docs: update hosts list

.sops.yaml

@@ -3,12 +3,26 @@ keys:
     - &tux age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
 
   - &hosts
-    - &sirius age1maxsx5tq2h3d92rfyl8ekcdan5gu5cpch4qs3c56cu7qag02xgvs3h0gqc
+    - &sirius age1d3t78xlqd0erlqj2m9947l9eqwpge3zrperljw3xrshh0gjx4ghs8tuqcu
-    - &canopus age1x36yr8h993srfj29sfpzt4wyz52nztvncpmhgmfs0j26qvfecq3qvcm0an
+    - &canopus age1udt3cssu7ahdrhsvckt8450rswrr6mknn36xpq74dkfp9lpajvnq84kdzj
-    - &arcturus age1huqa3hc7wcxk4dpelrzny437nzrx4fnll3d8g9ahznzk268yju5qufapxy
+    - &homelab age1jg642q775gmnmxeu29gcf3lph8vem4xr8t84cxe809dpd0myrussh49h60
-    - &alpha age1mzxxxzhy3us3rd960ufqv7vlxj5cnug86md6x69llg9ujzw2pqws057llf
+    - &arcturus age1zsl5d4vj6gl3h96y5p53sq5y4vr4vtlwp727h7rp9a4xfkxm53lqrh6r50
+    - &alpha age145uq9emlxqzm3wqauy9zqj78wqx9e6h09xag6wust7jjgn4upfzsaemcvx
+    - &vega age1ydkclhk9kwqdq74utesqdfupt43lz64d5k65gz2z9uyljcqq9fcq3hv28l
+    - &capella age1y4luzn2jls7rvgphej23srvdlx563lxq29tvf66vhwwzaf7c3f3qzvresh
 
 creation_rules:
+  - path_regex: hosts/common/secrets.yaml$
+    key_groups:
+      - age:
+          - *tux
+          - *sirius
+          - *canopus
+          - *homelab
+          - *arcturus
+          - *alpha
+          - *vega
+          - *capella
   - path_regex: hosts/sirius/secrets.yaml$
     key_groups:
       - age:
@@ -29,3 +43,13 @@ creation_rules:
       - age:
           - *tux
           - *alpha
+  - path_regex: hosts/capella/secrets.yaml$
+    key_groups:
+      - age:
+          - *tux
+          - *capella
+  - path_regex: hosts/homelab/secrets.yaml$
+    key_groups:
+      - age:
+          - *tux
+          - *homelab

LICENSE

@@ -1,674 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<https://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -1,12 +1,10 @@
 <h3 align="center">
-  tux's nix flake
+  tux's Nix Flake
 </h3>
 <p align="center">
   <a href="https://wakatime.com/badge/user/012e8da9-99fe-4600-891b-bd9d8dce73d9/project/312e6509-0e4f-47b7-b5de-54985b546702" target="_blank"><img alt="home" src="https://wakatime.com/badge/user/012e8da9-99fe-4600-891b-bd9d8dce73d9/project/312e6509-0e4f-47b7-b5de-54985b546702.svg"></a>
   <a href="https://builtwithnix.org" target="_blank"><img alt="home" src="https://img.shields.io/static/v1?logo=nixos&logoColor=white&label=&message=Built%20with%20Nix&color=41439a"></a>
   <a href="https://github.com/zemmsoares/awesome-rices" target="_blank"><img alt="home" src="https://raw.githubusercontent.com/zemmsoares/awesome-rices/main/assets/awesome-rice-badge.svg"></a>
-  <img alt="GitHub repo size" src="https://img.shields.io/github/repo-size/tuxdotrs/nix-config">
-  <img alt="GitHub commit activity" src="https://img.shields.io/github/commit-activity/m/tuxdotrs/nix-config">
 </p>
 <p align="center">
 	<img src="https://github.com/user-attachments/assets/fc28c35f-b87a-4931-ae7f-c231a11fd1a3" alt="desktop">
@@ -22,163 +20,65 @@
 
 ## Hosts
 
-|     | Hostname   | Board             | CPU                | RAM   | GPU                       | Purpose                                                                          |
+|     | Type    | Name     | Hardware                                 | Purpose                                                                            |
-| --- | ---------- | ----------------- | ------------------ | ----- | ------------------------- | -------------------------------------------------------------------------------- |
+| --- | ------- | -------- | ---------------------------------------- | ---------------------------------------------------------------------------------- |
-| 🖥️  | `sirius`   | MSI X570-A Pro    | Ryzen 7 5700X3D    | 64GB  | RTX 3080 TI + RTX 3060 TI | Triple-monitor desktop running Windows Subsystem for Linux.                      |
+| 💻  | Desktop | sirius   | Ryzen 7 5700X3D - 64GB RAM - RTX 3080 TI | Multi-monitor desktop running Windows Subsystem for Linux.                         |
-| 💻  | `canopus`  | Asus Zephyrus G15 | Ryzen 9 5900HS     | 16GB  | RTX 3060                  | Optimized for productivity on the go and some gaming.                            |
+| 🖥️  | Laptop  | canopus  | Ryzen 9 5900HS - 16 GB RAM - RTX 3060    | Optimized for productivity on the go and some gaming.                              |
-| ☁️  | `homelab`  | Minisforum MS-A1  | Ryzen 7 8700G      | 32GB  | Radeon 780M               | WIP                                                                              |
+| 🖥️  | Server  | homelab  | Ryzen 7 8700G - 32 GB RAM - Radeon 780M  | WIP                                                                                |
-| ☁️  | `arcturus` | KVM               | 4 Core             | 8GB   |                           | Primary server responsible for exposing my homelab applications to the internet. |
+| ☁️  | VPS     | arcturus | 4 Core - 8 GB RAM                        | Primary server responsible for exposing my homelab applications to the internet.   |
-| ☁️  | `alpha`    | KVM               | 4 Core             | 4GB   |                           | Monitors uptime and health status of all services across the infrastructure.     |
+| 🥔  | VPS     | alpha    | 2 Core - 4 GB RAM                        | Monitors uptime and health status of all services across the infrastructure.       |
-| 🥔  | `vega`     | Raspberry Pi 3B+  | Cortex A53         | 1GB   |                           | Running AdGuard Home for network-wide ad blocking.                               |
+| 🥔  | Server  | vega     | Cortex A53 - 1 GB RAM                    | Running AdGuard Home for network-wide ad blocking.                                 |
-| 📱  | `capella`  | Samsung S25 Ultra | Snapdragon 8 Elite | 12GB  | Adreno 830                | Primary mobile for daily usage. (Locked)                                         |
+| 📱  | Phone   | capella  | S25 Ultra - 12 GB RAM                    | Yes, I run nix on my android device. lol                                           |
-| 📱  | `rigel`    | Motorola Edge 30  | Snapdragon 778G+   | 8GB   | Adreno 642L               | Secondary mobile for some fun. (Rooted)                                          |
+| 📱  | Phone   | rigel    | Edge 30 - 8 GB RAM (Rooted)              | Yes, I run nix on my android device. lol                                           |
-| ☁️  | `node`     | ASRock B565D4     | Ryzen 9 5950X      | 128GB |                           | Running Ethereum and BSC nodes.                                                  |
+| ☁️  | VPS     | node     | i9-13900 - 64 GB RAM                     | Running Ethereum and BSC nodes. Currently in the process of migrating from Ubuntu. |
 
 ## Installation
 
-> [!NOTE]  
+Boot into NixOS bootable USB and then enter the following commands
-> This will get your base system ready, but keep in mind that many things might not work correctly — such as monitor resolution, font size, and more.
 
-### Prerequisites
+```
-
+# Clone this repositry
-Boot into the NixOS bootable USB before proceeding with the installation steps.
-
-### Installation Steps
-
-#### 1. Clone the repository
-
-```bash
 git clone https://github.com/tuxdotrs/nix-config.git
+
+# Navigate to the repository directory
 cd nix-config
-```
 
-#### 2. Gain root privileges
+# Install disko for disk partitioning
+nix-shell -p disko
 
-```bash
+# Partition the disk and make sure to replace DISK_PATH (eg. /dev/vda)
-sudo su
-
-```
-
-#### 3. Set up disk partitioning
-
-Install the required tools:
-
-```bash
-nix-shell -p disko neovim
-```
-
-Partition your disk using disko. **This will wipe your drive.** Replace `DISK_PATH` with your actual disk path (e.g., `/dev/vda` or `/dev/nvme0n1`):
-
-```bash
 disko --mode disko ./hosts/canopus/disko.nix --arg device '"DISK_PATH"'
-```
 
-#### 4. Configure your disk
+# Generate the hardware.nix file for your system
-
-Edit the configuration file:
-
-```bash
-nvim ./hosts/canopus/default.nix
-```
-
-In the imports statement, replace:
-
-```nix
-(import ./disko.nix {device = "/dev/nvme0n1";})
-```
-
-with:
-
-```nix
-(import ./disko.nix {device = "DISK_PATH";})
-```
-
-Make sure to replace `DISK_PATH` with your actual disk path.
-
-#### 5. Generate hardware configuration
-
-```bash
 nixos-generate-config --no-filesystems --root /mnt
-```
 
-Copy the generated hardware configuration to the repository:
+# Replace the hardware.nix with generated one
-
-```bash
 cp /mnt/etc/nixos/hardware-configuration.nix ./hosts/canopus/hardware.nix
-```
 
-#### 6. Install NixOS
+# Install
-
-```bash
 nixos-install --root /mnt --flake .#canopus
-```
 
