graphical/sway: use default WLR_RENDERER instead of

forcing gles2

.drone.yml

@@ -15,7 +15,9 @@ steps:
     commands:
       - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
       - nix $$NIX_FLAGS develop --command nix flake show
-      - nix $$NIX_FLAGS build ".#nixosConfigurations.flora-6.config.system.build.toplevel"
+      - nix $$NIX_FLAGS develop --command treefmt --fail-on-change
+      - nix $$NIX_FLAGS develop --command editorconfig-checker
+      - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
 
 ---
 kind: pipeline
@@ -42,7 +44,7 @@ steps:
         from_secret: private_ssh_key
       MANTA_USER: pub_solar
       MANTA_URL: https://eu-central.manta.greenbaum.cloud
-      MANTA_KEY_ID: "59:9f:5a:6f:c4:e2:3b:32:7f:13:1f:de:b7:59:80:85"
+      MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67"
     commands:
       - export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
       - echo env var TARGET_DIR is set to $$TARGET_DIR
@@ -111,9 +113,8 @@ steps:
       - nix run nixpkgs#gnused -- --in-place "s/$ISO_NAME/PubSolarOS-latest.iso/" PubSolarOS-latest.iso.sha256
 
   - name: "Publish ISO"
-    # custom drone-scp image, source: https://git.b12f.io/pub-solar/drone-scp/
-    # docker build --tag registry.greenbaum.cloud/library/drone-scp:v1.6.5 --file ./docker/Dockerfile.linux.amd64 .
-    image: registry.greenbaum.cloud/library/drone-scp:v1.6.5
+    # https://github.com/appleboy/drone-scp/pull/141 got merged, yay
+    image: appleboy/drone-scp:1.6.5-linux-amd64
     volumes:
       - name: file-exchange
         path: /var/nix/iso-cache
@@ -126,7 +127,7 @@ steps:
         from_secret: iso_web_ssh_port
       key:
         from_secret: iso_web_ssh_key
-      target: /srv/www/os/download
+      target: /data/srv/www/os/download
       source:
         - /var/nix/iso-cache/*.iso
         - /var/nix/iso-cache/*.iso.sha256
@@ -148,6 +149,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 59c35601e641341216eaba764756a96dfe9137f7c6255aa889b12c73af77f244
+hmac: a116f78a0b22188052893bdb46aa40f8de66438826c10ced362ea183d7644d67
 
 ...

.drone/setup_ssh.sh

@@ -1,11 +0,0 @@
-#!/usr/bin/env sh
-
-set -e
-
-# Setup ssh inside container
-mkdir -p ~/.ssh
-echo "$GITEA_SSH_KEY" > ~/.ssh/id_rsa
-echo "[git.b12f.io]:2222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ4uaREL7acSSCNAX+voDYl1Kj7JipP62fR5x1UyGP9u" >> ~/.ssh/known_hosts
-echo "Host git.b12f.io" >> ~/.ssh/config
-echo "  Port 2222" >> ~/.ssh/config
-chmod -R 600 ~/.ssh

.drone/upstream-branch.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env sh
-
-set -e
-set -u
-
-LOCAL="$DRONE_BRANCH"
-[ "$LOCAL" = "main" ] && UPSTREAM=origin/devos || UPSTREAM=origin/main
-
-git fetch --all
-git checkout "$LOCAL"
-git merge "$UPSTREAM"
-git push origin "$LOCAL"

.editorconfig

@@ -15,8 +15,19 @@ end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset
 indent_size = unset
+charset = unset
+indent_style = unset
+indent_size = unset
 
 [{.*,secrets}/**]
+end_of_line = false
+insert_final_newline = false
+trim_trailing_whitespace = unset
+charset = unset
+indent_style = unset
+indent_size = unset
+
+[*.rom]
 end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset

.git-blame-ignore-revs

@@ -1,2 +1,4 @@
 # Formatted code using treefmt and alejandra
 73bf158392a427d188b7aad36244b94506f57a15
+# nixfmt-rfc-style
+03e5a0ffdaab9b1331ab95ca3e730aaec1d7c151

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,38 +0,0 @@
----
-name: Bug report
-about: Create a report to help improve
-title: ''
-labels: 'bug'
-assignees: ''
-
----
-
-Your issue may already be reported!
-Please search on the [issue tracker](../) before creating one.
-
-## Expected Behavior
-<!--- What should happen? -->
-<!--- How it should work? -->
-
-## Current Behavior
-<!--- What happens instead of the expected behavior? -->
-
-## Possible Solution
-<!--- Not obligatory, but suggest a fix/reason for the bug, -->
-<!--- or ideas how to implement the addition or change -->
-
-## Steps to Reproduce
-<!--- An unambiguous set of steps to reproduce this bug. -->
-<!--- Linked fork or gist if needed. -->
-1.
-2.
-3.
-4.
-
-## Context
-<!--- How has this issue affected you? What are you trying to accomplish? -->
-<!--- Providing context helps us come up with a solution that is most useful in the real world. -->
-
-## Your Environment
-<!--- Include relevant details about the environment you experienced the bug in. -->
-<!--- If you have run `bud update`, for example, post the flake.lock file. -->

.github/ISSUE_TEMPLATE/community_request.md

@@ -1,22 +0,0 @@
----
-name: Commuity Request
-about: inspire contribution to the `community` branch
-title: ''
-labels: 'community'
-assignees: ''
-
----
-
-Your issue may already be reported!
-Please search on the [issue tracker](../) before creating one.
-
-## Ideas
-<!--- The `community` branch is meant to provide various preconfigured system options, -->
-<!--- useful to all kinds of users. -->
-
-<!--- The point is to engage the community for what it thinks are -->
-<!--- sane defaults for various tools. -->
-
-## Requests
-<!--- Have a tool that you'd like to see a system profile for? -->
-<!--- Feel free to request it here. -->

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,24 +0,0 @@
----
-name: Feature request
-about: Suggest an idea
-title: ''
-labels: 'enhancement'
-assignees: ''
-
----
-
-Your issue may already be reported!
-Please search on the [issue tracker](../) before creating one.
-
-## Would your feature fix an existing issue?
-<!--- If your idea is related to, or resolves other issues, please mention. -->
-
-## Describe the solution you'd like
-<!--- What you want to happen. -->
-
-## Describe alternatives you've considered
-<!--- Any alternative solutions or features you've considered? -->
-
-## Additional context
-<!--- Is this feature only useful for a particular usecase? -->
-<!--- Please elaborate. -->

.github/ISSUE_TEMPLATE/upstream_notice.md

@@ -1,16 +0,0 @@
----
-name: Upstream notice (Issues or Changes)
-about: Create an upstream notice to help our research
-title: '[ <put the upstream project> ]: <topic>'
-labels: 'upstream'
-assignees: ''
-
----
-
-## Link
-<!-- just place a link to the upstream issue, or PR -->
-
-
-## Context
-<!-- We want to make this as cheap for you as possible.
-Context is not required but helpful -->

.github/workflows/check.yml

@@ -1,29 +0,0 @@
-name: "Check & Cachix"
-on:
-  push:
-    branches:
-      - main
-      - trying
-      - staging
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v2.3.4
-    - uses: cachix/install-nix-action@v13
-      with:
-        install_url: https://github.com/numtide/nix-flakes-installer/releases/download/nix-2.4pre20210415_76980a1/install
-        extra_nix_config: |
-          experimental-features = nix-command flakes
-          system-features = nixos-test benchmark big-parallel kvm recursive-nix
-          substituters = https://nrdxp.cachix.org https://nix-community.cachix.org https://cache.nixos.org
-          trusted-public-keys = nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-    - uses: cachix/cachix-action@v10
-      with:
-        name: nrdxp
-        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-    - run: nix -Lv flake check
-    - run: nix -Lv build ".#nixosConfigurations.NixOS.config.system.build.toplevel"
-    - run: nix -Lv develop -c echo OK
-    - run: nix -Lv develop --command bud --help

.github/workflows/mdbook_docs.yml

@@ -1,27 +0,0 @@
-name: Deploy Docs to GitHub Pages
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  deploy:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v1
-        with:
-          mdbook-version: 'latest'
-
-      - run: mdbook build doc
-
-      - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_branch: gh-pages
-          publish_dir: ./doc/book
-          cname: devos.divnix.com

.github/workflows/release.yml

@@ -1,71 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - v*
-
-jobs:
-  changelog:
-    name: Update Changelog
-    runs-on: ubuntu-latest
-    steps:
-      - name: Get version from tag
-        env:
-          GITHUB_REF: ${{ github.ref }}
-        run: |
-          export CURRENT_VERSION=${GITHUB_TAG/refs\/tags\/v/}
-          echo "CURRENT_VERSION=$CURRENT_VERSION" >> $GITHUB_ENV
-      - name: Checkout code
-        uses: actions/checkout@v2
-        with:
-          ref: main
-      - name: Update Changelog
-        uses: heinrichreimer/github-changelog-generator-action@v2.1.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          issues: false
-          issuesWoLabels: false
-          pullRequests: true
-          prWoLabels: true
-          addSections: '{"documentation":{"prefix":"**Documentation:**","labels":["documentation"]}}'
-      - uses: stefanzweifel/git-auto-commit-action@v4
-        with:
-          commit_message: Update Changelog for tag ${{ env.CURRENT_VERSION }}
-          file_pattern: CHANGELOG.md
-
-  release_notes:
-    name: Create Release Notes
-    runs-on: ubuntu-latest
-    needs: changelog
-    steps:
-      - name: Get version from tag
-        env:
-          GITHUB_REF: ${{ github.ref }}
-        run: |
-          export CURRENT_VERSION=${GITHUB_TAG/refs\/tags\/v/}
-          echo "CURRENT_VERSION=$CURRENT_VERSION" >> $GITHUB_ENV
-
-      - name: Checkout code
-        uses: actions/checkout@v2
-        with:
-          ref: main
-
-      - name: Get Changelog Entry
-        id: changelog_reader
-        uses: mindsers/changelog-reader-action@v1
-        with:
-          version: ${{ env.CURRENT_VERSION }}
-          path: ./CHANGELOG.md
-
-      - name: Create Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Release ${{ github.ref }}
-          body: ${{ steps.changelog_reader.outputs.log_entry }}
-          draft: false
-          prerelease: false

.gitignore

@@ -4,7 +4,7 @@ doc/index.html
 
 # Result of bud commands
 vm
-iso
+/iso
 doi
 
 pkgs/_sources/.shake*

CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Quick branch overview
+
+We work with several branches in this repo. This document aims to explain how
+to contribute changes to the existing branches.
+
+### `main` branch
+
+- Changes to `modules` and `profiles` should go [the main branch](https://git.pub.solar/pub-solar/os/src/branch/main)
+- Changes can get accepted via: Pull Request
+- Branch protected from direct `git push`
+
+### `infra` branch
+
+- Changes to the [pub.solar](https://pub.solar) infrastructure should be merged [into this branch](https://git.pub.solar/pub-solar/os/src/branch/infra)
+- Changes can get accepted via: Pull Request
+- Branch protected from direct `git push`
+
+### `momo/main` branch
+
+- Changes to the [Momo](https://momo.koeln) infrastructure should be merged [into this branch](https://git.pub.solar/pub-solar/os/src/branch/momo/main)
+- Changes can get accepted via: Pull Request
+- Deployment of changes is [automatic via CI pipeline](https://git.pub.solar/pub-solar/os/src/commit/43bd7421509f7cc9ba06d7c740f3f536a4a2af76/.drone.yml#L20-L38)
+- Branch protected from direct `git push`
+
+### `$USER` branches
+
+- User's custom hosts and changes can be worked on in these branches
+- Direct `git push` possible
+- Examples:
+  - [hensoko](https://git.pub.solar/pub-solar/os/src/branch/hensoko)
+  - [b12f](https://git.pub.solar/pub-solar/os/src/branch/b12f)
+  - [axeman](https://git.pub.solar/pub-solar/os/src/branch/axeman)
+  - [teutat3s](https://git.pub.solar/pub-solar/os/src/branch/teutat3s)

README.md

@@ -38,7 +38,7 @@ _PubSolarOS_:
   as much non-free software as you like.
 - Automation is better. The reproducibility of nix feels so much more
   powerful once you're deploying your new configuration from your laptop
-  to all your other devices with one command. [We have an automated CI using drone](https://ci.b12f.io/pub-solar/os).
+  to all your other devices with one command. [We have an automated CI using drone](https://ci.pub.solar/pub-solar/os).
 - Community is important. We just like working on this together, and it
   feels really good to see our progress at the end of a
   [hakken.irl](https://pub.solar/hakken) session.

default.nix

@@ -5,32 +5,20 @@ let
 
   ciSystems = [
     "aarch64-linux"
-    "i686-linux"
     "x86_64-linux"
   ];
 
-  filterSystems =
-    lib.filterAttrs
-    (system: _: lib.elem system ciSystems);
+  filterSystems = lib.filterAttrs (system: _: lib.elem system ciSystems);
 
   recurseIntoAttrsRecursive = lib.mapAttrs (
-    _: v:
-      if lib.isAttrs v
-      then recurseIntoAttrsRecursive (lib.recurseIntoAttrs v)
-      else v
+    _: v: if lib.isAttrs v then recurseIntoAttrsRecursive (lib.recurseIntoAttrs v) else v
   );
 
-  systemOutputs =
-    lib.filterAttrs
-    (
-      name: set:
-        lib.isAttrs set
-        && lib.any
-        (system: set ? ${system} && name != "legacyPackages")
-        ciSystems
-    )
-    default.outputs;
+  systemOutputs = lib.filterAttrs (
+    name: set:
+    lib.isAttrs set && lib.any (system: set ? ${system} && name != "legacyPackages") ciSystems
+  ) default.outputs;
 
   ciDrvs = lib.mapAttrs (_: system: filterSystems system) systemOutputs;
 in
-  (recurseIntoAttrsRecursive ciDrvs) // {shell = import ./shell.nix;}
+(recurseIntoAttrsRecursive ciDrvs) // { shell = import ./shell.nix; }

doc/api-reference.md

@@ -59,5 +59,5 @@ list of strings
 _*Default*_
 
 ```
-["aarch64-linux","aarch64-darwin","i686-linux","x86_64-darwin","x86_64-linux"]
+["aarch64-linux","aarch64-darwin","x86_64-darwin","x86_64-linux"]
 ```

doc/book.toml

@@ -1,5 +1,9 @@
 [book]
-authors = ["Timothy DeHerrera"]
+authors = [
+  "Timothy DeHerrera",
+  "Parthiv Seetharaman",
+  "David Arnold",
+]
 language = "en"
 multilingual = false
 src = "."

doc/concepts/users.md

@@ -9,8 +9,7 @@
 Users are a special case of [profiles](profiles.md) that define system
 users and [home-manager][home-manager] configurations. For your convenience,
 home manager is wired in by default so all you have to worry about is declaring
-your users. For a fully fleshed out example, check out the developers personal
-[branch](https://github.com/divnix/devos/tree/nrd/users/nrd/default.nix).
+your users.
 
 ## Basic Usage
 
@@ -60,18 +59,6 @@ using the `homeConfigurations` flake output.
 This is great for keeping your environment consistent across Unix-like systems,
 including macOS.
 
-### From within the projects devshell:
-
-```sh
-# builds the pub-solar user defined in the PubSolarOS host
-nix build '.#homeConfigurations."pub-solar@PubSolarOS".activationPackage'
-
-# build and activate
-nix build '.#homeConfigurations."pub-solar@PubSolarOS".activationPackage' && ./result/activate && unlink result
-```
-
-### Manually from outside the project:
-
 ```sh
 # build
 nix build "github:divnix/devos#homeConfigurations.nixos@NixOS.home.activationPackage"
@@ -81,5 +68,5 @@ nix build "github:divnix/devos#homeConfigurations.nixos@NixOS.home.activationPac
 ```
 
 [home-manager]: https://nix-community.github.io/home-manager
-[modules-list]: https://github.com/divnix/devos/tree/main/users/modules/module-list.nix
+[modules-list]: https://github.com/divnix/digga/tree/main/users/modules/module-list.nix
 [portableuser]: https://digga.divnix.com/api-reference-home.html#homeusers

doc/start/index.md

@@ -4,7 +4,8 @@ The only dependency is nix, so make sure you have it [installed][install-nix].
 
