-runner" = {
-        image = "drone/drone-runner-docker:1";
-        autoStart = true;
-        # needs to run as root
-        #user = "994";
-        volumes = [
-          "/var/run/docker.sock:/var/run/docker.sock"
-        ];
-        dependsOn = ["drone-db"];
-        extraOptions = [
-          "--network=drone-net"
-        ];
-        environment = {
-          DRONE_RPC_HOST = "ci.pub.solar";
-          DRONE_RPC_PROTO = "https";
-          DRONE_RUNNER_CAPACITY = "2";
-          DRONE_RUNNER_NAME = "flora-6-docker-runner";
-        };
-        environmentFiles = [
-          config.age.secrets.drone-secrets.path
-        ];
-      };
-    };
-  };
-}
--- a/hosts/flora-6/flora-6.nix
+++ b/hosts/flora-6/flora-6.nix
@ -1,167 +0,0 @@
-{
-  config,
-  latestModulesPath,
-  lib,
-  inputs,
-  pkgs,
-  profiles,
-  self,
-  ...
-}: let
-  psCfg = config.pub-solar;
-in {
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ./triton-vmtools.nix
-
-    ./caddy.nix
-    ./drone.nix
-    ./keycloak.nix
-    ./gitea.nix
-    ./mailman.nix
-    ./owncast.nix
-
-    profiles.base-user
-    profiles.users.root # make sure to configure ssh keys
-    profiles.users.barkeeper
-
-    "${latestModulesPath}/services/misc/gitea.nix"
-    "${latestModulesPath}/services/web-servers/caddy/default.nix"
-  ];
-  disabledModules = [
-    "services/misc/gitea.nix"
-    "services/web-servers/caddy/default.nix"
-  ];
-
-  config = {
-    # # #
-    # # # pub.solar options
-    # # #
-    pub-solar.core = {
-      disk-encryption-active = false;
-      iso-options.enable = true;
-      lite = true;
-    };
-
-    # Allow sudo without a password for the barkeeper user
-    security.sudo.extraRules = [
-      {
-        users = ["${psCfg.user.name}"];
-        commands = [
-          {
-            command = "ALL";
-            options = ["NOPASSWD"];
-          }
-        ];
-      }
-    ];
-
-    # Override nix.conf for more agressive garbage collection
-    nix.extraOptions = lib.mkForce ''
-      min-free = 536870912
-      keep-outputs = false
-      keep-derivations = false
-      fallback = true
-    '';
-
-    # Machine user for CI pipelines
-    users.users.hakkonaut = {
-      description = "CI and automation user";
-      home = "/var/nix/iso-cache";
-      useDefaultShell = true;
-      uid = 998;
-      group = "hakkonaut";
-      isSystemUser = true;
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6"
-      ];
-    };
-
-    users.groups.hakkonaut = {};
-
-    # # #
-    # # # Triton host specific options
-    # # # DO NOT ALTER below this line, changes might render system unbootable
-    # # #
-
-    # Use the systemd-boot EFI boot loader.
-    boot.loader.systemd-boot.enable = true;
-    boot.loader.efi.canTouchEfiVariables = true;
-
-    # Force getting the hostname from cloud-init
-    networking.hostName = lib.mkDefault "";
-
-    # Set your time zone.
-    time.timeZone = "Europe/Berlin";
-
-    # Select internationalisation properties.
-    console = {
-      font = "Lat2-Terminus16";
-      keyMap = "us";
-    };
-
-    # List packages installed in system profile. To search, run:
-    # $ nix search wget
-    environment.systemPackages = with pkgs; [
-      git
-      vim
-      wget
-    ];
-
-    # Some programs need SUID wrappers, can be configured further or are
-    # started in user sessions.
-    # programs.mtr.enable = true;
-    # programs.gnupg.agent = {
-    #   enable = true;
-    #   enableSSHSupport = true;
-    # };
-
-    # List services that you want to enable:
-    services.cloud-init.enable = true;
-    services.cloud-init.ext4.enable = true;
-    services.cloud-init.network.enable = true;
-    # use the default NixOS cloud-init config, but add some SmartOS customization to it
-    environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
-      datasource_list: [ SmartOS ]
-
-      # Do not create the centos/ubuntu/debian user
-      users: [ ]
-
-      # mount second disk with label ephemeral0, gets formated by cloud-init
-      # this will fail to get added to /etc/fstab as it's read-only, but should
-      # mount at boot anyway
-      mounts:
-      - [ vdb, /data, auto, "defaults,nofail" ]
-    '';
-
-    # Enable the OpenSSH daemon.
-    services.openssh = {
-      enable = true;
-      settings = {
-        PasswordAuthentication = false;
-        PermitRootLogin = "no";
-        Macs = [
-          "hmac-sha2-512-etm@openssh.com"
-          "hmac-sha2-256-etm@openssh.com"
-          "umac-128-etm@openssh.com"
-          "hmac-sha2-512"
-          "hmac-sha2-256"
-          "umac-128@openssh.com"
-        ];
-      };
-    };
-
-    # We manage the firewall with nix, too
-    # altough triton can also manage firewall rules via the triton fwrule subcommand
-    networking.firewall.enable = true;
-
-    # This value determines the NixOS release from which the default
-    # settings for stateful data, like file locations and database versions
-    # on your system were taken. It‘s perfectly fine and recommended to leave
-    # this value at the release version of the first install of this system.
-    # Before changing this value read the documentation for this option
-    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-    system.stateVersion = "22.05"; # Did you read the comment?
-  };
-}
--- a/hosts/flora-6/gitea.nix
+++ b/hosts/flora-6/gitea.nix
@ -1,82 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: {
-  age.secrets.gitea-database-password = {
-    file = "${self}/secrets/gitea-database-password.age";
-    mode = "600";
-    owner = "gitea";
-  };
-  age.secrets.gitea-mailer-password = {
-    file = "${self}/secrets/gitea-mailer-password.age";
-    mode = "600";
-    owner = "gitea";
-  };
-
-  # gitea
-  services.gitea = {
-    enable = true;
-    package = pkgs.forgejo;
-    appName = "pub.solar git server";
-    database = {
-      type = "postgres";
-      passwordFile = config.age.secrets.gitea-database-password.path;
-    };
-    lfs.enable = true;
-    mailerPasswordFile = config.age.secrets.gitea-mailer-password.path;
-    settings = {
-      server = {
-        ROOT_URL = "https://git.pub.solar";
-        DOMAIN = "git.pub.solar";
-        HTTP_ADDR = "127.0.0.1";
-        HTTP_PORT = 3000;
-      };
-      mailer = {
-        ENABLED = true;
-        PROTOCOL = "smtps";
-        SMTP_ADDR = "mx2.greenbaum.cloud";
-        SMTP_PORT = 465;
-        FROM = ''"pub.solar git server" <gitea@pub.solar>'';
-        USER = "admins@pub.solar";
-      };
-      "repository.signing" = {
-        SIGNING_KEY = "default";
-        MERGES = "always";
-      };
-      openid = {
-        ENABLE_OPENID_SIGNIN = true;
-        ENABLE_OPENID_SIGNUP = true;
-      };
-      # uncomment after initial deployment, first user is admin user
-      # required to setup SSO (oauth openid-connect, keycloak auth provider)
-      service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
-      service.ENABLE_NOTIFY_MAIL = true;
-      session.COOKIE_SECURE = lib.mkForce true;
-    };
-  };
-
-  # See: https://docs.gitea.io/en-us/signing/#installing-and-generating-a-gpg-key-for-gitea
-  # Required for gitea server side gpg signatures
-  # configured/setup manually in:
-  # /var/lib/gitea/data/home/.gitconfig
-  # /var/lib/gitea/data/home/.gnupg/
-  # sudo su gitea
-  # export GNUPGHOME=/var/lib/gitea/data/home/.gnupg
-  # gpg --quick-gen-key 'pub.solar gitea <gitea@pub.solar>' ed25519
-  # TODO: implement declarative GPG key generation and
-  # gitea gitconfig
-  programs.gnupg.agent = {
-    enable = true;
-    pinentryFlavor = "curses";
-  };
-  # Required to make gpg work without a graphical environment?
-  # otherwise generating a new gpg key fails with this error:
-  # gpg: agent_genkey failed: No pinentry
-  # see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
-  environment.variables = {
-    GPG_TTY = "$(tty)";
-  };
-}
--- a/hosts/flora-6/hardware-configuration.nix
+++ b/hosts/flora-6/hardware-configuration.nix
@ -1,44 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [];
-
-  boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = [];
-  boot.extraModulePackages = [];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    autoResize = true;
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-label/boot";
-    fsType = "vfat";
-  };
-
-  fileSystems."/data" = {
-    device = "/dev/disk/by-label/ephemeral0";
-    fsType = "ext4";
-    options = [
-      "defaults"
-      "nofail"
-    ];
-  };
-
-  swapDevices = [];
-
-  networking.useDHCP = lib.mkDefault false;
-  networking.networkmanager.enable = lib.mkForce false;
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/hosts/flora-6/keycloak.nix
+++ b/hosts/flora-6/keycloak.nix
@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  pkgs,
-  self,
-  ...
-}: {
-  age.secrets.keycloak-database-password = {
-    file = "${self}/secrets/keycloak-database-password.age";
-    mode = "700";
-    #owner = "keycloak";
-  };
-
-  # keycloak
-  services.keycloak = {
-    enable = true;
-    database.passwordFile = config.age.secrets.keycloak-database-password.path;
-    settings = {
-      hostname = "auth.pub.solar";
-      http-host = "127.0.0.1";
-      http-port = 8080;
-      proxy = "edge";
-      features = "declarative-user-profile";
-    };
-    themes = {
-      "pub.solar" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
-    };
-  };
-}
--- a/hosts/flora-6/mailman.nix
+++ b/hosts/flora-6/mailman.nix
@ -1,102 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: let
-  # Source: https://github.com/NixOS/nixpkgs/blob/nixos-22.11/nixos/modules/services/mail/mailman.nix#L9C10-L10
-  # webEnv is required by the mailman-uwsgi systemd service
-  inherit (pkgs.mailmanPackages.buildEnvs {}) webEnv;
-in {
-  networking.firewall.allowedTCPPorts = [25];
-
-  services.postfix = {
-    enable = true;
-    relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"];
-    # get TLS certs for list.pub.solar from caddy
-    # TODO: when caddy renews certs, postfix doesn't know about it
-    # implement custom built caddy with events exec handler or systemd-reload
-    # hook so postfix reloads, too
-    sslCert = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.crt";
-    sslKey = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.key";
-    config = {
-      transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
-      local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
-    };
-    rootAlias = "admins@pub.solar";
-    postmasterAlias = "admins@pub.solar";
-    hostname = "list.pub.solar";
-  };
-
-  systemd.paths.watcher-caddy-ssl-file = {
-    description = "Watches for changes in caddy's TLS cert file (after renewals) to reload postfix";
-    documentation = ["systemd.path(5)"];
-    partOf = ["postfix-reload.service"];
-    pathConfig = {
-      PathChanged = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.crt";
-      Unit = "postfix-reload.service";
-    };
-    wantedBy = ["multi-user.target"];
-  };
-
-  systemd.services."postfix-reload" = {
-    description = "Reloads postfix config, e.g. after TLS certs change, notified by watcher-caddy-ssl-file.path";
-    documentation = ["systemd.path(5)"];
-    requires = ["postfix.service"];
-    after = ["postfix.service"];
-    startLimitIntervalSec = 10;
-    startLimitBurst = 5;
-    serviceConfig.Type = "oneshot";
-    script = ''
-      ${pkgs.systemd}/bin/systemctl reload postfix
-    '';
-    wantedBy = ["multi-user.target"];
-  };
-
-  services.mailman = {
-    enable = true;
-    # We use caddy instead of nginx
-    #serve.enable = true;
-    hyperkitty.enable = true;
-    webHosts = ["list.pub.solar"];
-    siteOwner = "admins@pub.solar";
-  };
-
-  # TODO add django-keycloak as auth provider
-  # https://django-keycloak.readthedocs.io/en/latest/
-  ## Extend settings.py directly since this can't be done via JSON
-  ## settings (services.mailman.webSettings)
-  #environment.etc."mailman3/settings.py".text = ''
-  #  INSTALLED_APPS.extend([
-  #    "allauth.socialaccount.providers.github",
-  #    "allauth.socialaccount.providers.gitlab"
-  #  ])
-  #'';
-
-  systemd.services.mailman-uwsgi = let
-    uwsgiConfig.uwsgi = {
-      type = "normal";
-      plugins = ["python3"];
-      home = webEnv;
-      manage-script-name = true;