-#### 7. Enter into the new system
+# Reboot to your beautiful DE
-
-```bash
-nixos-enter --root /mnt
-```
-
-#### 8. Set up directories and permissions
-
-```bash
-mkdir -p /persist/home
-chown -R tux:users /persist/home
-```
-
-#### 9. Set passwords
-
-Set the root password:
-
-```bash
-passwd root
-```
-
-Set the user password:
-
-```bash
-passwd tux
-```
-
-#### 10. Reboot
-
-```bash
 reboot
 ```
 
-Your NixOS system should now boot into a beautiful DE.
-
 ## Components
 
 |               | Wayland | Xorg             |
-| ------------- | -------- | ---------------- |
+| ------------- | ------- | ---------------- |
-| DM            | ly       | ly               |
+| DM            | /       | SDDM             |
-| WM/DE         | Hyprland | AwesomeWM        |
+| WM/DE         | /       | AwesomeWM        |
-| Compositor    | Hyprland | Picom (Jonaburg) |
+| Compositor    | /       | Picom (Jonaburg) |
-| Bar           | tPanel   | Wibar            |
+| Bar           | /       | Wibar            |
-| Hotkeys       | Hyprland | Awful            |
+| Hotkeys       | /       | Awful            |
-| Launcher      | tPanel   | Rofi             |
+| Launcher      | /       | Rofi             |
-| Notifications | tPanel   | Naughty          |
+| Notifications | /       | Naughty          |
-| Terminal      | Wezterm  | Wezterm          |
+| Terminal      | /       | Wezterm          |
-| Editor        | Neovim   | Neovim           |
+| Editor        | /       | Neovim           |
 
 ## Showcase
 
-### Desktop Hyprland
+### Desktop
-
-![Desktop](https://raw.githubusercontent.com/tuxdotrs/nix-config/refs/heads/main/assets/hyprland/desktop.png)
-
-### tPanel
-
-![tPanel](https://raw.githubusercontent.com/tuxdotrs/nix-config/refs/heads/main/assets/hyprland/tPanel.png)
-
-### Workflow
-
-![Workflow](https://raw.githubusercontent.com/tuxdotrs/nix-config/refs/heads/main/assets/hyprland/workflow.png)
-
-## Showcase
-
-### Desktop AwesomeWM
 
 ![2024-08-08_18-33](https://github.com/user-attachments/assets/1cdcc387-0f68-486c-a76c-a36ad2acb78d)
 

flake.nix

@@ -1,67 +1,160 @@
 {
-  description = "tux's nix configurations";
+  description = "tux's Nix Flake";
 
-  outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } (inputs.import-tree ./modules);
+  outputs = {
+    self,
+    nixpkgs,
+    deploy-rs,
+    ...
+  } @ inputs: let
+    inherit (self) outputs;
+    inherit (inputs.nixpkgs.lib) nixosSystem;
+    inherit (inputs.nix-on-droid.lib) nixOnDroidConfiguration;
+    forAllSystems = nixpkgs.lib.genAttrs [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    username = "tux";
+    email = "t@tux.rs";
 
-  inputs = {
+    mkNixOSConfig = host: {
-    flake-parts = {
+      specialArgs = {inherit inputs outputs username email;};
-      url = "github:hercules-ci/flake-parts";
+      modules = [./hosts/${host}];
-      inputs.nixpkgs-lib.follows = "nixpkgs";
     };
 
+    mkDroidConfig = host: {
+      pkgs = import nixpkgs {system = "aarch64-linux";};
+      extraSpecialArgs = {inherit inputs outputs username email;};
+      modules = [./hosts/${host}];
+    };
+
+    mkNixOSNode = hostname: {
+      inherit hostname;
+      profiles.system = {
+        user = "root";
+        path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.${hostname};
+      };
+    };
+
+    activateNixOnDroid = configuration:
+      deploy-rs.lib.aarch64-linux.activate.custom
+      configuration.activationPackage
+      "${configuration.activationPackage}/activate";
+
+    mkDroidNode = hostname: {
+      inherit hostname;
+      profiles.system = {
+        sshUser = "nix-on-droid";
+        user = "nix-on-droid";
+        magicRollback = true;
+        sshOpts = ["-p" "8022"];
+        path = activateNixOnDroid self.nixOnDroidConfigurations.${hostname};
+      };
+    };
+  in {
+    packages = forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
+    formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.alejandra);
+
+    # Custom packages and modifications, exported as overlays
+    overlays = import ./overlays {inherit inputs;};
+
+    # NixOS configuration entrypoint
+    # 'nixos-rebuild switch --flake .#your-hostname'
+    nixosConfigurations = {
+      arcturus = nixosSystem (mkNixOSConfig "arcturus");
+      canopus = nixosSystem (mkNixOSConfig "canopus");
+      alpha = nixosSystem (mkNixOSConfig "alpha");
+      sirius = nixosSystem (mkNixOSConfig "sirius");
+      vega = nixosSystem (mkNixOSConfig "vega");
+      vps = nixosSystem (mkNixOSConfig "vps");
+      isoImage = nixosSystem (mkNixOSConfig "isoImage");
+      homelab = nixosSystem (mkNixOSConfig "homelab");
+    };
+
+    # NixOnDroid configuration entrypoint
+    # 'nix-on-droid switch --flake .#your-hostname'
+    nixOnDroidConfigurations = {
+      capella = nixOnDroidConfiguration (mkDroidConfig "capella");
+      rigel = nixOnDroidConfiguration (mkDroidConfig "rigel");
+    };
+
+    deploy = {
+      nodes = {
+        arcturus = mkNixOSNode "arcturus";
+        canopus = mkNixOSNode "canopus";
+        alpha = mkNixOSNode "alpha";
+        sirius = mkNixOSNode "sirius";
+        vega = mkNixOSNode "vega";
+        capella = mkNixOSNode "capella";
+        homelab = mkNixOSNode "homelab";
+        rigel = mkDroidNode "rigel";
+      };
+    };
+    checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+  };
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/release-24.11";
+    nixos-wsl = {
+      url = "github:nix-community/nixos-wsl";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    nix-vscode-extensions = {
-    disko = {
+      url = "github:nix-community/nix-vscode-extensions";
-      url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
-    tnvim = {
-      url = "github:tuxdotrs/tnvim";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    tpanel = {
-      url = "github:tuxdotrs/tpanel";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    cyber-tux = {
-      url = "git+ssh://git@github.com/tuxdotrs/cyber-tux.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     wezterm-flake = {
       url = "github:wez/wezterm/main?dir=nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    disko = {
-    vicinae-extensions = {
+      url = "github:nix-community/disko";
-      url = "github:vicinaehq/extensions";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    nix-secrets = {
-    mango = {
+      url = "git+ssh://git@github.com/tuxdotrs/nix-secrets.git?shallow=1";
-      url = "github:DreamMaoMao/mango";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    nix-on-droid = {
-    import-tree.url = "github:vic/import-tree";
+      url = "github:nix-community/nix-on-droid/release-24.05";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+      inputs.nixpkgs.follows = "nixpkgs";
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11-small";
+      inputs.home-manager.follows = "home-manager";
+    };
+    tawm = {
+      url = "github:tuxdotrs/tawm";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    tnvim = {
+      url = "github:tuxdotrs/tnvim";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    trok = {
+      url = "git+ssh://git@github.com/tuxdotrs/trok.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    tfolio = {
+      url = "git+ssh://git@github.com/tuxdotrs/tfolio.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    cyber-tux = {
+      url = "git+ssh://git@github.com/tuxdotrs/cyber-tux.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nix-index-database = {
+      url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    ghostty.url = "github:ghostty-org/ghostty";
+    nixos-hardware.url = "github:nixos/nixos-hardware";
+    nixpkgs-f2k.url = "github:moni-dz/nixpkgs-f2k";
+    nur.url = "github:nix-community/nur";
+    sops-nix.url = "github:Mic92/sops-nix";
     impermanence.url = "github:nix-community/impermanence";
     deploy-rs.url = "github:serokell/deploy-rs";
-    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-    sops-nix.url = "github:Mic92/sops-nix";
-    treefmt-nix.url = "github:numtide/treefmt-nix";
-    lan-mouse.url = "github:feschber/lan-mouse";
-    hyprland.url = "github:hyprwm/Hyprland";
-    awww.url = "git+https://codeberg.org/LGFae/awww";
-    nixcord.url = "github:kaylorben/nixcord";
-    nur.url = "github:nix-community/nur";
-    lanzaboote.url = "github:nix-community/lanzaboote/v1.0.0";
   };
 }

hosts/alpha/default.nix

@@ -0,0 +1,103 @@
+{
+  pkgs,
+  username,
+  config,
+  email,
+  inputs,
+  ...
+}: {
+  imports = [
+    ./hardware.nix
+    ../common
+    ../../modules/nixos/selfhosted/uptime-kuma.nix