 ## Get the Template
 
-If you currently don't have flakes setup, you can utilize the digga shell to pull the template:
+If you currently don't have flakes setup, you can utilize the digga shell to
+pull the template:
 
 ```sh
 nix-shell "https://github.com/divnix/digga/archive/main.tar.gz" \
@@ -22,37 +23,26 @@ Then make sure to create the git repository:
 ```sh
 git init
 git add .
-git commit -m init
+git commit
 ```
 
-To drop into a nix-shell, if you don't have flakes setup, use the digga shell to create a `flake.lock`:
-
-```sh
-nix-shell "https://github.com/divnix/digga/archive/main.tar.gz" \
-  --run "nix flake lock"
-```
-
-Or if you do have flakes support, just run:
-
-```sh
-nix flake lock
-```
-
-Finally, run `nix-shell` to get to an interactive shell with all the dependencies, including the unstable nix
-version required. You can run `menu` to confirm that you are using digga (expected output includes [docs], [general commands], [linter], etc.).
+Finally, run `nix-shell` to get to an interactive shell with all the
+dependencies, including the unstable nix version required. You can run `menu` to
+confirm that you are using digga (expected output includes [docs], [general
+commands], [linter], etc.).
 
 In addition, the [binary cache](../integrations/cachix.md) is added for faster deployment.
 
-> ##### _Notes:_
+> # _Notes:_
 >
 > - Flakes ignore files that have not been added to git, so be sure to stage new
 >   files before building the system.
 > - You can choose to simply clone the repo with git if you want to follow
 >   upstream changes.
-> - If the `nix-shell -p cachix --run "cachix use nrdxp"` line doesn't work
->   you can try with sudo: `sudo nix-shell -p cachix --run "cachix use nrdxp"`
+> - If the `nix-shell -p cachix --run "cachix use nrdxp"` line doesn't work you
+>   can try with sudo: `sudo nix-shell -p cachix --run "cachix use nrdxp"`
 
-## Next Steps:
+## Next Steps
 
 - [Make installable ISO](./iso.md)
 

doc/tests.md

@@ -14,12 +14,21 @@ be built during CI.
 
 ## Integration Tests
 
-All your profiles defined in suites will be tested in a NixOS VM.
+All your profiles defined in suites can be tested against an individual host.
+Simply use digga's pre-baked `digga.lib.allProfilesTest` like so:
+
+```nix
+{
+  hosts = {
+    Morty.tests = [ allProfilesTest ];
+  };
+}
+```
 
 You can write integration tests for one or more NixOS VMs that can,
 optionally, be networked together, and yes, it's as awesome as it sounds!
 
-Be sure to use the `mkTest` function from digga, `digga.lib.pkgs-lib.mkTest`
+Be sure to use the `mkTest` function from Digga, `digga.lib.mkTest`
 which wraps the official [testing-python][testing-python] function to ensure
 that the system is setup exactly as it is for a bare DevOS system. There are
 already great resources for learning how to use these tests effectively,
@@ -28,7 +37,7 @@ and the examples in [nixpkgs][nixos-tests].
 
 [test-doc]: https://nixos.org/manual/nixos/stable/index.html#sec-nixos-tests
 [test-blog]: https://www.haskellforall.com/2020/11/how-to-use-nixos-for-lightweight.html
-[default]: https://github.com/divnix/devos/tree/main/tests/default.nix
+[default]: https://github.com/divnix/devos/tree/core/tests/default.nix
 [run-test]: https://github.com/NixOS/nixpkgs/blob/6571462647d7316aff8b8597ecdf5922547bf365/lib/debug.nix#L154-L166
 [nixos-tests]: https://github.com/NixOS/nixpkgs/tree/master/nixos/tests
 [testing-python]: https://github.com/NixOS/nixpkgs/tree/master/nixos/lib/testing-python.nix

flake.lock

@@ -3,18 +3,22 @@
     "agenix": {
       "inputs": {
         "darwin": [
-          "darwin"
+          "nix-darwin"
+        ],
+        "home-manager": [
+          "home-manager"
         ],
         "nixpkgs": [
-          "nixos"
-        ]
+          "nixpkgs"
+        ],
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1677247280,
-        "narHash": "sha256-sa+8MtoAOSLsWP9vf0qiJUyMovIEYgDzHE8TkoK04Hk=",
+        "lastModified": 1723293904,
+        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "833f87c8ff574a29aea3e091045cbaed3cf86bc1",
+        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
         "type": "github"
       },
       "original": {
@@ -23,42 +27,22 @@
         "type": "github"
       }
     },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "nixos"
-        ]
-      },
-      "locked": {
-        "lastModified": 1673295039,
-        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
-        "type": "github"
-      },
-      "original": {
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "deploy": {
+    "deploy-rs": {
       "inputs": {
         "flake-compat": [
           "flake-compat"
         ],
         "nixpkgs": [
-          "nixos"
+          "nixpkgs"
         ],
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1674127017,
-        "narHash": "sha256-QO1xF7stu5ZMDLbHN30LFolMAwY6TVlzYvQoUs1RD68=",
+        "lastModified": 1727447169,
+        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "8c9ea9605eed20528bf60fae35a2b613b901fd77",
+        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
         "type": "github"
       },
       "original": {
@@ -67,101 +51,14 @@
         "type": "github"
       }
     },
-    "devshell": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "digga",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1671489820,
-        "narHash": "sha256-qoei5HDJ8psd1YUPD7DhbHdhLIT9L2nadscp4Qk37uk=",
-        "owner": "numtide",
-        "repo": "devshell",
-        "rev": "5aa3a8039c68b4bf869327446590f4cdf90bb634",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "devshell",
-        "type": "github"
-      }
-    },
-    "devshell_2": {
-      "inputs": {
-        "flake-utils": [
-          "keycloak-theme-pub-solar",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "keycloak-theme-pub-solar",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1667210711,
-        "narHash": "sha256-IoErjXZAkzYWHEpQqwu/DeRNJGFdR7X2OGbkhMqMrpw=",
-        "owner": "numtide",
-        "repo": "devshell",
-        "rev": "96a9dd12b8a447840cc246e17a47b81a4268bba7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "devshell",
-        "type": "github"
-      }
-    },
-    "digga": {
-      "inputs": {
-        "darwin": [
-          "darwin"
-        ],
-        "deploy": [
-          "deploy"
-        ],
-        "devshell": "devshell",
-        "flake-compat": [
-          "flake-compat"
-        ],
-        "flake-utils": "flake-utils_2",
-        "flake-utils-plus": "flake-utils-plus",
-        "home-manager": [
-          "home"
-        ],
-        "nixlib": [
-          "nixos"
-        ],
-        "nixpkgs": [
-          "nixos"
-        ],
-        "nixpkgs-unstable": "nixpkgs-unstable"
-      },
-      "locked": {
-        "lastModified": 1674947971,
-        "narHash": "sha256-6gKqegJHs72jnfFP9g2sihl4fIZgtKgKuqU2rCkIdGY=",
-        "owner": "pub-solar",
-        "repo": "digga",
-        "rev": "2da608bd8afb48afef82c6b1b6d852a36094a497",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pub-solar",
-        "ref": "fix/bootstrap-iso",
-        "repo": "digga",
-        "type": "github"
-      }
-    },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -170,13 +67,34 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
+      "inputs": {
+        "systems": "systems_3"
+      },
       "locked": {
-        "lastModified": 1642700792,
-        "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
         "type": "github"
       },
       "original": {
@@ -185,157 +103,152 @@
         "type": "github"
       }
     },
-    "flake-utils-plus": {
+    "flakey-profile": {
+      "locked": {
+        "lastModified": 1712898590,
+        "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "type": "github"
+      }
+    },
+    "home-manager": {
       "inputs": {
-        "flake-utils": [
-          "digga",
-          "flake-utils"
+        "nixpkgs": [
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1654029967,
-        "narHash": "sha256-my3GQ3mQIw/1f6GPV1IhUZrcYQSWh0YJAMPNBjhXJDw=",
-        "owner": "gytis-ivaskevicius",
-        "repo": "flake-utils-plus",
-        "rev": "6271cf3842ff9c8a9af9e3508c547f86bc77d199",
+        "lastModified": 1732466619,
+        "narHash": "sha256-T1e5oceypZu3Q8vzICjv1X/sGs9XfJRMW5OuXHgpB3c=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "f3111f62a23451114433888902a55cf0692b408d",
         "type": "github"
       },
       "original": {
-        "owner": "gytis-ivaskevicius",
-        "ref": "refs/pull/120/head",
-        "repo": "flake-utils-plus",
+        "owner": "nix-community",
+        "ref": "release-24.11",
+        "repo": "home-manager",
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_3": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_4": {
-      "locked": {
-        "lastModified": 1653893745,
-        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "home": {
+    "invoiceplane-template": {
       "inputs": {
-        "nixpkgs": [
-          "nixos"
+        "flake-parts": [
+          "flake-parts"
         ],
-        "utils": "utils_2"
-      },
-      "locked": {
-        "lastModified": 1676257154,
-        "narHash": "sha256-eW3jymNLpdxS5fkp9NWKyNtgL0Gqtgg1vCTofKXDF1g=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "2cb27c79117a2a75ff3416c3199a2dc57af6a527",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-22.11",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "keycloak-theme-pub-solar": {
-      "inputs": {
-        "devshell": "devshell_2",
-        "flake-utils": "flake-utils_3",
         "nixpkgs": [
-          "nixos"
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1669645736,
-        "narHash": "sha256-u1yK1fyh1UEX3BITfk6ROenWbP3aznZRplwCE+FVtHE=",
-        "ref": "main",
-        "rev": "b488fe24a27bf76e0b777202bf13a68660121305",
-        "revCount": 17,
+        "lastModified": 1728398621,
+        "narHash": "sha256-cNCgW0g012t7lZ2gxBpc+Uu6GHV2sTEsOV50nSZ96FM=",
+        "ref": "refs/heads/main",
+        "rev": "a4f2aa76583b5dfa3f2db12ff360ba9f229cfb2f",
+        "revCount": 37,
         "type": "git",
-        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
+        "url": "https://git.pub.solar/momo/invoiceplane-templates.git"
       },
       "original": {
-        "ref": "main",
         "type": "git",
-        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
+        "url": "https://git.pub.solar/momo/invoiceplane-templates.git"
       }
     },
-    "latest": {
+    "lix": {
+      "flake": false,
       "locked": {
-        "lastModified": 1677063315,
-        "narHash": "sha256-qiB4ajTeAOVnVSAwCNEEkoybrAlA+cpeiBxLobHndE8=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "988cc958c57ce4350ec248d2d53087777f9e1949",
+        "lastModified": 1729298361,
+        "narHash": "sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U=",
+        "rev": "ad9d06f7838a25beec425ff406fe68721fef73be",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/ad9d06f7838a25beec425ff406fe68721fef73be.tar.gz?rev=ad9d06f7838a25beec425ff406fe68721fef73be"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/lix/archive/2.91.1.tar.gz"
+      }
+    },
+    "lix-module": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "flakey-profile": "flakey-profile",
+        "lix": "lix",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729360442,
+        "narHash": "sha256-6U0CyPycIBc04hbYy2hBINnVso58n/ZyywY2BD3hu+s=",
+        "rev": "9098ac95768f7006d7e070b88bae76939f6034e6",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/9098ac95768f7006d7e070b88bae76939f6034e6.tar.gz?rev=9098ac95768f7006d7e070b88bae76939f6034e6"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz"
+      }
+    },
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1732603785,
+        "narHash": "sha256-AEjWTJwOmSnVYsSJCojKgoguGfFfwel6z/6ud6UFMU8=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "6ab87b7c84d4ee873e937108c4ff80c015a40c7a",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
         "type": "github"
       }
     },
-    "nixos": {
+    "nix-direnv": {
+      "inputs": {
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
       "locked": {
-        "lastModified": 1677179781,
-        "narHash": "sha256-+peLp16ruWLuTFHo0ZUbLlS1/meS/+RsWQQ9bUAzOh8=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "50c23cd4ff6c8344e0b4d438b027b3afabfe58dd",
+        "lastModified": 1732689932,
+        "narHash": "sha256-dnB8nu6ozuflg7f887Udoujx284QI6FMCSuCYIiTCYQ=",
+        "owner": "nix-community",
+        "repo": "nix-direnv",
+        "rev": "0357fa09ff68323c472fc0362ddc141a6aa6c3b5",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-22.11",
-        "repo": "nixpkgs",
+        "owner": "nix-community",
+        "repo": "nix-direnv",
         "type": "github"
       }
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1677232326,
-        "narHash": "sha256-rAk2/80kLvA3yIMmSV86T1B4kNvwCFMSQ1FxXndaUB0=",
+        "lastModified": 1732483221,
+        "narHash": "sha256-kF6rDeCshoCgmQz+7uiuPdREVFuzhIorGOoPXMalL2U=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "2d44015779cced4eec9df5b8dab238b9f6312cb2",
+        "rev": "45348ad6fb8ac0e8415f6e5e96efe47dd7f39405",
         "type": "github"
       },
       "original": {
@@ -344,13 +257,123 @@
         "type": "github"
       }
     },
-    "nixpkgs-unstable": {
+    "nixpkgs": {
       "locked": {
-        "lastModified": 1672791794,
-        "narHash": "sha256-mqGPpGmwap0Wfsf3o2b6qHJW1w2kk/I6cGCGIU+3t6o=",
+        "lastModified": 1732350895,
+        "narHash": "sha256-GcOQbOgmwlsRhpLGSwZJwLbo3pu9ochMETuRSS1xpz4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9813adc7f7c0edd738c6bdd8431439688bb0cb3d",
+        "rev": "0c582677378f2d9ffcb01490af2f2c678dcb29d3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1730504152,
+        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+      }
+    },
+    "root": {
+      "inputs": {
+        "agenix": "agenix",
+        "deploy-rs": "deploy-rs",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
+        "invoiceplane-template": "invoiceplane-template",
+        "lix-module": "lix-module",
+        "nix-darwin": "nix-darwin",
+        "nix-direnv": "nix-direnv",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs",
+        "unstable": "unstable"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-direnv",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1724833132,
+        "narHash": "sha256-F4djBvyNRAXGusJiNYInqR6zIMI3rvlp6WiKwsRISos=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "3ffd842a5f50f435d3e603312eefa4790db46af5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "unstable": {
+      "locked": {
+        "lastModified": 1732521221,
+        "narHash": "sha256-2ThgXBUXAE1oFsVATK1ZX9IjPcS4nKFOAjhPNKuiMn0=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "4633a7c72337ea8fd23a4f2ba3972865e3ec685d",
         "type": "github"
       },
       "original": {
@@ -360,80 +383,16 @@
         "type": "github"
       }
     },
-    "nur": {
-      "locked": {
-        "lastModified": 0,
-        "narHash": "sha256-koC6DBYmLCrgXA+AMHVaODf1uHYPmvcFygHfy3eg6vI=",
-        "path": "/nix/store/6mfkswqi67m35qwv0vh7kpk8rypbl2rq-source",
-        "type": "path"
-      },
-      "original": {
-        "id": "nur",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "agenix": "agenix",
-        "darwin": "darwin",
-        "deploy": "deploy",
-        "digga": "digga",
-        "flake-compat": "flake-compat",
-        "home": "home",
-        "keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
-        "latest": "latest",
-        "nixos": "nixos",
-        "nixos-hardware": "nixos-hardware",
-        "nur": "nur",
-        "triton-vmtools": "triton-vmtools"
-      }
-    },
-    "triton-vmtools": {
-      "inputs": {
-        "flake-utils": "flake-utils_4",
-        "nixpkgs": [
-          "nixos"
-        ]
-      },
-      "locked": {
-        "dir": "vmtools",
-        "lastModified": 1669648111,
-        "narHash": "sha256-EKh7iM4fCyZ7L6+HmGn3QkZ1HuG9zMEkziOH3K13SbY=",
-        "ref": "main",
-        "rev": "d78c4afe040440437949ce581ae0dcdc5893553c",
-        "revCount": 28,
-        "type": "git",
-        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
-      },
-      "original": {
-        "dir": "vmtools",
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
-      }
-    },
     "utils": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
+      "inputs": {
+        "systems": "systems_2"
       },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "utils_2": {
       "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,177 +1,134 @@
 {
-  description = "A highly structured configuration database.";
+  description = "teutat3s hosts in nix";
 
   nixConfig.extra-experimental-features = "nix-command flakes";
-  nixConfig.extra-substituters = "https://nix-dram.cachix.org https://dram.cachix.org  https://nrdxp.cachix.org https://nix-community.cachix.org";
-  nixConfig.extra-trusted-public-keys = "nix-dram.cachix.org-1:CKjZ0L1ZiqH3kzYAZRt8tg8vewAx5yj8Du/+iR8Efpg= dram.cachix.org-1:baoy1SXpwYdKbqdTbfKGTKauDDeDlHhUpC+QuuILEMY= nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=";
 
   inputs = {
     # Track channels with commits tested and built by hydra
-    nixos.url = "github:nixos/nixpkgs/nixos-22.11";
-    latest.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
+    unstable.url = "github:nixos/nixpkgs/nixos-unstable";
 
     flake-compat.url = "github:edolstra/flake-compat";
     flake-compat.flake = false;
 
-    digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
-    digga.inputs.nixpkgs.follows = "nixos";
-    digga.inputs.nixlib.follows = "nixos";
-    digga.inputs.home-manager.follows = "home";
-    digga.inputs.deploy.follows = "deploy";
-    digga.inputs.darwin.follows = "darwin";
-    digga.inputs.flake-compat.follows = "flake-compat";
+    nix-darwin.url = "github:lnl7/nix-darwin/master";
+    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
 
-    home.url = "github:nix-community/home-manager/release-22.11";
-    home.inputs.nixpkgs.follows = "nixos";
+    home-manager.url = "github:nix-community/home-manager/release-24.11";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    darwin.url = "github:LnL7/nix-darwin";
-    darwin.inputs.nixpkgs.follows = "nixos";
+    flake-parts.url = "github:hercules-ci/flake-parts";
 
-    deploy.url = "github:serokell/deploy-rs";
-    deploy.inputs.nixpkgs.follows = "nixos";
-    deploy.inputs.flake-compat.follows = "flake-compat";
+    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    deploy-rs.inputs.flake-compat.follows = "flake-compat";
 
     agenix.url = "github:ryantm/agenix";
-    agenix.inputs.nixpkgs.follows = "nixos";
-    agenix.inputs.darwin.follows = "darwin";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
+    agenix.inputs.darwin.follows = "nix-darwin";
+    agenix.inputs.home-manager.follows = "home-manager";
+
+    nix-direnv.url = "github:nix-community/nix-direnv";
+    nix-direnv.inputs.nixpkgs.follows = "nixpkgs";
+    nix-direnv.inputs.flake-parts.follows = "flake-parts";
 
     nixos-hardware.url = "github:nixos/nixos-hardware";
 
-    triton-vmtools.url = "git+https://git.b12f.io/pub-solar/infra?ref=main&dir=vmtools";
-    triton-vmtools.inputs.nixpkgs.follows = "nixos";
+    lix-module = {
+      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
-    keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
-    keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixos";
+    invoiceplane-template.url = "git+https://git.pub.solar/momo/invoiceplane-templates.git";
+    invoiceplane-template.inputs.nixpkgs.follows = "nixpkgs";
+    invoiceplane-template.inputs.flake-parts.follows = "flake-parts";
   };
 
-  outputs = {
-    self,
-    digga,
-    nixos,
-    home,
-    nixos-hardware,
-    nur,
-    agenix,
-    deploy,
-    triton-vmtools,
-    keycloak-theme-pub-solar,
-    ...
-  } @ inputs:
-    digga.lib.mkFlake
-    {
-      inherit self inputs;
-
-      channelsConfig = {
-        # allowUnfree = true;
-      };
-
-      supportedSystems = ["x86_64-linux" "aarch64-linux"];
-
-      channels = {
-        nixos = {
-          imports = [(digga.lib.importOverlays ./overlays)];
-          overlays = [];
-        };
-        latest = {};
-      };
-
-      lib = import ./lib {lib = digga.lib // nixos.lib;};
-
-      sharedOverlays = [
-        (final: prev: {
-          __dontExport = true;
-          lib = prev.lib.extend (lfinal: lprev: {
-            our = self.lib;
-          });
-        })
-        nur.overlay
-        agenix.overlays.default
-
-        (import ./pkgs)
+  outputs =
+    inputs@{ self, ... }:
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
       ];
 
-      nixos = {
-        hostDefaults = {
-          system = "x86_64-linux";
-          channelName = "nixos";
-          imports = [(digga.lib.importExportableModules ./modules)];
-          modules = [
-            {lib.our = self.lib;}
-            # FIXME: upstream module causes a huge number of unnecessary
-            # dependencies to be pulled in for all systems -- many of them are
-            # graphical. should only be imported as needed.
-            # digga.nixosModules.bootstrapIso
-            digga.nixosModules.nixConfig
-            home.nixosModules.home-manager
-            agenix.nixosModules.age
-          ];
-        };
+      imports = [
+        ./lib
+        ./modules
+        ./hosts
+        ./users
+        ./overlays
+      ];
 
-        imports = [(digga.lib.importHosts ./hosts)];
-        hosts = {
-          /*
-          set host specific properties here
-          */
-          bootstrap = {
-            modules = [
-              digga.nixosModules.bootstrapIso
-            ];
-          };
-          PubSolarOS = {
-            tests = [
-              (import ./tests/first-test.nix {
-                pkgs = nixos.legacyPackages.x86_64-linux;
-                lib = nixos.lib;
-              })
-            ];
-          };
-        };
-        importables = rec {
-          profiles =
-            digga.lib.rakeLeaves ./profiles
-            // {
-              users = digga.lib.rakeLeaves ./users;
+      perSystem =
+        args@{
+          system,
+          pkgs,
+          config,
+          ...
+        }:
+        {
+          _module.args = {
+            inherit inputs;
+            pkgs = import inputs.nixpkgs {
+              inherit system;
+              overlays = [ inputs.agenix.overlays.default ];
             };
-          suites = with profiles; rec {
-            base = [users.pub-solar users.root];
-            iso = base ++ [base-user graphical pub-solar-iso];
-            pubsolaros = [full-install base-user users.root];
-            anonymous = [pubsolaros users.pub-solar];
+            unstable = import inputs.unstable { inherit system; };
+            master = import inputs.master { inherit system; };
+          };
+
+          devShells.default = pkgs.mkShell {
+            buildInputs = with pkgs; [
+              agenix
+              cachix
+              deploy-rs
+              nixd
+              nixos-generators
+              nvfetcher
+
+              editorconfig-checker
+              nodePackages.prettier
+              shellcheck
+              shfmt
+              treefmt
+            ];
           };
         };
-      };
 
-      home = {
-        imports = [(digga.lib.importExportableModules ./users/modules)];
-        modules = [];
-        importables = rec {