-      mount = "/=mailman_web.wsgi:application";
-      http = "127.0.0.1:18507";
-    };
-    uwsgiConfigFile = pkgs.writeText "uwsgi-mailman.json" (builtins.toJSON uwsgiConfig);
-  in {
-    wantedBy = ["multi-user.target"];
-    after = ["postgresql.service"];
-    requires = ["mailman-web-setup.service" "postgresql.service"];
-    restartTriggers = [config.environment.etc."mailman3/settings.py".source];
-    serviceConfig = {
-      # Since the mailman-web settings.py obstinately creates a logs
-      # dir in the cwd, change to the (writable) runtime directory before
-      # starting uwsgi.
-      ExecStart = "${pkgs.coreutils}/bin/env -C $RUNTIME_DIRECTORY ${pkgs.uwsgi.override {plugins = ["python3"];}}/bin/uwsgi --json ${uwsgiConfigFile}";
-      User = "mailman-web";
-      Group = "mailman";
-      RuntimeDirectory = "mailman-uwsgi";
-    };
-  };
-}
--- a/hosts/flora-6/owncast.nix
+++ b/hosts/flora-6/owncast.nix
@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: {
-  # owncast
-  services.owncast = {
-    enable = true;
-    user = "owncast";
-    group = "owncast";
-    # The directory where owncast stores its data files.
-    dataDir = "/var/lib/owncast";
-    # Open the appropriate ports in the firewall for owncast.
-    openFirewall = true;
-    # The IP address to bind the owncast web server to.
-    listen = "127.0.0.1";
-    # TCP port where owncast rtmp service listens.
-    rtmp-port = 1935;
-    # TCP port where owncast web-gui listens.
-    port = 5000;
-  };
-}
--- a/hosts/flora-6/triton-vmtools.nix
+++ b/hosts/flora-6/triton-vmtools.nix
@ -1,9 +0,0 @@
-{
-  pkgs,
-  inputs,
-  ...
-}: {
-  environment.systemPackages = with pkgs; [
-    inputs.triton-vmtools.packages.${pkgs.system}.default
-  ];
-}
--- a/hosts/nougat-2/acme.nix
+++ b/hosts/nougat-2/acme.nix
@ -1,79 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: let
-  exDomain = (import ./ex-domain.nix) lib;
-  pubsolarDomain = import ./pubsolar-domain.nix;
-
-  hostingdeProviderConf = {
-    dnsProvider = "hostingde";
-    credentialsFile = "${pkgs.writeText "hostingde-creds" ''
-      HOSTINGDE_API_KEY_FILE=${config.age.secrets."hosting.de-api-key.age".path}
-    ''}";
-  };
-in {
-  age.secrets."hosting.de-api-key.age" = {
-    file = "${self}/secrets/hosting.de-api-key.age";
-    mode = "440";
-    group = "acme";
-  };
-
-  systemd.tmpfiles.rules = [
-    "d '/data/acme' 0750 root acme - -"
-  ];
-
-  users.groups.acme = {};
-  ids.uids.acme = 997;
-  ids.gids.acme = 997;
-
-  containers.acme = {
-    autoStart = true;
-    privateNetwork = true;
-    hostAddress = "192.168.101.0";
-    localAddress = "192.168.106.0";
-    hostAddress6 = "fc00::1";
-    localAddress6 = "fc00::6";
-
-    bindMounts = {
-      "/var/lib/acme" = {
-        hostPath = "/data/acme";
-        isReadOnly = false;
-      };
-
-      "${config.age.secrets."hosting.de-api-key.age".path}" = {
-        hostPath = "${config.age.secrets."hosting.de-api-key.age".path}";
-        isReadOnly = true;
-      };
-    };
-
-    config = {
-      networking.nameservers = ["1.1.1.1"];
-      users.groups.acme = config.users.groups.acme;
-
-      security.acme = {
-        acceptTerms = true;
-        defaults.email = "acme@benjaminbaedorf.eu";
-        defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
-        defaults.group = "acme";
-
-        certs."b12f.io" = hostingdeProviderConf;
-        certs."mail.b12f.io" = hostingdeProviderConf;
-        certs."transmission.b12f.io" = hostingdeProviderConf;
-
-        certs."${exDomain}" = hostingdeProviderConf;
-        certs."mail.${exDomain}" = hostingdeProviderConf;
-
-        certs."${pubsolarDomain}" = hostingdeProviderConf;
-        certs."www.${pubsolarDomain}" = hostingdeProviderConf;
-        certs."auth.${pubsolarDomain}" = hostingdeProviderConf;
-        certs."git.${pubsolarDomain}" = hostingdeProviderConf;
-        certs."ci.${pubsolarDomain}" = hostingdeProviderConf;
-        certs."list.${pubsolarDomain}" = hostingdeProviderConf;
-        certs."obs-portal.${pubsolarDomain}" = hostingdeProviderConf;
-      };
-    };
-  };
-}
--- a/hosts/nougat-2/caddy.nix
+++ b/hosts/nougat-2/caddy.nix
@ -1,181 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: let
-  pubsolarDomain = import ./pubsolar-domain.nix;
-  # Machine user for CI pipelines
-in {
-  networking.firewall.allowedTCPPorts = [80 443];
-  networking.networkmanager.unmanaged = ["interface-name:ve-caddy"];
-  networking.nat = {
-    enable = true;
-
-    internalInterfaces = ["ve-caddy"];
-    externalInterface = "enp0s31f6";
-
-    # Lazy IPv6 connectivity for the container
-    enableIPv6 = true;
-  };
-
-  systemd.tmpfiles.rules = [
-    "d '/data/www' 0750 root www - -"
-    "d '/data/caddy' 0750 root caddy - -"
-  ];
-
-  users.groups.caddy = {};
-  users.groups.www = {};
-  users.users.hakkonaut.extraGroups = ["www"];
-  ids.uids.www = 996;
-  ids.gids.www = 996;
-
-  fileSystems."/var/lib/caddy" = {
-    device = "/data/caddy";
-    options = ["bind"];
-  };
-
-  fileSystems."/srv/www" = {
-    device = "/data/www";
-    options = ["bind"];
-  };
-
-  containers.caddy = {
-    autoStart = true;
-    privateNetwork = true;
-    hostAddress = "192.168.101.0";
-    localAddress = "192.168.103.0";
-    hostAddress6 = "fc00::1";
-    localAddress6 = "fc00::3";
-
-    forwardPorts = [
-      {
-        containerPort = 443;
-        hostPort = 443;
-        protocol = "tcp";
-      }
-      {
-        containerPort = 80;
-        hostPort = 80;
-        protocol = "tcp";
-      }
-    ];
-
-    bindMounts = {
-      "/srv/www/" = {
-        hostPath = "/data/www";
-        isReadOnly = false;
-      };
-
-      "/var/lib/caddy/" = {
-        hostPath = "/data/caddy";
-        isReadOnly = false;
-      };
-
-      "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory" = {
-        hostPath = "/data/acme";
-        isReadOnly = false;
-      };
-    };
-
-    config = {
-      users.groups.caddy = {};
-      users.groups.www = {};
-      users.groups.acme = {};
-      users.users.caddy.extraGroups = ["www" "acme"];
-
-      networking.firewall.allowedTCPPorts = [80 443];
-      environment.etc."resolv.conf".text = "nameserver 1.1.1.0";
-
-      services.caddy = {
-        enable = lib.mkForce true;
-
-        globalConfig = lib.mkForce ''
-          auto_https disable_certs
-        '';
-
-        virtualHosts = {
-          "dashboard.nougat-2.b12f.io" = {
-            extraConfig = ''
-              reverse_proxy :2019
-            '';
-          };
-          "www.b12f.io" = {
-            extraConfig = ''
-              redir https://pub.solar{uri}
-            '';
-          };
-          "mail.b12f.io" = {
-            extraConfig = ''
-              redir / /realms/pub.solar/account temporary
-              reverse_proxy :8080
-            '';
-          };
-
-          "${pubsolarDomain}" = {
-            logFormat = lib.mkForce ''
-              output discard
-            '';
-            extraConfig = ''
-              # PubSolarOS images
-              handle /os/download/* {
-                root * /srv/www
-                file_server /os/download/* browse
-              }
-              # serve base domain pub.solar for mastodon.pub.solar
-              # https://masto.host/mastodon-usernames-different-from-the-domain-used-for-installation/
-              handle /.well-known/host-meta {
-                redir https://mastodon.${pubsolarDomain}{uri}
-              }
-              # pub.solar website
-              handle {
-                root * /srv/www/pub.solar
-                try_files {path}.html {path}
-                file_server
-              }
-              # minimal error handling, respond with status code and text
-              handle_errors {
-                respond "{http.error.status_code} {http.error.status_text}"
-              }
-            '';
-          };
-          "www.${pubsolarDomain}" = {
-            logFormat = lib.mkForce ''
-              output discard
-            '';
-            extraConfig = ''
-              redir https://${pubsolarDomain}{uri}
-            '';
-          };
-          "auth.${pubsolarDomain}" = {
-            logFormat = lib.mkForce ''
-              output discard
-            '';
-            extraConfig = ''
-              redir / /realms/${pubsolarDomain}/account temporary
-              reverse_proxy 192.168.104.0:8080
-            '';
-          };
-          "git.${pubsolarDomain}" = {
-            logFormat = lib.mkForce ''
-              output discard
-            '';
-            extraConfig = ''
-              redir /user/login /user/oauth2/keycloak temporary
-              reverse_proxy 192.168.105.0:3000
-            '';
-          };
-          "ci.${pubsolarDomain}" = {
-            logFormat = lib.mkForce ''
-              output discard
-            '';
-            extraConfig = ''
-              reverse_proxy 192.168.101.0:8080
-            '';
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/nougat-2/concourse.nix
+++ b/hosts/nougat-2/concourse.nix
@ -1,137 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: let
-  pubsolarDomain = import ./pubsolar-domain.nix;
-
-  getSecret = name:
-    lib.attrsets.setAttrByPath [name] {
-      file = "${self}/secrets/${name}.age";
-      mode = "600";
-      owner = "concourse";
-    };
-
-  keys = [
-    "concourse-session-signing-key"
-    "concourse-worker-key"
-    "concourse-tsa-host-key"
-  ];
-
-  secrets =
-    [
-      "concourse-secrets"
-      "concourse-db-secrets"
-    ]
-    ++ keys;
-in {
-  age.secrets = lib.lists.foldl (a: b: a // getSecret b) {} secrets;
-
-  users.users.concourse = {
-    description = "Concourse Service";
-    home = "/var/lib/concourse";
-    useDefaultShell = true;
-    group = "concourse";
-    isSystemUser = true;
-  };
-
-  users.groups.concourse = {};
-  users.groups.postgres = {};
-  ids.uids.concourse = 995;
-  ids.gids.concourse = 995;
-
-  systemd.tmpfiles.rules = [
-    "d '/data/concourse/db' 0770 root postgres - -"
-  ];
-
-  system.activationScripts.mkConcourseNet = let
-    docker = config.virtualisation.oci-containers.backend;
-    dockerBin = "${pkgs.${docker}}/bin/${docker}";
-  in ''
-    ${dockerBin} network inspect concourse-net >/dev/null 2>&1 || ${dockerBin} network create concourse-net --subnet 172.20.0.0/24
-  '';
-
-  containers.concourse = {
-    autoStart = true;
-    privateNetwork = true;
-    hostAddress = "192.168.101.0";
-    localAddress = "192.168.107.0";
-    hostAddress6 = "fc00::1";
-    localAddress6 = "fc00::7";
-
-    bindMounts = {
-      "/var/lib/postgresql/14" = {
-        hostPath = "/data/concourse/db";
-        isReadOnly = false;
-      };
-
-      "${config.age.secrets.keycloak-database-password.path}" = {
-        hostPath = "${config.age.secrets.keycloak-database-password.path}";
-        isReadOnly = true;
-      };
-    };
-
-    config = {
-      networking.nameservers = ["1.1.1.1"];
-
-  virtualisation.oci-containers = {
-    containers."concourse-db" = {
-      image = "postgres:14";
-      autoStart = true;
-      user = builtins.toString config.ids.uids.postgres;
-      volumes = [
-        "/data/concourse/db:/var/lib/postgresql/data"
-      ];
-      extraOptions = [
-        "--network=concourse-net"
-      ];
-      environmentFiles = [
-        config.age.secrets.concourse-db-secrets.path
-      ];
-    };
-
-    containers."concourse" = {
-      image = "concourse/concourse:7.9.1";
-      autoStart = true;
-      user = builtins.toString config.ids.uids.concourse;
-      ports = [
-        "8080:8080"
-      ];
-      dependsOn = ["concourse-db"];
-      extraOptions = [
-        "--network=concourse-net"
-      ];
-      volumes = [
-        "${config.age.secrets.concourse-session-signing-key.path}:/keys/session_signing_key"
-        "${config.age.secrets.concourse-worker-key.path}:/keys/worker_key"
-        "${config.age.secrets.concourse-tsa-host-key.path}:/keys/tsa_host_key"
-      ];
-
-      environment = {
-        CONCOURSE_EXTERNAL_URL = "https://ci.${pubsolarDomain}";
-
-        CONCOURSE_ADD_LOCAL_USER = "crew:changeme";
-        CONCOURSE_MAIN_TEAM_LOCAL_USER = "crew";
-
-        # instead of relying on the default "detect"
-        CONCOURSE_WORKER_BAGGAGECLAIM_DRIVER = "overlay";