+  ];
+
+  tux.services.openssh.enable = true;
+  tux.services.openssh.ports = [23];
+
+  tux.services.tfolio.enable = true;
+
+  sops.secrets = {
+    borg_encryption_key = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    "cloudflare_credentials/email" = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    "cloudflare_credentials/dns_api_token" = {
+      sopsFile = ./secrets.yaml;
+    };
+  };
+
+  boot = {
+    kernelPackages = pkgs.linuxPackages_zen;
+    initrd.systemd.enable = true;
+
+    loader = {
+      grub.device = "/dev/sda";
+      timeout = 1;
+    };
+  };
+
+  networking = {
+    hostName = "alpha";
+
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [80 443 22];
+    };
+  };
+
+  security = {
+    acme = {
+      acceptTerms = true;
+      defaults.email = "${email}";
+      certs = {
+        "tux.rs" = {
+          domain = "*.tux.rs";
+          extraDomainNames = ["tux.rs"];
+          dnsProvider = "cloudflare";
+          credentialFiles = {
+            CLOUDFLARE_EMAIL_FILE = config.sops.secrets."cloudflare_credentials/email".path;
+            CLOUDFLARE_DNS_API_TOKEN_FILE = config.sops.secrets."cloudflare_credentials/dns_api_token".path;
+          };
+        };
+      };
+    };
+  };
+
+  users.users.nginx.extraGroups = ["acme"];
+
+  tux.services.nginxStreamProxy = {
+    enable = true;
+    upstreamServers = inputs.nix-secrets.proxy-servers;
+  };
+
+  services = {
+    nginx = {
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+    };
+  };
+
+  programs = {
+    zsh.enable = true;
+    dconf.enable = true;
+  };
+
+  environment.persistence."/persist" = {
+    enable = false;
+  };
+
+  home-manager.users.${username} = {
+    imports = [
+      ./home.nix
+    ];
+  };
+
+  system.stateVersion = "23.11";
+}

hosts/alpha/hardware.nix

@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/471d0988-e57c-4767-a2b4-c93797a8c16f";
+    fsType = "ext4";
+  };
+
+  swapDevices = [];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/alpha/home.nix

@@ -0,0 +1,3 @@
+{...}: {
+  home.stateVersion = "23.11";
+}

hosts/alpha/secrets.yaml

@@ -0,0 +1,33 @@
+borg_encryption_key: ENC[AES256_GCM,data:4rS4RVUbSErLEVJuUluYOrw0m2LlYP7zEeYTL4yTmc4=,iv:epNhm2nSDF4Lp+Iu/vZuDiTna+1q59lY7Ztmpcpmb5o=,tag:7o0MwZBdiDSPaL07qVOfWg==,type:str]
+cloudflare_credentials:
+    email: ENC[AES256_GCM,data:Re656wFjQWWNO/k=,iv:NsRdtzMbkOPS9kN/y/IYzRrBr+xmDXp87DTiNwHKesc=,tag:4hGnmto08H2MKxk/7QkI5w==,type:str]
+    dns_api_token: ENC[AES256_GCM,data:703Nk1PaePWYuKNVJkSVTplAvsSTLrYrWdhZlTqlMNRa6m2j5neahg==,iv:RHpz1O1TgFsooYGIJiI8Owwmk5hzd+x+DFADvt+k9C0=,tag:zlDnKbLbSBVXMaHOnk0AuQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkTnRhZVg3MmNiOFpoeTE3
+            SXdtRXN1VS82S3AveDFMRjFYQVJpMDdyQWowCjJrQlIwN2VHQUlUazNaMERnRDJR
+            dFQ2VUpDMlJENVU5cWtIY3pZZU9wSmcKLS0tIEF1NzRkSHJ5cTQrM3RWdUtrYzkw
+            VXI3QzE5UlBhS2g1RUl0TEtaS0NPTW8KAQ+9Hk3HNMhwm33T3mzgkavs6mx4zKqZ
+            xjfB5d5W5UI+7uYC+RQNNA/cVxAgkMiW4OL4HAt2hXD6lrsjNzxzpQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age145uq9emlxqzm3wqauy9zqj78wqx9e6h09xag6wust7jjgn4upfzsaemcvx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4OHkvTk5JaWxLbmZ5VEtV
+            S2VkMVl0WGZOYk5WRTJISWMxU0tja0x6alFrCnJISFNTbDhNRXJjUDJDS1JmWmRK
+            aGhyaFBjNTlhanE3UGdQb0JFUWFCTWcKLS0tIDhVZ1JxcGJUcWsvWVFSWFZWYjdx
+            K2syUkFRb3F3aFFFeis3OFR4ZENielEKGrUQCi7xaPzJKypvy4tyoSG1a2/l5Le0
+            dVcheJcRJvoo89WWrciMhZ/MCs5kffI464RVW7q9BxbJRDO2Obm2dw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-13T09:10:11Z"
+    mac: ENC[AES256_GCM,data:GTzDXeEzRFmrX0PU0GKPF5JwscZUrzUmB90ThHPZ7oqflOPpZBrotOo4MZCcU37HEPAXVeFUzVnsjN5bOp5RFqs70r9upj2jXiIsbx/yskcPOML3GAFmVc9HbjOK9TLyie2bJWaFhT+b7CgiJvyIu0QEh43dqSI4d3H1T8Hqn1o=,iv:kcV3Xz276+PKrztSIDB2SiJjDV2iqCn2A90AjEO326M=,tag:3xu3sQeRB15Os06i484GFw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

hosts/arcturus/default.nix

@@ -0,0 +1,218 @@
+{
+  modulesPath,
+  inputs,
+  username,
+  lib,
+  email,
+  config,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+    inputs.disko.nixosModules.default
+    (import ./disko.nix {device = "/dev/vda";})
+
+    ../common
+    ../../modules/nixos/virtualisation/docker.nix
+    ../../modules/nixos/selfhosted/postgresql.nix
+    ../../modules/nixos/selfhosted/headscale.nix
+    ../../modules/nixos/selfhosted/vaultwarden.nix
+    ../../modules/nixos/selfhosted/gitea.nix
+    ../../modules/nixos/selfhosted/plausible.nix
+    ../../modules/nixos/selfhosted/monitoring/grafana.nix
+    ../../modules/nixos/selfhosted/monitoring/loki.nix
+    ../../modules/nixos/selfhosted/monitoring/promtail.nix
+    ../../modules/nixos/selfhosted/ntfy-sh.nix
+    ../../modules/nixos/selfhosted/searx.nix
+    ../../modules/nixos/selfhosted/wakapi.nix
+    ../../modules/nixos/selfhosted/nextcloud.nix
+    ../../modules/nixos/selfhosted/silver-bullet.nix
+    ../../modules/nixos/selfhosted/rustdesk-server.nix
+    ../../modules/nixos/selfhosted/kasmweb.nix
+    ../../modules/nixos/selfhosted/open-webui.nix
+    ../../modules/nixos/selfhosted/glance
+  ];
+
+  tux.services.openssh.enable = true;
+
+  sops.secrets = {
+    borg_encryption_key = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    searx_secret_key = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    "cloudflare_credentials/email" = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    "cloudflare_credentials/dns_api_token" = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    plausible_key = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    wakapi_salt = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    nextcloud_password = {
+      sopsFile = ./secrets.yaml;
+      owner = "nextcloud";
+    };
+
+    silver_bullet = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    "cs2_secrets/SRCDS_TOKEN" = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    "cs2_secrets/CS2_RCONPW" = {
+      sopsFile = ./secrets.yaml;
+    };
+
+    "cs2_secrets/CS2_PW" = {
+      sopsFile = ./secrets.yaml;
+    };
+  };
+
+  nixpkgs = {
+    hostPlatform = "x86_64-linux";
+  };
+
+  boot = {
+    kernel.sysctl = {
+      "vm.swappiness" = 10;
+    };
+
+    initrd.systemd = {
+      enable = lib.mkForce true;
+
+      services.wipe-my-fs = {
+        wantedBy = ["initrd.target"];
+        after = ["initrd-root-device.target"];
+        before = ["sysroot.mount"];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          mkdir /btrfs_tmp
+          mount /dev/disk/by-partlabel/disk-primary-root /btrfs_tmp
+
+          if [[ -e /btrfs_tmp/root ]]; then
+              mkdir -p /btrfs_tmp/old_roots
+              timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+              mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+          fi
+
+          delete_subvolume_recursively() {
+              IFS=$'\n'
+              for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+                  delete_subvolume_recursively "/btrfs_tmp/$i"
+              done
+              btrfs subvolume delete "$1"
+          }
+
+          for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+              delete_subvolume_recursively "$i"
+          done
+
+          btrfs subvolume create /btrfs_tmp/root
+          umount /btrfs_tmp
+        '';
+      };
+    };
+
+    loader = {
+      grub = {
+        efiSupport = true;
+        efiInstallAsRemovable = true;
+        configurationLimit = 10;
+      };
+      timeout = 1;
+    };
+  };
+
+  networking = {
+    hostName = "arcturus";
+
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [80 443 22 3333 8081];
+    };
+  };
+
+  security = {
+    acme = {
+      acceptTerms = true;
+      defaults.email = "${email}";
+      certs = {
+        "tux.rs" = {
+          group = "nginx";
+          domain = "*.tux.rs";
+          extraDomainNames = ["tux.rs"];
+          dnsProvider = "cloudflare";
+          credentialFiles = {
+            CLOUDFLARE_EMAIL_FILE = config.sops.secrets."cloudflare_credentials/email".path;
+            CLOUDFLARE_DNS_API_TOKEN_FILE = config.sops.secrets."cloudflare_credentials/dns_api_token".path;
+          };
+        };
+      };
+    };
+  };
+
+  users.users.nginx.extraGroups = ["acme"];
+
+  services = {
+    nginx = {
+      recommendedTlsSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedProxySettings = true;
+      recommendedZstdSettings = true;
+    };
+  };
+
+  programs.fuse.userAllowOther = true;
+  fileSystems."/persist".neededForBoot = true;
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/nixos"