-          profiles = digga.lib.rakeLeaves ./users/profiles;
-          suites = with profiles; rec {
-            base = [direnv git];
+      flake = {
+        formatter."x86_64-linux" = inputs.unstable.legacyPackages."x86_64-linux".nixfmt-rfc-style;
+
+        deploy.nodes = self.lib.deploy.mkDeployNodes self.nixosConfigurations {
+          #example = {
+          #  hostname = "example.com:22";
+          #  sshUser = "bartender";
+          #  fastConnect = true;
+          #  profilesOrder = ["system" "direnv"];
+          #  profiles.direnv = {
+          #    user = "bartender";
+          #    path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.bartender;
+          #  };
+          #};
+
+          fae = {
+            hostname = "192.168.13.35";
+            sshUser = "pub-solar";
           };
-        };
-        users = {
-          pub-solar = {suites, ...}: {
-            imports = suites.base;
-
-            home.stateVersion = "21.03";
+          powder = {
+            hostname = "80.71.153.194";
+            sshUser = "root";
+            profilesOrder = [
+              "system"
+              "direnv"
+            ];
+            profiles.direnv = {
+              user = "pub-solar";
+              path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.pub-solar;
+            };
           };
-          barkeeper = {suites, ...}: {
-            imports = suites.base;
-
-            home.stateVersion = "21.03";
-          };
-        }; # digga.lib.importers.rakeLeaves ./users/hm;
-      };
-
-      devshell = ./shell;
-
-      homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
-
-      deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
-        flora-6 = {
-          sshUser = "barkeeper";
-          hostname = "flora-6.pub.solar";
         };
       };
     };

hosts/0001/caddy.nix

@@ -1,55 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: {
-  services.caddy = {
-    enable = lib.mkForce true;
-    group = "www-user";
-    email = "admins@pub.solar";
-    globalConfig = lib.mkForce "";
-    virtualHosts = {
-      "momo.koeln" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          # website
-          handle {
-            root * /srv/www/momo.koeln
-            try_files {path}.html {path}
-            file_server
-          }
-          # minimal error handling, respond with status code and text
-          handle_errors {
-            respond "{http.error.status_code} {http.error.status_text}"
-          }
-        '';
-      };
-      "www.momo.koeln" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          redir https://momo.koeln{uri}
-        '';
-      };
-      "list.momo.koeln" = {
-        logFormat = lib.mkForce ''
-          output discard
-        '';
-        extraConfig = ''
-          handle_path /static/* {
-            root * /var/lib/mailman/web
-            file_server
-          }
-
-          reverse_proxy :8000
-        '';
-      };
-    };
-  };
-  networking.firewall.allowedTCPPorts = [80 443];
-}

hosts/0001/default.nix

@@ -1,5 +0,0 @@
-{...}: {
-  imports = [
-    ./0001.nix
-  ];
-}

hosts/0001/gitea.nix

@@ -1,120 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: let
-  hostAddress = "10.10.42.1";
-  serviceAddress = "10.10.42.3";
-
-  hostname = "git.momo.koeln";
-
-  dbUserName = "gitea";
-
-  hostStateDir = "/mnt/internal/gitea";
-  containerStateDir = "/var/lib/gitea";
-in {
-  age.secrets.gitea-database-password = {
-    file = "${self}/secrets/gitea-database-password.age";
-    mode = "600";
-    owner = "gitea";
-  };
-
-  age.secrets.gitea-mailer-password = {
-    file = "${self}/secrets/gitea-mailer-password.age";
-    mode = "600";
-    owner = "gitea";
-  };
-
-  services.caddy.virtualHosts.${hostname} = {
-    logFormat = lib.mkForce ''
-      output discard
-    '';
-    extraConfig = ''
-      redir /user/login /user/oauth2/${config.containers.keycloak.config.services.keycloak.settings.hostname} temporary
-      reverse_proxy ${serviceAddress}:8080
-    '';
-  };
-
-  containers."gitea" = {
-    privateNetwork = true;
-    hostAddress = hostAddress;
-    localAddress = serviceAddress;
-
-    bindMounts."${containerStateDir}" = {
-      hostPath = hostStateDir;
-      isReadOnly = false;
-    };
-
-    bindMounts."${config.age.secrets.gitea-database-password.path}" = {
-      hostPath = config.age.secrets.gitea-database-password.path;
-      isReadOnly = true;
-    };
-
-    bindMounts."${config.age.secrets.gitea-mailer-password.path}" = {
-      hostPath = config.age.secrets.gitea-mailer-password.path;
-      isReadOnly = true;
-    };
-
-    config = {
-      config,
-      pkgs,
-      ...
-    }: {
-      # gitea
-      services.gitea = {
-        enable = true;
-        appName = "pub.solar git server";
-        database = {
-          type = "postgres";
-          passwordFile = config.age.secrets.gitea-database-password.path;
-        };
-        domain = domain;
-        httpAddress = "0.0.0.0";
-        httpPort = 3000;
-        lfs.enable = true;
-        mailerPasswordFile = config.pub-solar.infra-node.mailing.passwordFile;
-        rootUrl = "https://git.pub.solar";
-        settings = {
-          mailer = mkIf config.pub-solar.infra-node.mailing.enabled {
-            ENABLED = true;
-            MAILER_TYPE = config.pub-solar.infra-node.mailing.type;
-            HOST = config.pub-solar.infra-node.mailing.host;
-            FROM = config.pub-solar.infra-node.mailing.from;
-            USER = config.pub-solar.infra-node.mailing.user;
-          };
-          # currently broken, gpg core dumps
-          #"repository.signing" = {
-          #  SIGNING_KEY = "default";
-          #  MERGES = "always";
-          #};
-          openid = {
-            ENABLE_OPENID_SIGNIN = true;
-            ENABLE_OPENID_SIGNUP = true;
-          };
-          # uncomment after initial deployment, first user is admin user
-          # required to setup SSO (oauth openid-connect, keycloak auth provider)
-          service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
-          session.COOKIE_SECURE = lib.mkForce true;
-        };
-      };
-
-      # Required for gitea server side gpg signatures
-      # configured / setup manually in
-      # /var/lib/gitea/data/home/.gitconfig and
-      # /var/lib/gitea/data/home/.gnupg/
-      programs.gnupg.agent = {
-        enable = true;
-        pinentryFlavor = "curses";
-      };
-      # Required to make gpg work without a graphical environment?
-      # otherwise generating a new gpg key fails with this error:
-      # gpg: agent_genkey failed: No pinentry
-      # see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
-      environment.variables = {
-        GPG_TTY = "$(tty)";
-      };
-    };
-  };
-}

hosts/0001/keycloak.nix

@@ -1,73 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  pkgs,
-  self,
-  ...
-}: let
-  hostAddress = "10.10.42.1";
-  serviceAddress = "10.10.42.1";
-
-  hostname = "auth.momo.koeln";
-
-  dbUserName = "keycloak";
-
-  hostStateDir = "/mnt/internal/keycloak";
-  containerStateDir = "/var/lib/keycloak";
-in {
-  age.secrets.keycloak-database-password = {
-    file = "${self}/secrets/keycloak-database-password.age";
-    mode = "700";
-    #owner = "keycloak";
-  };
-
-  services.caddy.virtualHosts.${hostname} = {
-    logFormat = lib.mkForce ''
-      output discard
-    '';
-    extraConfig = ''
-      redir / /realms/momo.koeln/account temporary
-      reverse_proxy ${serviceAddress}:8080
-    '';
-  };
-
-  containers."keycloak" = {
-    privateNetwork = true;
-    hostAddress = hostAddress;
-    localAddress = serviceAddress;
-
-    bindMounts."${containerStateDir}" = {
-      hostPath = hostStateDir;
-      isReadOnly = false;
-    };
-
-    bindMounts."${config.age.secrets.keycloak-database-password.path}" = {
-      hostPath = config.age.secrets.keycloak-database-password.path;
-      isReadOnly = true;
-    };
-
-    config = {
-      config,
-      pkgs,
-      ...
-    }: {
-      # keycloak
-      services.keycloak = {
-        enable = true;
-        database.passwordFile = config.age.secrets.keycloak-database-password.path;
-
-        settings = {
-          hostname = domain;
-          http-host = "0.0.0.0";
-          http-port = 8080;
-          proxy = "edge";
-        };
-
-        # themes = {
-        #   "momo.koeln" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
-        # };
-      };
-    };
-  };
-}

hosts/0001/mailman.nix

@@ -1,143 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: let
-  postfixConfig = pkgs.writeTextFile {
-    name = "main.cf";
-    text = builtins.readFile ./postfix/main.cf;
-  };
-in {
-  system.activationScripts.mkMailmanNet = let
-    docker = config.virtualisation.oci-containers.backend;
-    dockerBin = "${pkgs.${docker}}/bin/${docker}";
-  in ''
-    ${dockerBin} network inspect mailman-net >/dev/null 2>&1 || ${dockerBin} network create mailman-net --subnet 172.20.1.0/24
-  '';
-
-  users.users.mailman = {
-    description = "Mailman Service";
-    home = "/var/lib/mailman";
-    useDefaultShell = true;
-    uid = 993;
-    # Group hakkonaut so caddy can serve the static files from mailman-web directly
-    group = "hakkonaut";
-    isSystemUser = true;
-  };
-
-  systemd.tmpfiles.rules = [
-    "d '/var/lib/mailman' 0750 mailman hakkonaut - -"
-  ];
-
-  age.secrets.mailman-core-secrets = {
-    file = "${self}/secrets/mailman-core-secrets.age";
-    mode = "600";
-    owner = "mailman";
-  };
-
-  age.secrets.mailman-web-secrets = {
-    file = "${self}/secrets/mailman-web-secrets.age";
-    mode = "600";
-    owner = "mailman";
-  };
-
-  age.secrets.mailman-db-secrets = {
-    file = "${self}/secrets/mailman-db-secrets.age";
-    mode = "600";
-    owner = "mailman";
-  };
-
-  virtualisation = {
-    docker = {
-      enable = true;
-    };
-
-    oci-containers = {
-      backend = "docker";
-      containers."mailman-core" = {
-        image = "maxking/mailman-core:0.4";
-        autoStart = true;
-        user = "993";
-        volumes = [
-          "/var/lib/mailman/core:/opt/mailman/"
-        ];
-        extraOptions = [
-          "--network=mailman-net"
-        ];
-        environment = {
-          DATABASE_TYPE = "postgres";
-          DATABASE_CLASS = "mailman.database.postgresql.PostgreSQLDatabase";
-          MTA = "postfix";
-        };
-        environmentFiles = [
-          config.age.secrets.mailman-core-secrets.path
-        ];
-        ports = [
-          "127.0.0.1:8001:8001" # API
-          "127.0.0.1:8024:8024" # LMTP - incoming emails
-        ];
-      };
-
-      containers."mailman-web" = {
-        image = "maxking/mailman-web:0.4";
-        autoStart = true;
-        user = "993";
-        volumes = [
-          "/var/lib/mailman/web:/opt/mailman-web-data"
-        ];
-        extraOptions = [
-          "--network=mailman-net"
-        ];
-        environment = {
-          DATABASE_TYPE = "postgres";
-          SERVE_FROM_DOMAIN = "list.pub.solar";
-          MAILMAN_ADMIN_USER = "admin";
-          MAILMAN_ADMIN_EMAIL = "admins@pub.solar";
-        };
-        environmentFiles = [
-          config.age.secrets.mailman-web-secrets.path
-        ];
-        ports = [
-          "127.0.0.1:8000:8000" # HTTP
-          # "127.0.0.1:8080:8080" # uwsgi
-        ];
-      };
-
-      containers."mailman-db" = {
-        image = "postgres:14-alpine";
-        autoStart = true;
-        user = "993";
-        extraOptions = [
-          "--network=mailman-net"
-        ];
-        volumes = [
-          "/var/lib/mailman/database:/var/lib/postgresql/data"
-        ];
-        environmentFiles = [
-          config.age.secrets.mailman-db-secrets.path
-        ];
-      };
-
-      containers."mailman-postfix" = {
-        image = "mailu/postfix:1.9.46";
-        autoStart = true;
-        user = "993";
-        extraOptions = [
-          "--network=mailman-net"
-        ];
-        volumes = [
-          "/var/lib/mailman/postfix/overrides:/overrides:ro"
-          "/var/lib/mailman/postfix/mailqueue:/var/spool/postfix"
-          "/var/lib/mailman/postfix/data:/var/lib/postfix"
-          "/var/lib/mailman/core:/var/lib/mailman/core"
-          "${postfixConfig}:/etc/postfix/main.cf"
-        ];
-        environmentFiles = [
-          config.age.secrets.mailman-db-secrets.path
-        ];
-      };
-    };
-  };
-}

hosts/0001/nextcloud.nix

@@ -1,88 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  pkgs,
-  self,
-  ...
-}: let
-  hostAddress = "10.10.42.1";
-  serviceAddress = "10.10.42.2";
-
-  hostname = "cloud.momo.koeln";
-
-  dbUserName = "nextcloud";
-
-  hostStateDir = "/mnt/internal/nextcloud";
-  containerStateDir = "/var/lib/nextcloud";
-in {
-  age.secrets.nextcloud-db-password = {
-    file = "${self}/secrets/nextcloud-db-password.age";
-    mode = "700";
-    owner = "nextcloud";
-  };
-
-  age.secrets.nextcloud-admin-password = {
-    file = "${self}/secrets/nextcloud-admin-password";
-    mode = "700";
-    owner = "nextcloud";
-  };
-
-  services.caddy.virtualHosts.${hostname} = {
-    logFormat = lib.mkForce ''
-      output discard
-    '';
-    extraConfig = ''
-      reverse_proxy ${serviceAddress}:80
-    '';
-  };
-
-  containers."nextcloud" = {
-    privateNetwork = true;
-    hostAddress = hostAddress;
-    localAddress = serviceAddress;
-
-    bindMounts."${containerStateDir}" = {
-      hostPath = hostStateDir;
-      isReadOnly = false;
-    };
-
-    config = {
-      config,
-      pkgs,
-      ...
-    }: {
-      networking.firewall.allowedTCPPorts = [80];
-
-      # nextcloud
-      services.nextcloud = {
-        enable = true;
-        hostName = hostname;
-        home = containerStateDir;
-        config = {
-          dbuser = dbUserName;
-          dbtype = "pgsql";
-          dbport = 5432;
-          dbpassFile = config.age.secrets.nextcloud-db-password.path;
-
-          adminUser = "admin";
-          adminpassFile = config.age.secrets.nextcloud-admin-password.path;
-        };
-      };
-
-      services.postgresql = {
-        enable = true;
-        ensureUsers = [
-          {
-            name = dbUserName;
-            ensurePermissions = {
-              "DATABASE nextcloud" = "ALL PRIVILEGES";
-            };
-          }
-        ];
-
-        ensureDatabases = ["nextcloud"];
-      };
-    };
-  };
-}

hosts/0001/postfix/main.cf

@@ -1,692 +0,0 @@
-# Global Postfix configuration file. This file lists only a subset
-# of all parameters. For the syntax, and for a complete parameter
-# list, see the postconf(5) manual page (command: "man 5 postconf").
-#
-# For common configuration examples, see BASIC_CONFIGURATION_README
-# and STANDARD_CONFIGURATION_README. To find these documents, use
-# the command "postconf html_directory readme_directory", or go to
-# http://www.postfix.org/BASIC_CONFIGURATION_README.html etc.
-#
-# For best results, change no more than 2-3 parameters at a time,
-# and test if Postfix still works after every change.
-
-# COMPATIBILITY
-#
-# The compatibility_level determines what default settings Postfix
-# will use for main.cf and master.cf settings. These defaults will
-# change over time.
-#
-# To avoid breaking things, Postfix will use backwards-compatible
-# default settings and log where it uses those old backwards-compatible
-# default settings, until the system administrator has determined
-# if any backwards-compatible default settings need to be made
-# permanent in main.cf or master.cf.
-#
-# When this review is complete, update the compatibility_level setting
-# below as recommended in the RELEASE_NOTES file.
-#
-# The level below is what should be used with new (not upgrade) installs.
-#
-compatibility_level = 3.6
-
-# SOFT BOUNCE
-#
-# The soft_bounce parameter provides a limited safety net for
-# testing.  When soft_bounce is enabled, mail will remain queued that
-# would otherwise bounce. This parameter disables locally-generated
-# bounces, and prevents the SMTP server from rejecting mail permanently
-# (by changing 5xx replies into 4xx replies). However, soft_bounce
-# is no cure for address rewriting mistakes or mail routing mistakes.
-#
-#soft_bounce = no
-
-# LOCAL PATHNAME INFORMATION
-#
-# The queue_directory specifies the location of the Postfix queue.
-# This is also the root directory of Postfix daemons that run chrooted.
-# See the files in examples/chroot-setup for setting up Postfix chroot
-# environments on different UNIX systems.
-#
-queue_directory = /var/spool/postfix
-
-# The command_directory parameter specifies the location of all
-# postXXX commands.
-#
-command_directory = /usr/sbin
-
-# The daemon_directory parameter specifies the location of all Postfix
-# daemon programs (i.e. programs listed in the master.cf file). This
-# directory must be owned by root.
-#
-daemon_directory = /usr/libexec/postfix
-
-# The data_directory parameter specifies the location of Postfix-writable
-# data files (caches, random numbers). This directory must be owned
-# by the mail_owner account (see below).
-#
-data_directory = /var/lib/postfix
-
-# QUEUE AND PROCESS OWNERSHIP
-#
-# The mail_owner parameter specifies the owner of the Postfix queue
-# and of most Postfix daemon processes.  Specify the name of a user
-# account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS
-# AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM.  In
-# particular, don't specify nobody or daemon. PLEASE USE A DEDICATED
-# USER.
-#
-mail_owner = postfix
-
-# The default_privs parameter specifies the default rights used by
-# the local delivery agent for delivery to external file or command.
-# These rights are used in the absence of a recipient user context.
-# DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER.
-#
-#default_privs = nobody
-
-# INTERNET HOST AND DOMAIN NAMES
-#
-# The myhostname parameter specifies the internet hostname of this
-# mail system. The default is to use the fully-qualified domain name
-# from gethostname(). $myhostname is used as a default value for many
-# other configuration parameters.
-#
-myhostname = list.pub.solar
-#myhostname = virtual.domain.tld
-
-# The mydomain parameter specifies the local internet domain name.
-# The default is to use $myhostname minus the first component.
-# $mydomain is used as a default value for many other configuration
-# parameters.
-#
-#mydomain = domain.tld
-
-# SENDING MAIL
-#
-# The myorigin parameter specifies the domain that locally-posted
-# mail appears to come from. The default is to append $myhostname,
-# which is fine for small sites.  If you run a domain with multiple
-# machines, you should (1) change this to $mydomain and (2) set up
-# a domain-wide alias database that aliases each user to
-# user@that.users.mailhost.
-#
-# For the sake of consistency between sender and recipient addresses,
-# myorigin also specifies the default domain name that is appended
-# to recipient addresses that have no @domain part.
-#
-#myorigin = $myhostname
-#myorigin = $mydomain
-
-# RECEIVING MAIL
-
-# The inet_interfaces parameter specifies the network interface
-# addresses that this mail system receives mail on.  By default,
-# the software claims all active interfaces on the machine. The
-# parameter also controls delivery of mail to user@[ip.address].
-#
-# See also the proxy_interfaces parameter, for network addresses that
-# are forwarded to us via a proxy or network address translator.
-#
-# Note: you need to stop/start Postfix when this parameter changes.
-#
-#inet_interfaces = all
-#inet_interfaces = $myhostname
-#inet_interfaces = $myhostname, localhost
-
-# The proxy_interfaces parameter specifies the network interface
-# addresses that this mail system receives mail on by way of a
-# proxy or network address translation unit. This setting extends
-# the address list specified with the inet_interfaces parameter.
-#
-# You must specify your proxy/NAT addresses when your system is a
-# backup MX host for other domains, otherwise mail delivery loops
-# will happen when the primary MX host is down.
-#
-#proxy_interfaces =
-#proxy_interfaces = 1.2.3.4
-
-# The mydestination parameter specifies the list of domains that this
-# machine considers itself the final destination for.
-#
-# These domains are routed to the delivery agent specified with the
-# local_transport parameter setting. By default, that is the UNIX
-# compatible delivery agent that lookups all recipients in /etc/passwd
-# and /etc/aliases or their equivalent.
-#
-# The default is $myhostname + localhost.$mydomain + localhost.  On
-# a mail domain gateway, you should also include $mydomain.
-#
-# Do not specify the names of virtual domains - those domains are
-# specified elsewhere (see VIRTUAL_README).
-#
-# Do not specify the names of domains that this machine is backup MX
-# host for. Specify those names via the relay_domains settings for
-# the SMTP server, or use permit_mx_backup if you are lazy (see
-# STANDARD_CONFIGURATION_README).
-#
-# The local machine is always the final destination for mail addressed
-# to user@[the.net.work.address] of an interface that the mail system
-# receives mail on (see the inet_interfaces parameter).
-#
-# Specify a list of host or domain names, /file/name or type:table
-# patterns, separated by commas and/or whitespace. A /file/name
-# pattern is replaced by its contents; a type:table is matched when
-# a name matches a lookup key (the right-hand side is ignored).
-# Continue long lines by starting the next line with whitespace.
-#
-# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".
-#
-#mydestination = $myhostname, localhost.$mydomain, localhost
-#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
-#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
-#	mail.$mydomain, www.$mydomain, ftp.$mydomain
-
-# REJECTING MAIL FOR UNKNOWN LOCAL USERS
-#
-# The local_recipient_maps parameter specifies optional lookup tables
-# with all names or addresses of users that are local with respect
-# to $mydestination, $inet_interfaces or $proxy_interfaces.
-#
-# If this parameter is defined, then the SMTP server will reject
-# mail for unknown local users. This parameter is defined by default.
-#
-# To turn off local recipient checking in the SMTP server, specify
-# local_recipient_maps = (i.e. empty).
-#
-# The default setting assumes that you use the default Postfix local
-# delivery agent for local delivery. You need to update the
-# local_recipient_maps setting if:
-#
-# - You define $mydestination domain recipients in files other than
-#   /etc/passwd, /etc/aliases, or the $virtual_alias_maps files.
-#   For example, you define $mydestination domain recipients in
-#   the $virtual_mailbox_maps files.
-#
-# - You redefine the local delivery agent in master.cf.
-#
-# - You redefine the "local_transport" setting in main.cf.
-#
-# - You use the "luser_relay", "mailbox_transport", or "fallback_transport"
-#   feature of the Postfix local delivery agent (see local(8)).
-#
-# Details are described in the LOCAL_RECIPIENT_README file.
-#
-# Beware: if the Postfix SMTP server runs chrooted, you probably have
-# to access the passwd file via the proxymap service, in order to
-# overcome chroot restrictions. The alternative, having a copy of
-# the system passwd file in the chroot jail is just not practical.
-#
-# The right-hand side of the lookup tables is conveniently ignored.
-# In the left-hand side, specify a bare username, an @domain.tld
-# wild-card, or specify a user@domain.tld address.
-#
-#local_recipient_maps = unix:passwd.byname $alias_maps
-#local_recipient_maps = proxy:unix:passwd.byname $alias_maps