-        CONCOURSE_X_FRAME_OPTIONS = "allow";
-        CONCOURSE_CONTENT_SECURITY_POLICY = "*";
-        CONCOURSE_CLUSTER_NAME = "pub.solar";
-        CONCOURSE_WORKER_CONTAINERD_DNS_SERVER = "8.8.8.8";
-
-        CONCOURSE_SESSION_SIGNING_KEY = "/keys/session_signing_key";
-        CONCOURSE_TSA_HOST_KEY = "/keys/tsa_host_key";
-        CONCOURSE_TSA_AUTHORIZED_KEYS = "/keys/worker_key";
-
-        # For ARM-based machine, change the Concourse runtime to "houdini"
-        CONCOURSE_WORKER_RUNTIME = "containerd";
-      };
-      environmentFiles = [
-        config.age.secrets.concourse-secrets.path
-      ];
-    };
-  };
-}
--- a/hosts/nougat-2/configuration.nix
+++ b/hosts/nougat-2/configuration.nix
@ -1,136 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  psCfg = config.pub-solar;
-in {
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-  ];
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelParams = [
-    "boot.shell_on_fail=1"
-    "ip=135.181.179.123::135.181.179.65:255.255.255.192:nougat-2.b12f.io::off"
-  ];
-  networking.hostName = "nougat-2";
-
-  # The mdadm RAID1s were created with 'mdadm --create ... --homehost=hetzner',
-  # but the hostname for each machine may be different, and mdadm's HOMEHOST
-  # setting defaults to '<system>' (using the system hostname).
-  # This results mdadm considering such disks as "foreign" as opposed to
-  # "local", and showing them as e.g. '/dev/md/hetzner:root0'
-  # instead of '/dev/md/root0'.
-  # This is mdadm's protection against accidentally putting a RAID disk
-  # into the wrong machine and corrupting data by accidental sync, see
-  # https://bugzilla.redhat.com/show_bug.cgi?id=606481#c14 and onward.
-  # We do not worry about plugging disks into the wrong machine because
-  # we will never exchange disks between machines, so we tell mdadm to
-  # ignore the homehost entirely.
-  environment.etc."mdadm.conf".text = ''
-    HOMEHOST <ignore>
-    ARRAY /dev/md/SSD metadata=1.2 name=nixos:SSD UUID=f8189c09:cb247cc7:22b79b5f:df888705
-    ARRAY /dev/md/HDD metadata=1.2 name=nixos:HDD UUID=85ed8a8e:9ddc5f09:c6ef6110:c00728fa
-  '';
-  # The RAIDs are assembled in stage1, so we need to make the config
-  # available there.
-  boot.initrd.services.swraid.enable = true;
-  boot.initrd.services.swraid.mdadmConf = config.environment.etc."mdadm.conf".text;
-
-  boot.initrd.network.enable = true;
-  boot.initrd.network.ssh = {
-    enable = true;
-    port = 22;
-    authorizedKeys =
-      if psCfg.user.publicKeys != null
-      then psCfg.user.publicKeys
-      else [];
-    hostKeys = ["/etc/secrets/initrd/ssh_host_ed25519_key"];
-  };
-
-  # Network (Hetzner uses static IP assignments, and we don't use DHCP here)
-  networking.useDHCP = false;
-  networking.interfaces."enp0s31f6".ipv4.addresses = [
-    {
-      address = "135.181.179.123";
-      prefixLength = 26;
-    }
-  ];
-  networking.defaultGateway = "135.181.179.65";
-
-  networking.interfaces."enp0s31f6".ipv6.addresses = [
-    {
-      address = "2a01:4f9:3a:2170::1";
-      prefixLength = 64;
-    }
-  ];
-  networking.defaultGateway6 = {
-    address = "fe80::1";
-    interface = "enp0s31f6";
-  };
-
-  networking.nameservers = ["1.1.1.1"];
-
-  # Initial empty root password for easy login:
-  users.users.root.initialHashedPassword = "";
-  users.users.root.openssh.authorizedKeys.keys =
-    if psCfg.user.publicKeys != null
-    then psCfg.user.publicKeys
-    else [];
-
-  users.users.hakkonaut = {
-    home = "/home/hakkonaut";
-    description = "CI and automation user";
-    useDefaultShell = true;
-    group = "hakkonaut";
-    isSystemUser = true;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6"
-    ];
-  };
-
-  users.groups.hakkonaut = {};
-  ids.uids.hakkonaut = 998;
-  ids.gids.hakkonaut = 998;
-
-  services.openssh.enable = true;
-  services.openssh.settings.PermitRootLogin = "prohibit-password";
-
-  pub-solar.core.disk-encryption-active = false;
-  pub-solar.core.lite = true;
-
-  virtualisation = {
-    docker = {
-      enable = true;
-    };
-
-    oci-containers = {
-      backend = "docker";
-    };
-  };
-
-  security.sudo.extraRules = [
-    {
-      users = ["${psCfg.user.name}"];
-      commands = [
-        {
-          command = "ALL";
-          options = ["NOPASSWD"];
-        }
-      ];
-    }
-  ];
-
-  # This value determines the NixOS release with which your system is to be
-  # compatible, in order to avoid breaking some software such as database
-  # servers. You should change this only after NixOS release notes say you
-  # should.
-  system.stateVersion = "23.05"; # Did you read the comment?
-}
--- a/hosts/nougat-2/default.nix
+++ b/hosts/nougat-2/default.nix
@ -1,5 +0,0 @@
-{...}: {
-  imports = [
-    ./nougat-2.nix
-  ];
-}
--- a/hosts/nougat-2/ex-domain.nix
+++ b/hosts/nougat-2/ex-domain.nix
@ -1 +0,0 @@
-lib: lib.concatStrings (lib.lists.reverseList ["et" ".n" "zz" "wd" "h"])
--- a/hosts/nougat-2/gitea.nix
+++ b/hosts/nougat-2/gitea.nix
@ -1,124 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: let
-  pubsolarDomain = import ./pubsolar-domain.nix;
-in {
-  age.secrets.gitea-database-password = {
-    file = "${self}/secrets/gitea-database-password.age";
-    mode = "600";
-    group = "gitea";
-  };
-
-  # age.secrets.gitea-mailer-password = {
-  #   file = "${self}/secrets/gitea-mailer-password.age";
-  #   mode = "600";
-  #   owner = "gitea";
-  # };
-
-  systemd.tmpfiles.rules = [
-    "d '/data/gitea/db' 0770 root postgres - -"
-    "d '/data/gitea/gitea' 0770 root gitea - -"
-  ];
-
-  users.groups.postgres = {};
-  users.groups.gitea = {};
-  ids.uids.gitea = 994;
-  ids.gids.gitea = 994;
-
-  containers.gitea = {
-    autoStart = true;
-    privateNetwork = true;
-    hostAddress = "192.168.101.0";
-    localAddress = "192.168.105.0";
-    hostAddress6 = "fc00::1";
-    localAddress6 = "fc00::5";
-
-    bindMounts = {
-      "/var/lib/postgresql/14" = {
-        hostPath = "/data/gitea/db";
-        isReadOnly = false;
-      };
-
-      "/var/lib/gitea" = {
-        hostPath = "/data/gitea/gitea";
-        isReadOnly = false;
-      };
-
-      "${config.age.secrets.gitea-database-password.path}" = {
-        hostPath = "${config.age.secrets.gitea-database-password.path}";
-        isReadOnly = true;
-      };
-    };
-
-    config = {
-      networking.nameservers = ["1.1.1.1"];
-
-      services.gitea = {
-        enable = true;
-        package = pkgs.forgejo;
-        appName = "pub.solar git server";
-        database = {
-          type = "postgres";
-          passwordFile = config.age.secrets.gitea-database-password.path;
-        };
-        lfs.enable = true;
-        # mailerPasswordFile = config.age.secrets.gitea-mailer-password.path;
-        settings = {
-          server = {
-            DOMAIN = "git.${pubsolarDomain}";
-            HTTP_ADDR = "127.0.0.1";
-            HTTP_PORT = 3000;
-            ROOT_URL = "https://git.${pubsolarDomain}";
-          };
-          mailer = {
-            ENABLED = false;
-            PROTOCOL = "smtps";
-            SMTP_ADDR = "mx2.greenbaum.cloud";
-            SMTP_PORT = 465;
-            FROM = ''"pub.solar git server" <gitea@pub.solar>'';
-            USER = "admins@pub.solar";
-          };
-          "repository.signing" = {
-            SIGNING_KEY = "default";
-            MERGES = "always";
-          };
-          openid = {
-            ENABLE_OPENID_SIGNIN = true;
-            ENABLE_OPENID_SIGNUP = true;
-          };
-          # uncomment after initial deployment, first user is admin user
-          # required to setup SSO (oauth openid-connect, keycloak auth provider)
-          service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
-          service.ENABLE_NOTIFY_MAIL = true;
-          session.COOKIE_SECURE = lib.mkForce true;
-        };
-      };
-
-      # See: https://docs.gitea.io/en-us/signing/#installing-and-generating-a-gpg-key-for-gitea
-      # Required for gitea server side gpg signatures
-      # configured/setup manually in:
-      # /var/lib/gitea/data/home/.gitconfig
-      # /var/lib/gitea/data/home/.gnupg/
-      # sudo su gitea
-      # export GNUPGHOME=/var/lib/gitea/data/home/.gnupg
-      # gpg --quick-gen-key 'pub.solar gitea <gitea@pub.solar>' ed25519
-      # TODO: implement declarative GPG key generation and
-      # gitea gitconfig
-      programs.gnupg.agent = {
-        enable = true;
-        pinentryFlavor = "curses";
-      };
-      # Required to make gpg work without a graphical environment?
-      # otherwise generating a new gpg key fails with this error:
-      # gpg: agent_genkey failed: No pinentry
-      # see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
-      environment.variables = {
-        GPG_TTY = "$(tty)";
-      };
-    };
-  };
-}
--- a/hosts/nougat-2/hardware-configuration.nix
+++ b/hosts/nougat-2/hardware-configuration.nix
@ -1,64 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "dm-snapshot"
-    "xhci_pci"
-    "ahci"
-    "nvme"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-    "dm-raid"
-    "e1000e"
-  ];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-intel"];
-  boot.extraModulePackages = [];
-
-  boot.initrd.luks.devices."ssd" = {
-    device = "/dev/disk/by-id/md-uuid-f8189c09:cb247cc7:22b79b5f:df888705";
-  };
-
-  boot.initrd.luks.devices."hdd" = {
-    device = "/dev/disk/by-id/md-uuid-85ed8a8e:9ddc5f09:c6ef6110:c00728fa";
-  };
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/cb88e8b9-be51-43eb-a51a-cd021c90771c";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/3F6D-065E";
-    fsType = "vfat";
-  };
-
-  fileSystems."/data" = {
-    device = "/dev/disk/by-uuid/824341f0-fd56-4db7-bb7e-4f161d94144b";
-    fsType = "ext4";
-  };
-
-  swapDevices = [
-    {device = "/dev/disk/by-uuid/f37e9f96-0174-4cac-a0bb-b63b2a67a4ad";}
-  ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/hosts/nougat-2/keycloak.nix
+++ b/hosts/nougat-2/keycloak.nix
@ -1,64 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  pkgs,
-  self,
-  ...
-}: let
-  pubsolarDomain = import ./pubsolar-domain.nix;
-in {
-  age.secrets.keycloak-database-password = {
-    file = "${self}/secrets/keycloak-database-password.age";
-    mode = "770";
-    group = "keycloak";
-  };
-
-  systemd.tmpfiles.rules = [
-    "d '/data/keycloak/db' 0770 root postgres - -"
-  ];
-
-  users.groups.postgres = {};
-  users.groups.keycloak = {};
-  ids.uids.keycloak = 993;
-  ids.gids.keycloak = 993;
-
-  containers.keycloak = {
-    autoStart = true;
-    privateNetwork = true;
-    hostAddress = "192.168.101.0";
-    localAddress = "192.168.104.0";
-    hostAddress6 = "fc00::1";
-    localAddress6 = "fc00::4";
-
-    bindMounts = {
-      "/var/lib/postgresql/14" = {
-        hostPath = "/data/keycloak/db";
-        isReadOnly = false;
-      };
-
-      "${config.age.secrets.keycloak-database-password.path}" = {
-        hostPath = "${config.age.secrets.keycloak-database-password.path}";
-        isReadOnly = true;
-      };
-    };
-
-    config = {
-      networking.nameservers = ["1.1.1.1"];
-
-      services.keycloak = {
-        enable = true;
-        database.passwordFile = config.age.secrets.keycloak-database-password.path;
-        settings = {
-          hostname = "auth.${pubsolarDomain}";
-          http-host = "0.0.0.0";
-          http-port = 8080;
-          proxy = "edge";
-        };
-        themes = {
-          "pub.solar" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
-        };
-      };
-    };
-  };
-}
--- a/hosts/nougat-2/nougat-2.nix
+++ b/hosts/nougat-2/nougat-2.nix
@ -1,29 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  self,
-  profiles,
-  fix-atomic-container-restartsModulesPath,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
-in {
-  imports = [
-    ./configuration.nix
-
-    profiles.base-user
-    profiles.users.root # make sure to configure ssh keys
-    profiles.users.barkeeper
-
-
-    ./acme.nix
-    ./caddy.nix
-    ./keycloak.nix
-    ./gitea.nix
-    # ./concourse.nix
-    # "${fix-atomic-container-restartsModulesPath}/virtualisation/nixos-containers.nix"
-  ];
-}
--- a/hosts/nougat-2/pubsolar-domain.nix
+++ b/hosts/nougat-2/pubsolar-domain.nix
@ -1 +0,0 @@
-"pub.solar.b12f.io"
--- a/modules/docker/default.nix
+++ b/modules/docker/default.nix
@ -14,6 +14,7 @@ in {