+      "/var/lib/acme"
+      "/var/lib/postgresql"
+      "/var/lib/headscale"
+      "/var/lib/vaultwarden"
+      "/var/lib/gitea"
+      "/var/lib/clickhouse"
+      "/var/lib/grafana"
+      "/var/lib/promtail"
+      "/var/lib/private"
+      "/var/lib/nextcloud"
+      "/var/lib/silverbullet"
+      "/var/lib/kasmweb"
+    ];
+    files = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+  };
+
+  home-manager.users.${username} = {
+    imports = [
+      ./home.nix
+    ];
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/arcturus/disko.nix

@@ -0,0 +1,53 @@
+{device ? throw "Set this to the disk device, e.g. /dev/nvme0n1", ...}: {
+  disko.devices.disk.primary = {
+    inherit device;
+    type = "disk";
+    content = {
+      type = "gpt"; # GPT partitioning scheme
+      partitions = {
+        boot = {
+          name = "boot";
+          size = "1M";
+          type = "EF02";
+        };
+        # EFI Partition
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = ["defaults" "umask=0077"];
+          };
+        };
+        # Btrfs Root Partition
+        root = {
+          size = "100%"; # Use remaining space
+          type = "8300"; # Linux filesystem type
+          content = {
+            type = "btrfs";
+            subvolumes = {
+              "/root" = {
+                mountOptions = ["compress=zstd"]; # Compression for better performance
+                mountpoint = "/"; # Root subvolume
+              };
+              "/persist" = {
+                mountOptions = ["compress=zstd"]; # Compression for persistent data
+                mountpoint = "/persist"; # Persistent subvolume
+              };
+              "/nix" = {
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                  "noacl"
+                ]; # Optimize for Nix store
+                mountpoint = "/nix"; # Nix subvolume
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/arcturus/home.nix

@@ -0,0 +1,15 @@
+{username, ...}: {
+  home.persistence."/persist/home/${username}" = {
+    directories = [
+      "Projects"
+      "Stuff"
+      ".ssh"
+    ];
+    files = [
+      ".zsh_history"
+    ];
+    allowOther = true;
+  };
+
+  home.stateVersion = "24.11";
+}

hosts/arcturus/secrets.yaml

@@ -0,0 +1,42 @@
+borg_encryption_key: ENC[AES256_GCM,data:7DZQaoS2a5mPjTej25vr1aO1yAAPyXT2tf/VxKrLxF0=,iv:it8JlyEj4r4Z+qDvoEWMQlGkbVh08M/BCkGLVzRCVKQ=,tag:81gRhru8J3hkQhIbgUOgBg==,type:str]
+searx_secret_key: ENC[AES256_GCM,data:Z49PJ2gNI5CI0IfzOta+r67VNUvjoPpMVv5lajGhUMPzSy1KWZC5wIM3d02jWwCOsNjXdU5hE3j9W0rkoy5ZhFPXBJRUEv5b6IcaLA==,iv:364zGZkD2LO189nkvizl8yjedi1IgYEEQMA67SexSSI=,tag:qPqefG6jUaBOpUy6d7E++w==,type:str]
+plausible_key: ENC[AES256_GCM,data:Ynf2aJ6RLRdAkT9ltLpCXTl8zg/VESDchlf67PmKjc93rSfDgq9tFqv1q55Km2lDo7y9iLu5WyLLg24CSSwy8Q==,iv:yW5hgP4dhfkvunv3iYmXGEH9w29OOmrG4ourPagslVg=,tag:C5PVfEseP5gJdoQQL4gERQ==,type:str]
+wakapi_salt: ENC[AES256_GCM,data:Vk5Lezv0f/0ehHqXXBCsQxWFYE2KFujTfII0r7Gd1BXFrwiPEdX62aZ+9LQx7s1RTHh0n+LP/5t0cmHO/fJhGw==,iv:ZUlRwNXUCQ53Lymi9fO4qoBWjLpHVWfTnYM0Z1I6F5o=,tag:dadkEKV7paH4+qAz7Bxxqg==,type:str]
+cloudflare_credentials:
+    email: ENC[AES256_GCM,data:qesgxkzUglKdYPI=,iv:2XDEoQzmtagSiILWZzJPswdhkQ+qjdZfNd+LL1nHPx8=,tag:K1F23Za2Zq78tzf0fl5zEw==,type:str]
+    dns_api_token: ENC[AES256_GCM,data:ibSL4KWYhqgHjo27fiSqB1iN9NWU3/qGGuLpmiMpBf+qCuh8uxR7Yw==,iv:NapMvfUSm5rgeROK7KuxGyog8s2PW9CCKtjRG87FoCQ=,tag:/Oah7PRCe4XPts0IYt83zw==,type:str]
+nextcloud_password: ENC[AES256_GCM,data:o37mq4YHQT5pbi+cXrk=,iv:8HiDwdHTozNM2lHpgqVhdsspuifppsL2I6Z31xEnYFI=,tag:xTnfn8HcubfiQwLYIkpxjw==,type:str]
+silver_bullet: ENC[AES256_GCM,data:waEPGskjkkdX98PKzgZG1bzS+NwL6GR8kok=,iv:8a8IeXla8XSHFzjKcVY3QYUK5aFk2kPHVIRvs1y7So0=,tag:p++o6wvLtG5DbDmUusRQLg==,type:str]
+cs2_secrets:
+    SRCDS_TOKEN: ENC[AES256_GCM,data:SzPz4sHDgEoioX8ylLFM6AUUS60gWYpR3ifxUD8A8IQga24t6GM0dyGDryc=,iv:XefIn9yCLPLKVRA+rZiSGUH3l6ZANIJoGRuM/3vFLIw=,tag:flEjl9c7i3XBlHJaq41QYQ==,type:str]
+    CS2_RCONPW: ENC[AES256_GCM,data:ZyVeoOngZjxKR/ObYo5yJC1ViCNufuA=,iv:+fJK0sY39V/iH7OjT0AzQq6RefVzLZCDETYcAMFnZNU=,tag:IOhRUQRdffNMXa2cKZvi/w==,type:str]
+    CS2_PW: ENC[AES256_GCM,data:W1Cur7YT1F/+45vmqif2JbpjVURfnfo=,iv:sBNDM2N+QWDAMculBBZtYZcM7ILEfpwkwOd7ErORQhI=,tag:XFsxTUjctZKU38RQUfJ8HQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TGpVMzNDZjNQSkNDQmM3
+            eXpvZDRPZW9Kbm81Z2VVUVZIckFNUC9zTEZzCmliUkNWS01YMHVRaUoxTS84VmxQ
+            UDZtbkhmZmdZVWVsaHN3djkwSERGQ1kKLS0tIEh0ckhDTkQvcEM0UFI2MUVXVHI5
+            WnhEdnRqazdZWmczYXYxNy9BMHdwdEUKYgB34OOezF3iF706pIfDmQ0FJEHXBbGF
+            EJRNmA4Zl1AwyzkN3NSlctzvxx201T1GWL4qZeyVafRv5jQ9oSfK7g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zsl5d4vj6gl3h96y5p53sq5y4vr4vtlwp727h7rp9a4xfkxm53lqrh6r50
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHeXNrT3c1bENOK0lNZWNT
+            eFBqYm1BRHBhakFQMVVIKzR0SDRDOW9jUXdBCmFIQWZRSnBlOFBralVFakQ2clNY
+            Q1Nma0pRVHh4L3IwQm1GbTdqb1BUcWsKLS0tIFRQOVIxb1FRc29WSVVERWsxSDhq
+            NGprRGVyZ2plWVNrM3drM3JSUjM2L0UKuNk5DqYn2DIfRpY72zDRP5BKoVAXtNv9
+            uLI//8wc7f4I3uBdARQdpRE1fapY1UOJOn3i0yndrZARPEbdohRK1Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-24T12:59:25Z"
+    mac: ENC[AES256_GCM,data:WGWGvbqu07XZ5oU2HBGUbP/9oNCavPBXb2SIm10CG2s377QAWZmpdOC2AGAX8J3NfLtyWEHm8WUQSKjNKvKWARsXU24lNnY+BTSIkF8ymrAU/rRMX8VJi92IYjregAfVBIaYomxqJFhNuAhmsQ75ZYMpRBTusxiEFEdl/H9obiY=,iv:VXIVkpnOY2gZ/xDX/oFvZn08K5Gp49tpiJQGK20blro=,tag:Hkk92ZQWTRY9oQb3Mm6R3w==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.3

hosts/canopus/default.nix

@@ -0,0 +1,332 @@
+{
+  inputs,
+  username,
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  imports = [
+    inputs.nixos-hardware.nixosModules.asus-zephyrus-ga503
+    inputs.disko.nixosModules.default
+
+    (import ./disko.nix {device = "/dev/nvme0n1";})
+    ./hardware.nix
+
+    ../common
+    ../../modules/nixos/desktop
+    ../../modules/nixos/desktop/awesome
+    ../../modules/nixos/desktop/hyprland
+    ../../modules/nixos/virtualisation
+    ../../modules/nixos/steam.nix
+  ];
+
+  tux.services.openssh.enable = true;
+
+  nixpkgs.config.cudaSupport = true;
+
+  sops.secrets = {
+    hyperbolic_api_key = {
+      sopsFile = ./secrets.yaml;
+      owner = "${username}";
+    };
+  };
+
+  networking = {
+    hostName = "canopus";
+    networkmanager = {
+      enable = true;
+      wifi.powersave = false;
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [80 443 22 3000 6666 8081];
+
+      # Facilitate firewall punching
+      allowedUDPPorts = [41641];
+
+      allowedTCPPortRanges = [
+        {
+          from = 1714;
+          to = 1764;
+        }
+      ];
+      allowedUDPPortRanges = [
+        {
+          from = 1714;
+          to = 1764;
+        }
+      ];
+    };
+  };
+
+  boot = {
+    binfmt.emulatedSystems = ["aarch64-linux"];
+
+    plymouth = {
+      enable = true;
+      theme = "spinner-monochrome";
+      themePackages = [
+        (pkgs.plymouth-spinner-monochrome.override {inherit (config.boot.plymouth) logo;})
+      ];
+    };
+
+    kernelParams = [
+      "quiet"
+      "loglevel=3"
+      "systemd.show_status=auto"
+      "udev.log_level=3"
+      "rd.udev.log_level=3"
+      "vt.global_cursor_default=0"
+    ];
+    consoleLogLevel = 0;
+    initrd.verbose = false;
+
+    kernelPackages = pkgs.linuxPackages_zen;
+    supportedFilesystems = ["ntfs"];
+
+    initrd.systemd = {
+      enable = lib.mkForce true;
+
+      services.wipe-my-fs = {
+        wantedBy = ["initrd.target"];
+        after = ["initrd-root-device.target"];
+        before = ["sysroot.mount"];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          mkdir /btrfs_tmp
+          mount /dev/disk/by-partlabel/disk-primary-root /btrfs_tmp
+
+          if [[ -e /btrfs_tmp/root ]]; then
+              mkdir -p /btrfs_tmp/old_roots
+              timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+              mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+          fi
+
+          delete_subvolume_recursively() {
+              IFS=$'\n'
+              for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+                  delete_subvolume_recursively "/btrfs_tmp/$i"
+              done
+              btrfs subvolume delete "$1"
+          }
+
+          for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+              delete_subvolume_recursively "$i"
+          done
+
+          btrfs subvolume create /btrfs_tmp/root
+          umount /btrfs_tmp
+        '';
+      };
+    };
+
+    loader = {
+      systemd-boot = {
+        enable = true;
+        configurationLimit = 5;