-#local_recipient_maps =
-
-# The unknown_local_recipient_reject_code specifies the SMTP server
-# response code when a recipient domain matches $mydestination or
-# ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty
-# and the recipient address or address local-part is not found.
-#
-# The default setting is 550 (reject mail) but it is safer to start
-# with 450 (try again later) until you are certain that your
-# local_recipient_maps settings are OK.
-#
-# unknown_local_recipient_reject_code = 550
-
-# TRUST AND RELAY CONTROL
-
-# The mynetworks parameter specifies the list of "trusted" SMTP
-# clients that have more privileges than "strangers".
-#
-# In particular, "trusted" SMTP clients are allowed to relay mail
-# through Postfix.  See the smtpd_recipient_restrictions parameter
-# in postconf(5).
-#
-# You can specify the list of "trusted" network addresses by hand
-# or you can let Postfix do it for you (which is the default).
-#
-# By default (mynetworks_style = subnet), Postfix "trusts" SMTP
-# clients in the same IP subnetworks as the local machine.
-# On Linux, this works correctly only with interfaces specified
-# with the "ifconfig" command.
-#
-# Specify "mynetworks_style = class" when Postfix should "trust" SMTP
-# clients in the same IP class A/B/C networks as the local machine.
-# Don't do this with a dialup site - it would cause Postfix to "trust"
-# your entire provider's network.  Instead, specify an explicit
-# mynetworks list by hand, as described below.
-#
-# Specify "mynetworks_style = host" when Postfix should "trust"
-# only the local machine.
-#
-#mynetworks_style = class
-#mynetworks_style = subnet
-#mynetworks_style = host
-
-# Alternatively, you can specify the mynetworks list by hand, in
-# which case Postfix ignores the mynetworks_style setting.
-#
-# Specify an explicit list of network/netmask patterns, where the
-# mask specifies the number of bits in the network part of a host
-# address.
-#
-# You can also specify the absolute pathname of a pattern file instead
-# of listing the patterns here. Specify type:table for table-based lookups
-# (the value on the table right-hand side is not used).
-#
-mynetworks = mailman-core,mailman-web
-#mynetworks = $config_directory/mynetworks
-#mynetworks = hash:/etc/postfix/network_table
-
-# The relay_domains parameter restricts what destinations this system will
-# relay mail to.  See the smtpd_recipient_restrictions description in
-# postconf(5) for detailed information.
-#
-# By default, Postfix relays mail
-# - from "trusted" clients (IP address matches $mynetworks) to any destination,
-# - from "untrusted" clients to destinations that match $relay_domains or
-#   subdomains thereof, except addresses with sender-specified routing.
-# The default relay_domains value is $mydestination.
-#
-# In addition to the above, the Postfix SMTP server by default accepts mail
-# that Postfix is final destination for:
-# - destinations that match $inet_interfaces or $proxy_interfaces,
-# - destinations that match $mydestination
-# - destinations that match $virtual_alias_domains,
-# - destinations that match $virtual_mailbox_domains.
-# These destinations do not need to be listed in $relay_domains.
-#
-# Specify a list of hosts or domains, /file/name patterns or type:name
-# lookup tables, separated by commas and/or whitespace.  Continue
-# long lines by starting the next line with whitespace. A file name
-# is replaced by its contents; a type:name table is matched when a
-# (parent) domain appears as lookup key.
-#
-# NOTE: Postfix will not automatically forward mail for domains that
-# list this system as their primary or backup MX host. See the
-# permit_mx_backup restriction description in postconf(5).
-#
-#relay_domains = $mydestination
-
-# INTERNET OR INTRANET
-
-# The relayhost parameter specifies the default host to send mail to
-# when no entry is matched in the optional transport(5) table. When
-# no relayhost is given, mail is routed directly to the destination.
-#
-# On an intranet, specify the organizational domain name. If your
-# internal DNS uses no MX records, specify the name of the intranet
-# gateway host instead.
-#
-# In the case of SMTP, specify a domain, host, host:port, [host]:port,
-# [address] or [address]:port; the form [host] turns off MX lookups.
-#
-# If you're connected via UUCP, see also the default_transport parameter.
-#
-#relayhost = $mydomain
-#relayhost = [gateway.my.domain]
-#relayhost = [mailserver.isp.tld]
-#relayhost = uucphost
-#relayhost = [an.ip.add.ress]
-
-# REJECTING UNKNOWN RELAY USERS
-#
-# The relay_recipient_maps parameter specifies optional lookup tables
-# with all addresses in the domains that match $relay_domains.
-#
-# If this parameter is defined, then the SMTP server will reject
-# mail for unknown relay users. This feature is off by default.
-#
-# The right-hand side of the lookup tables is conveniently ignored.
-# In the left-hand side, specify an @domain.tld wild-card, or specify
-# a user@domain.tld address.
-#
-#relay_recipient_maps = hash:/etc/postfix/relay_recipients
-
-# INPUT RATE CONTROL
-#
-# The in_flow_delay configuration parameter implements mail input
-# flow control. This feature is turned on by default, although it
-# still needs further development (it's disabled on SCO UNIX due
-# to an SCO bug).
-#
-# A Postfix process will pause for $in_flow_delay seconds before
-# accepting a new message, when the message arrival rate exceeds the
-# message delivery rate. With the default 100 SMTP server process
-# limit, this limits the mail inflow to 100 messages a second more
-# than the number of messages delivered per second.
-#
-# Specify 0 to disable the feature. Valid delays are 0..10.
-#
-#in_flow_delay = 1s
-
-# ADDRESS REWRITING
-#
-# The ADDRESS_REWRITING_README document gives information about
-# address masquerading or other forms of address rewriting including
-# username->Firstname.Lastname mapping.
-
-# ADDRESS REDIRECTION (VIRTUAL DOMAIN)
-#
-# The VIRTUAL_README document gives information about the many forms
-# of domain hosting that Postfix supports.
-
-# "USER HAS MOVED" BOUNCE MESSAGES
-#
-# See the discussion in the ADDRESS_REWRITING_README document.
-
-# TRANSPORT MAP
-#
-# See the discussion in the ADDRESS_REWRITING_README document.
-
-# ALIAS DATABASE
-#
-# The alias_maps parameter specifies the list of alias databases used
-# by the local delivery agent. The default list is system dependent.
-#
-# On systems with NIS, the default is to search the local alias
-# database, then the NIS alias database. See aliases(5) for syntax
-# details.
-#
-# If you change the alias database, run "postalias /etc/aliases" (or
-# wherever your system stores the mail alias file), or simply run
-# "newaliases" to build the necessary DBM or DB file.
-#
-# It will take a minute or so before changes become visible.  Use
-# "postfix reload" to eliminate the delay.
-#
-#alias_maps = dbm:/etc/aliases
-#alias_maps = hash:/etc/aliases
-#alias_maps = hash:/etc/aliases, nis:mail.aliases
-#alias_maps = netinfo:/aliases
-
-# The alias_database parameter specifies the alias database(s) that
-# are built with "newaliases" or "sendmail -bi".  This is a separate
-# configuration parameter, because alias_maps (see above) may specify
-# tables that are not necessarily all under control by Postfix.
-#
-#alias_database = dbm:/etc/aliases
-#alias_database = dbm:/etc/mail/aliases
-#alias_database = hash:/etc/aliases
-#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
-
-# ADDRESS EXTENSIONS (e.g., user+foo)
-#
-# The recipient_delimiter parameter specifies the separator between
-# user names and address extensions (user+foo). See canonical(5),
-# local(8), relocated(5) and virtual(5) for the effects this has on
-# aliases, canonical, virtual, relocated and .forward file lookups.
-# Basically, the software tries user+foo and .forward+foo before
-# trying user and .forward.
-#
-#recipient_delimiter = +
-
-# DELIVERY TO MAILBOX
-#
-# The home_mailbox parameter specifies the optional pathname of a
-# mailbox file relative to a user's home directory. The default
-# mailbox file is /var/spool/mail/user or /var/mail/user.  Specify
-# "Maildir/" for qmail-style delivery (the / is required).
-#
-#home_mailbox = Mailbox
-#home_mailbox = Maildir/
-
-# The mail_spool_directory parameter specifies the directory where
-# UNIX-style mailboxes are kept. The default setting depends on the
-# system type.
-#
-#mail_spool_directory = /var/mail
-#mail_spool_directory = /var/spool/mail
-
-# The mailbox_command parameter specifies the optional external
-# command to use instead of mailbox delivery. The command is run as
-# the recipient with proper HOME, SHELL and LOGNAME environment settings.
-# Exception:  delivery for root is done as $default_user.
-#
-# Other environment variables of interest: USER (recipient username),
-# EXTENSION (address extension), DOMAIN (domain part of address),
-# and LOCAL (the address localpart).
-#
-# Unlike other Postfix configuration parameters, the mailbox_command
-# parameter is not subjected to $parameter substitutions. This is to
-# make it easier to specify shell syntax (see example below).
-#
-# Avoid shell meta characters because they will force Postfix to run
-# an expensive shell process. Procmail alone is expensive enough.
-#
-# IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN
-# ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER.
-#
-#mailbox_command = /some/where/procmail
-#mailbox_command = /some/where/procmail -a "$EXTENSION"
-
-# The mailbox_transport specifies the optional transport in master.cf
-# to use after processing aliases and .forward files. This parameter
-# has precedence over the mailbox_command, fallback_transport and
-# luser_relay parameters.
-#
-# Specify a string of the form transport:nexthop, where transport is
-# the name of a mail delivery transport defined in master.cf.  The
-# :nexthop part is optional. For more details see the sample transport
-# configuration file.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must update the "local_recipient_maps" setting in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-# Cyrus IMAP over LMTP. Specify ``lmtpunix      cmd="lmtpd"
-# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
-#mailbox_transport = lmtp:unix:/var/imap/socket/lmtp
-#
-# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and
-# subsequent line in master.cf.
-#mailbox_transport = cyrus
-
-# The fallback_transport specifies the optional transport in master.cf
-# to use for recipients that are not found in the UNIX passwd database.
-# This parameter has precedence over the luser_relay parameter.
-#
-# Specify a string of the form transport:nexthop, where transport is
-# the name of a mail delivery transport defined in master.cf.  The
-# :nexthop part is optional. For more details see the sample transport
-# configuration file.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must update the "local_recipient_maps" setting in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-#fallback_transport = lmtp:unix:/file/name
-#fallback_transport = cyrus
-#fallback_transport =
-
-# The luser_relay parameter specifies an optional destination address
-# for unknown recipients.  By default, mail for unknown@$mydestination,
-# unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned
-# as undeliverable.
-#
-# The following expansions are done on luser_relay: $user (recipient
-# username), $shell (recipient shell), $home (recipient home directory),
-# $recipient (full recipient address), $extension (recipient address
-# extension), $domain (recipient domain), $local (entire recipient
-# localpart), $recipient_delimiter. Specify ${name?value} or
-# ${name:value} to expand value only when $name does (does not) exist.
-#
-# luser_relay works only for the default Postfix local delivery agent.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must specify "local_recipient_maps =" (i.e. empty) in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-#luser_relay = $user@other.host
-#luser_relay = $local@other.host
-#luser_relay = admin+$local
-
-# JUNK MAIL CONTROLS
-#
-# The controls listed here are only a very small subset. The file
-# SMTPD_ACCESS_README provides an overview.
-
-# The header_checks parameter specifies an optional table with patterns
-# that each logical message header is matched against, including
-# headers that span multiple physical lines.
-#
-# By default, these patterns also apply to MIME headers and to the
-# headers of attached messages. With older Postfix versions, MIME and
-# attached message headers were treated as body text.
-#
-# For details, see "man header_checks".
-#
-#header_checks = regexp:/etc/postfix/header_checks
-
-# FAST ETRN SERVICE
-#
-# Postfix maintains per-destination logfiles with information about
-# deferred mail, so that mail can be flushed quickly with the SMTP
-# "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld".
-# See the ETRN_README document for a detailed description.
-#
-# The fast_flush_domains parameter controls what destinations are
-# eligible for this service. By default, they are all domains that
-# this server is willing to relay mail to.
-#
-#fast_flush_domains = $relay_domains
-
-# SHOW SOFTWARE VERSION OR NOT
-#
-# The smtpd_banner parameter specifies the text that follows the 220
-# code in the SMTP server's greeting banner. Some people like to see
-# the mail version advertised. By default, Postfix shows no version.
-#
-# You MUST specify $myhostname at the start of the text. That is an
-# RFC requirement. Postfix itself does not care.
-#
-#smtpd_banner = $myhostname ESMTP $mail_name
-#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
-
-# PARALLEL DELIVERY TO THE SAME DESTINATION
-#
-# How many parallel deliveries to the same user or domain? With local
-# delivery, it does not make sense to do massively parallel delivery
-# to the same user, because mailbox updates must happen sequentially,
-# and expensive pipelines in .forward files can cause disasters when
-# too many are run at the same time. With SMTP deliveries, 10
-# simultaneous connections to the same domain could be sufficient to
-# raise eyebrows.
-#
-# Each message delivery transport has its XXX_destination_concurrency_limit
-# parameter.  The default is $default_destination_concurrency_limit for
-# most delivery transports. For the local delivery agent the default is 2.
-
-#local_destination_concurrency_limit = 2
-#default_destination_concurrency_limit = 20
-
-# DEBUGGING CONTROL
-#
-# The debug_peer_level parameter specifies the increment in verbose
-# logging level when an SMTP client or server host name or address
-# matches a pattern in the debug_peer_list parameter.
-#
-debug_peer_level = 2
-
-# The debug_peer_list parameter specifies an optional list of domain
-# or network patterns, /file/name patterns or type:name tables. When
-# an SMTP client or server host name or address matches a pattern,
-# increase the verbose logging level by the amount specified in the
-# debug_peer_level parameter.
-#
-#debug_peer_list = 127.0.0.1
-#debug_peer_list = some.domain
-
-# The debugger_command specifies the external command that is executed
-# when a Postfix daemon program is run with the -D option.
-#
-# Use "command .. & sleep 5" so that the debugger can attach before
-# the process marches on. If you use an X-based debugger, be sure to
-# set up your XAUTHORITY environment variable before starting Postfix.
-#
-debugger_command =
-  PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
-  ddd $daemon_directory/$process_name $process_id & sleep 5
-
-# If you can't use X, use this to capture the call stack when a
-# daemon crashes. The result is in a file in the configuration
-# directory, and is named after the process name and the process ID.
-#
-# debugger_command =
-#	PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont;
-#	echo where) | gdb $daemon_directory/$process_name $process_id 2>&1
-#	>$config_directory/$process_name.$process_id.log & sleep 5
-#
-# Another possibility is to run gdb under a detached screen session.
-# To attach to the screen session, su root and run "screen -r
-# <id_string>" where <id_string> uniquely matches one of the detached
-# sessions (from "screen -list").
-#
-# debugger_command =
-#	PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen
-#	-dmS $process_name gdb $daemon_directory/$process_name
-#	$process_id & sleep 1
-
-# INSTALL-TIME CONFIGURATION INFORMATION
-#
-# The following parameters are used when installing a new Postfix version.
-#
-# sendmail_path: The full pathname of the Postfix sendmail command.
-# This is the Sendmail-compatible mail posting interface.
-#
-sendmail_path = /usr/sbin/sendmail
-
-# newaliases_path: The full pathname of the Postfix newaliases command.
-# This is the Sendmail-compatible command to build alias databases.
-#
-newaliases_path = /usr/bin/newaliases
-
-# mailq_path: The full pathname of the Postfix mailq command.  This
-# is the Sendmail-compatible mail queue listing command.
-#
-mailq_path = /usr/bin/mailq
-
-# setgid_group: The group for mail submission and queue management
-# commands.  This must be a group name with a numerical group ID that
-# is not shared with other accounts, not even with the Postfix account.
-#
-setgid_group = postdrop
-
-# html_directory: The location of the Postfix HTML documentation.
-#
-html_directory = no
-
-# manpage_directory: The location of the Postfix on-line manual pages.
-#
-manpage_directory = /usr/share/man
-
-# sample_directory: The location of the Postfix sample configuration files.
-# This parameter is obsolete as of Postfix 2.1.
-#
-sample_directory = /etc/postfix
-
-# readme_directory: The location of the Postfix README files.
-#
-readme_directory = /usr/share/doc/postfix/readme
-inet_protocols = ipv4
-meta_directory = /etc/postfix
-shlib_directory = /usr/lib/postfix
-
-
-# Config below taken and adapted from
-# https://github.com/maxking/docker-mailman#postfix
-recipient_delimiter = +
-unknown_local_recipient_reject_code = 550
-owner_request_special = no
-
-transport_maps =
-    regexp:/var/lib/mailman/core/var/data/postfix_lmtp
-local_recipient_maps =
-    regexp:/var/lib/mailman/core/var/data/postfix_lmtp
-relay_domains =
-    regexp:/var/lib/mailman/core/var/data/postfix_domains

hosts/0001/triton-vmtools.nix

@@ -1,9 +0,0 @@
-{
-  pkgs,
-  inputs,
-  ...
-}: {
-  environment.systemPackages = with pkgs; [
-    inputs.triton-vmtools.packages.${pkgs.system}.default
-  ];
-}

hosts/PubSolarOS.nix

@@ -1,15 +1,17 @@
-{suites, ...}: {
+{ suites, ... }:
+{
   ### root password is empty by default ###
   ### default password: pub-solar, optional: add your SSH keys
-  imports =
-    suites.iso;
+  imports = suites.iso;
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
   networking.networkmanager.enable = true;
 
-  fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+  };
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions

hosts/bootstrap.nix

@@ -5,18 +5,21 @@
   profiles,
   ...
 }:
-with lib; let
+let
+  inherit (lib) mkForce;
+
   # Gets hostname of host to be bundled inside iso
   # Copied from https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L3-L11
-  getFqdn = config: let
-    net = config.networking;
-    fqdn =
-      if (net ? domain) && (net.domain != null)
-      then "${net.hostName}.${net.domain}"
-      else net.hostName;
-  in
+  getFqdn =
+    config:
+    let
+      net = config.networking;
+      fqdn =
+        if (net ? domain) && (net.domain != null) then "${net.hostName}.${net.domain}" else net.hostName;
+    in
     fqdn;
-in {
+in
+{
   # build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
   imports = [
     # profiles.networking
@@ -31,7 +34,9 @@ in {
     boot.loader.systemd-boot.enable = true;
 
     # will be overridden by the bootstrapIso instrumentation
-    fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+    };
 
     system.nixos.label = "PubSolarOS-" + config.system.nixos.version;
 

hosts/default.nix

@@ -0,0 +1,155 @@
+{
+  withSystem,
+  self,
+  inputs,
+  config,
+  ...
+}:
+{
+  flake = {
+    nixosModules = {
+      home-manager = {
+        imports = [
+          inputs.home-manager.nixosModules.home-manager
+          ({
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.extraSpecialArgs = {
+              flake = {
+                inherit self inputs config;
+              };
+            };
+          })
+        ];
+      };
+    };
+    nixosConfigurations = {
+      dumpyourvms = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
+          self.nixosModules.base
+          ./dumpyourvms
+          self.nixosModules.teutat3s
+          self.nixosModules.audio
+          self.nixosModules.bluetooth
+          self.nixosModules.desktop-extended
+          self.nixosModules.docker
+          self.nixosModules.graphical
+          self.nixosModules.nextcloud
+          self.nixosModules.office
+          self.nixosModules.printing
+        ];
+      };
+
+      ryzensun = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
+          self.nixosModules.base
+          ./ryzensun
+          self.nixosModules.teutat3s
+          self.nixosModules.audio
+          self.nixosModules.desktop-extended
+          self.nixosModules.docker
+          self.nixosModules.forgejo-actions-runner
+          self.nixosModules.graphical
+          self.nixosModules.office
+          self.nixosModules.printing
+          self.nixosModules.virtualisation
+        ];
+      };
+
+      fae = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
+          self.nixosModules.base
+          inputs.nixos-hardware.nixosModules.raspberry-pi-4
+          ./fae
+          self.nixosModules.pub-solar
+          self.nixosModules.acme
+          self.nixosModules.invoiceplane
+          self.nixosModules.actual
+        ];
+      };
+
+      #powder = self.inputs.nixpkgs.lib.nixosSystem {
+      #  specialArgs = {
+      #    flake = {
+      #      inherit self inputs config;
+      #    };
+      #  };
+      #  modules = [
+      #    self.nixosModules.base
+      #    inputs.nixos-hardware.nixosModules.raspberry-pi-4
+      #    ./powder
+      #    self.nixosModules.teutat3s
+      #    self.nixosModules.docker
+      #    self.nixosModules.wireguard-client
+      #    self.nixosModules.invoiceplane
+      #  ];
+      #};
+
+      iso = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
+          "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
+          self.nixosModules.base
+          ./iso
+          self.nixosModules.nixos
+        ];
+      };
+
+      iso-arm = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
+          "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
+          self.nixosModules.base
+          ./iso
+          self.nixosModules.nixos
+        ];
+      };
+
+      iso-graphical = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
+          "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
+          self.nixosModules.base
+          ./iso
+          self.nixosModules.nixos
+          self.nixosModules.graphical
+          self.nixosModules.audio
+          self.nixosModules.bluetooth
+          (
+            { ... }:
+            {
+              pub-solar.graphical.wayland.software-renderer.enable = true;
+            }
+          )
+        ];
+      };
+    };
+  };
+}

hosts/dumpyourvms/.config/sway/config.d/applications.conf

@@ -0,0 +1,12 @@
+# seahorse
+for_window [title="seahorse"] floating enabled
+
+# NetworkManager