  config = mkIf cfg.enable {
    virtualisation.docker.enable = true;
+    virtualisation.docker.package = pkgs.docker_24;
    users.users = with pkgs;
      pkgs.lib.setAttrByPath [psCfg.user.name] {
        extraGroups = ["docker"];
--- a/modules/graphical/network-manager-applet.service.nix
+++ b/modules/graphical/network-manager-applet.service.nix
@ -1,6 +1,6 @@
 pkgs: {
  Unit = {
-    Description = "Lightweight Wayland notification daemon";
+    Description = "Network Manager applet";
    BindsTo = ["sway-session.target"];
    After = ["sway-session.target"];
    # ConditionEnvironment requires systemd v247 to work correctly
--- a/modules/sway/config/config.d/custom-keybindings.conf
+++ b/modules/sway/config/config.d/custom-keybindings.conf
@ -18,9 +18,6 @@ bindsym $mod+Shift+h exec psos help

 bindsym $mod+F2 exec firefox

-bindsym $mod+F3 exec $term -e vifm
-bindsym $mod+Shift+F3 exec gksu $term -e vifm
-
 bindsym $mod+F4 exec nautilus -w
 bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon

--- a/modules/terminal-life/bash/default.nix
+++ b/modules/terminal-life/bash/default.nix
@ -100,8 +100,6 @@ in {
    mutt = "neomutt";
    ls = "exa";
    la = "exa --group-directories-first -lag";
-    fm = "vifm .";
-    vifm = "vifm .";
    wget = "wget --hsts-file=$XDG_CACHE_HOME/wget-hsts";
    irssi = "irssi --config=$XDG_CONFIG_HOME/irssi/config --home=$XDG_DATA_HOME/irssi";
    drone = "DRONE_TOKEN=$(secret-tool lookup drone token) drone";
@ -109,5 +107,6 @@ in {
    # fix nixos-option
    nixos-option = "nixos-option -I nixpkgs=${self}/lib/compat";
    myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
+    nnn = "nnn -d -e -H -r";
  };
 }
--- a/modules/terminal-life/default.nix
+++ b/modules/terminal-life/default.nix
@ -25,11 +25,6 @@ in {
    programs.command-not-found.enable = false;

    environment.systemPackages = with pkgs; [
-      ack
-      bat
-      exa
-      fd
-      neovim
      screen
    ];

@ -52,10 +47,15 @@ in {
          gh
          glow
          jump
-          nnn
+          (nnn.overrideAttrs (o: {
+            patches =
+              (o.patches or [])
+              ++ [
+                ./nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
+              ];
+          }))
          powerline
          silver-searcher
-          vifm
          watson
        ];

--- a/modules/terminal-life/nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
+++ b/modules/terminal-life/nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
@ -0,0 +1,38 @@
+From a81ee68923412c0fb8fab46f2f918a7ec865b384 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
+Date: Sun, 9 Jul 2023 04:19:51 +0200
+Subject: [PATCH] feat: use wasd keybindings for jkli
+
+---
+ src/nnn.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/nnn.h b/src/nnn.h
+index d476ddd2..5f106987 100644
+--- a/src/nnn.h
+++ b/src/nnn.h
+@@ -131,7 +131,7 @@ struct key {
+ static struct key bindings[] = {
+ 	/* Back */
+ 	{ KEY_LEFT,       SEL_BACK },
+-	{ 'h',            SEL_BACK },
+	{ 'j',            SEL_BACK },
+ 	/* Inside or select */
+ 	{ KEY_ENTER,      SEL_OPEN },
+ 	{ '\r',           SEL_OPEN },
+@@ -139,10 +139,10 @@ static struct key bindings[] = {
+ 	{ KEY_RIGHT,      SEL_NAV_IN },
+ 	{ 'l',            SEL_NAV_IN },
+ 	/* Next */
+-	{ 'j',            SEL_NEXT },
+	{ 'k',            SEL_NEXT },
+ 	{ KEY_DOWN,       SEL_NEXT },
+ 	/* Previous */
+-	{ 'k',            SEL_PREV },
+	{ 'i',            SEL_PREV },
+ 	{ KEY_UP,         SEL_PREV },
+ 	/* Page down */
+ 	{ KEY_NPAGE,      SEL_PGDN },
+-- 
+2.40.1
+
--- a/modules/terminal-life/nvim/default.nix
+++ b/modules/terminal-life/nvim/default.nix
@ -47,62 +47,130 @@ in {
  plugins = with pkgs.vimPlugins;
    []
    ++ lib.optionals (!cfg.lite) [
+      (pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [
+        p.ini
+        p.json
+        p.json5
+        p.markdown
+        p.nix
+        p.toml
+        p.yaml
+
+        p.css
+        p.graphql
+        p.html
+        p.javascript
+        p.scss
+        p.tsx
+        p.typescript
+        p.vue
+
+        p.c
+        p.cpp
+        p.go
+        p.gomod
+        p.gosum
+        p.haskell
+        p.lua
+        p.php
+        p.python
+        p.ruby
+        p.rust
+
+        p.vim
+        p.vimdoc
+
+        p.passwd
+        p.sql
+
+        p.diff
+        p.gitcommit
+        p.gitignore
+        p.git_config
+        p.gitattributes
+        p.git_rebase
+
+        p.bash
+        p.dockerfile
+        p.make
+        p.ninja
+        p.terraform
+      ]))
+
+      # Dependencies for nvim-lspconfig
      nvim-cmp
      cmp-nvim-lsp
      cmp_luasnip
      luasnip

+      # Quickstart configs for neovim LSP
      lsp_extensions-nvim
      nvim-lspconfig

+      # Collaborative editing in Neovim using built-in capabilities
      instant-nvim-nvfetcher

+      # Search functionality behind :Ack
      ack-vim
+
+      # The status bar in the bottom of the screen with the mode indication and file location
      vim-airline
+
+      # Automatically load editorconfig files in repos to configure nvim settings
      editorconfig-vim
+
+      # File browser. Use <leader>n to access
      nnn-vim
+
+      # Highlight characters when using f, F, t, and T
      quick-scope
+
+      # Get sudo in vim; :SudaWrite <optional filename>
      suda-vim
-      syntastic
-      vim-gutentags
-      vim-vinegar
+
+      # Undo history etc. per project
      vim-workspace-nvfetcher

+      # JSON schemas
+      SchemaStore-nvim
+
+      # Work with tags files
+      vim-gutentags
+
+      # Neovim colorschemes / themes
      sonokai
      vim-hybrid-material
      vim-airline-themes
      vim-apprentice-nvfetcher

+      # Git integrations
+      # A Git wrapper so awesome, it should be illegal
      fugitive
+      # Shows git diff markers in the sign column
      vim-gitgutter
+      # GitHub extension for fugitive
      vim-rhubarb
+      # Ease your git workflow within Vim
      vimagit-nvfetcher

+      # FZF fuzzy finder
      fzf-vim
      fzfWrapper
+      # Make the yanked region apparent
      vim-highlightedyank

+      # :Beautify Code beautifier
      vim-beautify-nvfetcher
-      vim-surround

+      # Unload, delete or wipe a buffer without closing the window
      vim-bufkill
+      # Defaults everyone can agree on
      vim-sensible

-      ansible-vim
+      # emmet for vim: http://emmet.io/
      emmet-vim
-      rust-vim
+      # Caddyfile syntax support for Vim
      vim-caddyfile-nvfetcher
-      vim-go
-      vim-javascript
-      vim-json
-      SchemaStore-nvim
-      vim-markdown
-      vim-nix
-      vim-nixhash
-      vim-ruby
-      vim-toml
-      vim-vue
-      yats-vim
    ];

  extraConfig = builtins.concatStringsSep "\n" [
--- a/modules/terminal-life/nvim/init.vim
+++ b/modules/terminal-life/nvim/init.vim
@ -101,3 +101,6 @@ if has("autocmd")
  au BufReadPost * if line("'\"") > 1 && line("'\"") <= line("$") | exe "normal! g'\"" | endif
 endif

+nmap - :NnnPicker %<CR>
+nmap <leader>n :NnnPicker %<CR>
+nmap <leader>N :NnnPicker<CR>
--- a/modules/terminal-life/nvim/plugins.vim
+++ b/modules/terminal-life/nvim/plugins.vim
@ -83,3 +83,5 @@ if executable('ag')
  let g:ackprg = 'ag --vimgrep'
 endif

+" nnn
+let g:nnn#command = 'nnn -d -e -H -r'
--- a/overlays/overrides.nix
+++ b/overlays/overrides.nix
@ -4,6 +4,12 @@ channels: final: prev: {
  inherit
    (channels.latest)
    nixd
+    docker_24
+    ;
+
+  inherit
+    (channels.fork)
+    nvfetcher
    ;

  haskellPackages =
--- a/pkgs/_sources/generated.nix
+++ b/pkgs/_sources/generated.nix
@ -3,17 +3,17 @@
 {
  blesh-nvfetcher = {
    pname = "blesh-nvfetcher";
-    version = "4089c4e1cb411121472180189953664b978d8972";
+    version = "9d84b424daf31b192891c06275fff316fa5ddd35";
    src = fetchFromGitHub {
      owner = "akinomyoga";
      repo = "ble.sh";
-      rev = "4089c4e1cb411121472180189953664b978d8972";
+      rev = "9d84b424daf31b192891c06275fff316fa5ddd35";
      fetchSubmodules = true;
      deepClone = false;
      leaveDotGit = true;
-      sha256 = "sha256-ZLkiBm3vsRe42crLffM9Z8F5yzKvNRV2/AqK9RkuU+8=";
+      sha256 = "sha256-7aX5UtDB9pUHHeOi9n+qWsM2KGenHVL6O18vG9W8tmQ=";
    };
-    date = "2023-07-18";
+    date = "2023-10-02";
  };
  instant-nvim-nvfetcher = {
    pname = "instant-nvim-nvfetcher";
--- a/profiles/base-user/.config/git/gitmessage.nix
+++ b/profiles/base-user/.config/git/gitmessage.nix
@ -6,19 +6,27 @@
  user = config.pub-solar.user;
  xdg = config.home-manager.users."${user.name}".xdg;
 in ''
-  # Title: Summary, imperative, start upper case, don't end with a period
-  # No more than 50 chars. #### 50 chars is here:  #
+# What happened?
+#
+# fix feat build chore ci docs style refactor perf test
+#
+# type!(optional scope): <summary> --------------#
 #


-  # ^ Remember ending with an extra blank line
-  # Body: Explain *what* and *why* (not *how*). Include issue number.
-  # Wrap at 72 chars. ################################## which is here:  #
+# ^\n
+# What exactly was done and why? --------------------------------------#
 #