+      };
+      efi.canTouchEfiVariables = true;
+      timeout = 1;
+    };
+  };
+
+  hardware = {
+    bluetooth.enable = true;
+    bluetooth.powerOnBoot = true;
+    graphics.enable32Bit = true;
+  };
+
+  security = {
+    polkit.enable = true;
+    rtkit.enable = true;
+  };
+
+  systemd = {
+    enableEmergencyMode = false;
+
+    user = {
+      services.polkit-gnome-authentication-agent-1 = {
+        description = "polkit-gnome-authentication-agent-1";
+        wantedBy = ["graphical-session.target"];
+        wants = ["graphical-session.target"];
+        after = ["graphical-session.target"];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
+          Restart = "on-failure";
+          RestartSec = 1;
+          TimeoutStopSec = 10;
+        };
+      };
+    };
+  };
+
+  programs = {
+    ssh.startAgent = true;
+    xfconf.enable = true;
+    file-roller.enable = true;
+    thunar = {
+      enable = true;
+      plugins = with pkgs.xfce; [thunar-archive-plugin thunar-volman];
+    };
+    nix-ld = {
+      enable = true;
+      package = pkgs.nix-ld-rs;
+    };
+    nm-applet.enable = true;
+    noisetorch.enable = true;
+  };
+
+  services = {
+    resolved.enable = true;
+    flatpak.enable = true;
+
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+    };
+
+    logind = {
+      extraConfig = "HandlePowerKey=suspend";
+      lidSwitch = "suspend";
+      lidSwitchExternalPower = "suspend";
+    };
+
+    xrdp = {
+      enable = true;
+      openFirewall = true;
+      defaultWindowManager = "awesome";
+      audio.enable = true;
+    };
+
+    syncthing = {
+      enable = true;
+      user = "tux";
+      dataDir = "/home/tux/";
+      openDefaultPorts = true;
+    };
+
+    xserver = {
+      enable = true;
+      xkb = {
+        layout = "in";
+        variant = "eng";
+      };
+    };
+
+    libinput.touchpad.naturalScrolling = true;
+
+    # To use Auto-cpufreq we need to
+    # disable TLP because it's enabled by nixos-hardware
+    tlp.enable = false;
+    auto-cpufreq = {
+      enable = true;
+      settings = {
+        battery = {
+          governor = "powersave";
+          turbo = "never";
+          scaling_min_freq = 400000;
+          scaling_max_freq = 3800000;
+        };
+        charger = {
+          governor = "powersave";
+          turbo = "never";
+          scaling_max_freq = 3800000;
+        };
+      };
+    };
+
+    blueman.enable = true;
+
+    supergfxd = {
+      enable = true;
+      settings = {
+        mode = "Integrated";
+        vfio_enable = false;
+        vfio_save = false;
+        always_reboot = false;
+        no_logind = false;
+        logout_timeout_s = 180;
+        hotplug_type = "None";
+      };
+    };
+
+    asusd = {
+      enable = true;
+      enableUserService = true;
+      asusdConfig.text = ''
+        (
+          charge_control_end_threshold: 100,
+          panel_od: false,
+          mini_led_mode: false,
+          disable_nvidia_powerd_on_battery: true,
+          ac_command: "",
+          bat_command: "",
+          platform_policy_on_battery: Quiet,
+          platform_policy_on_ac: Quiet,
+          ppt_pl1_spl: None,
+          ppt_pl2_sppt: None,
+          ppt_fppt: None,
+          ppt_apu_sppt: None,
+          ppt_platform_sppt: None,
+          nv_dynamic_boost: None,
+          nv_temp_target: None,
+        )
+      '';
+      profileConfig.text = ''
+        (
+          active_profile: Quiet,
+        )
+      '';
+    };
+
+    gvfs.enable = true;
+    tumbler.enable = true;
+    gnome.gnome-keyring.enable = true;
+    tailscale = {
+      enable = true;
+      extraUpFlags = ["--login-server https://hs.tux.rs"];
+    };
+    mullvad-vpn = {
+      enable = true;
+      package = pkgs.mullvad-vpn;
+    };
+  };
+
+  fonts.packages = with pkgs.nerd-fonts; [
+    fira-code
+    jetbrains-mono
+  ];
+
+  programs.fuse.userAllowOther = true;
+  fileSystems."/persist".neededForBoot = true;
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/bluetooth"
+      "/var/lib/tailscale"
+      "/var/lib/nixos"
+      "/etc/NetworkManager/system-connections"
+    ];
+    files = [
+      # "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+  };
+
+  home-manager.users.${username} = {
+    imports = [
+      ./home.nix
+    ];
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/canopus/disko.nix

@@ -0,0 +1,48 @@
+{device ? throw "Set this to the disk device, e.g. /dev/nvme0n1", ...}: {
+  disko.devices.disk.primary = {
+    inherit device;
+    type = "disk";
+    content = {
+      type = "gpt"; # GPT partitioning scheme
+      partitions = {
+        # EFI Partition
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = ["defaults" "umask=0077"];
+          };
+        };
+        # Btrfs Root Partition
+        root = {
+          size = "100%"; # Use remaining space
+          type = "8300"; # Linux filesystem type
+          content = {
+            type = "btrfs";
+            subvolumes = {
+              "/root" = {
+                mountOptions = ["compress=zstd"]; # Compression for better performance
+                mountpoint = "/"; # Root subvolume
+              };
+              "/persist" = {
+                mountOptions = ["compress=zstd"]; # Compression for persistent data
+                mountpoint = "/persist"; # Persistent subvolume
+              };
+              "/nix" = {
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                  "noacl"
+                ]; # Optimize for Nix store
+                mountpoint = "/nix"; # Nix subvolume
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/canopus/hardware.nix

@@ -0,0 +1,26 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/canopus/home.nix

@@ -0,0 +1,103 @@
+{
+  pkgs,
+  username,
+  ...
+}: {
+  imports = [
+    ../../modules/home/desktop/awesome
+    ../../modules/home/desktop/hyprland
+    ../../modules/home/desktop/waybar
+    ../../modules/home/picom
+    ../../modules/home/alacritty
+    ../../modules/home/wezterm
+    ../../modules/home/ghostty
+    ../../modules/home/desktop/rofi
+    ../../modules/home/barrier
+    ../../modules/home/firefox
+    ../../modules/home/brave
+    ../../modules/home/vs-code
+    ../../modules/home/mopidy
+    ../../modules/home/thunderbird
+    ../../modules/home/easyeffects
+  ];
+
+  home.pointerCursor = {
+    package = pkgs.bibata-cursors;
+    name = "Bibata-Modern-Ice";
+  };
+
+  qt.enable = true;
+  qt.platformTheme.name = "gtk";
+  qt.style.name = "adwaita-dark";
+  qt.style.package = pkgs.adwaita-qt;
+
+  gtk = {
+    enable = true;
+    theme = {
+      name = "Materia-dark";
+      package = pkgs.materia-theme;
+    };
+    iconTheme = {
+      package = pkgs.tela-icon-theme;
+      name = "Tela-black";
+    };
+  };
+
+  home.packages = with pkgs; [
+    discord
+    telegram-desktop
+    anydesk
+    stable.rustdesk-flutter
+    rawtherapee
+    stable.beekeeper-studio
+    obs-studio
+    flameshot
+    libreoffice-qt
+    spotify
+    stremio
+    galaxy-buds-client
+    copyq
+    vlc
+    tor-browser
+  ];
+
+  home.persistence."/persist/home/${username}" = {
+    directories = [
+      "Downloads"
+      "Music"
+      "Wallpapers"
+      "Documents"
+      "Videos"
+      "Projects"
+      "Stuff"
+      "go"
+      ".mozilla"
+      ".ssh"
+      ".wakatime"
+      ".rustup"
+      ".cargo"
+      ".config/BraveSoftware"
+      ".config/copyq"
+      ".config/discord"
+      ".config/Vencord"
+      ".config/sops"
+      ".config/obs-studio"
+      ".config/rustdesk"
+      ".config/spotify"
+      ".local/share/nvim"
+      ".local/share/zoxide"
+      ".local/share/Smart\ Code\ ltd"
+      ".local/share/GalaxyBudsClient"
+      ".local/share/TelegramDesktop"
+      ".local/state/lazygit"
+      ".cache/spotify"
+    ];
+    files = [
+      ".zsh_history"
+      ".wakatime.cfg"
+    ];
+    allowOther = true;
+  };
+
+  home.stateVersion = "24.11";
+}

hosts/canopus/secrets.yaml

@@ -0,0 +1,30 @@
+hyperbolic_api_key: ENC[AES256_GCM,data:FjDSbdutLa9hnVGRR+k2MznVfDGAx1/rNfjY/vaBuvKoBRj7aHqGpQ1cvhfxjyLMqPLqLnmimEtZeykvgkIIjKGzw5PewE23+lrN3oQyoYJvK+b8PRStjSaxOfzOnuLXi+YVnsU939nStLwnmSYKDabNWgFcWYsHwtHDafuWyovM9sVwasTn,iv:bxseG6GLKBL/CJOS8SrhgiLEyvMGSNQIMJSYLk2MqEo=,tag:4wxmkUwlcu23d7pMHbvIoQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwUnhkNzR0TnNzL29xV3cv
+            R3lqYUtVWWlNOVFTZHhTMWJZL1ZJUDIxaG0wCnIvQnkxSWJxWTZYVEkvS1ZWSEhk
+            YmhuK2JtS3lmUjV6MW50SGZrTnpkeDAKLS0tIDkvbk5abnhkNlA0dmgwV0Z0L1BS
+            UUduZUV3OGcvaFdBOFFsc0xzVCtQcUUKrmZvR2onMD0snqPw8okxaK6Tz5sA/cmR