+for_window [app_id="nm-connection-editor"] floating enabled
+
+# thunderbird
+for_window [title="New Task:*"] floating enabled
+for_window [title="Edit Task:*"] floating enabled
+for_window [title="New Event:*"] floating enabled
+for_window [title="Edit Event:*"] floating enabled
+

hosts/dumpyourvms/.config/sway/config.d/autostart.conf

@@ -0,0 +1,6 @@
+# Autostart applications
+#
+# Example:
+# exec swayidle
+
+exec qMasterPassword

hosts/dumpyourvms/.config/sway/config.d/custom-keybindings.conf

@@ -0,0 +1,3 @@
+# switch keyboard input language
+bindsym $mod+tab exec swaymsg input "1452:628:Apple_Inc._Apple_Internal_Keyboard_/_Trackpad" xkb_switch_layout next
+

hosts/dumpyourvms/.config/sway/config.d/input-defaults.conf

@@ -0,0 +1,37 @@
+### Input configuration
+#
+# You can get the names of your inputs by running: swaymsg -t get_inputs
+# Read `man 5 sway-input` for more information about this section.
+
+input "type:keyboard" {
+  xkb_layout us(intl),de
+  xkb_model pc105
+  xkb_options ctrl:nocaps
+}
+
+input "type:touchpad" {
+  tap enabled
+  natural_scroll enabled
+  # Disable while typing
+  dwt enabled
+}
+
+# Touchpad controls
+#bindsym XF86TouchpadToggle exec $HOME/Workspace/ben/toggletouchpad.sh # toggle touchpad
+
+# Screen brightness controls
+bindsym XF86MonBrightnessUp exec "brightnessctl -d acpi_video0 set +10%"
+bindsym XF86MonBrightnessDown exec "brightnessctl -d acpi_video0 set 10%-"
+
+# Keyboard backlight brightness controls
+bindsym XF86KbdBrightnessDown exec "brightnessctl -d smc::kbd_backlight set 10%-"
+bindsym XF86KbdBrightnessUp exec "brightnessctl -d smc::kbd_backlight set +10%"
+
+# Pulse Audio controls
+bindsym XF86AudioRaiseVolume exec pactl set-sink-volume @DEFAULT_SINK@ +5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #increase sound volume
+bindsym XF86AudioLowerVolume exec pactl set-sink-volume @DEFAULT_SINK@ -5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #decrease sound volume
+bindsym XF86AudioMute exec pactl set-sink-mute @DEFAULT_SINK@ toggle # mute sound
+# Media player controls
+bindsym XF86AudioPlay exec "playerctl play-pause; notify-send 'Play/Pause'"
+bindsym XF86AudioNext exec "playerctl next; notify-send 'Next'"
+bindsym XF86AudioPrev exec "playerctl previous; notify-send 'Prev.'"

hosts/dumpyourvms/.config/sway/config.d/screens.conf

@@ -0,0 +1,39 @@
+### Output configuration
+#
+# Example configuration:
+#
+#   output HDMI-A-1 resolution 1920x1080 position 1920,0
+#
+# You can get the names of your outputs by running: swaymsg -t get_outputs
+
+set $main_screen eDP-1
+set $displayport DP-3
+set $hmdi HDMI-A-1
+
+output $main_screen scale 1.7
+output $displayport scale 1
+
+output $main_screen position 0 1440
+output $displayport position 0 0 resolution 2560x1440@60Hz
+
+#bindswitch lid:on output $main_screen disable
+#bindswitch lid:off output $main_screen enable
+bindsym $mod+Shift+x output $main_screen toggle
+
+# TODO when using more monitors
+## Manual management of external displays
+# Set the shortcuts and what they do
+#set $mode_display HDMI (i) top, (j) left, (k) bottom, (l) right, (o) off
+#mode "$mode_display" {
+#    bindsym i output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 1080, mode "default"
+#    bindsym j output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 1920 0, mode "default"
+#    bindsym k output HDMI-A-1 enable; output HDMI-A-1 pos 0 900 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym l output HDMI-A-1 enable; output HDMI-A-1 pos 1440 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym o output HDMI-A-1 disable, mode "default"
+#
+#    # back to normal: Enter or Escape
+#    bindsym Return mode "default"
+#    bindsym Escape mode "default"
+#}
+## Declare here the shortcut to bring the display selection menu
+#bindsym $mod+x mode "$mode_display"

hosts/dumpyourvms/consul-agent-ca.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDbzCCAxSgAwIBAgIRAMK20/fFF0YVThq8xm/YvBswCgYIKoZIzj0EAwIwgbkx
+CzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNj
+bzEaMBgGA1UECRMRMTAxIFNlY29uZCBTdHJlZXQxDjAMBgNVBBETBTk0MTA1MRcw
+FQYDVQQKEw5IYXNoaUNvcnAgSW5jLjFAMD4GA1UEAxM3Q29uc3VsIEFnZW50IENB
+IDI1ODgxOTUyODQyOTMwNjIxMjY4NDgwMTUxODE3OTM2NjUxNzc4NzAeFw0xOTEx
+MDYwMDI3MzVaFw0yNDExMDQwMDI3MzVaMIG5MQswCQYDVQQGEwJVUzELMAkGA1UE
+CBMCQ0ExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xGjAYBgNVBAkTETEwMSBTZWNv
+bmQgU3RyZWV0MQ4wDAYDVQQREwU5NDEwNTEXMBUGA1UEChMOSGFzaGlDb3JwIElu
+Yy4xQDA+BgNVBAMTN0NvbnN1bCBBZ2VudCBDQSAyNTg4MTk1Mjg0MjkzMDYyMTI2
+ODQ4MDE1MTgxNzkzNjY1MTc3ODcwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQE
+SZ2kc9rKUNX3czze+rFR/bZdLx3JEYrpcSXKkpv1wr68E1Jqhi/8Dm8b62Ei/Bc6
+ZhoJvtB2Shtl+6LbjccUo4H6MIH3MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8E
+BTADAQH/MGgGA1UdDgRhBF9hZjo4MzoyZTpiOToyZTozMzo5MDplOTpkMjpiNzpj
+NjpjYzpkYToxODoyYTphNzpjMzo5ZTozMTpmNTpkZTo4Mzo4YzozMDo0Mjo3OTo4
+ZDo0ZDpmZDozMjo2NzpiYjBqBgNVHSMEYzBhgF9hZjo4MzoyZTpiOToyZTozMzo5
+MDplOTpkMjpiNzpjNjpjYzpkYToxODoyYTphNzpjMzo5ZTozMTpmNTpkZTo4Mzo4
+YzozMDo0Mjo3OTo4ZDo0ZDpmZDozMjo2NzpiYjAKBggqhkjOPQQDAgNJADBGAiEA
+zKCV25P6HqFEa1iUVQnsNAp/WHUwxNlR0OctZSdiuIkCIQDiRK03ZYSK/hmY9kXV
+42nj6kO8MexfiYN4IE4URmzYnA==
+-----END CERTIFICATE-----

hosts/dumpyourvms/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./dumpyourvms.nix
+    ./hardware-configuration.nix
+
+    ./networking.nix
+  ];
+}

hosts/dumpyourvms/dumpyourvms.nix

@@ -0,0 +1,189 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in
+{
+  pub-solar = {
+    terminal-life.full = true;
+    core.hibernation = {
+      enable = true;
+      resumeDevice = "/dev/mapper/cryptroot";
+      resumeOffset = 47366144;
+    };
+  };
+
+  # Fix backlight for keyboard and brightness, adjust function key binding,
+  # intel_pstate for cpu schedutil
+  # For now, the radeon driver seems to work better than amdgpu with Radeon R9 M370X
+  # Explicitly set amdgpu support in place of radeon
+  # Source: https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/southern-islands/default.nix
+  # Try again after https://lists.freedesktop.org/archives/amd-gfx/2023-March/090096.html lands
+  boot.kernelParams = [
+    "acpi_backlight=video"
+    "hid_apple.fnmode=2"
+    "intel_pstate=active"
+    "radeon.si_support=0"
+    "amdgpu.si_support=1"
+  ];
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Fix for Error switching console mode to 1: unsupported on startup
+  boot.loader.systemd-boot.consoleMode = lib.mkForce "0";
+
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  systemd.sleep.extraConfig = ''
+    HibernateMode=shutdown
+  '';
+
+  hardware = {
+    cpu.intel.updateMicrocode = true;
+    facetimehd.enable = true;
+    graphics = {
+      extraPackages = with pkgs; [ intel-vaapi-driver ]; # i7-4870HQ older hardware like haswell (crystall well)
+      extraPackages32 = with pkgs.pkgsi686Linux; [ intel-vaapi-driver ];
+    };
+  };
+
+  services.fstrim.enable = true;
+
+  networking.hostName = "dumpyourvms";
+
+  services.resolved = {
+    enable = true;
+    extraConfig = ''
+      DNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 5.9.164.112#dns3.digitalcourage.de 89.233.43.71#unicast.censurfridns.dk 185.49.141.37#getdnsapi.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net 2a01:4f8:251:554::2#dns3.digitalcourage.de 2a01:3a0:53:53::0#unicast.censurfridns.dk 2a04:b900:0:100::38#getdnsapi.net
+      FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
+      Domains=~.
+      DNSOverTLS=yes
+    '';
+  };
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+  };
+  services.usbmuxd.enable = true;
+
+  #programs.droidcam.enable = true;
+  #services.mozillavpn.enable = true;
+
+  security.pki.certificateFiles = [ ./consul-agent-ca.pem ];
+
+  # Power off dedicated GPU, use only integrated Intel GPU to save battery
+  # https://github.com/NixOS/nixpkgs/pull/33915
+  # https://ubuntuforums.org/showthread.php?t=2409856
+  systemd.services."amd-hybrid-graphics-power-save" = {
+    path = [ pkgs.bash ];
+    description = "Power Off dedicated AMD Card to reduce power usage";
+    requires = [ "sys-kernel-debug.mount" ];
+    enable = true;
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.bash}/bin/sh -c 'sleep 7 && if grep --quiet 'IGD:+' /sys/kernel/debug/vgaswitcheroo/switch; then echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch; fi'";
+      ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch'";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  # Increase console font size for HiDPI display
+  console = {
+    earlySetup = true;
+    font = lib.mkForce "ter-i32b";
+    packages = [ pkgs.terminus_font ];
+  };
+
+  # Thunderbolt tools
+  services.hardware.bolt.enable = true;
+
+  # Enable udev rules for gnupg smart cards
+  hardware.gpgSmartcards.enable = true;
+
+  hardware.keyboard.uhk.enable = true;
+
+  powerManagement = {
+    # brcmfmac being loaded during hibernation would inhibit a successful resume
+    # https://bugzilla.kernel.org/show_bug.cgi?id=101681#c116.
+    # Also brcmfmac could randomly crash on resume from sleep.
+    # To hibernate successfully using the amdgpu driver, the dedicated GPU needs
+    # to be powered on.
+    powerUpCommands = lib.mkBefore (
+      "${pkgs.kmod}/bin/modprobe brcmfmac"
+      + lib.optionalString (lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2") " brcmfmac_wcc"
+    );
+    powerDownCommands = lib.mkBefore (
+      lib.optionalString (lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2") "${pkgs.kmod}/bin/rmmod brcmfmac_wcc\n"
+      + ''
+        ${pkgs.kmod}/bin/rmmod brcmfmac
+        ${pkgs.systemd}/bin/systemctl stop amd-hybrid-graphics-power-save.service
+      ''
+    );
+    resumeCommands =
+      if config.systemd.services."amd-hybrid-graphics-power-save".enable == true then
+        ''
+          ${pkgs.systemd}/bin/systemctl start amd-hybrid-graphics-power-save.service
+        ''
+      else
+        "";
+  };
+
+  # Change lid switch behaviour
+  services.logind.lidSwitch = "hibernate";
+
+  # Power management
+  services.power-profiles-daemon.enable = true;
+
+  services.udev.extraRules =
+    # Disable XHC1 wakeup signal to avoid resume getting triggered some time
+    # after suspend. Reboot required for this to take effect.
+    lib.optionalString (lib.versionAtLeast config.boot.kernelPackages.kernel.version "3.13")
+      ''SUBSYSTEM=="pci", KERNEL=="0000:00:14.0", ATTR{power/wakeup}="disabled"'';
+
+  home-manager =
+    pkgs.lib.setAttrByPath
+      [
+        "users"
+        psCfg.user.name
+      ]
+      {
+        # Custom device sway configs
+        xdg.configFile = {
+          "sway/config.d/10-applications.conf".source = ./.config/sway/config.d/applications.conf;
+          "sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
+          "sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
+          "sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
+          "sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
+        };
+      };
+
+  # WLAN frequency compliance (e.g. check for radar with DFS)
+  hardware.firmware = with pkgs; [ wireless-regdb ];
+  boot.extraModprobeConfig = ''
+    options cfg80211 ieee80211_regdom="DE"
+
+    # Enable the integrated GPU (iGPU) Intel i915 by default if present
+    options apple-gmux force_igd=y
+
+    # Enable HD-Audio Codec-Specific Models
+    # https://www.kernel.org/doc/html/latest/sound/hd-audio/models.html
+    options snd-hda-intel model=mbp11
+
+    # https://bbs.archlinux.org/viewtopic.php?pid=1445636#p1445636
+    #
+    options snd-hda-intel index=1
+  '';
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
+}

hosts/dumpyourvms/hardware-configuration.nix

@@ -0,0 +1,48 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    #(modulesPath + "/hardware/network/broadcom-43xx.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/17bbb016-d27c-47da-8805-58c6395891e8";
+    fsType = "ext4";
+  };
+
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/c100b9a7-99d7-44d9-b7c2-3892a5f233c4";
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/06B8-5414";
+    fsType = "vfat";
+  };
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 18432;
+    }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/dumpyourvms/networking.nix

@@ -0,0 +1,286 @@
+{ pkgs, lib, ... }:
+{
+  systemd.services.wg-quick-wg5.serviceConfig.Type = lib.mkForce "simple";
+  systemd.services.wg-quick-wg5.serviceConfig.Restart = "on-failure";
+  systemd.services.wg-quick-wg5.serviceConfig.RestartSec = "5s";
+
+  systemd.services.NetworkManager-wait-online.enable = true;
+
+  networking = {
+    networkmanager.dns = "systemd-resolved";
+
+    #networkmanager.dispatcherScripts = [
+    #  { source = "${pkgs.prison-break}/bin/prison-break"; }
+    #];
+
+    hosts = {
+      "10.0.0.42" = [
+        "nomad.service.consul"
+        "nomad.service.cgn-1.consul"
+      ];
+      "10.0.0.66" = [ "consul.service.cgn-1.consul" ];
+      "10.0.1.9" = [ "consul.service.lev-1.consul" ];
+      "10.0.0.70" = [
+        "vault.service.consul"
+        "vault.service.cgn-1.consul"
+      ];
+      "10.0.0.200" = [ "headnode.cgn-1" ];
+      "10.0.0.201" = [ "cn01.cgn-1" ];
+      "10.0.0.202" = [ "cn02.cgn-1" ];
+      "10.0.0.205" = [ "cn05.cgn-1" ];
+      "10.0.0.206" = [ "cn06.cgn-1" ];
+      "10.0.0.207" = [ "cn07.cgn-1" ];
+      "10.0.0.208" = [ "cn08.cgn-1" ];
+      "10.0.1.200" = [ "headnode.lev-1" ];
+      "10.0.1.201" = [ "cn01.lev-1" ];
+      "10.0.1.202" = [ "cn02.lev-1" ];
+      "10.0.1.203" = [ "cn03.lev-1" ];
+      "10.0.1.204" = [ "cn04.lev-1" ];
+      "10.0.1.205" = [ "cn05.lev-1" ];
+      "10.0.1.206" = [ "cn00.lev-1" ];
+      "10.0.1.207" = [ "cn06.lev-1" ];
+      "10.0.1.208" = [ "cn07.lev-1" ];
+      "10.101.64.10" = [ "wifi.bahn.de" ];
+      "192.168.13.25" = [
+        "ryzensun.local"
+        "cloudapi.coal-1.mnx.io"
+      ];
+    };
+
+    wireguard.enable = true;
+    wg-quick.interfaces = {
+      wg0 = {
+        autostart = false;
+        address = [ "10.8.8.6/32" ];
+        privateKeyFile = "/etc/wireguard/wg0.privatekey";
+
+        peers = [
+          {
+            publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
+            allowedIPs = [
+              "10.8.8.16/32"
+              "10.0.0.0/24"
+              "10.88.88.0/24"
+            ];
+            endpoint = "85.88.23.16:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+      wg1 = {
+        autostart = false;
+        address = [ "192.168.188.203/24" ];
+        privateKeyFile = "/etc/wireguard/wg1.privatekey";
+
+        peers = [
+          {
+            publicKey = "iZkgeA/mFxBRclCa5SJYdqffClly/uho5krebcUloCY=";
+            allowedIPs = [ "192.168.188.0/24" ];
+            presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
+            #endpoint = "85.214.70.91:50163";
+            #endpoint = "u7dazg4ceu9dggxa.myfritz.net:50163";
+            endpoint = "[2a00:6020:1000:47::2ded]:50163";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+      wg2 = {
+        autostart = false;
+        address = [ "10.6.6.4/32" ];
+        privateKeyFile = "/etc/wireguard/wg2.privatekey";
+
+        peers = [
+          {
+            publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
+            presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
+            allowedIPs = [
+              "10.6.6.1/32"
+              "10.1.1.0/24"
+            ];
+            endpoint = "85.88.23.127:51820";
+            persistentKeepalive = 16;
+          }
+        ];
+      };
+      wg3 = {
+        autostart = false;
+        address = [ "10.11.11.2/32" ];
+        privateKeyFile = "/etc/wireguard/wg3.privatekey";
+        mtu = 1300;
+
+        peers = [
+          {
+            publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
+            presharedKeyFile = "/etc/wireguard/wg3.presharedkey";
+            allowedIPs = [
+              "10.11.11.0/24"
+              "192.168.1.0/24"
+              "10.0.1.0/24"
+            ];
+            endpoint = "80.71.153.1:51820";
+            persistentKeepalive = 16;
+          }
+        ];
+      };
+      wg4 = {
+        address = [ "fdaa:1:3234:a7b:16a9:0:a:202/120" ];
+        privateKeyFile = "/etc/wireguard/wg4.privatekey";
+        postUp = "resolvectl dns wg4 fdaa:1:3234::3; resolvectl domain wg4 ~internal";
+        preDown = "resolvectl revert wg4";
+        #dns = [
+        #  "fdaa:1:3234::3, internal"
+        #];
+
+        peers = [
+          {
+            publicKey = "yUyg63j5+17YeJ7gRhxoQuF6rvdX0JF59M6skytJFTQ=";
+            allowedIPs = [ "fdaa:1:3234::/48" ];
+            #endpoint = "ams1.gateway.6pn.dev:51820";
+            endpoint = "176.58.93.206:51820";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+      wg5 = {
+        autostart = false;
+        address = [ "192.168.13.201/24" ];
+        privateKeyFile = "/etc/wireguard/wg5.privatekey";
+        postUp = "resolvectl dnsovertls wg5 no; resolvectl dns wg5 192.168.13.1; resolvectl domain wg5 ~fritz.box";
+        preDown = "resolvectl revert wg5";
+
+        peers = [
+          {
+            publicKey = "UhPW8jebAPaMYqjJfSFO9QAMhk0E+dq4i6lB4Wjg91Q=";
+            presharedKeyFile = "/etc/wireguard/wg5.presharedkey";
+            allowedIPs = [ "192.168.13.0/24" ];
+            endpoint = "svxqr7qjmk9beu7t.myfritz.net:59538";
+            #endpoint = "84.44.134.172:59538";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+      wg6 = {
+        address = [
+          "10.7.6.201/32"
+          "fd00:fae:fae:fae:fae:201::/96"
+        ];
+        privateKeyFile = "/etc/wireguard/wg6.privatekey";
+
+        peers = [
+          {
+            # nachtigall.pub.solar
+            publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
+            allowedIPs = [
+              "10.7.6.1/32"
+              "fd00:fae:fae:fae:fae:1::/96"
+            ];
+            #endpoint = "138.201.80.102:51820";
+            endpoint = "[2a01:4f8:172:1c25::1]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # metronom.pub.solar
+            publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
+            allowedIPs = [
+              "10.7.6.3/32"
+              "fd00:fae:fae:fae:fae:3::/96"
+            ];
+            endpoint = "49.13.236.167:51820";
+            #endpoint = "[2a01:4f8:c2c:7082::]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # tankstelle.pub.solar
+            publicKey = "iRTlY1lB7nPXf2eXzX8ZZDkfMmXyGjff5/joccbP8Cg=";
+            allowedIPs = [
+              "10.7.6.4/32"
+              "fd00:fae:fae:fae:fae:4::/96"
+            ];
+            #endpoint = "80.244.242.5:51820";
+            endpoint = "[2001:4d88:1ffa:26::5]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # trinkgenossin.pub.solar
+            publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
+            allowedIPs = [
+              "10.7.6.5/32"
+              "fd00:fae:fae:fae:fae:5::/96"
+            ];
+            #endpoint = "85.215.152.22:51820";
+            endpoint = "[2a01:239:35d:f500::1]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # delite.pub.solar
+            publicKey = "ZT2qGWgMPwHRUOZmTQHWCRX4m14YwOsiszjsA5bpc2k=";
+            allowedIPs = [
+              "10.7.6.6/32"
+              "fd00:fae:fae:fae:fae:6::/96"
+            ];
+            #endpoint = "80.244.242.5:51820";
+            endpoint = "[2a04:52c0:124:9d8c::2]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # blue-shell.pub.solar
+            publicKey = "bcrIpWrKc1M+Hq4ds3aN1lTaKE26f2rvXhd+93QrzR8=";
+            allowedIPs = [
+              "10.7.6.7/32"
+              "fd00:fae:fae:fae:fae:7::/96"
+            ];
+            #endpoint = "80.244.242.5:51820";
+            endpoint = "[2a03:4000:43:24e::1]:51820";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+      wg7 = {
+        address = [
+          "10.30.30.201/32"
+          "fd00:3030:3030:3030:3030:201::/96"
+        ];
+        privateKeyFile = "/etc/wireguard/wg7.privatekey";
+
+        peers = [
+          {
+            # pioneer.momo.koeln
+            publicKey = "W9Vn2yv+AZjOD7sqKp4DyMbIz5N++Vjlr+6J3BnXj3o=";
+            allowedIPs = [
+              "10.30.30.1/32"
+              "fd00:3030:3030:3030:3030:1::/96"
+            ];
+            #endpoint = "80.244.242.4:51820";
+            endpoint = "[2001:4d88:1ffa:26::4]:51820";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+      # mozillavpn
+      moz0 = {
+        autostart = false;
+        address = [
+          "10.142.131.196/32"
+          "fc00:bbbb:bbbb:bb01:d:0:e:83c4/128"
+        ];
+        privateKeyFile = "/etc/wireguard/moz0.privatekey";
+        #postUp = "resolvectl dns wg4 fdaa:1:3234::3; resolvectl domain wg4 ~internal";
+        #preDown = "resolvectl revert wg4";
+        #dns = [
+        #  "fdaa:1:3234::3, internal"
+        #];
+
+        peers = [
+          {
+            publicKey = "ku1NYeOAGbY65YL/JKZhrqVzDJKXQiVj9USXbfkOBA0=";
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::/0"
+            ];
+            endpoint = "185.254.75.3:36294";
+          }
+        ];
+      };
+    };
+  };
+}

hosts/dumpyourvms/unbound.nix

@@ -0,0 +1,52 @@
+{
+  enable = false;
+  localControlSocketPath = "/run/unbound/unbound.ctl";
+  settings = {
+    server = {
+      cache-max-ttl = 14400;
+      cache-min-ttl = 1200;
+      aggressive-nsec = true;
+      prefetch = false;
+      rrset-roundrobin = true;
+      use-caps-for-id = true;
+      do-ip6 = false;
+      hide-identity = true;
+      hide-version = true;
+      do-not-query-localhost = false;
+      tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt";
+    };
+
+    # fritz.box stub zone
+    stub-zone = {
+      name = "fritz.box";
+      stub-addr = "192.168.13.1";
+    };
+
+    # DNS over DLS forwarding
+    forward-zone = {
+      name = ".";
+      forward-tls-upstream = true;
+
+      forward-addr = [
+        "5.1.66.255@853#dot.ffmuc.net"
+        "185.150.99.255@853#dot.ffmuc.net"
+        "89.233.43.71@853#unicast.censurfridns.dk"
+        "94.130.110.185@853#ns1.dnsprivacy.at"
+
+        "2001:678:e68:f000::@853#dot.ffmuc.net"
+        "2001:678:ed0:f000::@853#dot.ffmuc.net"
+        "2a01:3a0:53:53::0@853#unicast.censurfridns.dk"
+        "2a01:4f8:c0c:3c03::2@853#ns1.dnsprivacy.at"
+        "2a01:4f8:c0c:3bfc::2@853#ns2.dnsprivacy.at"
+
+        "2001:610:1:40ba:145:100:185:15@853#dnsovertls.sinodun.com"
+        "2001:610:1:40ba:145:100:185:16@853#dnsovertls1.sinodun.com"
+        "2a04:b900:0:100::38@853#getdnsapi.net"
+
+        "145.100.185.15@853#dnsovertls.sinodun.com"
+        "145.100.185.16@853#dnsovertls1.sinodun.com"
+        "185.49.141.37@853#getdnsapi.net"
+      ];
+    };
+  };
+}

hosts/fae/actual.nix

@@ -0,0 +1,28 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in
+{
+  security.acme.certs = {
+    "actual.faenix.eu" = { };
+  };
+
+  services.nginx.virtualHosts = {
+    "actual.faenix.eu" = {
+      forceSSL = true;
+      useACMEHost = "actual.faenix.eu";
+      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.actual.settings.port}";
+    };
+  };
+
+  services.actual = {
+    enable = true;
+  };
+}

hosts/fae/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./actual.nix
+    ./paperless.nix
+    ./invoiceplane.nix
+    ./fae.nix
+  ];
+}

hosts/fae/fae.nix

@@ -0,0 +1,71 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  config = {
+    pub-solar.core.disk-encryption-active = false;
+
+    fileSystems = {
+      "/" = {
+        device = "/dev/disk/by-label/NIXOS_SD";
+        fsType = "ext4";