-  # ^ Remember ending with an extra blank line
-  # At the end: Include Co-authored-by for all contributors.
+# ^\n
+#
+# Any issue numbers or links?
+#
+# Ref: #123
+
+
+# ^\n
 #
 # Co-authored-by: Example Name <email@example.com>
 ''
--- a/profiles/base-user/.config/vifm/colors/base16.vifm
+++ b/profiles/base-user/.config/vifm/colors/base16.vifm
@ -1,26 +0,0 @@
-" Reset all styles first
-highlight clear
-
-highlight Border	cterm=none	ctermfg=235	ctermbg=0
-
-highlight TopLine	cterm=none	ctermfg=20	ctermbg=18
-highlight TopLineSel	cterm=none	ctermfg=1	ctermbg=18
-
-highlight Win		cterm=none	ctermfg=188	ctermbg=0
-highlight Directory	cterm=bold	ctermfg=4	ctermbg=0
-highlight CurrLine	cterm=none	ctermfg=3	ctermbg=19
-highlight OtherLine	cterm=none	ctermfg=3	ctermbg=19
-highlight Selected	cterm=none	ctermfg=5	ctermbg=19
-
-highlight JobLine	cterm=bold	ctermfg=0	ctermbg=18
-highlight StatusLine	cterm=bold	ctermfg=0	ctermbg=18
-highlight ErrorMsg	cterm=bold	ctermfg=0	ctermbg=18
-highlight WildMenu	cterm=bold	ctermfg=0	ctermbg=18
-highlight CmdLine	cterm=none	ctermfg=20	ctermbg=0
-
-highlight Executable	cterm=bold	ctermfg=2	ctermbg=0
-highlight Link		cterm=none	ctermfg=9	ctermbg=0
-highlight BrokenLink	cterm=none	ctermfg=1	ctermbg=0
-highlight Device	cterm=none	ctermfg=228	ctermbg=0
-highlight Fifo		cterm=none	ctermfg=109	ctermbg=0
-highlight Socket	cterm=none	ctermfg=110	ctermbg=0
--- a/profiles/base-user/.config/vifm/vifmrc
+++ b/profiles/base-user/.config/vifm/vifmrc
@ -1,495 +0,0 @@
-" vim: filetype=vifm :
-" Sample configuration file for vifm (last updated: 2 June, 2019)
-" You can edit this file by hand.
-" The " character at the beginning of a line comments out the line.
-" Blank lines are ignored.
-" The basic format for each item is shown with an example.
-
-" ------------------------------------------------------------------------------
-
-" Command used to edit files in various contexts.  The default is vim.
-" If you would like to use another vi clone such as Elvis or Vile
-" you will need to change this setting.
-
-set vicmd=nvim
-" set vicmd=elvis\ -G\ termcap
-" set vicmd=vile
-
-" This makes vifm perform file operations on its own instead of relying on
-" standard utilities like `cp`.  While using `cp` and alike is a more universal
-" solution, it's also much slower when processing large amounts of files and
-" doesn't support progress measuring.
-
-set syscalls
-
-" Trash Directory
-" The default is to move files that are deleted with dd or :d to
-" the trash directory.  If you change this you will not be able to move
-" files by deleting them and then using p to put the file in the new location.
-" I recommend not changing this until you are familiar with vifm.
-" This probably shouldn't be an option.
-
-set trash
-
-" This is how many directories to store in the directory history.
-
-set history=100
-
-" Automatically resolve symbolic links on l or Enter.
-
-set nofollowlinks
-
-" With this option turned on you can run partially entered commands with
-" unambiguous beginning using :! (e.g. :!Te instead of :!Terminal or :!Te<tab>).
-
-" set fastrun
-
-" Natural sort of (version) numbers within text.
-
-set sortnumbers
-
-" Maximum number of changes that can be undone.
-
-set undolevels=100
-
-" Use Vim's format of help file (has highlighting and "hyperlinks").
-" If you would rather use a plain text help file set novimhelp.
-
-set vimhelp
-
-" If you would like to run an executable file when you
-" press return on the file name set this.
-
-set norunexec
-
-" Selected color scheme
-
-colorscheme base16
-
-" Format for displaying time in file list. For example:
-" TIME_STAMP_FORMAT=%m/%d-%H:%M
-" See man date or man strftime for details.
-
-set timefmt=%m/%d\ %H:%M
-
-" Show list of matches on tab completion in command-line mode
-
-set wildmenu
-
-" Display completions in a form of popup with descriptions of the matches
-
-set wildstyle=popup
-
-" Display suggestions in normal, visual and view modes for keys, marks and
-" registers (at most 5 files).  In other view, when available.
-
-set suggestoptions=normal,visual,view,otherpane,keys,marks,registers
-
-" Ignore case in search patterns unless it contains at least one uppercase
-" letter
-
-set ignorecase
-set smartcase
-
-" Don't highlight search results automatically
-
-set nohlsearch
-
-" Use increment searching (search while typing)
-set incsearch
-
-" Try to leave some space from cursor to upper/lower border in lists
-
-set scrolloff=4
-
-" Don't do too many requests to slow file systems
-
-if !has('win')
-    set slowfs=curlftpfs
-endif
-
-" Set custom status line look
-
-set statusline="  Hint: %z%= %A %10u:%-7g %15s %20d  "
-
-" ------------------------------------------------------------------------------
-
-" :mark mark /full/directory/path [filename]
-
-mark b ~/bin/
-mark h ~/
-
-" ------------------------------------------------------------------------------
-
-" :com[mand][!] command_name action
-" The following macros can be used in a command
-" %a is replaced with the user arguments.
-" %c the current file under the cursor.
-" %C the current file under the cursor in the other directory.
-" %f the current selected file, or files.
-" %F the current selected file, or files in the other directory.
-" %b same as %f %F.
-" %d the current directory name.
-" %D the other window directory name.
-" %m run the command in a menu window
-
-command! df df -h %m 2> /dev/null
-command! diff vim -d %f %F
-command! zip zip -r %f.zip %f
-command! unzip unzip %c %c.extracted
-command! run !! ./%f
-command! make !!make %a
-command! mkcd :mkdir %a | cd %a
-command! vgrep vim "+grep %a"
-command! reload :write | restart
-
-" ------------------------------------------------------------------------------
-
-" The file type is for the default programs to be used with
-" a file extension.
-" :filetype pattern1,pattern2 defaultprogram,program2
-" :fileviewer pattern1,pattern2 consoleviewer
-" The other programs for the file type can be accessed with the :file command
-" The command macros %f, %F, %d, %F may be used in the commands.
-" The %a macro is ignored.  To use a % you must put %%.
-
-" For automated FUSE mounts, you must register an extension with :file[x]type
-" in one of following formats:
-"
-" :filetype extensions FUSE_MOUNT|some_mount_command using %SOURCE_FILE and %DESTINATION_DIR variables
-" %SOURCE_FILE and %DESTINATION_DIR are filled in by vifm at runtime.
-" A sample line might look like this:
-" :filetype *.zip,*.jar,*.war,*.ear FUSE_MOUNT|fuse-zip %SOURCE_FILE %DESTINATION_DIR
-"
-" :filetype extensions FUSE_MOUNT2|some_mount_command using %PARAM and %DESTINATION_DIR variables
-" %PARAM and %DESTINATION_DIR are filled in by vifm at runtime.
-" A sample line might look like this:
-" :filetype *.ssh FUSE_MOUNT2|sshfs %PARAM %DESTINATION_DIR
-" %PARAM value is filled from the first line of file (whole line).
-" Example first line for SshMount filetype: root@127.0.0.1:/
-"
-" You can also add %CLEAR if you want to clear screen before running FUSE
-" program.
-
-" Pdf
-filextype *.pdf epdfview %c %i &, apvlv %c, xpdf %c
-fileviewer *.pdf
-        \ vifmimg pdfpreview %px %py %pw %ph %c
-        \ %pc
-        \ vifmimg clear
-        " \ pdftotext -nopgbrk %c -
-
-" PostScript
-filextype *.ps,*.eps,*.ps.gz
-        \ {View in zathura}
-        \ zathura %f,
-        \ {View in gv}
-        \ gv %c %i &,
-
-" Djvu
-filextype *.djvu
-        \ {View in zathura}
-        \ zathura %f,
-        \ {View in apvlv}
-        \ apvlv %f,
-
-" Audio
-filetype *.wav,*.mp3,*.flac,*.m4a,*.wma,*.ape,*.ac3,*.og[agx],*.spx,*.opus
-        \ {Play using vlc}
-        \ vlc %c,
-        \ {Play using ffplay}
-        \ ffplay -nodisp -autoexit %c,
-fileviewer *.mp3 mp3info
-fileviewer *.flac soxi
-
-" Video
-filextype *.avi,*.mp4,*.wmv,*.dat,*.3gp,*.ogv,*.mkv,*.mpg,*.mpeg,*.vob,
-        \*.fl[icv],*.m2v,*.mov,*.webm,*.ts,*.mts,*.m4v,*.r[am],*.qt,*.divx,
-        \*.as[fx]
-        \ {View using vlc}
-        \ vlc %f,
-        \ {View using ffplay}
-        \ ffplay -fs -autoexit %f,
-fileviewer *.avi,*.mp4,*.wmv,*.dat,*.3gp,*.ogv,*.mkv,*.mpg,*.mpeg,*.vob,
-        \*.fl[icv],*.m2v,*.mov,*.webm,*.ts,*.mts,*.m4v,*.r[am],*.qt,*.divx,
-        \*.as[fx]
-        \ vifmimg videopreview %px %py %pw %ph %c
-        \ %pc
-        \ vifmimg clear
-        " \ ffprobe -pretty %c 2>&1
-
-" Web
-filextype *.html,*.htm
-        \ {Open with vim}
-        \ nvim %f,
-        \ {Open with firefox}
-        \ firefox %f &,
-filetype *.html,*.htm links, lynx
-
-" Object
-filetype *.o nm %f | less
-
-" Man page
-filetype *.[1-8] man ./%c
-fileviewer *.[1-8] man ./%c | col -b
-
-" Images
-filextype *.bmp,*.jpg,*.jpeg,*.png,*.gif,*.xpm
-        \ {View in viewnior}
-        \ viewnior %f,
-fileviewer *.bmp,*.jpg,*.jpeg,*.png,*.xpm
-        \ vifmimg draw %px %py %pw %ph %c
-        \ %pc
-        \ vifmimg clear
-        " Get w3m image previews inside vifm
-        " \ imgt %px %py %pw %ph %c
-        " \ %pc
-        " \ imgc %px %py %pw %ph   NOT NEEDED IN XTERM
-fileviewer *.gif
-        \ vifmimg gifpreview %px %py %pw %ph %c
-        \ %pc
-        \ vifmimg clear
-
-" OpenRaster
-filextype *.ora
-        \ {Edit in MyPaint}
-        \ mypaint %f,
-
-" Mindmap
-filextype *.vym
-        \ {Open with VYM}
-        \ vym %f &,
-
-" MD5
-filetype *.md5
-        \ {Check MD5 hash sum}
-        \ md5sum -c %f %S,
-
-" SHA1
-filetype *.sha1
-        \ {Check SHA1 hash sum}
-        \ sha1sum -c %f %S,
-
-" SHA256
-filetype *.sha256
-        \ {Check SHA256 hash sum}
-        \ sha256sum -c %f %S,
-
-" SHA512
-filetype *.sha512
-        \ {Check SHA512 hash sum}
-        \ sha512sum -c %f %S,
-
-" GPG signature
-filetype *.asc
-        \ {Check signature}
-        \ !!gpg --verify %c,
-
-" Torrent
-filetype *.torrent ktorrent %f &
-fileviewer *.torrent dumptorrent -v %c
-
-" FuseZipMount
-filetype *.zip,*.jar,*.war,*.ear,*.oxt,*.apkg
-        \ {Mount with fuse-zip}
-        \ FUSE_MOUNT|fuse-zip %SOURCE_FILE %DESTINATION_DIR,
-        \ {View contents}
-        \ zip -sf %c | less,
-        \ {Extract here}
-        \ tar -xf %c,
-fileviewer *.zip,*.jar,*.war,*.ear,*.oxt zip -sf %c
-
-" ArchiveMount
-filetype *.tar,*.tar.bz2,*.tbz2,*.tgz,*.tar.gz,*.tar.xz,*.txz
-        \ {Mount with archivemount}
-        \ FUSE_MOUNT|archivemount %SOURCE_FILE %DESTINATION_DIR,
-fileviewer *.tgz,*.tar.gz tar -tzf %c
-fileviewer *.tar.bz2,*.tbz2 tar -tjf %c
-fileviewer *.tar.txz,*.txz xz --list %c
-fileviewer *.tar tar -tf %c
-
-" Rar2FsMount and rar archives
-filetype *.rar
-        \ {Mount with rar2fs}
-        \ FUSE_MOUNT|rar2fs %SOURCE_FILE %DESTINATION_DIR,
-fileviewer *.rar unrar v %c
-
-" IsoMount
-filetype *.iso
-        \ {Mount with fuseiso}
-        \ FUSE_MOUNT|fuseiso %SOURCE_FILE %DESTINATION_DIR,
-
-" SshMount
-filetype *.ssh
-        \ {Mount with sshfs}
-        \ FUSE_MOUNT2|sshfs %PARAM %DESTINATION_DIR %FOREGROUND,
-
-" FtpMount
-filetype *.ftp
-        \ {Mount with curlftpfs}
-        \ FUSE_MOUNT2|curlftpfs -o ftp_port=-,,disable_eprt %PARAM %DESTINATION_DIR %FOREGROUND,
-
-" Fuse7z and 7z archives
-filetype *.7z
-        \ {Mount with fuse-7z}
-        \ FUSE_MOUNT|fuse-7z %SOURCE_FILE %DESTINATION_DIR,
-fileviewer *.7z 7z l %c
-
-" Office files
-filextype *.odt,*.doc,*.docx,*.xls,*.xlsx,*.odp,*.pptx libreoffice %f &
-fileviewer *.doc catdoc %c
-fileviewer *.docx docx2txt.pl %f -
-
-" TuDu files
-filetype *.tudu tudu -f %c
-
-" Qt projects
-filextype *.pro qtcreator %f &
-
-" All others
-filetype *.ts,*.js,*.css,*.sass,*.scss,*.go,*.rs,*.py,*.html,*.xhtml,*.json,*.jsx,*.tsx,*.vue,*.svelte,*.sql
-        \ {Open in editor}
-        \ nvim %c,
-fileviewer *.ts,*.js,*.css,*.sass,*.scss,*.go,*.rs,*.py,*.html,*.xhtml,*.json,*.jsx,*.tsx,*.vue,*.svelte,*.sql bat %c
-
-" Directories
-filextype */
-        \ {View in thunar}
-        \ Thunar %f &,
-
-" Syntax highlighting in preview
-"
-" Explicitly set highlight type for some extensions
-"
-" 256-color terminal
-" fileviewer *.[ch],*.[ch]pp highlight -O xterm256 -s dante --syntax c %c
-" fileviewer Makefile,Makefile.* highlight -O xterm256 -s dante --syntax make %c
-"
-" 16-color terminal
-" fileviewer *.c,*.h highlight -O ansi -s dante %c
-"
-" Or leave it for automatic detection
-"
-" fileviewer *[^/] pygmentize -O style=monokai -f console256 -g
-
-" Displaying pictures in terminal
-"
-" fileviewer *.jpg,*.png shellpic %c
-
-" Open all other files with default system programs (you can also remove all
-" :file[x]type commands above to ensure they don't interfere with system-wide
-" settings).  By default all unknown files are opened with 'vi[x]cmd'
-" uncommenting one of lines below will result in ignoring 'vi[x]cmd' option
-" for unknown file types.
-" For *nix:
-" filetype * xdg-open
-" For OS X:
-" filetype * open
-" For Windows:
-" filetype * start, explorer
-
-" ------------------------------------------------------------------------------
-
-" What should be saved automatically between vifm sessions.  Drop "savedirs"
-" value if you don't want vifm to remember last visited directories for you.
-set vifminfo=dhistory,savedirs,chistory,state,tui,shistory,
-    \phistory,fhistory,dirstack,registers,bookmarks,bmarks
-
-" ------------------------------------------------------------------------------
-
-" Examples of configuring both panels
-
-" Customize view columns a bit (enable ellipsis for truncated file names)
-"
-" set viewcolumns=-{name}..,6{}.
-
-" Filter-out build and temporary files
-"
-" filter! /^.*\.(lo|o|d|class|py[co])$|.*~$/
-
-" ------------------------------------------------------------------------------
-
-" Sample mappings
-
-" Start shell in current directory
-nnoremap s :shell<cr>
-
-" Display sorting dialog
-nnoremap S :sort<cr>
-
-" Toggle visibility of preview window
-nnoremap w :view<cr>
-vnoremap w :view<cr>gv
-
-" Open file in existing instance of nvim
-nnoremap o :!vim %f<cr>
-" Open file in new instance of vim
-nnoremap O :!vim %f<cr>
-
-" Open file in the background using its default program
-nnoremap gb :file &<cr>l
-
-" Interaction with system clipboard
-if has('win')
-    " Yank current directory path to Windows clipboard with forward slashes
-    nnoremap yp :!echo %"d:gs!\!/! %i | clip<cr>
-    " Yank path to current file to Windows clipboard with forward slashes
-    nnoremap yf :!echo %"c:gs!\!/! %i | clip<cr>
-elseif executable('xclip')
-    " Yank current directory path into the clipboard
-    nnoremap yd :!echo %d | xclip %i<cr>
-    " Yank current file path into the clipboard
-    nnoremap yf :!echo %c:p | xclip %i<cr>
-elseif executable('xsel')
-    " Yank current directory path into primary and selection clipboards
-    nnoremap yd :!echo -n %d | xsel --input --primary %i &&
-                \ echo -n %d | xsel --clipboard --input %i<cr>
-    " Yank current file path into into primary and selection clipboards
-    nnoremap yf :!echo -n %c:p | xsel --input --primary %i &&
-                \ echo -n %c:p | xsel --clipboard --input %i<cr>
-endif
-
-" Mappings for faster renaming
-nnoremap I cw<c-a>
-nnoremap cc cw<c-u>
-nnoremap A cw
-
-" Open console in current directory
-nnoremap ,t :!xterm &<cr>
-
-" Open editor to edit vifmrc and apply settings after returning to vifm
-nnoremap ,c :write | edit $MYVIFMRC | restart<cr>
-" Open gvim to edit vifmrc
-nnoremap ,C :!gvim --remote-tab-silent $MYVIFMRC &<cr>
-
-" Toggle wrap setting on ,w key
-nnoremap ,w :set wrap!<cr>
-
-" Example of standard two-panel file managers mappings
-nnoremap <f3> :!less %f<cr>
-nnoremap <f4> :edit<cr>
-nnoremap <f5> :copy<cr>
-nnoremap <f6> :move<cr>
-nnoremap <f7> :mkdir<space>
-nnoremap <f8> :delete<cr>
-
-" Arrow remapping
-map i <Up>
-map j <Left>
-map k <Down>
-noremap h i
-
-vnoremap K L
-vnoremap I H
-vnoremap H I
-
-nnoremap K L
-nnoremap I H
-nnoremap H I
-
-" Escape overwrite
-cmap jj <Esc>
-
-" fzf
-command! FZFfind :set noquickview | :execute 'goto "'.system('fd --hidden --exclude .git --exclude node_modules | fzf --preview "ls -lhA --group-directories-first --color=always {}" --preview-window wrap 2>/dev/tty ').'"%IU' | redraw
-nnoremap <c-p> :FZFfind<cr>
--- a/profiles/base-user/home.nix
+++ b/profiles/base-user/home.nix
@ -61,8 +61,6 @@ in {
    xdg.configFile."user-dirs.locale".source = ./.config/user-dirs.locale;
    xdg.configFile."xsettingsd/xsettingsd.conf".source = ./.config/xsettingsd/xsettingsd.conf;
    xdg.configFile."mako/config".source = ./.config/mako/config;
-    xdg.configFile."vifm/vifmrc".source = ./.config/vifm/vifmrc;
-    xdg.configFile."vifm/colors/base16.vifm".source = ./.config/vifm/colors/base16.vifm;
    xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
    xdg.configFile."waybar/config".source = ./.config/waybar/config;
    xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
--- a/profiles/base-user/session-variables.nix
+++ b/profiles/base-user/session-variables.nix
@ -7,13 +7,6 @@
  psCfg = config.pub-solar;
  wlroots = psCfg.graphical.wayland;
  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
-  globalVariables = {
-    EDITOR = "/run/current-system/sw/bin/nvim";
-    VISUAL = "/run/current-system/sw/bin/nvim";
-
-    # Make sure virsh runs without root
-    LIBVIRT_DEFAULT_URI = "qemu:///system";
-  };
  variables = {
    XDG_CONFIG_HOME = xdg.configHome;
    XDG_CACHE_HOME = xdg.cacheHome;
@ -32,8 +25,11 @@
      then "pixman"
      else "gles2";