+            1ZczgwLslJA7kwGKYOslUGA7aGB4jyP+M74wBAVa71BqWatypp0RfA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1udt3cssu7ahdrhsvckt8450rswrr6mknn36xpq74dkfp9lpajvnq84kdzj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEOE0xbDN0UmdVdE1DR1lo
+            dmNudDk2TjNQdHFGc0lJTSt0dVVRU3BPRlg0ClV1ZUdxRVNpSmhYQm80QjdhdFc5
+            SVI4bi93WDBDWHQvejJIV21Bc2NsMjgKLS0tIEduZ2hHSnI3UXlGU2ZFZkpTRDJo
+            K0tiZ0swMmpuVW02OHMrRThlOXBWUjQKYHyJZuvQABh+gJ+THQ5SakVEqsKkyBMb
+            k6KnjRATpdZlmm0GjbD4aasF/j/V2fuH327Z72jPWQuI1y5ZfbDhSg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-21T14:42:55Z"
+    mac: ENC[AES256_GCM,data:UoUa+ypzLAfl2dU7r0dPkddDKyL3d/jFYAUTBbo1828THBCIJPRxaBHmMI1+BjZ/TSvJsGFhJS6YbrQB0zKN/CrH/OGdZPpwJ3VXwFtBWcEc7v8VZCFeWoRnYA31j7uPBA/KxvxpijSEIyJDO4IO+885cyK+uI+5DY9OU9UkDrg=,iv:56K11zOXjZP2XWcz9Xe9Wzqu1XhTfm9Fqd4xNETs2vU=,tag:IssVEyR9AJDZ18+RBvR63Q==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.3

hosts/capella/default.nix

@@ -0,0 +1,63 @@
+{
+  pkgs,
+  username,
+  outputs,
+  inputs,
+  email,
+  ...
+}: {
+  imports = [
+    ../../modules/droid/sshd.nix
+  ];
+
+  android-integration.am.enable = true;
+  android-integration.termux-open-url.enable = true;
+  android-integration.xdg-open.enable = true;
+  android-integration.termux-setup-storage.enable = true;
+  android-integration.termux-reload-settings.enable = true;
+
+  terminal.font = let
+    firacode = pkgs.nerd-fonts.fira-code;
+    fontPath = "share/fonts/truetype/NerdFonts/FiraCode/FiraCodeNerdFont-Regular.ttf";
+  in "${firacode}/${fontPath}";
+
+  time.timeZone = "Asia/Kolkata";
+
+  tux.services.openssh = {
+    enable = true;
+    ports = [8022];
+    authorizedKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+OzPUe2ECPC929DqpkM39tl/vdNAXfsRnmrGfR+X3D ${email}"
+    ];
+  };
+
+  user = {
+    uid = 10479;
+    gid = 10479;
+    shell = "${pkgs.zsh}/bin/zsh";
+  };
+
+  environment.etcBackupExtension = ".backup";
+  environment.motd = '''';
+  environment.packages = with pkgs; [
+    nano
+    git
+    neovim
+    openssh
+    inputs.trok.packages."aarch64-linux".default
+  ];
+
+  home-manager = {
+    config = ./home.nix;
+    backupFileExtension = "backup";
+    extraSpecialArgs = {inherit inputs outputs username email;};
+    useGlobalPkgs = true;
+  };
+
+  # Set up nix for flakes
+  nix.extraOptions = ''
+    experimental-features = nix-command flakes
+  '';
+
+  system.stateVersion = "24.05";
+}

hosts/capella/home.nix

@@ -0,0 +1,34 @@
+{pkgs, ...}: {
+  imports = [
+    ../../modules/home/git
+    ../../modules/home/starship
+  ];
+
+  programs = {
+    bat.enable = true;
+    zoxide = {
+      enable = true;
+      options = ["--cmd cd"];
+    };
+    zsh = {
+      enable = true;
+      shellAliases = {
+        ls = "lsd";
+      };
+      syntaxHighlighting.enable = true;
+      autosuggestion.enable = true;
+      initContent = ''
+        fastfetch
+      '';
+    };
+  };
+
+  home.packages = with pkgs; [
+    neovim
+    busybox
+    lsd
+    fastfetch
+  ];
+
+  home.stateVersion = "24.05";
+}

hosts/common/default.nix

@@ -0,0 +1,59 @@
+{
+  username,
+  outputs,
+  inputs,
+  email,
+  ...
+}: {
+  imports = [
+    inputs.impermanence.nixosModules.impermanence
+    inputs.home-manager.nixosModules.home-manager
+    inputs.nix-index-database.nixosModules.nix-index
+
+    ../../modules/base
+    ../../modules/nixos/fail2ban.nix
+    ../../modules/nixos/selfhosted/upstream-proxy.nix
+    ../../modules/nixos/selfhosted/tfolio.nix
+    ../../modules/nixos/selfhosted/cyber-tux.nix
+    ../../modules/nixos/networking/ssh.nix
+    ../../modules/nixos/selfhosted/trok.nix
+  ];
+
+  sops.secrets.tux-password = {
+    sopsFile = ./secrets.yaml;
+    neededForUsers = true;
+  };
+
+  time.timeZone = "Asia/Kolkata";
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    extraLocaleSettings = {
+      LC_ADDRESS = "en_IN";
+      LC_IDENTIFICATION = "en_IN";
+      LC_MEASUREMENT = "en_IN";
+      LC_MONETARY = "en_IN";
+      LC_NAME = "en_IN";
+      LC_NUMERIC = "en_IN";
+      LC_PAPER = "en_IN";
+      LC_TELEPHONE = "en_IN";
+      LC_TIME = "en_IN";
+    };
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  programs = {
+    zsh.enable = true;
+  };
+
+  home-manager = {
+    backupFileExtension = "hm-backup";
+    useUserPackages = true;
+    extraSpecialArgs = {inherit inputs outputs username email;};
+    users.${username} = {
+      imports = [
+        ./home.nix
+      ];
+    };
+  };
+}

hosts/common/home.nix

@@ -0,0 +1,44 @@
+{
+  outputs,
+  username,
+  inputs,
+  ...
+}: {
+  imports = [
+    inputs.impermanence.nixosModules.home-manager.impermanence
+    inputs.nix-index-database.hmModules.nix-index
+
+    ../../modules/home/shell
+    ../../modules/home/git
+    ../../modules/home/starship
+    ../../modules/home/nvim
+    ../../modules/home/tmux
+    ../../modules/home/helix
+    ../../modules/home/aria2
+  ];
+
+  nixpkgs = {
+    overlays = [
+      outputs.overlays.additions
+      outputs.overlays.modifications
+      outputs.overlays.stable-packages
+      outputs.overlays.nur
+      outputs.overlays.nix-vscode-extensions
+    ];
+
+    config = {
+      allowUnfree = true;
+      allowUnfreePredicate = _: true;
+      joypixels.acceptLicense = true;
+    };
+  };
+
+  home = {
+    username = "${username}";
+    homeDirectory = "/home/${username}";
+  };
+
+  programs.home-manager.enable = true;
+
+  systemd.user.startServices = "sd-switch";
+}

hosts/common/secrets.yaml

@@ -0,0 +1,84 @@
+tux-password: ENC[AES256_GCM,data:X5y3+HuWsnZ9wnjCBAbOzIWO9o7AB716/WoaqsJ4U9F7Ok4gCqZwUVMRm4unb54Ggp3ctRUAi2iDqTCKoaMIfgkdWzj74ix39w==,iv:9gl//PAvzXO2e+v6jRdVh5uLv3p1xt7cxuV7N27heLI=,tag:ZqKESAf5AoUVG6wbsQ1ymw==,type:str]
+sops:
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age:
+    - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5OVloM2VlbFNvdTZ2N3Q0
+        b2pLNXU4Q05meGRNV2NVc3k5djUyOFhjaWdvClZvUXR6K0JnTG5yQ0xzZ2ltcGxD
+        cmUvMW5KbTU0YzE3bmhrQWE0VzBPaE0KLS0tIFZydzZ5M2NtSko1TUxmRWdtcVBR
+        cVZha2lHcGQ2RndmTkJ6czMwQzFyUDgK+MdsnznFru+9XiBoKBXpMeyFjd8GiPNn
+        mIcD6RMxxg8OBOEuAqszTJ6aFgjNhTMmkZpD/htPcLHVqU6ETPz+ew==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age1d3t78xlqd0erlqj2m9947l9eqwpge3zrperljw3xrshh0gjx4ghs8tuqcu
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UnhyUlpNUnVnMTNJRUUy
+        VjZ2bWpZMzJHVlQ0RDRkVmRRdjh1WnNGZlJzCk14VWQvSnBjcjdBd1pFazlnS2VN
+        VSszM2hHQzl0eVNJa2JZNWZRNHdvREUKLS0tIDdvdGx3VlRIMzNBc05SUkhnajdN
+        L2ZuekNJYm9uc3ZuM1ljMDUxSjlEM1EKpXMtDX5xaQViGsxRT2mZeNDENk6PwD9x
+        pPrx/B4RvE6nbU9ywrYlK1UQ5VVrbA9pXxsyy2HMawN4fOkugbWSiQ==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age1udt3cssu7ahdrhsvckt8450rswrr6mknn36xpq74dkfp9lpajvnq84kdzj
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsQlZOdWorTStxR0FxakZJ
+        Q1RNYnRSWXc5NnFSY2VZNElXd0pXR0hSV2xzCmgzZ1NxT2FiSWhYYWl0UVpNOUZY
+        QW1SamhQZzc1L2JKQmRjVXBGSXVHNkkKLS0tIDcyRUtRcXU0ekRwcDZKMTRncm5m
+        VTdNQVAxdkNQMFFncnd4eDJlc2Y1S2cK40aaDENAS8eXWtO7t+L0sYXvs7eJj6hd
+        xRmphVIxTILQ01WnD5StKEIOhg8y66h9KOIuqRLi7qb9781QYKfuzA==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age1jg642q775gmnmxeu29gcf3lph8vem4xr8t84cxe809dpd0myrussh49h60
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyZ25EWnZ0c2htV0JRNEFh
+        RFBzU3F6Y2NTMnpRNXlqUHZvQlREWUJ5R2swCkNKblJMSU56MXlVVWY0Nk5mOXU2
+        MjBlV0pLUHVEM0RvT1BROEthblFEWDQKLS0tIHdCWUNTbE1FMmcwaWxncTBYbFVp
+        ZGk0V3JpQUU1TGxyVFVmSUF6UDRseHMKUOVQlTblgz8FAsInQkBnyM3iUV5+gmDP
+        TVEfewEsw5+61ArA1OIqpXqW/QeCw9+1O6dOAi9/Z3Fgw4AdPUsWpQ==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age1zsl5d4vj6gl3h96y5p53sq5y4vr4vtlwp727h7rp9a4xfkxm53lqrh6r50
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmbTM1NTdZeGNDbVpJNEhH
+        TGVvVi95cnhMT2QxdkE0Z3d0WCtDdXNiRlUwCnNGNjRYWjQzV3hUVXg3WWp1SUh5
+        aE85YkV1NkVNcUNmbXFJN29lUVhReGsKLS0tIDNDR0JacTVLZFR1M0tnU25oVEVY
+        UTN4aHQyQ1hONURCc1FTQkMxdmZ1eUUKUt37gBetdgOyyloyeo2RLSAI481Rdv0y
+        OUgbQB6DvU8fVrptZnnIrkd2TjaHYq1bF1DsfMzLgtC4UVdeu9CSuw==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age145uq9emlxqzm3wqauy9zqj78wqx9e6h09xag6wust7jjgn4upfzsaemcvx
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDTU9vbjhtT1c0NlU4L0pq
+        ZHVlamZHS25hTVUycUNPaXEwVzBlb25wSGpJCjE0TXJQQ3ZoS2VRWUFJYjNteS9B
+        ZElVL3ZuU2VPMVdBdlREMUovejJRNDAKLS0tIGZMZXlEMnJOcG5vT0Q2SnVTdGtE
+        MTJiNDlXeCtPakJsWWF4RHJjdUpiQmMKYfnHI74b9S8zj6ybHdGB9iQtkQxVSgtv