+        options = [ "noatime" ];
+      };
+    };
+
+    networking.hostName = "paperless";
+
+    services.openssh = {
+      enable = true;
+      openFirewall = true;
+      allowSFTP = true;
+    };
+
+    boot.kernelParams = [ "boot.shell_on_fail=1" ];
+
+    # Would decrease closure size, but currenly broken (cairo)
+    #environment.noXlibs = true;
+
+    nix = {
+      gc.automatic = true;
+
+      optimise.automatic = true;
+
+      settings = {
+        auto-optimise-store = true;
+        sandbox = true;
+        allowed-users = [ "@wheel" ];
+        trusted-users = [
+          "root"
+          "@wheel"
+        ];
+      };
+
+      extraOptions = ''
+        min-free = 536870912
+        keep-outputs = true
+        keep-derivations = true
+        fallback = true
+      '';
+    };
+
+    # custom raspi boot loader is already present
+    boot.loader.systemd-boot.enable = false;
+    boot.loader.grub.enable = false;
+    boot.loader.generic-extlinux-compatible.enable = true;
+    boot.kernelPackages = pkgs.linuxPackages_6_6;
+
+    nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "23.11"; # Did you read the comment?
+  };
+}

hosts/fae/invoiceplane.nix

@@ -0,0 +1,80 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+  backupDir = "/var/lib/invoiceplane/backup";
+in
+{
+  security.acme.certs = {
+    "billing.faenix.eu" = { };
+  };
+
+  services.nginx.virtualHosts = {
+    "billing.faenix.eu" = {
+      forceSSL = true;
+      useACMEHost = "billing.faenix.eu";
+    };
+  };
+
+  services.invoiceplane = {
+    webserver = "nginx";
+    sites."billing.faenix.eu" = {
+      enable = true;
+
+      invoiceTemplates = [
+        flake.self.inputs.invoiceplane-template.packages.${pkgs.system}.invoiceplane-template
+      ];
+
+      settings = {
+        IP_URL = "https://billing.faenix.eu";
+        DISABLE_SETUP = true;
+        SETUP_COMPLETED = true;
+        # Useful for debugging, logs to
+        # /var/lib/invoiceplane/<domain>/logs/
+        #ENABLE_DEBUG=true;
+      };
+
+      poolConfig = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.max_requests" = 500;
+        "pm.max_spare_servers" = 4;
+        "pm.min_spare_servers" = 2;
+        "pm.start_servers" = 2;
+        "php_admin_value[date.timezone]" = "Europe/Berlin";
+        "php_admin_value[error_log]" = "/var/lib/invoiceplane/billing.faenix.eu/logs/php-error.log";
+        "php_admin_flag[display_errors]" = "off";
+        "php_admin_flag[log_errors]" = "on";
+        "catch_workers_output" = "yes";
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [ "d '${backupDir}' 0700 root root - -" ];
+
+  services.restic.backups = {
+    invoiceplane = {
+      paths = [
+        backupDir
+        "/var/lib/invoiceplane/billing.faenix.eu"
+      ];
+      timerConfig = {
+        OnCalendar = "*-*-* 00:00:00 Etc/UTC";
+      };
+      initialize = true;
+      passwordFile = config.age.secrets."restic-password.age".path;
+      # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
+      repository = "rclone:cloud.pub.solar:/Backups/InvoicePlane";
+      backupPrepareCommand = ''
+        ${pkgs.sudo}/bin/sudo -u invoiceplane ${pkgs.mariadb-client}/bin/mariadb-dump --all-databases --user=invoiceplane > "${backupDir}/invoiceplane-mariadb-dump.sql"
+      '';
+      rcloneConfigFile = config.age.secrets."fae-rclone.conf.age".path;
+    };
+  };
+}

hosts/fae/paperless.nix

@@ -0,0 +1,107 @@
+{
+  flake,
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+
+  dataDir = "${xdg.dataHome}/Paperless";
+  backupDir = "${xdg.dataHome}/PaperlessBackup";
+  consumptionDir = "/home/${psCfg.user.name}/.local/share/scandir";
+
+in
+{
+  services.paperless = {
+    enable = true;
+    user = psCfg.user.name;
+    consumptionDir = consumptionDir;
+    dataDir = dataDir;
+    address = "127.0.0.1";
+    settings = {
+      PAPERLESS_ADMIN_USER = psCfg.user.name;
+      PAPERLESS_AUTO_LOGIN_USERNAME = psCfg.user.name;
+      PAPERLESS_URL = "https://paperless.faenix.eu";
+    };
+  };
+
+  hardware.sane = {
+    enable = true;
+    # No aarch64 support for now
+    #brscan5.enable = true;
+  };
+
+  home-manager.users."${psCfg.user.name}" = {
+    home.sessionVariables = {
+      SCANNER_OUTPUT_DIR = consumptionDir;
+    };
+    systemd.user.sessionVariables = {
+      SCANNER_OUTPUT_DIR = consumptionDir;
+    };
+  };
+
+  security.acme.certs = {
+    "paperless.faenix.eu" = { };
+  };
+
+  services.nginx = {
+    enable = true;
+
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+    clientMaxBodySize = "256m";
+
+    virtualHosts = {
+      "paperless.faenix.eu" = {
+        #listenAddresses = [
+        #  "192.168.13.35"
+        #];
+        forceSSL = true;
+        useACMEHost = "paperless.faenix.eu";
+        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.paperless.port}";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  systemd.tmpfiles.rules = [
+    "d /home/${psCfg.user.name}/.local 0700 ${psCfg.user.name} users - -"
+    "d /home/${psCfg.user.name}/.local/share 0700 ${psCfg.user.name} users - -"
+    "d '${backupDir}' 0700 ${psCfg.user.name} users - -"
+  ];
+
+  age.secrets."fae-rclone.conf.age" = {
+    file = "${flake.self}/secrets/fae-rclone.conf.age";
+    path = "/root/.config/rclone/rclone.conf";
+    mode = "400";
+  };
+
+  age.secrets."restic-password.age" = {
+    file = "${flake.self}/secrets/restic-password.age";
+    mode = "400";
+  };
+
+  services.restic.backups = {
+    paperless = {
+      paths = [ backupDir ];
+      timerConfig = {
+        OnCalendar = "*-*-* 01:00:00 Etc/UTC";
+      };
+      initialize = true;
+      passwordFile = config.age.secrets."restic-password.age".path;
+      # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
+      repository = "rclone:cloud.pub.solar:/Backups/Paperless";
+      backupPrepareCommand = "${dataDir}/paperless-manage document_exporter ${backupDir} -c -p";
+      rcloneConfigFile = config.age.secrets."fae-rclone.conf.age".path;
+    };
+  };
+}

hosts/iso/default.nix

@@ -0,0 +1,8 @@
+{ pkgs, lib, ... }:
+{
+  pub-solar.core.disk-encryption-active = false;
+  isoImage.squashfsCompression = "gzip -Xcompression-level 1";
+  systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
+  networking.networkmanager.enable = false;
+  nixpkgs.hostPlatform = "x86_64-linux";
+}

hosts/powder/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  imports = [ ./powder.nix ];
+}

hosts/powder/hardware-configuration.nix

@@ -7,13 +7,20 @@
   pkgs,
   modulesPath,
   ...
-}: {
-  imports = [];
+}:
+{
+  imports = [ ];
 
-  boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = [];
-  boot.extraModulePackages = [];
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "virtio_pci"
+    "xhci_pci"
+    "sr_mod"
+    "virtio_blk"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
     device = "/dev/disk/by-label/nixos";
@@ -35,10 +42,9 @@
     ];
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   networking.useDHCP = lib.mkDefault false;
-  networking.networkmanager.enable = lib.mkForce false;
 
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/powder/powder.nix

@@ -1,93 +1,23 @@
 {
   config,
-  latestModulesPath,
-  lib,
   inputs,
+  lib,
   pkgs,
   profiles,
-  self,
   ...
-}: let
-  psCfg = config.pub-solar;
-in {
+}:
+{
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
-    ./triton-vmtools.nix
 
-    ./caddy.nix
-    ./keycloak.nix
-    ./nextcloud.nix
-    ./gitea.nix
-    ./mailman.nix
-
-    profiles.base-user
     profiles.users.root # make sure to configure ssh keys
-    profiles.users.barkeeper
-
-    "${latestModulesPath}/services/misc/gitea.nix"
-  ];
-
-  disabledModules = [
-    "services/misc/gitea.nix"
+    profiles.users.pub-solar
+    profiles.base-user
   ];
 
   config = {
-    age.secrets.mailing-password = {
-      file = "${self}/secrets/gitea-database-password.age";
-      mode = "700";
-      owner = "root";
-    };
-
-    # # #
-    # # # pub.solar options
-    # # #
-    pub-solar.core = {
-      disk-encryption-active = false;
-      iso-options.enable = true;
-      lite = true;
-    };
-
-    pub-solar.infra-node = {
-      mailing = {
-        type = "smtp";
-        user = "admin@momo.koeln";
-        host = "mx2.greenbaum.cloud:465";
-        from = ''"pub.solar git server" <gitea@pub.solar>'';
-        passwordFile = config.age.secrets.mailing-password.path;
-      };
-    };
-
-    # Allow sudo without a password for the barkeeper user
-    security.sudo.extraRules = [
-      {
-        users = ["${psCfg.user.name}"];
-        commands = [
-          {
-            command = "ALL";
-            options = ["NOPASSWD"];
-          }
-        ];
-      }
-    ];
-
-    # Machine user for CI pipelines
-    users.users.www-user = {
-      description = "user";
-      home = "/var/nix/iso-cache";
-      useDefaultShell = true;
-      uid = 10001;
-      group = "www-user";
-      isSystemUser = true;
-      openssh.authorizedKeys.keys = [];
-    };
-
-    users.groups.www-user = {};
-
-    # # #
-    # # # Triton host specific options
-    # # # DO NOT ALTER below this line, changes might render system unbootable
-    # # #
+    pub-solar.core.iso-options.enable = true;
 
     # Use the systemd-boot EFI boot loader.
     boot.loader.systemd-boot.enable = true;
@@ -97,7 +27,7 @@ in {
     networking.hostName = lib.mkDefault "";
 
     # Set your time zone.
-    time.timeZone = "Europe/Berlin";
+    # time.timeZone = "Europe/Amsterdam";
 
     # Select internationalisation properties.
     console = {
@@ -111,6 +41,7 @@ in {
       git
       vim
       wget
+      caddy
     ];
 
     # Some programs need SUID wrappers, can be configured further or are
@@ -140,15 +71,10 @@ in {
     '';
 
     # Enable the OpenSSH daemon.
-    services.openssh = {
-      enable = true;
-      passwordAuthentication = false;
-      permitRootLogin = "no";
-    };
+    services.openssh.enable = true;
 
-    # We manage the firewall with nix, too
-    # altough triton can also manage firewall rules via the triton fwrule subcommand
-    networking.firewall.enable = true;
+    # Triton manages firewall rules via the triton fwrule subcommand
+    networking.firewall.enable = false;
 
     # This value determines the NixOS release from which the default
     # settings for stateful data, like file locations and database versions

hosts/ryzensun/.config/sway/config.d/autostart.conf

@@ -0,0 +1,6 @@
+# Autostart applications
+#
+# Example:
+# exec swayidle
+
+exec qMasterPassword

hosts/ryzensun/.config/sway/config.d/custom-keybindings.conf

@@ -0,0 +1,3 @@
+# switch keyboard input language
+#bindsym $mod+tab exec swaymsg input "1118:1896:Microsoft_Microsoft___SiderWinderTM_X4_Keyboard_Consumer_Control" xkb_switch_layout next
+bindsym $mod+tab exec swaymsg input "7504:24868:Ultimate_Gadget_Laboratories_UHK_60_v2" xkb_switch_layout next

hosts/ryzensun/.config/sway/config.d/input-defaults.conf

@@ -0,0 +1,33 @@
+### Input configuration
+#
+# You can get the names of your inputs by running: swaymsg -t get_inputs
+# Read `man 5 sway-input` for more information about this section.
+
+input "type:keyboard" {
+  xkb_layout us(intl),de
+  xkb_options ctrl:nocaps
+}
+
+input "type:touchpad" {
+  natural_scroll enabled
+}
+
+# Touchpad controls
+#bindsym XF86TouchpadToggle exec $HOME/Workspace/ben/toggletouchpad.sh # toggle touchpad
+
+# Screen brightness controls
+bindsym XF86MonBrightnessUp exec "brightnessctl -d intel_backlight set +10%"
+bindsym XF86MonBrightnessDown exec "brightnessctl -d intel_backlight set 10%-"
+
+# Keyboard backlight brightness controls
+bindsym XF86KbdBrightnessDown exec "brightnessctl -d smc::kbd_backlight set 10%-"
+bindsym XF86KbdBrightnessUp exec "brightnessctl -d smc::kbd_backlight set +10%"
+
+# Pulse Audio controls
+bindsym XF86AudioRaiseVolume exec pactl set-sink-volume @DEFAULT_SINK@ +5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #increase sound volume
+bindsym XF86AudioLowerVolume exec pactl set-sink-volume @DEFAULT_SINK@ -5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #decrease sound volume
+bindsym XF86AudioMute exec pactl set-sink-mute @DEFAULT_SINK@ toggle # mute sound
+# Media player controls
+bindsym XF86AudioPlay exec "playerctl play-pause; notify-send 'Play/Pause'"
+bindsym XF86AudioNext exec "playerctl next; notify-send 'Next'"
+bindsym XF86AudioPrev exec "playerctl previous; notify-send 'Prev.'"

hosts/ryzensun/.config/sway/config.d/screens.conf

@@ -0,0 +1,33 @@
+### Output configuration
+#
+# Example configuration:
+#
+#   output HDMI-A-1 resolution 1920x1080 position 1920,0
+#
+# You can get the names of your outputs by running: swaymsg -t get_outputs
+
+set $main_screen HDMI-A-1
+
+output $main_screen scale 1
+
+#bindswitch lid:on output $main_screen disable
+#bindswitch lid:off output $main_screen enable
+bindsym $mod+Shift+x output $main_screen toggle
+
+# TODO when using more monitors
+## Manual management of external displays
+# Set the shortcuts and what they do
+#set $mode_display HDMI (i) top, (j) left, (k) bottom, (l) right, (o) off
+#mode "$mode_display" {
+#    bindsym i output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 1080, mode "default"
+#    bindsym j output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 1920 0, mode "default"
+#    bindsym k output HDMI-A-1 enable; output HDMI-A-1 pos 0 900 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym l output HDMI-A-1 enable; output HDMI-A-1 pos 1440 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym o output HDMI-A-1 disable, mode "default"
+#
+#    # back to normal: Enter or Escape
+#    bindsym Return mode "default"
+#    bindsym Escape mode "default"
+#}
+## Declare here the shortcut to bring the display selection menu
+#bindsym $mod+x mode "$mode_display"

hosts/ryzensun/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./ryzensun.nix
+    ./hardware-configuration.nix
+
+    ./networking.nix
+  ];
+}

hosts/ryzensun/hardware-configuration.nix

@@ -0,0 +1,41 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/bad2e49e-c8e7-4516-a6f8-77db999d12b0";
+    fsType = "ext4";
+  };
+
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/ef6c5bb0-0bcf-4af4-bbc9-02c849999e54";
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/2C62-C8B5";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/ryzensun/networking.nix

@@ -0,0 +1,175 @@
+{
+  networking = {
+    hosts = {
+      "10.0.0.42" = [
+        "nomad.service.consul"
+        "nomad.service.cgn-1.consul"
+      ];
+      "10.0.0.66" = [ "consul.service.cgn-1.consul" ];
+      "10.0.1.9" = [ "consul.service.lev-1.consul" ];
+      "10.0.0.70" = [
+        "vault.service.consul"
+        "vault.service.cgn-1.consul"
+      ];
+      "10.0.0.200" = [ "headnode.cgn-1" ];
+      "10.0.0.201" = [ "cn01.cgn-1" ];
+      "10.0.0.202" = [ "cn02.cgn-1" ];
+      "10.0.0.205" = [ "cn05.cgn-1" ];
+      "10.0.0.206" = [ "cn06.cgn-1" ];
+      "10.0.0.207" = [ "cn07.cgn-1" ];
+      "10.0.0.208" = [ "cn08.cgn-1" ];
+      "10.0.1.200" = [ "headnode.lev-1" ];
+      "10.0.1.201" = [ "cn01.lev-1" ];
+      "10.0.1.202" = [ "cn02.lev-1" ];
+      "10.0.1.203" = [ "cn03.lev-1" ];
+      "10.0.1.204" = [ "cn04.lev-1" ];
+      "10.0.1.205" = [ "cn05.lev-1" ];
+      "10.0.1.206" = [ "cn00.lev-1" ];
+      "10.0.1.207" = [ "cn06.lev-1" ];
+      "10.0.1.208" = [ "cn07.lev-1" ];
+    };
+
+    interfaces.enp4s0.wakeOnLan.enable = true;
+
+    wireguard.enable = true;
+    wg-quick.interfaces = {
+      wg0 = {
+        address = [ "10.8.8.7/32" ];
+        privateKeyFile = "/etc/wireguard/wg0.privatekey";
+
+        peers = [
+          {
+            publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
+            allowedIPs = [
+              "10.8.8.16/32"
+              "10.0.0.0/24"
+              "10.88.88.0/24"
+            ];
+            endpoint = "85.88.23.16:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+      wg1 = {
+        address = [ "10.11.11.6/32" ];
+        privateKeyFile = "/etc/wireguard/wg1.privatekey";
+        mtu = 1300;
+
+        peers = [
+          {
+            publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
+            presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
+            allowedIPs = [
+              "10.11.11.0/24"
+              "192.168.1.0/24"
+              "10.0.1.0/24"
+            ];
+            endpoint = "80.71.153.1:51820";
+            #persistentKeepalive = 16;
+          }
+        ];
+      };
+      wg2 = {
+        address = [ "10.7.6.204/32" ];
+        privateKeyFile = "/etc/wireguard/wg2.privatekey";
+
+        peers = [
+          {
+            # nachtigall.pub.solar
+            publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
+            allowedIPs = [
+              "10.7.6.1/32"
+              "fd00:fae:fae:fae:fae:1::/96"
+            ];
+            #endpoint = "138.201.80.102:51820";
+            endpoint = "[2a01:4f8:172:1c25::1]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # metronom.pub.solar
+            publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
+            allowedIPs = [
+              "10.7.6.3/32"
+              "fd00:fae:fae:fae:fae:3::/96"
+            ];
+            endpoint = "49.13.236.167:51820";
+            #endpoint = "[2a01:4f8:c2c:7082::]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # tankstelle.pub.solar
+            publicKey = "iRTlY1lB7nPXf2eXzX8ZZDkfMmXyGjff5/joccbP8Cg=";
+            allowedIPs = [
+              "10.7.6.4/32"
+              "fd00:fae:fae:fae:fae:4::/96"
+            ];
+            #endpoint = "80.244.242.5:51820";
+            endpoint = "[2001:4d88:1ffa:26::5]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # trinkgenossin.pub.solar
+            publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
+            allowedIPs = [
+              "10.7.6.5/32"
+              "fd00:fae:fae:fae:fae:5::/96"
+            ];
+            #endpoint = "85.215.152.22:51820";
+            endpoint = "[2a01:239:35d:f500::1]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # delite.pub.solar
+            publicKey = "ZT2qGWgMPwHRUOZmTQHWCRX4m14YwOsiszjsA5bpc2k=";
+            allowedIPs = [
+              "10.7.6.6/32"
+              "fd00:fae:fae:fae:fae:6::/96"
+            ];
+            #endpoint = "80.244.242.5:51820";
+            endpoint = "[2a04:52c0:124:9d8c::2]:51820";
+            persistentKeepalive = 15;
+          }
+          {
+            # blue-shell.pub.solar
+            publicKey = "bcrIpWrKc1M+Hq4ds3aN1lTaKE26f2rvXhd+93QrzR8=";
+            allowedIPs = [
+              "10.7.6.7/32"
+              "fd00:fae:fae:fae:fae:7::/96"
+            ];
+            #endpoint = "80.244.242.5:51820";
+            endpoint = "[2a03:4000:43:24e::1]:51820";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+      #wg1 = {
+      #  address = [ "10.13.0.1/32" ];
+      #  privateKeyFile = "/etc/wireguard/wg1.privatekey";
+      #  mtu = 1412;
+
+      #  peers = [
+      #    {
+      #      publicKey = "XS3TTIMU7Jp3JJANBpE14RsVDJk6/VUvZgjQgQP8kAs=";
+      #      allowedIPs = [ "10.13.0.100/32" "192.168.188.0/24" ];
+      #      endpoint = "[2a00:6020:48ad:dd00:dea6:32ff:fe85:3306]:51820";
+      #      persistentKeepalive = 25;
+      #    }
+      #  ];
+      #};
+      #wg2 = {
+      #  address = [ "10.6.6.4/32" ];
+      #  privateKeyFile = "/etc/wireguard/wg2.privatekey";
+
+      #  peers = [
+      #    {
+      #      publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
+      #      presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
+      #      allowedIPs = [ "10.6.6.1/32" "10.1.1.0/24" ];
+      #      endpoint = "85.88.23.127:51820";
+      #      persistentKeepalive = 16;
+      #    }
+      #  ];
+      #};
+    };
+  };
+}

hosts/ryzensun/ryzensun.nix

@@ -0,0 +1,88 @@
+{
+  config,
+  pkgs,
+  lib,
+  flake,
+  ...
+}:
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in
+{
+  config = {
+    age.secrets.docker-ci-runner-secrets = {
+      file = "${flake.self}/secrets/docker-ci-runner-secrets.age";
+      mode = "600";
+      owner = "999";
+    };
+
+    pub-solar.terminal-life.full = true;
+    #pub-solar.docker-ci-runner = {
+    #  enable = false;
+    #  runnerEnvironment = {
+    #    DRONE_RUNNER_CAPACITY = "1";
+    #    DRONE_RUNNER_LABELS = "hosttype:baremetal";
+    #  };
+    #  runnerVarsFile = config.age.secrets.docker-ci-runner-secrets.path;
+    #};
+
+    boot.kernelParams = [ "amd_pstate=active" ];
+    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+    # Required for WakeOnLan
+    boot.initrd = {
+      availableKernelModules = [ "r8169" ];
+      network = {
+        enable = true;
+        udhcpc.enable = true;
+        flushBeforeStage2 = true;
+        ssh = {
+          enable = true;
+          # To prevent ssh clients from freaking out because a different host key is used,
+          # a different port for ssh is useful (assuming the same host has also a regular sshd running)
+          port = 2222;
+
+          # Please create this manually the first time.
+          # sudo ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key
+          hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
+          authorizedKeys = psCfg.user.publicKeys;
+        };
+        postCommands = ''
+          # Automatically ask for the password on SSH login
+          echo 'cryptsetup-askpass || echo "Unlock was successful; exiting SSH session" && exit 1' >> /root/.profile
+        '';
+      };
+    };
+
+    services.fstrim.enable = true;
+
+    services.tailscale.enable = true;
+    services.openssh = {
+      enable = true;
+      openFirewall = true;
+      allowSFTP = true;
+    };
+
+    networking.hostName = "ryzensun";
+
+    hardware.keyboard.uhk.enable = true;
+
+    hardware.cpu.amd.updateMicrocode = true;
+
+    home-manager.users."${psCfg.user.name}".xdg.configFile = {
+      "sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
+      "sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
+      "sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
+      "sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
+    };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "21.05"; # Did you read the comment?
+  };
+}

lib/add-local-hostname.nix

@@ -0,0 +1,5 @@
+{ lib }:
+hostnames: {
+  "127.0.0.1" = hostnames;
+  "::1" = hostnames;
+}

lib/compat/default.nix

@@ -1,21 +1,21 @@
 let
-  lock = builtins.fromJSON (builtins.readFile builtins.path {
-    path = ../../flake.lock;
-    name = "lockPath";
-  });
+  lock = builtins.fromJSON (
+    builtins.readFile builtins.path {
+      path = ../../flake.lock;
+      name = "lockPath";
+    }
+  );
   flake =
     import
-    (
-      fetchTarball {
+      (fetchTarball {
         url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
         sha256 = lock.nodes.flake-compat.locked.narHash;
-      }
-    )
-    {
-      src = builtins.path {
-        path = ../../.;
-        name = "projectRoot";
+      })
+      {
+        src = builtins.path {
+          path = ../../.;
+          name = "projectRoot";
+        };
       };
-    };
 in
-  flake
+flake

lib/compat/nixos/default.nix

@@ -1,4 +1,5 @@
-{...}: let
+{ ... }:
+let
   inherit (default.inputs.nixos) lib;
 
   host = configs.${hostname} or configs.PubSolarOS;
@@ -6,4 +7,4 @@
   default = (import ../.).defaultNix;
   hostname = lib.fileContents /etc/hostname;
 in
-  host
+host

lib/default.nix

@@ -1,2 +1,20 @@
-{lib}:
-lib.makeExtensible (self: {})
+{ lib, inputs, ... }:
+{
+  # Configuration common to all Linux systems