+    EDITOR = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
+    VISUAL = "/etc/profiles/per-user/${psCfg.user.name}/bin/nvim";
+
    # fix "xdg-open fork-bomb" your preferred browser from here
-    BROWSER = "firefox";
+    BROWSER = "${pkgs.firefox-wayland}/bin/firefox";

    # node
    NODE_REPL_HISTORY = "${xdg.dataHome}/node_repl_history";
@ -45,6 +41,9 @@
    NPM_CONFIG_CACHE = "${xdg.configHome}/npm";
    # TODO: used to be XDG_RUNTIME_DIR NPM_CONFIG_TMP = "/tmp/npm";

+    # Make sure virsh runs without root
+    LIBVIRT_DEFAULT_URI = "qemu:///system";
+
    # wine
    WINEPREFIX = "${xdg.dataHome}/wineprefixes/default";

@ -87,6 +86,23 @@

    # FZF shell history widget default colors
    FZF_DEFAULT_OPTS = lib.mkForce "--color=bg+:#2d2a2e,bg:#1a181a,spinner:#ef9062,hl:#7accd7 --color=fg:#d3d1d4,header:#7accd7,info:#e5c463,pointer:#ef9062 --color=marker:#ef9062,fg+:#d3d1d4,prompt:#e5c463,hl+:#7accd7";
+
+    # nnn theme colors
+    NNN_FCOLORS = let
+      BLK = "04";
+      CHR = "04";
+      DIR = "04";
+      EXE = "02";
+      REG = "00";
+      HARDLINK = "01";
+      SYMLINK = "01";
+      MISSING = "01";
+      ORPHAN = "07";
+      FIFO = "05";
+      SOCK = "05";
+      OTHER = "02";
+    in
+      BLK + CHR + DIR + EXE + REG + HARDLINK + SYMLINK + MISSING + ORPHAN + FIFO + SOCK + OTHER;
  };

  envListNames = lib.attrsets.mapAttrsToList (name: value: name) variables;
@ -104,5 +120,5 @@ in {
    systemd.user.sessionVariables = variablesWithMeta;
  };