+        xBkMZ6SgTZIuCS5HIf6a7muYIfkVCQMQHKF10p6BULVKc0Rr/ZAA1Q==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age1ydkclhk9kwqdq74utesqdfupt43lz64d5k65gz2z9uyljcqq9fcq3hv28l
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTVo3NXRJOXpmLzU0SUZ0
+        bmVJZng1RmtSaTdWcFJLaDhFS0Z0d2h1T0dzCkhBbVNRUW1DUlFhQ3VJTC9ZRS9u
+        SmE0WmJQZ1hxS256YkgxZXphem9rNUkKLS0tIEMxY1ErM2M3dmEvemVkSVJLUnBP
+        dE5wWDRtbHVSRlFjUEs2WnpnUmRzRlUKznDFUOLnRW1dlL3hAQVZmvNxFsLxUbHM
+        6YOTK08Ahi93qsKpuC05XoKwbMhVyC59zdnNQzoU9EMtaCTm5UFUsQ==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age1y4luzn2jls7rvgphej23srvdlx563lxq29tvf66vhwwzaf7c3f3qzvresh
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqc2d6cWR6VDZLWFA2ZlhV
+        dG1kNm9Fdi93ZllzNWxXdk5PcE5lR0F4QkRJCkEzbWxvU3dHZG01SzhEQm02eXh4
+        TkdCL2RtUDE0bzdIWk5jVVpvMGp2T28KLS0tIEQyVEZLZ3JQWlI2aVhDem4wZ0Er
+        RTh0enVYTkdrVjBVc2xGQjgrK25nMmcKkWeBeMglk452ZwHR3h67kL7vs/hQc7s+
+        2f0DyAQfYO4QWdDGkFB3WZI/b9YIDatIZGlKUx07CEmI84ErYYmNLA==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2025-02-01T13:39:27Z"
+  mac: ENC[AES256_GCM,data:5FyPM1CcibPMlt5d1J7AydMRKMGE1HTFQFHIokn00vByZSj0WIUFebJ/hryFzGZK05zsBDEULWSy2ntSG5MWJFdDom4Wl58WnDzZo33RyYztPXvpD/o8J5BuYQWFngCLiz67rm/7QdZ/A6N0uyl7YmvqLzGjore12eEB3R9jzOQ=,iv:yiFJ8l+oSyAVRFOwKLMqw23ODcxoGIq7+QytyTw1ZKY=,tag:fFJo+soFRqFIrvThKPEeYg==,type:str]
+  pgp: []
+  unencrypted_suffix: _unencrypted
+  version: 3.9.3

hosts/homelab/default.nix

@@ -0,0 +1,148 @@
+{
+  inputs,
+  username,
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  imports = [
+    inputs.disko.nixosModules.default
+
+    (import ./disko.nix {device = "/dev/nvme0n1";})
+    ./hardware.nix
+
+    ../common
+    ../../modules/nixos/desktop
+    ../../modules/nixos/virtualisation/docker.nix
+  ];
+
+  tux.services.openssh.enable = true;
+
+  sops.secrets = {
+    discord_token = {
+      sopsFile = ./secrets.yaml;
+    };
+  };
+
+  tux.services.cyber-tux = {
+    enable = true;
+    environmentFile = config.sops.secrets.discord_token.path;
+  };
+
+  networking = {
+    hostName = "homelab";
+    networkmanager = {
+      enable = true;
+      wifi.powersave = false;
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [22];
+
+      # Facilitate firewall punching
+      allowedUDPPorts = [41641];
+    };
+  };
+
+  boot = {
+    consoleLogLevel = 0;
+    initrd.verbose = false;
+
+    kernelPackages = pkgs.linuxPackages_zen;
+
+    initrd.systemd = {
+      enable = lib.mkForce true;
+
+      services.wipe-my-fs = {
+        wantedBy = ["initrd.target"];
+        after = ["initrd-root-device.target"];
+        before = ["sysroot.mount"];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          mkdir /btrfs_tmp
+          mount /dev/disk/by-partlabel/disk-primary-root /btrfs_tmp
+
+          if [[ -e /btrfs_tmp/root ]]; then
+              mkdir -p /btrfs_tmp/old_roots
+              timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+              mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+          fi
+
+          delete_subvolume_recursively() {
+              IFS=$'\n'
+              for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+                  delete_subvolume_recursively "/btrfs_tmp/$i"
+              done
+              btrfs subvolume delete "$1"
+          }
+
+          for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+              delete_subvolume_recursively "$i"
+          done
+
+          btrfs subvolume create /btrfs_tmp/root
+          umount /btrfs_tmp
+        '';
+      };
+    };
+
+    loader = {
+      systemd-boot = {
+        enable = true;
+        configurationLimit = 5;
+      };
+      efi.canTouchEfiVariables = true;
+      timeout = 1;
+    };
+  };
+
+  hardware = {
+    graphics.enable32Bit = true;
+  };
+
+  security = {
+    rtkit.enable = true;
+  };
+
+  programs = {
+    nix-ld = {
+      enable = true;
+      package = pkgs.nix-ld-rs;
+    };
+  };
+
+  services = {
+    tailscale = {
+      enable = true;
+      extraUpFlags = ["--login-server https://hs.tux.rs"];
+    };
+  };
+
+  programs.fuse.userAllowOther = true;
+  fileSystems."/persist".neededForBoot = true;
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/tailscale"
+      "/var/lib/nixos"
+      "/etc/NetworkManager/system-connections"
+    ];
+    files = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+  };
+
+  home-manager.users.${username} = {
+    imports = [
+      ./home.nix
+    ];
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/homelab/disko.nix

@@ -0,0 +1,48 @@
+{device ? throw "Set this to the disk device, e.g. /dev/nvme0n1", ...}: {
+  disko.devices.disk.primary = {
+    inherit device;
+    type = "disk";
+    content = {
+      type = "gpt"; # GPT partitioning scheme
+      partitions = {
+        # EFI Partition
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = ["defaults" "umask=0077"];
+          };
+        };
+        # Btrfs Root Partition
+        root = {
+          size = "100%"; # Use remaining space
+          type = "8300"; # Linux filesystem type
+          content = {
+            type = "btrfs";
+            subvolumes = {
+              "/root" = {
+                mountOptions = ["compress=zstd"]; # Compression for better performance
+                mountpoint = "/"; # Root subvolume
+              };
+              "/persist" = {
+                mountOptions = ["compress=zstd"]; # Compression for persistent data
+                mountpoint = "/persist"; # Persistent subvolume
+              };
+              "/nix" = {
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                  "noacl"
+                ]; # Optimize for Nix store
+                mountpoint = "/nix"; # Nix subvolume
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/homelab/hardware.nix

@@ -0,0 +1,26 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/homelab/home.nix

@@ -0,0 +1,21 @@
+{username, ...}: {
+  home.persistence."/persist/home/${username}" = {
+    directories = [
+      "Projects"
+      "Stuff"
+      ".ssh"
+      ".wakatime"
+      ".config/sops"
+      ".local/share/nvim"
+      ".local/share/zoxide"
+      ".local/state/lazygit"
+    ];
+    files = [
+      ".zsh_history"
+      ".wakatime.cfg"
+    ];
+    allowOther = true;
+  };
+
+  home.stateVersion = "24.11";
+}

hosts/homelab/secrets.yaml

@@ -0,0 +1,30 @@
+discord_token: ENC[AES256_GCM,data:fZqz6LD3+Svtton5gNCXO5ddWAqW1IyxP3M2DAIXZEIYRHUfAq8h9LES2IHWepjl5qKimxB35zacE/TYK2fitngWtRGVoMDBzzU6VTKNulNV3yFWrPA=,iv:YOplYld+c9vHVC0Srfm89qrh4yUygDiW67X2TdwHKMc=,tag:Ioc2wNLX818fRQ/2PSO7Sw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2YktFRE9KS0h0T0hDTlpF
+            ZEk0VzNTcVE0ampsWVRtSzJ3UHBXL2NlUUh3Cjk5ZnFKVENmTTJHQjgrVWlyOUE1
+            THUrTUFzdWhKejNUNXpsNVpvZVdJWm8KLS0tIDZ5bmYzSVBUVlVORHAzSGtCQmVo
+            a2JuSWVtMi9FMkova3BCd2F0U2VCRzQKonG/AkEn2X2l3vyr0UlJprGW2ZSwrczq
+            xHafyGiU/I1AO/HoB3BXyP8t/Sgn/dy42lspqZ3MoLLlmx7dQeTd+g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1jg642q775gmnmxeu29gcf3lph8vem4xr8t84cxe809dpd0myrussh49h60
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxWUowUlB2cWVOclpRMENn
+            TU5za0Y2UHZ5eFNZMEdQWm9xdTZFYkVwS2hNCnRBUU1ndFdiQ09sQjBDb1greC93
+            ejl2OVZTTEtIcWpxUk5RRngrbjRWREEKLS0tIDVrSHhxbmJFdWwyQS9xeWlFZitJ
+            Y1RHaFdXaE9DODJtSTFCSVZWb0xVeUEK4qeBKg3u+vhBIM1dQ7BaOWi/C7Q8hk60
+            vu9Zr075n0+kb5Ab+RH24ZmEoP5PJXjwEfbAnmRTjn0reYn1nfcNYA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-15T12:45:59Z"
+    mac: ENC[AES256_GCM,data:NLGe7L/oiG62x4PmQ6FobnuisFmMxYoGhxfqQ4qZdy9emYL/+FnrtFsKTKqZ9IHjrNnCmbk7y+Cds/azC1xGVcaj50jEox87vtqIZ3z0XsD1mJjCAdHkBVzzpQGwHas/5y0Inyj+oKsvQrqVacqYHVA/ES+zMvou8nD+EWIH2LE=,iv:fBVOnwih+QFkYZ8IfMBpQiT1XwSZtzo3VYaBOL3I5o4=,tag:p+ePQsrmcLcnLr2fgWQXQg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

hosts/isoImage/default.nix

@@ -0,0 +1,84 @@
+{
+  pkgs,
+  modulesPath,
+  inputs,
+  username,
+  ...
+}: {
+  imports = [
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+    inputs.home-manager.nixosModules.home-manager
+
+    ../../modules/nixos/default.nix
+    ../../modules/nixos/desktop/awesome
+  ];
+
+  nixpkgs.hostPlatform = "x86_64-linux";
+
+  networking = {
+    hostName = "iso";
+  };
+
+  hardware = {
+    bluetooth.enable = true;
+    bluetooth.powerOnBoot = true;
+  };
+
+  security = {
+    rtkit.enable = true;
+  };
+
+  programs = {
+    ssh.startAgent = true;
+    thunar = {
+      enable = true;
+      plugins = with pkgs.xfce; [thunar-archive-plugin thunar-volman];
+    };
+    nm-applet.enable = true;
+  };
+