+  flake = {
+    lib =
+      let
+        callLibs = file: import file { inherit lib; };
+      in
+      rec {
+        ## Define your own library functions here!
+        #id = x: x;
+        ## Or in files, containing functions that take {lib}
+        #foo = callLibs ./foo.nix;
+        ## In configs, they can be used under "lib.our"
+
+        deploy = import ./deploy.nix { inherit inputs lib; };
+        addLocalHostname = callLibs ./add-local-hostname.nix;
+      };
+  };
+}

lib/deploy.nix

@@ -0,0 +1,80 @@
+/*
+  The contents of this file are adapted from digga
+  https://github.com/divnix/digga
+
+  Licensed under the MIT license
+*/
+
+{ lib, inputs }:
+let
+  getFqdn =
+    c:
+    let
+      net = c.config.networking;
+      fqdn =
+        if (net ? domain) && (net.domain != null) then "${net.hostName}.${net.domain}" else net.hostName;
+    in
+    fqdn;
+in
+{
+  mkDeployNodes =
+    systemConfigurations: extraConfig:
+    /*
+      *
+       Synopsis: mkNodes _systemConfigurations_ _extraConfig_
+
+       Generate the `nodes` attribute expected by deploy-rs
+       where _systemConfigurations_ are `nodes`.
+
+       _systemConfigurations_ should take the form of a flake's
+       _nixosConfigurations_. Note that deploy-rs does not currently support
+       deploying to darwin hosts.
+
+       _extraConfig_, if specified, will be merged into each of the
+       nodes' configurations.
+
+       Example _systemConfigurations_ input:
+
+       ```
+       {
+       hostname-1 = {
+       fastConnection = true;
+       sshOpts = [ "-p" "25" ];
+       };
+       hostname-2 = {
+       sshOpts = [ "-p" "19999" ];
+       sshUser = "root";
+       };
+       }
+       ```
+      *
+    */
+    lib.recursiveUpdate (lib.mapAttrs (_: c: {
+      hostname = getFqdn c;
+      profiles.system =
+        let
+          system = c.pkgs.system;
+
+          # Unmodified nixpkgs
+          pkgs = import inputs.nixpkgs { inherit system; };
+
+          # nixpkgs with deploy-rs overlay but force the nixpkgs package
+          deployPkgs = import inputs.nixpkgs {
+            inherit system;
+            overlays = [
+              inputs.deploy-rs.overlays.default
+              (self: super: {
+                deploy-rs = {
+                  inherit (pkgs) deploy-rs;
+                  lib = super.deploy-rs.lib;
+                };
+              })
+            ];
+          };
+        in
+        {
+          user = "root";
+          path = deployPkgs.deploy-rs.lib.activate.nixos c;
+        };
+    }) systemConfigurations) extraConfig;
+}

modules/acme/default.nix

@@ -0,0 +1,28 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  age.secrets."hosting-de-acme-secrets" = {
+    file = "${flake.self}/secrets/hosting-de-acme-secrets.age";
+    mode = "400";
+    owner = "acme";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+
+    defaults = {
+      email = "jfw@miom.space";
+      # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      dnsProvider = "hostingde";
+      dnsPropagationCheck = true;
+      environmentFile = config.age.secrets."hosting-de-acme-secrets".path;
+      group = "nginx";
+      webroot = null;
+    };
+  };
+}

modules/actual/default.nix

@@ -0,0 +1,121 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  cfg = config.services.actual;
+  configFile = formatType.generate "config.json" cfg.settings;
+  dataDir = "/var/lib/actual";
+
+  formatType = pkgs.formats.json { };
+in
+{
+  options.services.actual = {
+    enable = mkEnableOption "actual, a privacy focused app for managing your finances";
+    package = mkPackageOption pkgs "actual-server" { };
+
+    openFirewall = mkOption {
+      default = false;
+      type = types.bool;
+      description = "Whether to open the firewall for the specified port.";
+    };
+
+    settings = mkOption {
+      default = { };
+      description = "Server settings, refer to (the documentation)[https://actualbudget.org/docs/config/] for available options.";
+      type = types.submodule {
+        freeformType = formatType.type;
+
+        options = {
+          hostname = mkOption {
+            type = types.str;
+            description = "The address to listen on";
+            default = "::";
+          };
+
+          port = mkOption {
+            type = types.port;
+            description = "The port to listen on";
+            default = 3000;
+          };
+        };
+
+        config = {
+          serverFiles = mkDefault "${dataDir}/server-files";
+          userFiles = mkDefault "${dataDir}/user-files";
+          dataDir = mkDefault dataDir;
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.port ];
+
+    systemd.services.actual = {
+      description = "Actual server, a local-first personal finance app";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment.ACTUAL_CONFIG_PATH = configFile;
+      serviceConfig = {
+        ExecStart = getExe cfg.package;
+        DynamicUser = true;
+        User = "actual";
+        Group = "actual";
+        StateDirectory = "actual";
+        WorkingDirectory = dataDir;
+        LimitNOFILE = "1048576";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        StateDirectoryMode = "0700";
+        Restart = "always";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        #MemoryDenyWriteExecute = true; # Leads to coredump because V8 does JIT
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@pkey"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = [
+    lib.maintainers.oddlama
+    lib.maintainers.patrickdag
+  ];
+}

modules/adb/default.nix

@@ -0,0 +1,16 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  psCfg = config.pub-solar;
+in
+{
+  programs.adb.enable = true;
+
+  users.users."${psCfg.user.name}" = {
+    extraGroups = [ "adbusers" ];
+  };
+}

modules/arduino/default.nix

@@ -4,24 +4,15 @@
   pkgs,
   ...
 }:
-with lib; let
+let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.devops;
-in {
-  options.pub-solar.arduino = {
-    enable = mkEnableOption "Life with home automation";
-  };
-  config = mkIf cfg.enable {
-    users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
-      extraGroups = ["dialout"];
-    };
-
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          arduino
-          arduino-cli
-        ];
-      };
+in
+{
+  users.users."${psCfg.user.name}" = {
+    extraGroups = [ "dialout" ];
+    packages = with pkgs; [
+      arduino
+      arduino-cli
+    ];
   };
 }

modules/audio/default.nix

@@ -4,102 +4,52 @@
   pkgs,
   ...
 }:
-with lib; let
+let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.audio;
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
-in {
-  options.pub-solar.audio = {
-    enable = mkEnableOption "Life in highs and lows";
-    mopidy.enable = mkEnableOption "Life with mopidy";
-    spotify.enable = mkEnableOption "Life in DRM";
-    spotify.username = mkOption {
-      description = "Spotify login username or email";
-      type = types.str;
-      example = "yourname@example.com";
-      default = "";
-    };
-    bluetooth.enable = mkEnableOption "Life with bluetooth";
+in
+{
+  users.users."${psCfg.user.name}" = {
+    extraGroups = [ "audio" ];
+    packages = with pkgs; [
+      # easyeffects, e.g. for microphone noise filtering
+      easyeffects
+      mu
+      pavucontrol
+      pa_applet
+      playerctl
+      # Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
+      pulseaudio
+      vimpc
+    ];
   };
 
-  config = mkIf cfg.enable {
-    users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
-      extraGroups = ["audio"];
-    };
+  home-manager.users."${psCfg.user.name}" = {
+    xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
+    systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
+  };
 
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages =
-          [
-            # easyeffects, e.g. for microphone noise filtering
-            easyeffects
-            mu
-            pavucontrol
-            pa_applet
-            playerctl
-            # Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
-            pulseaudio
-            vimpc
-          ]
-          ++ (
-            if cfg.spotify.enable
-            then [pkgs.spotify-tui]
-            else []
-          );
-        xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
-        systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
+  # rtkit is optional but recommended
+  security.rtkit.enable = true;
 
-        services.spotifyd = mkIf cfg.spotify.enable {
-          enable = true;
-          settings = {
-            global = {
-              username = cfg.spotify.username;
-              password_cmd = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1001/bus ${pkgs.libsecret}/bin/secret-tool lookup spotify password";
-              bitrate = 320;
-              volume_normalisation = true;
-              no_audio_cache = false;
-              max_cache_size = 1000000000;
-            };
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-PipeWire#setting-sample-rates
+    extraConfig.pipewire = {
+      "10-clock-rate" = {
+        "context.properties" = {
+          default = {
+            "clock.rate" = 48000; # Pipewire default
+            "clock.allowed-rates" = [
+              44100
+              48000
+            ];
           };
         };
       };
-
-    # rtkit is optional but recommended
-    security.rtkit.enable = true;
-    # Enable sound using pipewire-pulse
-    services.pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-
-      config.pipewire = {
-        context.default.clock = {
-          allowed-rates = [44100 48000 88200 96000];
-          rate = 44100;
-        };
-      };
-      config.pipewire-pulse = builtins.fromJSON (builtins.readFile ./pipewire-pulse.conf.json);
     };
-
-    # Bluetooth configuration using wireplumber
-    # https://nixos.wiki/wiki/PipeWire#Bluetooth_Configuration
-    environment.etc = mkIf cfg.bluetooth.enable {
-      "wireplumber/bluetooth.lua.d/51-bluez-config.lua".text = ''
-        bluez_monitor.properties = {
-          ["bluez5.enable-sbc-xq"] = true,
-          ["bluez5.enable-msbc"] = true,
-          ["bluez5.enable-hw-volume"] = true,
-          ["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
-        }
-      '';
-    };
-
-    # Enable bluetooth
-    hardware.bluetooth.enable = mkIf cfg.bluetooth.enable true;
-    services.blueman.enable = mkIf cfg.bluetooth.enable true;
-
-    # Enable audio server & client
-    services.mopidy = mkIf cfg.mopidy.enable ((import ./mopidy.nix) pkgs);
   };
 }

modules/audio/mopidy.nix

@@ -1,18 +0,0 @@
-pkgs: {
-  enable = true;
-  extensionPackages = with pkgs; [
-    mopidy-mpd
-    mopidy-soundcloud
-    mopidy-youtube
-    mopidy-local
-    mopidy-jellyfin
-  ];
-
-  configuration = ''
-    [mpd]
-    hostname = ::
-
-    [audio]
-    output = pulsesink server=127.0.0.1:4713
-  '';
-}

modules/audio/pipewire-pulse.conf.json

@@ -1,36 +0,0 @@
-{
-  "context.properties": {},
-  "context.spa-libs": {
-    "audio.convert.*": "audioconvert/libspa-audioconvert",
-    "support.*": "support/libspa-support"
-  },
-  "context.modules": [
-    {
-      "name": "libpipewire-module-rtkit",
-      "args": {},
-      "flags": ["ifexists", "nofail"]
-    },
-    {
-      "name": "libpipewire-module-protocol-native"
-    },
-    {
-      "name": "libpipewire-module-client-node"
-    },
-    {
-      "name": "libpipewire-module-adapter"
-    },
-    {
-      "name": "libpipewire-module-metadata"
-    },
-    {
-      "name": "libpipewire-module-protocol-pulse",
-      "args": {
-        "server.address": ["unix:native", "tcp:4713"],
-        "vm.overrides": {
-          "pulse.min.quantum": "1024/48000"
-        }
-      }
-    }
-  ],
-  "stream.properties": {}
-}

modules/bluetooth/default.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+  hardware.bluetooth = {
+    enable = true;
+    # Disable bluetooth on startup to save battery
+    powerOnBoot = false;
+    package = pkgs.bluez-experimental;
+    # Disable useless SIM Access Profile plugin
+    disabledPlugins = [ "sap" ];
+    settings = {
+      General = {
+        # Enables experimental features and interfaces.
+        # Makes BlueZ Battery Provider available
+        Experimental = true;
+      };
+    };
+  };
+
+  services.blueman.enable = true;
+  services.pipewire.wireplumber.configPackages = [
+    # https://pipewire.pages.freedesktop.org/wireplumber/daemon/configuration/bluetooth.html
+    (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/10-bluez.conf" ''
+      monitor.bluez.properties = {
+        bluez5.enable-hw-volume = true
+        bluez5.enable-msbc = false
+        bluez5.enable-sbc-xq = true
+        bluez5.headset-roles = [ hsp_hs hsp_ag hfp_hf hfp_ag ]
+      }
+    '')
+  ];
+}

modules/ci-runner/default.nix

@@ -1,45 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  self,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.ci-runner;
-in {
-  options.pub-solar.ci-runner = {
-    enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
-  };
-
-  config = mkIf cfg.enable {
-    systemd.user.services.ci-runner = {
-      enable = true;
-
-      description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-      };
-
-      path = [
-        pkgs.git
-        pkgs.nix
-        pkgs.libvirt
-      ];
-
-      wantedBy = ["multi-user.target"];
-      after = ["network.target" "libvirtd.service"];
-
-      script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
-    };
-
-    age.secrets."drone-runner-exec-config" = {
-      file = "${self}/secrets/drone-runner-exec-config";
-      mode = "700";
-      owner = psCfg.user.name;
-    };
-  };
-}

modules/compat/default.nix

@@ -1,12 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-with lib; {
-  # Both things below are for
-  # https://github.com/NixOS/nixpkgs/issues/124215
-  documentation.info.enable = lib.mkForce false;
-  nix.settings.extra-sandbox-paths = ["/bin/sh=${pkgs.bash}/bin/sh"];
-}

modules/core/boot.nix

@@ -4,42 +4,33 @@
   lib,
   ...
 }:
-with lib; let
+let
   cfg = config.pub-solar.core;
-in {
-  options.pub-solar.core.iso-options.enable = mkOption {
-    type = types.bool;
-    default = false;
-    description = "Feature flag for iso builds";
-  };
-
-  options.pub-solar.core.disk-encryption-active = mkOption {
-    type = types.bool;
+in
+{
+  options.pub-solar.core.disk-encryption-active = lib.mkOption {
+    type = lib.types.bool;
     default = true;
     description = "Whether it should be assumed that there is a cryptroot device";
   };
 
   config = {
     boot = {
-      # Enable plymouth for better experience of booting
-      plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
-
       # Mount / luks device in initrd
       # Allow fstrim to work on it.
-      # The ! makes this enabled by default
-      initrd = mkIf (!cfg.iso-options.enable && cfg.disk-encryption-active) {
+      initrd = lib.mkIf cfg.disk-encryption-active {
         luks.devices."cryptroot" = {
           allowDiscards = true;
         };
       };
 
-      loader.systemd-boot.enable = true;
+      loader.systemd-boot.enable = lib.mkDefault true;
 
       # Use latest LTS linux kernel by default
-      kernelPackages = pkgs.linuxPackages_5_15;
+      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_12;
 
       # Support ntfs drives
-      supportedFilesystems = ["ntfs"];
+      supportedFilesystems = [ "ntfs" ];
     };
   };
 }

modules/core/default.nix

@@ -1,42 +1,35 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
+{ config, lib, ... }:
+let
   cfg = config.pub-solar.core;
-in {
+  psCfg = config.pub-solar;
+in
+{
   imports = [
     ./boot.nix
     ./hibernation.nix
-    ./fonts.nix
     ./i18n.nix
     ./networking.nix
-    ./nix.nix
     ./packages.nix
-    ./services.nix
   ];
 
-  options.pub-solar.core = {
-    lite = mkOption {
-      description = ''
-        Enable a lite edition of core with less default modules and a reduced package set.
-      '';
-      default = false;
-      type = types.bool;
-    };
+  # Service that makes Out of Memory Killer more effective
+  services.earlyoom.enable = true;
+
+  services.logind.lidSwitch = "hibernate";
+
+  services.tor.settings = {
+    UseBridges = true;
   };
 
-  config = {
-    pub-solar = {
-      audio.enable = mkIf (!cfg.lite) (mkDefault true);
-      crypto.enable = mkIf (!cfg.lite) (mkDefault true);
-      devops.enable = mkIf (!cfg.lite) (mkDefault true);
+  # The options below are directly taken from or inspired by
+  # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
 
-      terminal-life = {
-        enable = mkDefault true;
-        lite = cfg.lite;
-      };
-    };
-  };
+  # Limit the use of sudo to the group wheel
+  security.sudo.execWheelOnly = true;
+
+  # Remove the complete default environment of packages like
+  # nano, perl and rsync
+  environment.defaultPackages = lib.mkForce [ ];
+
+  # fileSystems."/".options = [ "noexec" ];
 }

modules/core/fonts.nix

@@ -1,14 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  fonts = {
-    fonts = with pkgs; [powerline-fonts dejavu_fonts];
-    fontconfig.defaultFonts = {
-      monospace = ["DejaVu Sans Mono for Powerline"];
-      sansSerif = ["DejaVu Sans"];
-    };
-  };
-}

modules/core/hibernation.nix

@@ -4,9 +4,11 @@
   lib,
   ...
 }:
-with lib; let
+let
   cfg = config.pub-solar.core.hibernation;
-in {
+  inherit (lib) mkOption types mkIf;
+in
+{
   options.pub-solar.core.hibernation = {
     enable = mkOption {
       type = types.bool;
@@ -15,8 +17,8 @@ in {
     };
 
     resumeDevice = mkOption {
-      type = types.str;
-      default = "/dev/sda1";
+      type = types.nullOr types.str;
+      default = null;
       description = "The location of the hibernation resume swap file.";
     };
 
@@ -29,8 +31,10 @@ in {
 
   config = {
     boot = mkIf cfg.enable {
-      resumeDevice = cfg.resumeDevice;
-      kernelParams = mkIf (cfg.resumeOffset != null) ["resume_offset=${builtins.toString cfg.resumeOffset}"];
+      resumeDevice = mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
+      kernelParams = mkIf (cfg.resumeOffset != null) [
+        "resume_offset=${builtins.toString cfg.resumeOffset}"
+      ];
     };
   };
 }

modules/core/i18n.nix

@@ -4,7 +4,7 @@
   lib,
   ...
 }:
-with lib; {
+{
   config = {
     # Set your time zone.
     time.timeZone = "Europe/Berlin";
@@ -15,6 +15,11 @@ with lib; {
     };
     i18n = {
       defaultLocale = "en_US.UTF-8";
+      supportedLocales = [
+        "C.UTF-8/UTF-8"
+        "en_US.UTF-8/UTF-8"
+        "de_DE.UTF-8/UTF-8"
+      ];
     };
   };
 }

modules/core/networking.nix

@@ -1,85 +1,40 @@
 {
+  flake,
   config,
   pkgs,
   lib,
   ...
 }:
-with lib; let
-  cfg = config.pub-solar.core;
-in {
-  options.pub-solar.core = {
-    enableCaddy = mkOption {
-      type = types.bool;
-      default = !cfg.lite;
-    };
-    enableHelp = mkOption {
-      type = types.bool;
-      default = !cfg.lite;
-    };
+{
+  # disable NetworkManager and systemd-networkd -wait-online by default
+  systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
+  systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
 
-    binaryCaches = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = "Binary caches to use.";
-    };
-    publicKeys = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = "Public keys of binary caches.";
-    };
+  networking.networkmanager = {
+    # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
+    enable = if config.programs.sway.enable then lib.mkDefault true else false;
+    # not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
+    #wifi.backend = "iwd";
   };
-  config = {
-    # disable NetworkManager and systemd-networkd -wait-online by default
-    systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
-    systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
 
-    networking.networkmanager = {
-      # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
-      enable = true;
-      wifi.backend = "iwd";
-    };
+  networking.firewall.enable = true;
 
-    networking.firewall.enable = true;
+  # For rage encryption, all hosts need a ssh key pair
+  services.openssh = {
+    enable = true;
+    allowSFTP = lib.mkDefault false;
 
-    # Customized binary caches list (with fallback to official binary cache)
-    nix.settings.substituters = cfg.binaryCaches;
-    nix.settings.trusted-public-keys = cfg.publicKeys;
+    openFirewall = lib.mkDefault false;
 
-    # These entries get added to /etc/hosts
-    networking.hosts = {
-      "127.0.0.1" =
-        []
-        ++ lib.optionals cfg.enableCaddy ["caddy.local"]
-        ++ lib.optionals config.pub-solar.printing.enable ["cups.local"]
-        ++ lib.optionals cfg.enableHelp ["help.local"];
-    };
+    settings.PasswordAuthentication = lib.mkDefault false;
+    settings.KbdInteractiveAuthentication = false;
 
-    # Caddy reverse proxy for local services like cups
-    services.caddy = {
-      enable = cfg.enableCaddy;
-      globalConfig = ''
-        default_bind 127.0.0.1
-        auto_https off
-      '';
-      extraConfig = concatStringsSep "\n" [
-        (lib.optionalString
-          config.pub-solar.printing.enable
-          ''
-            cups.local:80 {
-              request_header Host localhost:631
-              reverse_proxy unix//run/cups/cups.sock
-            }
-          '')
-
-        (lib.optionalString
-          cfg.enableHelp
-          ''
-            help.local:80 {
-              root * ${pkgs.psos-docs}/lib/html
-              file_server
-            }
-          '')
-      ];
-    };
+    extraConfig = ''
+      AllowTcpForwarding yes
+      X11Forwarding no
+      AllowAgentForwarding no
+      AllowStreamLocalForwarding no
+      AuthenticationMethods publickey
+    '';
   };
 }

modules/core/nix.nix

@@ -1,31 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  inputs,
-  ...
-}: {
-  nix = {
-    # Use default version alias for nix package
-    package = pkgs.nix;
-    gc.automatic = true;
-    optimise.automatic = true;
-    settings = {
-      # Improve nix store disk usage
-      auto-optimise-store = true;
-      # Prevents impurities in builds
-      sandbox = true;
-      # give root and @wheel special privileges with nix
-      trusted-users = ["root" "@wheel"];
-      # This is just a representation of the nix default
-      system-features = ["nixos-test" "benchmark" "big-parallel" "kvm"];
-    };
-    # Generally useful nix option defaults
-    extraOptions = ''
-      min-free = 536870912
-      keep-outputs = true
-      keep-derivations = true
-      fallback = true
-    '';
-  };
-}

modules/core/packages.nix

@@ -4,75 +4,30 @@
   lib,
   ...
 }:
-with lib; let
+let
   psCfg = config.pub-solar;
   cfg = config.pub-solar.core;
-in {
-  environment = {
-    systemPackages = with pkgs;
-      [
-        # Core unix utility packages
-        coreutils-full
-        dnsutils
-        inetutils
-        progress
-        pciutils
-        usbutils
+in
+{
+  environment.systemPackages = with pkgs; [
+    # Core unix utility packages
+    coreutils-full
+    diffutils
+    dnsutils
+    exfat
+    file
+    findutils
+    inetutils
+    lsof
+    progress
+    pciutils
+    usbutils
 
-        wget
-        openssl
-        openssh
-        curl
-        htop
-        lsof
-        psmisc
-        file
+    gitMinimal
 
-        # zippit
-        zip
-        unzip
-
-        # Modern modern utilities
-        p7zip
-        croc
-        jq
-      ]
-      ++ lib.optionals (!cfg.lite) [