-  environment.variables = globalVariables;
+  environment.variables = variablesWithMeta;
 }
--- a/secrets/drone-db-secrets.age
+++ b/secrets/drone-db-secrets.age
@ -1,24 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw 4IYDRUd6wQzWDLzyFLPzy/t8L1V1UT/KwgfMLvDn5GQ
-4lKiqrafTVNtmcbbWdDsEkPSaN0/1Ud1k+rW1p0Wi0I
-> ssh-ed25519 BVsyTA 5kVXS829ZZONa7iqxXQXpcQ4eoKEH14Aah6Oo6plWjE
-Rv06OqEOnVjrlwBy8JtfV+v+arbqrO2Cv6paIx0Bzf0
-> ssh-rsa kFDS0A
-dvnz72ZtLpuBJfJEoXBb9TyQuEtNK1VZBXtSq9X7RL4fg4rbvGWRiGwl+IH1u8Tp
-6TPephD603lGkxhglh9KlmVp7vqZ4ILRN9836b4Ic0kPttK7iCWoRQsLzHMpwQyD
-Lb8ViRCIj+a2ZWfThaxjSXjXgDR5ZJGrnSwHhxsK9R3A4YUhT8jLvVRCfrUYhtPu
-9AhhT3P9FceflBJzIrD0lozYyaFi5eV4dySAgGyuuBzPXmdWZiOoEbArV9M/N1ss
-LJ/Nf23Ki39qe8w6YelcbhZTi6D2zfOA34Rd+QO8xzZFKKk0iZVSJ0ODk0I42itY
-rxiOQFX3Mpv2/FoqOzJY9WeFHHw61pfZid5UkjFLaongel60a0QSrJvhNoz8J5Jp
-k1GitKbBJl9V69XDY8RqQyDspImOkf7M7497C3OjdUtQkzC2cHzIfbDIi36Oifyp
-254KLVyCtArCqKZClnwcXAl9KtP4d9FM1TL7vSsJM67wfSpWakm5gptSM3WyYsZy
-Y2NkVU/Mk1AQLyrYKz+jtEwTmcrGo8zUFwKQZrXkytNV+vlWxwUAjZupNef5Ih7F
-6okWpmRTjozIZzdJgAHSJ96nnbu5QZt0GmmJ+LtCfIZ+1W3M156hODwCaN9Qg6Ki
-30MR/njAjWE7o5TB+gI6iV2OYxd0/Yqyy9lIdEEllFk
-> ssh-ed25519 cakP9w usfEkp11W/3dAIKp0EcTL0NJe8cMHLJamShjSEbc+EA
-cVK/YSYLIvcXeZWpqEUHkwufHxOIR4uYOvZGi2eMNz4
-> ym-grease
-INN4gag+EYKDUsKFd8N2CrLBWtRGC/BKP4IEfaAt4a5L1FFUAeEaRRAfuQ5ZWvnG
-vV0T8ASMwsMJ07X2X2faghc
--- 7BrGKq+40E31/Jz0C6jg7Jequ0k4W+71wjLGLdR+9vg
-†Ì"	Ñ‡dRY$†ñ œîŽÌÚZüä“w2«	£AKà MŒÜ./ÀžÌàU!ûÐÖj'$¡û¥šâ 8n`<60>û5ÛDØñ0J<Û<>¸ßˆëÂ*¹YÎ>“†›³R¹fÍ•²Š|/ôlS‰ÄòJÚëÊ`2‘á[§ƒ í™ì
--- a/secrets/drone-secrets.age
+++ b/secrets/drone-secrets.age
--- a/secrets/gitea-database-password.age
+++ b/secrets/gitea-database-password.age
--- a/secrets/gitea-mailer-password.age
+++ b/secrets/gitea-mailer-password.age
@ -1,23 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw KuyePsvWNh4rYXs8Eiq7JXZdVOUzewtQ9jEcOqTOTCs
-69jfk3fZ9gTJyq1dIJmi9KGAhlZ307fQLSgPmDm7/yQ
-> ssh-ed25519 BVsyTA V9RtiFn2g/7PPL3ragEn51VIiRyKlW889Uc1fAqkc0I
-IQv7b2Rei0rdp0MJEsSqwQmjUmWlNcUHjzvsEk/anro
-> ssh-rsa kFDS0A
-RfWK33SKHaI2/gw3/1h76dhJq/0z1fgl8JVjsKmPgj/K+TPH05DoObBmKG2wAwcg
-xA48ejVh4zIHhQkbTrnfOYUo32WJvtxEzDZcgwi2ZOJlhrZ8p8aIcoGVgcNiPI8V
-S2hN52aCjKtnz6+zzBaEsbsNEyqlAD6hIvjnBDgQUNy9tVSWhPZbbkkLD7vZ24iH
-MilVTDV6jUAxlgq+Yb3bxIyYhFlb0ACkc9D3XxmKp4Ukcag9HJ1dn0OPw2NEdEnO
-KCydY9aHqcw8nbTpDLzwXPgh6HPKXa7aNrfvKRrM6B6nA4Cy8hr+QcxBCEYBsVdm
-dzojEhJm/SccBhEbzPRyla1dUsdfM8tQzy4hg/4bAvmSb3sSqZX3LUhE8NhPML4c
-Vb5+0GUOyQ8zPZfORoT6L7785d5eeWJ9SbKnr2rteEJfzOLeHdM/IdJNXgP0u6ee
-BMaf/Jo3A6JPpYurHvUCWPulyEsic7LuVrEi6HnQmzeX342B7Gn/srL6YzsfGeV+
-j1G1AIUv+QHdz4bX3oqGgqwVGaPbcRClZDnB/Gq+a3E+zJVEGnFagoBSDE2/jpC0
-KXAzaS3CaZ4wqKRZJA/GGWu+KZXA7F87Gr1I84jwdhyn6Dr1l51z0s4NFx6gmYW2
-Nz7QUZz15DNcIXLdpz3XJqSpJ1sinkcVkCdQykv+miI
-> ssh-ed25519 cakP9w Ghr10m5/sD5g4yyMtOrPiO3SEbmhrXMjtRVQf8c4I3E
-hbb4UOdZ7E2u7ImAAkyr4FV/pACSEopucguPLjQYo98
-> 7=-grease <]_?g0s
-
--- 2SbSEW2lbLlhNC7fPB52ZLLfhV1kywGzsLKFhZHRZaE
-ÔîæqX›yónÃ}øqÍ
¥ïzYv1tc¢nÚp¨v“Þ!ðÎ»OÑè§ƒâ>
--- a/secrets/hosting.de-api-key.age
+++ b/secrets/hosting.de-api-key.age
@ -1,24 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw 20k6EMk3iFO98VaGMQVxAxLuCIKp8M8DN3SucCtNNlM
-Za5+geQFA/CVkj/IADKmrj3EIsKcj4l9jETuvQbApCE
-> ssh-ed25519 BVsyTA vqpU3pzGierKMAKK0Gn/xvEkdebGgfahP5CmRE8tZTY
-ZsmYvYgFzOL2PL1mLJ8vwoWiT1bngJq1Y4P3MBYcbbI
-> ssh-rsa kFDS0A
-chQyiXGW3eND86nYKKZVX3Tr3MKVYJXoQccbYn5yGEmXw17U67z2YgbgXcKJGszE
-FiOKe6fWCbrnCi/GkktM+bbnbJtfCOFK/J2VlVQrHScibel0z4+yd0aeH02EVHla
-34vcv2Tdi09BVn5Me2Gh94/CKgzAiIIHmvDfYFsBZNQOalAbn0PvpHFJcVnf2DsR
-bVgOKL8l4mHz/gihI5cCr5snz3ClhHv/aFbTR2QpHPKAfz5aRi0pe9phpqv9TDb9
-3taeIDZ2dIVpASyqIBxzxzep6liJrupldmQQGpzleKpRfqPWrM5BAmMHr6/LiP24
-caHaP7SOVTr1s1wo4Qh8x97LrXYe2AEmJogteoLJddYYgqYhJuoCS62dDbyry32D
-3BHJTcxl2OsgFDP9Q9uABhwNExdu9z7ohbvyOwZ3ZkgEbpFOKPAOExKK0FV6C5R3
-nKox0yPZGIsTP0wjjyWlZAwUkNIj1m5gXL6l3h4930EnPZFe7vg+lfC/4v2V21pE
-l5U1a+LqBzOk7qCgVgtbAZZEIvK8s0kZYLmPmtMyjIm/mnl6yxY80Kwf6oTlb6KN
-bFopzuBfmCZk3hVzkrVDmpxpWTcFclSG7H/R+1SSibHOL0RcLuULhrVHd4qOPYrQ
-I4jDt3nmUKU1si1IhOQe20NKG3DokMGDQk3balKIMfU
-> ssh-ed25519 cakP9w zXYz3ME+JJqwpWGFlnHzTxNTvpGMXAZB00rrh0MN1wc
-tgNVf1JJWPkU7TxYcakGE+omp1fNqwXVzyQBpPAdVCU
-> Sq|yWUT-grease N>}A9
-TvMfldFuvLXmFvEmgZTd8zXY2iH9Sw
--- jyypo7T4RplBaZ94/suJgMliWbt4tQNMhrDUv/YMaYE
-ž ÒS=Š8¶¨å¹Æ¸k®C¶³UÜŽ<C39C>2eõX}$G-oØžCÖl=ýÛQ¥û_§áÞ¡r)ädâyHûiÇ<69>[*aµÄ R®ã
-X
--- a/secrets/keycloak-database-password.age
+++ b/secrets/keycloak-database-password.age
--- a/secrets/mailman-core-secrets.age
+++ b/secrets/mailman-core-secrets.age
@ -1,23 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw gkhWIVF4XyeitN9y4jhIplrFAzkT+vUIXyyQKh/7IwU
-DWi5ZfTdf9QzqTFLD++3ctckO9DiBOynHqWfhyc4InI
-> ssh-ed25519 BVsyTA afwxuuU7CZIzOZeN0aNDsPm3GQc1/pK1PJ9Yc6DnoHk
-2wkHEvDZb8FoRygCn08arkh2GZh5nxMO2ag5y7nAdzA
-> ssh-rsa kFDS0A
-KZRclxsJja35rXgVUlFqBe3tOEryUTePT748oNs5LJoAi/h9PnRwIW4K/pzgFqVL
-ADcMb5T8WBqDJ/JvZKkOXOERIj9K2KGx2ETCYat0wgB/ojB8ER7NIsEaVmcbKyY0
-5x7DP07DGdkdkzfPNaRhsFBL4xoF8LxrR3ZjKR++c0ICMQ6WKOuXB0J6spBv15rR
-IE4yOpV+vhYoUh1X9tGKfNthxKnV40FtJX6ucSmIoGbRAzdZUACRDRVjWgNVJc+x
-ucbOnJE1UA1T/ttxFRkjIFg7jPyv75YPAUO+/u+0xrxQfsDhXY4zuvz+2Ze9gwue
-WQWHR2kKrv5udYCMLCug1f1QpgeBiysW+EzseR0sgLfSNGH/sssB8RNnXU2hruc0
-oMvnsSNTfLCD+xzMbDhJbELI415sVfbJ9Lm29Sv60k03aW7HagTdNGwQJ8qJeeeX
-XM+z089encgbej/iuruH4JVDAdiNzuEZMgCKWhmcX2VKQxunWTWCdUGpuotL4mL/
-xHxjmz2eEKF3KuSSmEuvtqMkVVJYRbpIjj7p1cMGE2DsA/sTWEd49hSBkkfV12pt
-lxyk1/0bPRI90qQb6slRm9R9DRwJp1v9Cht/ZEmNvOdXskTgBT3hyi6/8ykYZlvT
-ogX3qz4OF7KftBA+5YHWvA99tvKmUKN6bcCWVbFwtDo
-> ssh-ed25519 cakP9w hMZotYYfld14w9/8QGj7D0iTeXJ3CZ6h08PF1mjrqmQ
-9ZJMVHwwU/a0AJNmSXHf9q/4Ap1tJvhXCsga0nY2REw
-> ukh-grease
-k5f1OA
--- qmDVJB1ai7/Ps+Wb2fXtyM5rIvH9e/2u6dDbf1/EefE
-³lö—ƒj£C$ŽÁ”Î ý£ïð·X™¤ü—mË)(-bôIÙ1
pÀÊý&ˆI¶DºÞQ?cvŠ	’y‹\†¾>cAïãÞwJ)Ÿxme^,¿y±ÉÓÚÂænv\ÍE®º`…¹ô³3²â™LÑÍxŸ„úÁ%ü6rŒ).öx.¶Bü Ó|W£6ù½Àœóüä0%t.YyÆ4u½¯R±Ãe±Ó*‚	/Wi!PKj3‚½tG‘¬nôüüIoVÍ-ÂIá„¤<E2809E>6e‰€G6$Õ|(>]ißt½ÎÚ<C38E>k1ue»ª·,jómÆl,~Ïß×#fY>quÏz¤`íø4{ÙÜÝVj¢ÊÒï/ž’:3zºÜãj	?yË¦€Aq!ÊªÁ\N3žò.¡áïë ŽW•®¢œ«  p˜9˜µ‘¼å®ŒÛ
--- a/secrets/mailman-db-secrets.age
+++ b/secrets/mailman-db-secrets.age
@ -1,23 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw vcObihtzXJ3+hQDnNQ37nWiv6I+aSfX6u5U/KAxO+Rk
-hrcPHjL0qMaFN6Rj0AqO73L0EpH6H1AjC6cHwoJiDa4
-> ssh-ed25519 BVsyTA O7ALAsno95CTjlrHpYeUhw5avBHYzVZLP/c8nPg+BCY
-mx3H5mB6Q1WavsjIIuUIC6pe/YHTE45bRh6SDbTZEhQ
-> ssh-rsa kFDS0A
-pj+13dL6H7gPkh/b3vZOztRM7VdSElkeB4SjsfZh2lZoMpjhuiQuUauxJl+pAAXZ
-37evEIcAmDnrl2+tBXq/9krry4DbpYRL7Mz4TYjYmSn2sRDDd4q/Tv1bXdLwuZ8G
-svq1qWhDkAsL6rxzpOV+EsE2EyZxtGx0Odgp7GMmAJq1Vrm8NUF/+Nh3V8LtDmtz
-08tgebfKoWDRFnDbWN7Du+TN9TUp4MlpMPUqjJPDVmsVsVsKTRvck+M8iTaf9HPv
-GJ9TNPwDN9ZvL+0jFd+v440MqXsejsrxIxPHQ/KsgnOciiW58Drn2vNyBL3FVYxG
-C+JzKsRl3AQpP6qoXv5I1pwitI9yLXf+7aSyVUANUWU3ZG8M1KIGtIBTMHAh4w+B
-yJl5qwY2Ty3FKbi3alT7SdWBlRK/m6Lqh6qFSa9kptpgIQ6D3nzWOhrs8tdRFuYm
-6ilwarYuDXD+eLukBJ63l1OL1jVicLpMJXp40v2iQisDR3ifW7dHRXyadGIBvbHl
-6c9ZQP6WritVR3CCZIHSBoxnUD5pGV+KbfbHh0Q1E2goV4SOGyivG4q9iXKIGk6A
-S1Yl5/kwA+/gzc0VdgQmcr9dFe8jC4n5SsaFRAzr+2e+IjH2EhinJlERFwxDJ6+q
-ADeLbCApDA2mKNBiZ2c1p12F+iL7Vk07xLV0owHvNOw
-> ssh-ed25519 cakP9w ay0pLMA3UdI/7XtF9GgftyKavJe89NqdpzYVP4+Trgk
-ptOrYOEC7NgQPXF3EnuUaySQqJqP30Ez1lY+0RmXUTg
-> ma-grease (S#' ?5>*(YT
-N6grE/WR7SJGCaVJcWYSVxeeiA
--- +u1sOmxTLHDiBiOFP0aI7VQvxQX3NYnq586q4LhJk1Q
-»?S ÿ¿…¹aª“à_²ÑcÄY-ù Å®$¦{]s]<7F>…<EFBFBD>ª2µÎQbÁXˆ|Å^µÿ:Xþ"õðøã§rÐÅÝ‰p”w±I=WUúØdBÈ‰ÄC òž
2¿¹Ê„+àI\a¬ú¸ù5ì$TG[òè=ËÖ ?_¶ p™¢°‘â²™d^ó%Ô&èTÎ”¥ÿàNÚ
--- a/secrets/mailman-web-secrets.age
+++ b/secrets/mailman-web-secrets.age
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@ -1,31 +1,8 @@
 let
  # set ssh public keys here for your system and user
-  b12f-bbcom = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCmXpOU6vzQiVSSYCoxHYv7wDxC63Qg3dxlAMR6AOzwIABCU5PFFNcO0NWYms/YR7MOViorl+19LCLRABar9JgHU1n+uqxKV6eGph3OPeMp5sN8LAh7C9N+TZj8iJzBxQ3ch+Z/LdmLRwYNJ7KSUI+gwGK6xRS3+z1022Y4P0G0sx7IeCBl4lealQEIIF10ZOfjUdBcLQar7XTc5AxyGKnHCerXHRtccCoadLQujk0AvPXbv3Ma4JwX9X++AnCWRWakqS5UInu2tGuZ/6Hrjd2a9AKWjTaBVDcbYqCvY4XVuMj2/A2bCceFBaoi41apybSk26FSFTU4qiEUNQ6lxeOwG4+1NCXyHe2bGI4VyoxinDYa8vLLzXIRfTRA0qoGfCweXNeWPf0jMqASkUKaSOH5Ot7O5ps34r0j9pWzavDid8QeKJPyhxKuF1a5G4iBEZ0O9vuti60dPSjJPci9oTxbune2/jb7Sa0yO06DtLFJ2ncr5f70s/BDxKk4XIwQLy+KsvzlQEGdY8yA6xv28bOGxL3sQ0HE2pDTsvIbAisVOKzdJeolStL9MM5W8Hg0r/KkGj2bg0TfoRp1xHV9hjKkvJrsQ6okaPvNFeZq0HXzPhWMOVQ+/46z80uaQ1ByRLr3FTwuWJ7F/73ndfxiq6bDE4z2Ji0vOjeWJm6HCxTdGw==";
-  teutat3s-dumpyourvms = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
-  flora-6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP1InpTBN4AlF/4V8HHumAMLJzeO8DpzjUv9Co/+J09 root@pub-solar-infra-vm-1";
-  nougat-2-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINELr5Bvr15GqCHevg9QP8oYFgmaRUUHcPFf4MZho9gI root@nougat-2";
-
-  allKeys = [
-    flora-6
-    teutat3s-dumpyourvms
-    b12f-bbcom
-    nougat-2-host
-  ];
-
-  deployKeys = [
-    flora-6
-    teutat3s-dumpyourvms
-    b12f-bbcom
-    nougat-2-host
-  ];
+  system = "";
+  user = "";
+  allKeys = [system user];
 in {
-  "gitea-database-password.age".publicKeys = deployKeys;
-  "gitea-mailer-password.age".publicKeys = deployKeys;
-  "keycloak-database-password.age".publicKeys = deployKeys;
-  "drone-secrets.age".publicKeys = deployKeys;
-  "drone-db-secrets.age".publicKeys = deployKeys;
-  "mailman-core-secrets.age".publicKeys = deployKeys;
-  "mailman-web-secrets.age".publicKeys = deployKeys;
-  "mailman-db-secrets.age".publicKeys = deployKeys;
-  "hosting.de-api-key.age".publicKeys = deployKeys;
+  "secret.age".publicKeys = allKeys;
 }
--- a/users/barkeeper/default.nix
+++ b/users/barkeeper/default.nix
@ -1,42 +0,0 @@
-{
-  config,
-  hmUsers,
-  pkgs,
-  lib,
-  ...
-}: let
-  psCfg = config.pub-solar;
-in {
-  config = {
-    home-manager.users = {inherit (hmUsers) barkeeper;};
-
-    pub-solar = {
-      # These are your personal settings
-      # The only required settings are `name` and `password`,
-      # The rest is used for programs like git
-      user = {
-        name = "barkeeper";
-        description = "pub.solar infra user";
-        password = "$6$MCJ28kLwfNl9SNDq$Oh9eT6Sn6z4xGrQsLlIBI7cvJzX3P5As59OSZ.hoeBWc79Un2YdwH/hRIC.4ZDOuwQp0lHI82dNn/xeTaCn631";
-        fullName = "pub.solar infra barkeeper";
-        email = "admins@pub.solar";
-        gpgKeyId = "";
-        publicKeys = [
-          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmiF8ndGhnx2YAWbPDq14fftAwcJ0xnjJIVTotI12OO4SPX/SwH5Yp8C8Kf002qN9FbFmaONzq3s8TYpej13JubhfsQywNuFKZuZvJeHzmOwxsANW86RVrWT0WZmYx9a/a1TF9rPQpibDVt60wX8yLdExaJc5F1SvIIuyz1kxYpz36wItfR6hcwoLGh1emFCmfCpebJmp3hsrMDTTtTW/YNhyeSZW74ckyvZyjCYtRCJ8uF0ZmOSKRdillv4Ztg8MsUubGn+vaMl6V6x/QuDuehEPoM/3wBx9o22nf+QVbk7S1PC8EdT/K5vskn4/pfR7mDCyQOq1hB4w4Oyn0dsfX pi@ssrtc"
-
-          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHx4A8rLYmFgTOp1fDGbbONN8SOT0l5wWrUSYFUcVzMPTyfdT23ZVIdVD5yZCySgi/7PSh5mVmyLIZVIXlNrZJg= @b12f Yubi Main"
-          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEST9eyAY3nzGYNnqDYfWHu+89LZsOjyKHMqCFvtP7vrgB7F7JbbECjdjAXEOfPDSCVwtMMpq8JJXeRMjpsD0rw= @b12f Yubi Backup"
-
-          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a @teutat3s"
-
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135 @hensoko"
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work"
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb @hensoko"
-
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKa5elEXgBc2luVBOHVWZisJgt0epFQOercPi0tZzPU root@cloud.pub.solar"
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU axeman@tuxnix"
-        ];
-      };
-    };
-  };
-}
Author	SHA1	Message	Date
b12f	c9b4b44b68	Merge pull request 'Update flake inputs' (#258 ) from main-update-flake-inputs into main All checks were successful continuous-integration/drone/push Build is passing Details Reviewed-on: #258 Reviewed-by: b12f <hello@benjaminbaedorf.eu>	2023-10-13 11:26:39 +02:00
teutat3s	2501d4a145	chore: update blesh in nvfetcher All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details	2023-10-09 21:11:31 +02:00
teutat3s	45edd17782	Update flake inputs All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details • Updated input 'latest': 'github:nixos/nixpkgs/3a2786eea085f040a66ecde1bc3ddc7099f6dbeb' (2023-09-11) → 'github:nixos/nixpkgs/87828a0e03d1418e848d3dd3f3014a632e4a4f64' (2023-10-06) • Updated input 'nixos': 'github:nixos/nixpkgs/e5f018cf150e29aac26c61dac0790ea023c46b24' (2023-09-12) → 'github:nixos/nixpkgs/5a237aecb57296f67276ac9ab296a41c23981f56' (2023-10-07) • Updated input 'darwin': 'github:LnL7/nix-darwin/4496ab26628c5f43d2a5c577a06683c753e32fe2' (2023-09-12) → 'github:LnL7/nix-darwin/8b6ea26d5d2e8359d06278364f41fbc4b903b28a' (2023-10-03) • Updated input 'deploy': 'github:serokell/deploy-rs/31c32fb2959103a796e07bbe47e0a5e287c343a8' (2023-09-12) → 'github:serokell/deploy-rs/e3f41832680801d0ee9e2ed33eb63af398b090e9' (2023-09-18) • Updated input 'home': 'github:nix-community/home-manager/9787dffff5d315c9593d3f9fb0f9bf2097e1b57b' (2023-09-11) → 'github:nix-community/home-manager/07682fff75d41f18327a871088d20af2710d4744' (2023-09-19) • Updated input 'nixos-hardware': 'github:nixos/nixos-hardware/3ccd87fcdae4732fe33773cefa4375c641a057e7' (2023-09-13) → 'github:nixos/nixos-hardware/bb2db418b616fea536b1be7f6ee72fb45c11afe0' (2023-10-06)	2023-10-09 19:15:11 +02:00
teutat3s	4a7b5f3bb2	Merge pull request 'Bump flake inputs in lock file' (#254 ) from feat/main-bump-flake-lock into main All checks were successful continuous-integration/drone/push Build is passing Details Reviewed-on: #254	2023-09-13 13:13:57 +02:00
teutat3s	d83389b1dd	Use docker version 24 All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details	2023-09-13 12:38:31 +02:00
teutat3s	dfd80c0e95	Fix nvfetcher by using forked nixpkgs See upstream issue: https://github.com/NixOS/nixpkgs/issues/249962	2023-09-13 12:38:12 +02:00
teutat3s	110e0aefad	Bump flake inputs in lock file Some checks failed continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is failing Details • Updated input 'latest': 'github:nixos/nixpkgs/5df4d78d54f7a34e9ea1f84a22b4fd9baebc68d0' (2023-07-20) → 'github:nixos/nixpkgs/3a2786eea085f040a66ecde1bc3ddc7099f6dbeb' (2023-09-11) • Updated input 'nixos': 'github:nixos/nixpkgs/08700de174bc6235043cb4263b643b721d936bdb' (2023-07-18) → 'github:nixos/nixpkgs/e5f018cf150e29aac26c61dac0790ea023c46b24' (2023-09-12) • Updated input 'darwin': 'github:LnL7/nix-darwin/b06bab83bdf285ea0ae3c8e145a081eb95959047' (2023-07-02) → 'github:LnL7/nix-darwin/4496ab26628c5f43d2a5c577a06683c753e32fe2' (2023-09-12) • Updated input 'deploy': 'github:serokell/deploy-rs/724463b5a94daa810abfc64a4f87faef4e00f984' (2023-06-14) → 'github:serokell/deploy-rs/31c32fb2959103a796e07bbe47e0a5e287c343a8' (2023-09-12) • Updated input 'home': 'github:nix-community/home-manager/07c347bb50994691d7b0095f45ebd8838cf6bc38' (2023-06-27) → 'github:nix-community/home-manager/9787dffff5d315c9593d3f9fb0f9bf2097e1b57b' (2023-09-11) • Updated input 'nixos-hardware': 'github:nixos/nixos-hardware/429f232fe1dc398c5afea19a51aad6931ee0fb89' (2023-06-15) → 'github:nixos/nixos-hardware/3ccd87fcdae4732fe33773cefa4375c641a057e7' (2023-09-13)	2023-09-13 12:12:25 +02:00
teutat3s	fcf960a70f	Merge pull request 'nvfetcher: use version 0.6.1.0 from latest instead of flake' (#249 ) from main-nvfetcher-override into main All checks were successful continuous-integration/drone/push Build is passing Details Reviewed-on: #249	2023-07-21 12:33:05 +02:00
teutat3s	5acbaa3dd5	flake: update nixos + latest inputs All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details • Updated input 'latest': 'github:nixos/nixpkgs/2de8efefb6ce7f5e4e75bdf57376a96555986841' (2023-07-12) → 'github:nixos/nixpkgs/5df4d78d54f7a34e9ea1f84a22b4fd9baebc68d0' (2023-07-20) • Updated input 'nixos': 'github:nixos/nixpkgs/fcc147b1e9358a8386b2c4368bd928e1f63a7df2' (2023-07-13) → 'github:nixos/nixpkgs/08700de174bc6235043cb4263b643b721d936bdb' (2023-07-18)	2023-07-21 12:23:33 +02:00
teutat3s	88404be55b	Bump nvfetcher	2023-07-21 12:23:23 +02:00
teutat3s	5a05079e17	graphical: fix network-manager-applet service description	2023-07-21 12:10:47 +02:00
teutat3s	2d27b9c315	nvfetcher: use version 0.6.1.0 from latest instead of flake All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details	2023-07-21 12:04:14 +02:00
teutat3s	8f4f5687f2	Merge pull request 'feat: use nnn and treesitter' (#235 ) from feat/nnn into main Some checks failed continuous-integration/drone/push Build is failing Details Reviewed-on: #235 Reviewed-by: teutat3s <teutates@mailbox.org>	2023-07-21 11:46:26 +02:00
Benjamin Bädorf	9bade4eb64	feat: add line length indicators to gitmessage All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details	2023-07-20 23:59:36 +02:00
Benjamin Bädorf	d951e821b3	feat: add back vim-gutentags to nvim	2023-07-20 23:59:08 +02:00
teutat3s	1fe6d34f6e	neovim: add syntax highlighting for ini, lua, All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details bash, make, ninja, diff, php Sort nvim-treesitter.withPlugins alphabetically	2023-07-14 13:38:01 +02:00
teutat3s	9271e8d037	Fix merge conflict leftovers All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details	2023-07-14 13:13:13 +02:00
teutat3s	fd74f59c39	Bump flake inputs nixos + latest in lockfile • Updated input 'latest': 'github:nixos/nixpkgs/645ff62e09d294a30de823cb568e9c6d68e92606' (2023-07-01) → 'github:nixos/nixpkgs/2de8efefb6ce7f5e4e75bdf57376a96555986841' (2023-07-12) • Updated input 'nixos': 'github:nixos/nixpkgs/b72aa95f7f096382bff3aea5f8fde645bca07422' (2023-06-30) → 'github:nixos/nixpkgs/fcc147b1e9358a8386b2c4368bd928e1f63a7df2' (2023-07-13)	2023-07-14 13:12:50 +02:00
Benjamin Bädorf	e36709613c	fix: load schemastore for nvim Some checks failed continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is failing Details	2023-07-13 18:07:58 +02:00
Benjamin Bädorf	41c2d668f7	feat: use nnn and treesitter All checks were successful continuous-integration/drone/push Build is passing Details vifm is removed in favour of nnn, with the keybindings in nvim being changed. TODO: improve the colorscheme of `nnn` to match `ls`. All nvim plugins that were responsible for language syntax highlighting are removed in favour of treesitter[1], a syntax highlighter that parses AST instead of being regex-based. This is still experimental, but my tests so far have not encountered any issues. 1) https://github.com/nvim-treesitter/nvim-treesitter	2023-07-13 17:15:53 +02:00
				`@ -1 +0,0 @@`
				`lib: lib.concatStrings (lib.lists.reverseList ["et" ".n" "zz" "wd" "h"])`