-        mtr
-
-        gitFull
-        git-lfs
-        git-bug
-
-        xdg-utils
-        sysfsutils
-        renameutils
-        nfs-utils
-        moreutils
-        mailutils
-        keyutils
-        input-utils
-        elfutils
-        binutils
-        dateutils
-        diffutils
-        findutils
-        exfat
-
-        # Nix specific utilities
-        alejandra
-        niv
-        manix
-        nix-index
-        nix-tree
-        nixpkgs-review
-        # Build broken, python2.7-PyJWT-2.0.1.drv' failed
-        #nixops
-        psos
-        nvd
-
-        # Fun
-        neofetch
-      ];
-  };
+    btop
+    mtr
+    nmap
+    nload
+  ];
 }

modules/core/services.nix

@@ -1,18 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  # For rage encryption, all hosts need a ssh key pair
-  services.openssh = {
-    enable = true;
-    # If you don't want the host to have SSH actually opened up to the net,
-    # set `services.openssh.openFirewall` to false in your config.
-    openFirewall = lib.mkDefault true;
-    passwordAuthentication = false;
-  };
-
-  # Service that makes Out of Memory Killer more effective
-  services.earlyoom.enable = true;
-}

modules/crypto/default.nix

@@ -4,42 +4,29 @@
   pkgs,
   ...
 }:
-with lib; let
+let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.crypto;
-in {
-  options.pub-solar.crypto = {
-    enable = mkEnableOption "Life in private";
-  };
+in
+{
+  services.udev.packages = [ pkgs.yubikey-personalization ];
+  services.dbus.packages = [ pkgs.gcr ];
+  services.pcscd.enable = true;
 
-  config = mkIf cfg.enable {
-    services.udev.packages = [pkgs.yubikey-personalization];
-    services.dbus.packages = [pkgs.gcr];
-    services.pcscd.enable = true;
+  services.gnome.gnome-keyring.enable = true;
 
-    services.gnome.gnome-keyring.enable = true;
+  users.users."${psCfg.user.name}".packages = with pkgs; [ libsecret ];
 
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
+  home-manager.users."${psCfg.user.name}" = {
+    systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
 
-        services.gpg-agent = {
-          enable = true;
-          pinentryFlavor = "gnome3";
-          verbose = true;
-        };
+    services.gpg-agent = {
+      enable = true;
+      pinentryPackage = lib.mkDefault pkgs.pinentry-gnome3;
+      verbose = true;
+    };
 
-        programs.gpg = {
-          enable = true;
-        };
-
-        home.packages = [
-          gnome.seahorse
-          keepassxc
-          libsecret
-          qMasterPassword
-          restic
-        ];
-      };
+    programs.gpg = {
+      enable = true;
+    };
   };
 }

modules/crypto/polkit-gnome-authentication-agent.service.nix

@@ -1,15 +1,15 @@
 pkgs: {
   Unit = {
     Description = "Legacy polkit authentication agent for GNOME";
-    Documentation = ["https://gitlab.freedesktop.org/polkit/polkit/"];
-    BindsTo = ["sway-session.target"];
-    After = ["sway-session.target"];
+    Documentation = [ "https://gitlab.freedesktop.org/polkit/polkit/" ];
+    BindsTo = [ "sway-session.target" ];
+    After = [ "sway-session.target" ];
   };
   Service = {
     Type = "simple";
     ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
   };
   Install = {
-    WantedBy = ["sway-session.target"];
+    WantedBy = [ "sway-session.target" ];
   };
 }

modules/ddclient/default.nix

@@ -0,0 +1,285 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.ddclient;
+  boolToStr = bool: if bool then "yes" else "no";
+  dataDir = "/var/lib/ddclient";
+  StateDirectory = builtins.baseNameOf dataDir;
+  RuntimeDirectory = StateDirectory;
+
+  usev4 = if cfg.usev4 != "" then "usev4=${cfg.usev4}" else "";
+  usev6 = if cfg.usev6 != "" then "usev6=${cfg.usev6}" else "";
+
+  configFile' = pkgs.writeText "ddclient.conf" ''
+    # This file can be used as a template for configFile or is automatically generated by Nix options.
+    use=no
+    ${usev4}
+    ${usev6}
+    cache=${dataDir}/ddclient.cache
+    foreground=yes
+    login=${cfg.username}
+    password=${
+      if cfg.protocol == "nsupdate" then
+        "/run/${RuntimeDirectory}/ddclient.key"
+      else
+        "@password_placeholder@"
+    }
+    protocol=${cfg.protocol}
+    ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
+    ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
+    ${lib.optionalString (cfg.zone != "") "zone=${cfg.zone}"}
+    ssl=${boolToStr cfg.ssl}
+    wildcard=yes
+    quiet=${boolToStr cfg.quiet}
+    verbose=${boolToStr cfg.verbose}
+    ${cfg.extraConfig}
+    ${lib.concatStringsSep "," cfg.domains}
+  '';
+  configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
+
+  preStart = ''
+    install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    ${lib.optionalString (cfg.configFile == null) (
+      if (cfg.protocol == "nsupdate") then
+        ''
+          install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
+        ''
+      else if (cfg.passwordFile != null) then
+        ''
+          "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
+        ''
+      else
+        ''
+          sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
+        ''
+    )}
+  '';
+in
+with lib;
+{
+  disabledModules = [ "services/networking/ddclient.nix" ];
+
+  imports = [
+    (mkChangedOptionModule
+      [
+        "services"
+        "ddclient"
+        "domain"
+      ]
+      [
+        "services"
+        "ddclient"
+        "domains"
+      ]
+      (
+        config:
+        let
+          value = getAttrFromPath [
+            "services"
+            "ddclient"
+            "domain"
+          ] config;
+        in
+        if value != "" then [ value ] else [ ]
+      )
+    )
+    (mkRemovedOptionModule [
+      "services"
+      "ddclient"
+      "homeDir"
+    ] "")
+    (mkRemovedOptionModule [
+      "services"
+      "ddclient"
+      "password"
+    ] "Use services.ddclient.passwordFile instead.")
+  ];
+
+  ###### interface
+
+  options = {
+    services.ddclient = with lib.types; {
+      enable = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
+        '';
+      };
+
+      package = mkOption {
+        type = package;
+        default = pkgs.ddclient;
+        defaultText = lib.literalExpression "pkgs.ddclient";
+        description = lib.mdDoc ''
+          The ddclient executable package run by the service.
+        '';
+      };
+
+      domains = mkOption {
+        default = [ "" ];
+        type = listOf str;
+        description = lib.mdDoc ''
+          Domain name(s) to synchronize.
+        '';
+      };
+
+      username = mkOption {
+        # For `nsupdate` username contains the path to the nsupdate executable
+        default = lib.optionalString (
+          config.services.ddclient.protocol == "nsupdate"
+        ) "${pkgs.bind.dnsutils}/bin/nsupdate";
+        defaultText = "";
+        type = str;
+        description = lib.mdDoc ''
+          User name.
+        '';
+      };
+
+      passwordFile = mkOption {
+        default = null;
+        type = nullOr str;
+        description = lib.mdDoc ''
+          A file containing the password or a TSIG key in named format when using the nsupdate protocol.
+        '';
+      };
+
+      interval = mkOption {
+        default = "10min";
+        type = str;
+        description = lib.mdDoc ''
+          The interval at which to run the check and update.
+          See {command}`man 7 systemd.time` for the format.
+        '';
+      };
+
+      configFile = mkOption {
+        default = null;
+        type = nullOr path;
+        description = lib.mdDoc ''
+          Path to configuration file.
+          When set this overrides the generated configuration from module options.
+        '';
+        example = "/root/nixos/secrets/ddclient.conf";
+      };
+
+      protocol = mkOption {
+        default = "dyndns2";
+        type = str;
+        description = lib.mdDoc ''
+          Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
+        '';
+      };
+
+      server = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          Server address.
+        '';
+      };
+
+      ssl = mkOption {
+        default = true;
+        type = bool;
+        description = lib.mdDoc ''
+          Whether to use SSL/TLS to connect to dynamic DNS provider.
+        '';
+      };
+
+      quiet = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Print no messages for unnecessary updates.
+        '';
+      };
+
+      script = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          script as required by some providers.
+        '';
+      };
+
+      usev4 = mkOption {
+        default = "webv4, webv4=checkip.dyndns.com/, webv4-skip='Current IP Address: '";
+        type = str;
+        description = lib.mdDoc ''
+          Method to determine the IP address to send to the dynamic DNS provider.
+        '';
+      };
+
+      usev6 = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          Method to determine the IP address to send to the dynamic DNS provider.
+        '';
+      };
+
+      verbose = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Print verbose information.
+        '';
+      };
+
+      zone = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          zone as required by some providers.
+        '';
+      };
+
+      extraConfig = mkOption {
+        default = "";
+        type = lines;
+        description = lib.mdDoc ''
+          Extra configuration. Contents will be added verbatim to the configuration file.
+
+          ::: {.note}
+          `daemon` should not be added here because it does not work great with the systemd-timer approach the service uses.
+          :::
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf config.services.ddclient.enable {
+    systemd.services.ddclient = {
+      description = "Dynamic DNS Client";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      restartTriggers = optional (cfg.configFile != null) cfg.configFile;
+
+      serviceConfig = {
+        DynamicUser = true;
+        RuntimeDirectoryMode = "0700";
+        inherit RuntimeDirectory;
+        inherit StateDirectory;
+        Type = "oneshot";
+        ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
+        ExecStart = "${lib.getBin cfg.package}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
+      };
+    };
+
+    systemd.timers.ddclient = {
+      description = "Run ddclient";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = cfg.interval;
+        OnUnitInactiveSec = cfg.interval;
+      };
+    };
+  };
+}

modules/default.nix

@@ -0,0 +1,43 @@
+{ self, inputs, ... }:
+{
+  flake = {
+    nixosModules = rec {
+      acme = import ./acme;
+      actual = import ./actual;
+      audio = import ./audio;
+      bluetooth = import ./bluetooth;
+      core = import ./core;
+      crypto = import ./crypto;
+      desktop-extended = import ./desktop-extended;
+      docker = import ./docker;
+      #email = import ./email;
+      forgejo-actions-runner = import ./forgejo-actions-runner;
+      #gaming = import ./gaming;
+      graphical = import ./graphical;
+      invoiceplane = import ./invoiceplane;
+      nix = import ./nix;
+      nextcloud = import ./nextcloud;
+      office = import ./office;
+      printing = import ./printing;
+      terminal-life = import ./terminal-life;
+      user = import ./user;
+      virtualisation = import ./virtualisation;
+      #wireguard-client = import ./wireguard-client;
+
+      base.imports = [
+        self.nixosModules.home-manager
+        inputs.agenix.nixosModules.default
+        inputs.lix-module.nixosModules.default
+
+        self.nixosModules.overlays
+        self.nixosModules.core
+        self.nixosModules.crypto
+        self.nixosModules.nix
+        self.nixosModules.terminal-life
+
+        self.nixosModules.root
+        self.nixosModules.user
+      ];
+    };
+  };
+}

modules/desktop-extended/default.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, ... }:
+let
+  psCfg = config.pub-solar;
+in
+{
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    ungoogled-chromium
+
+    gimp
+    inkscape
+    tigervnc
+    nodejs_20
+
+    signal-desktop
+    tdesktop
+    element-desktop
+  ];
+
+  fonts = {
+    packages = with pkgs; [
+      dejavu_fonts
+      fira-code
+      fira-code-symbols
+      #google-fonts
+      lato
+      montserrat
+      nerdfonts
+      noto-fonts
+      noto-fonts-cjk-sans
+      open-sans
+      powerline-fonts
+      source-sans-pro
+    ];
+  };
+}

modules/devops/default.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.devops;
-in {
-  options.pub-solar.devops = {
-    enable = mkEnableOption "Life automated";
-  };
-
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          drone-cli
-          nmap
-          pgcli
-          ansible
-          ansible-lint
-          restic
-          shellcheck
-          terraform
-        ];
-      };
-  };
-}

modules/docker-ci-runner/default.nix

@@ -1,109 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  self,
-  ...
-}:
-with lib; let
-  bootstrap = pkgs.writeScript "bootstrap.sh" ''
-    #!/usr/bin/env bash
-
-    set -e
-
-    apt update
-    apt install --yes curl git sudo xz-utils
-
-    adduser --system --uid 999 build
-    chown build /nix
-
-    sudo -u build curl -L https://nixos.org/nix/install > install
-    sudo -u build sh install
-
-    echo "export PATH=/nix/var/nix/profiles/per-user/build/profile/bin:''$PATH" >> /etc/profile
-
-    mkdir /etc/nix
-    echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
-
-    export nix_user_config_file="/home/build/.local/share/nix/trusted-settings.json"
-    mkdir -p $(dirname \\$nix_user_config_file)
-    echo '{"extra-experimental-features":{"nix-command flakes":true},"extra-substituters":{"https://nix-dram.cachix.org https://dram.cachix.org  https://nrdxp.cachix.org https://nix-community.cachix.org":true},"extra-trusted-public-keys":{"nix-dram.cachix.org-1:CKjZ0L1ZiqH3kzYAZRt8tg8vewAx5yj8Du/+iR8Efpg= dram.cachix.org-1:baoy1SXpwYdKbqdTbfKGTKauDDeDlHhUpC+QuuILEMY= nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=":true}}' > \\$nix_user_config_file
-    chown -R build /home/build/
-
-    curl -L https://github.com/drone-runners/drone-runner-exec/releases/latest/download/drone_runner_exec_linux_amd64.tar.gz | tar xz
-    sudo install -t /usr/local/bin drone-runner-exec
-
-    if [ ! -f /run/vars ]; then
-      exit 1
-    fi
-
-    cp -a /run/vars /run/runtime-vars
-    env | grep "DRONE" >> /run/runtime-vars
-
-    su - -s /bin/bash build sh -c "/usr/local/bin/drone-runner-exec daemon /run/runtime-vars"
-  '';
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.docker-ci-runner;
-in {
-  options.pub-solar.docker-ci-runner = {
-    enable = lib.mkEnableOption "Enables a docker container running a drone exec runner as unprivileged user.";
-
-    enableKvm = lib.mkOption {
-      description = ''
-        Enable kvm support.
-      '';
-      default = true;
-      type = types.bool;
-    };
-
-    nixCacheLocation = lib.mkOption {
-      description = ''
-        Location of nix cache that is shared between builds
-      '';
-      default = "/var/lib/docker-ci-runner";
-      type = types.path;
-    };
-
-    runnerEnvironment = lib.mkOption {
-      description = ''
-        Additional environment vars added to the vars file on container runtime
-      '';
-      default = {};
-    };
-
-    runnerVarsFile = lib.mkOption {
-      description = ''
-        Location of vars file passed to drone runner
-      '';
-      type = types.path;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation = {
-      docker = {
-        enable = true; # sadly podman is not supported rightnow
-      };
-
-      oci-containers = {
-        backend = "docker";
-        containers."drone-exec-runner" = {
-          image = "debian";
-          autoStart = true;
-          entrypoint = "bash";
-          cmd = ["/bootstrap.sh"];
-
-          volumes = [
-            "${cfg.runnerVarsFile}:/run/vars"
-            "${cfg.nixCacheLocation}:/nix"
-            "${bootstrap}:/bootstrap.sh"
-          ];
-
-          environment = cfg.runnerEnvironment;
-
-          extraOptions = lib.mkIf cfg.enableKvm ["--device=/dev/kvm"];
-        };
-      };
-    };
-  };
-}

modules/docker/default.nix

@@ -4,23 +4,15 @@
   pkgs,
   ...
 }:
-with lib; let
+let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.docker;
-in {
-  options.pub-solar.docker = {
-    enable = mkEnableOption "Life in metal boxes";
+in
+{
+  virtualisation.docker.enable = true;
+
+  users.users."${psCfg.user.name}" = {
+    extraGroups = [ "docker" ];
   };
 
-  config = mkIf cfg.enable {
-    virtualisation.docker.enable = true;
-    users.users = with pkgs;
-      pkgs.lib.setAttrByPath [psCfg.user.name] {
-        extraGroups = ["docker"];
-      };
-
-    environment.systemPackages = with pkgs; [
-      docker-compose
-    ];
-  };
+  environment.systemPackages = with pkgs; [ docker-compose ];
 }

modules/email/default.nix

@@ -4,30 +4,58 @@
   pkgs,
   ...
 }:
-with lib; let
+let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.email;
-in {
-  options.pub-solar.email = {
-    enable = mkEnableOption "Life in headers";
-  };
+in
+{
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    w3m
+    urlscan
+    neomutt
+    offlineimap
+    msmtp
+    mailto-mutt
+  ];
 
-  config = mkIf cfg.enable {
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          w3m
-          urlscan
-          neomutt
-          offlineimap
-          msmtp
-          mailto-mutt
-        ];
+  home-manager.users."${psCfg.user.name}" = {
+    programs.offlineimap = {
+      enable = true;
+      pythonFile = builtins.readFile ./offlineimap.py;
+    };
 
-        programs.offlineimap = {
-          enable = true;
-          pythonFile = builtins.readFile ./offlineimap.py;
-        };
-      };
+    xdg.configFile."mutt/muttrc".source = ./.config/mutt/muttrc;
+    xdg.configFile."mutt/base16.muttrc".source = ./.config/mutt/base16.muttrc;
+    xdg.configFile."mutt/mailcap".source = ./.config/mutt/mailcap;
+    xdg.configFile."offlineimap/functions.py".source = ./.config/offlineimap/functions.py;
+
+    xdg.configFile."mutt/accounts.muttrc".text = ''
+      source ./hello@benjaminbaedorf.eu.muttrc
+
+      macro index <f1> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/hello@benjaminbaedorf.eu.muttrc<enter><change-folder>!<enter>'
+      macro index <f2> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/benjamin.baedorf@rwth-aachen.de.muttrc<enter><change-folder>!<enter>'
+      macro index <f3> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/byb@miom.space.muttrc<enter><change-folder>!<enter>'
+      macro index <f4> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/mail@b12f.io.muttrc<enter><change-folder>!<enter>'
+      macro index <f5> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/admins@pub.solar.muttrc<enter><change-folder>!<enter>'
+      macro index <f6> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/crew@pub.solar.muttrc<enter><change-folder>!<enter>'
+    '';
+    xdg.configFile."mutt/hello@benjaminbaedorf.eu.muttrc".source =
+      ./.config/mutt + "/hello@benjaminbaedorf.eu.muttrc";
+    xdg.configFile."mutt/benjamin.baedorf@rwth-aachen.de.muttrc".source =
+      ./.config/mutt + "/benjamin.baedorf@rwth-aachen.de.muttrc";
+    xdg.configFile."mutt/hello@benjaminbaedorf.eu.signature".source =
+      ./.config/mutt + "/hello@benjaminbaedorf.eu.signature";
+    xdg.configFile."mutt/byb@miom.space.muttrc".source = ./.config/mutt + "/byb@miom.space.muttrc";
+    xdg.configFile."mutt/byb@miom.space.signature".source =
+      ./.config/mutt + "/byb@miom.space.signature";
+    xdg.configFile."mutt/mail@b12f.io.muttrc".source = ./.config/mutt + "/mail@b12f.io.muttrc";
+    xdg.configFile."mutt/mail@b12f.io.signature".source = ./.config/mutt + "/mail@b12f.io.signature";
+    xdg.configFile."mutt/admins@pub.solar.muttrc".source = ./.config/mutt + "/admins@pub.solar.muttrc";
+    xdg.configFile."mutt/admins@pub.solar.signature".source =
+      ./.config/mutt + "/admins@pub.solar.signature";
+    xdg.configFile."mutt/crew@pub.solar.muttrc".source = ./.config/mutt + "/crew@pub.solar.muttrc";
+    xdg.configFile."mutt/crew@pub.solar.signature".source =
+      ./.config/mutt + "/crew@pub.solar.signature";
+    xdg.configFile."offlineimap/config".source = ./.config/offlineimap/config;
+    xdg.configFile."msmtp/config".source = ./.config/msmtp/config;
   };
 }

modules/forgejo-actions-runner/default.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  pkgs,
+  lib,
+  flake,
+  ...
+}:
+let
+  hostname = config.networking.hostName;
+in
+{
+  age.secrets."forgejo-actions-runner-token.age" = {
+    file = "${flake.self}/secrets/forgejo-actions-runner-token.age";
+    mode = "440";
+  };
+
+  # Trust docker bridge interface traffic
+  # Needed for the docker runner to communicate with the act_runner cache
+  networking.firewall.trustedInterfaces = [ "br-+" ];
+
+  users.users.gitea-runner = {
+    home = "/var/lib/gitea-runner/${hostname}";
+    useDefaultShell = true;
+    group = "gitea-runner";
+    # Required to interact with nix daemon
+    extraGroups = [ "wheel" ];
+    isSystemUser = true;
+  };
+
+  users.groups.gitea-runner = { };
+
+  systemd.tmpfiles.rules = [ "d '/var/lib/gitea-runner' 0750 gitea-runner gitea-runner - -" ];
+
+  systemd.services."gitea-runner-${hostname}" = {
+    serviceConfig.DynamicUser = lib.mkForce false;
+  };
+
+  # forgejo actions runner
+  # https://forgejo.org/docs/latest/admin/actions/
+  # https://docs.gitea.com/usage/actions/quickstart
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances."${hostname}" = {
+      enable = true;
+      name = hostname;
+      url = "https://git.pub.solar";
+      tokenFile = config.age.secrets."forgejo-actions-runner-token.age".path;
+      labels = [
+        # provide a debian 12 bookworm base with Node.js for actions
+        "debian-latest:docker://git.pub.solar/pub-solar/actions-base-image:20-bookworm"
+        # fake the ubuntu name, commonly used in actions examples
+        "ubuntu-latest:docker://git.pub.solar/pub-solar/actions-base-image:20-bookworm"
+        # alpine with Node.js
+        "alpine-latest:docker://node:20-alpine"
+      ];
+    };
+  };
+}

modules/gaming/default.nix

@@ -4,28 +4,17 @@
   pkgs,
   ...
 }:
-with lib; let
+let
   psCfg = config.pub-solar;
-  cfg = config.pub-solar.gaming;
-in {
-  options.pub-solar.gaming = {
-    enable = mkEnableOption "Life in shooters";
-  };
+in
+{
+  programs.steam.enable = true;
+  nixpkgs.config.packageOverrides = pkgs: { steam = pkgs.steam.override { }; };
 
-  config = mkIf cfg.enable {
-    programs.steam.enable = true;
-    nixpkgs.config.packageOverrides = pkgs: {
-      steam = pkgs.steam.override {};
-    };
-
-    home-manager = with pkgs;
-      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-        home.packages = [
-          playonlinux
-          godot
-          obs-studio
-          obs-studio-plugins.wlrobs
-        ];
-      };
-  };
+  users.users."${psCfg.user.name}".packages = with pkgs; [
+    playonlinux
+    godot
+    obs-studio
+    obs-studio-plugins.wlrobs
+  ];
 }

modules/graphical/.config/swaync/config.json

@@ -0,0 +1,12 @@
+{
+  "positionX": "right",
+  "positionY": "top",
+  "timeout": 10,
+  "timeout-low": 5,
+  "timeout-critical": 0,
+  "notification-window-width": 500,
+  "keyboard-shortcuts": true,
+  "image-visibility": "always",
+  "transition-time": 200,
+  "hide-on-clear": false
+}