+  services = {
+    resolved.enable = true;
+
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+    };
+
+    logind = {
+      extraConfig = "HandlePowerKey=suspend";
+      lidSwitch = "suspend";
+      lidSwitchExternalPower = "suspend";
+    };
+
+    xserver = {
+      enable = true;
+      xkb = {
+        layout = "in";
+        variant = "eng";
+      };
+    };
+
+    libinput.touchpad.naturalScrolling = true;
+
+    blueman.enable = true;
+
+    gvfs.enable = true;
+    tumbler.enable = true;
+  };
+
+  fonts.packages = with pkgs.nerd-fonts; [
+    fira-code
+    jetbrains-mono
+  ];
+
+  home-manager.users.${username} = {
+    imports = [
+      ./home.nix
+    ];
+  };
+
+  system.stateVersion = "23.11";
+}

hosts/isoImage/home.nix

@@ -0,0 +1,7 @@
+{...}: {
+  imports = [
+    ../common/home.nix
+  ];
+
+  home.stateVersion = "23.11";
+}

hosts/rigel/default.nix

@@ -0,0 +1,63 @@
+{
+  pkgs,
+  username,
+  outputs,
+  inputs,
+  email,
+  ...
+}: {
+  imports = [
+    ../../modules/droid/sshd.nix
+  ];
+
+  android-integration.am.enable = true;
+  android-integration.termux-open-url.enable = true;
+  android-integration.xdg-open.enable = true;
+  android-integration.termux-setup-storage.enable = true;
+  android-integration.termux-reload-settings.enable = true;
+
+  terminal.font = let
+    firacode = pkgs.nerd-fonts.fira-code;
+    fontPath = "share/fonts/truetype/NerdFonts/FiraCode/FiraCodeNerdFont-Regular.ttf";
+  in "${firacode}/${fontPath}";
+
+  time.timeZone = "Asia/Kolkata";
+
+  tux.services.openssh = {
+    enable = true;
+    ports = [8022];
+    authorizedKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+OzPUe2ECPC929DqpkM39tl/vdNAXfsRnmrGfR+X3D ${email}"
+    ];
+  };
+
+  user = {
+    uid = 10225;
+    gid = 10225;
+    shell = "${pkgs.zsh}/bin/zsh";
+  };
+
+  environment.etcBackupExtension = ".backup";
+  environment.motd = '''';
+  environment.packages = with pkgs; [
+    nano
+    git
+    neovim
+    openssh
+    inputs.trok.packages."aarch64-linux".default
+  ];
+
+  home-manager = {
+    config = ./home.nix;
+    backupFileExtension = "backup";
+    extraSpecialArgs = {inherit inputs outputs username email;};
+    useGlobalPkgs = true;
+  };
+
+  # Set up nix for flakes
+  nix.extraOptions = ''
+    experimental-features = nix-command flakes
+  '';
+
+  system.stateVersion = "24.05";
+}

hosts/rigel/home.nix

@@ -0,0 +1,34 @@
+{pkgs, ...}: {
+  imports = [
+    ../../modules/home/git
+    ../../modules/home/starship
+  ];
+
+  programs = {
+    bat.enable = true;
+    zoxide = {
+      enable = true;
+      options = ["--cmd cd"];
+    };
+    zsh = {
+      enable = true;
+      shellAliases = {
+        ls = "lsd";
+      };
+      syntaxHighlighting.enable = true;
+      autosuggestion.enable = true;
+      initContent = ''
+        fastfetch
+      '';
+    };
+  };
+
+  home.packages = with pkgs; [
+    neovim
+    busybox
+    lsd
+    fastfetch
+  ];
+
+  home.stateVersion = "24.05";
+}

hosts/sirius/default.nix

@@ -0,0 +1,56 @@
+{
+  pkgs,
+  inputs,
+  username,
+  config,
+  ...
+}: {
+  imports = [
+    inputs.nixos-wsl.nixosModules.wsl
+
+    ../common
+    ../../modules/nixos/virtualisation/docker.nix
+  ];
+
+  tux.services.openssh.enable = true;
+
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
+
+  nixpkgs = {
+    config.cudaSupport = true;
+    hostPlatform = "x86_64-linux";
+  };
+
+  wsl = {
+    enable = true;
+    defaultUser = "${username}";
+    useWindowsDriver = true;
+  };
+
+  networking.hostName = "sirius";
+
+  programs = {
+    ssh.startAgent = true;
+    zsh.enable = true;
+
+    nix-ld = {
+      enable = true;
+      libraries = config.hardware.graphics.extraPackages;
+      package = pkgs.nix-ld-rs;
+    };
+
+    dconf.enable = true;
+  };
+
+  environment.persistence."/persist" = {
+    enable = false;
+  };
+
+  home-manager.users.${username} = {
+    imports = [
+      ./home.nix
+    ];
+  };
+
+  system.stateVersion = "23.11";
+}

hosts/sirius/home.nix

@@ -0,0 +1,3 @@
+{...}: {
+  home.stateVersion = "23.11";
+}

hosts/vega/default.nix

@@ -0,0 +1,66 @@
+{
+  pkgs,
+  username,
+  ...
+}: {
+  imports = [
+    ./hardware.nix
+    ../common
+
+    ../../modules/nixos/selfhosted/adguard.nix
+  ];
+
+  tux.services.openssh.enable = true;
+
+  boot.initrd.availableKernelModules = [
+    "usbhid"
+    "usb_storage"
+    "vc4"
+    "pcie_brcmstb" # required for the pcie bus to work
+    "reset-raspberrypi" # required for vl805 firmware to load
+  ];
+
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  hardware.enableRedistributableFirmware = true;
+  powerManagement.cpuFreqGovernor = "ondemand";
+
+  networking = {
+    hostName = "vega";
+    networkmanager = {
+      enable = true;
+      wifi.powersave = false;
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [22];
+
+      # Facilitate firewall punching
+      allowedUDPPorts = [41641];
+    };
+  };
+
+  services = {
+    tailscale = {
+      enable = true;
+      extraUpFlags = ["--login-server https://hs.tux.rs"];
+    };
+  };
+
+  environment.systemPackages = with pkgs; [go-wol];
+
+  environment.persistence."/persist" = {
+    enable = false;
+  };
+
+  home-manager.users.${username} = {
+    imports = [
+      ./home.nix
+    ];
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/vega/hardware.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enu1u1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/vega/home.nix

@@ -0,0 +1,3 @@
+{...}: {
+  home.stateVersion = "24.11";
+}

hosts/vps/default.nix

@@ -0,0 +1,101 @@
+{
+  modulesPath,
+  inputs,
+  username,
+  lib,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+    inputs.disko.nixosModules.default
+    (import ./disko.nix {device = "/dev/sda";})
+
+    ../common
+  ];
+
+  tux.services.openssh.enable = true;
+
+  nixpkgs = {
+    hostPlatform = "x86_64-linux";
+  };
+
+  boot = {
+    initrd.systemd = {
+      enable = lib.mkForce true;
+
+      services.wipe-my-fs = {
+        wantedBy = ["initrd.target"];
+        after = ["initrd-root-device.target"];
+        before = ["sysroot.mount"];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          mkdir /btrfs_tmp
+          mount /dev/disk/by-partlabel/disk-primary-root /btrfs_tmp
+
+          if [[ -e /btrfs_tmp/root ]]; then
+              mkdir -p /btrfs_tmp/old_roots
+              timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+              mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+          fi
+
+          delete_subvolume_recursively() {
+              IFS=$'\n'
+              for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+                  delete_subvolume_recursively "/btrfs_tmp/$i"
+              done
+              btrfs subvolume delete "$1"
+          }
+
+          for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+              delete_subvolume_recursively "$i"
+          done
+
+          btrfs subvolume create /btrfs_tmp/root
+          umount /btrfs_tmp
+        '';
+      };
+    };
+
+    loader = {
+      grub = {
+        efiSupport = true;
+        efiInstallAsRemovable = true;
+      };
+    };
+  };
+
+  networking.hostName = "vps";
+
+  users = {
+    users.${username} = {
+      password = "${username}";
+      hashedPasswordFile = lib.mkForce null;
+    };
+  };
+
+  programs.fuse.userAllowOther = true;
+  fileSystems."/persist".neededForBoot = true;
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/nixos"
+    ];
+    files = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+  };
+
+  home-manager.users.${username} = {
+    imports = [
+      ./home.nix
+    ];
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/vps/disko.nix

@@ -0,0 +1,53 @@
+{device ? throw "Set this to the disk device, e.g. /dev/nvme0n1", ...}: {
+  disko.devices.disk.primary = {
+    inherit device;
+    type = "disk";
+    content = {
+      type = "gpt"; # GPT partitioning scheme
+      partitions = {
+        boot = {
+          name = "boot";
+          size = "1M";
+          type = "EF02";
+        };
+        # EFI Partition
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = ["defaults" "umask=0077"];
+          };
+        };
+        # Btrfs Root Partition
+        root = {
+          size = "100%"; # Use remaining space
+          type = "8300"; # Linux filesystem type
+          content = {
+            type = "btrfs";
+            subvolumes = {
+              "/root" = {
+                mountOptions = ["compress=zstd"]; # Compression for better performance
+                mountpoint = "/"; # Root subvolume
+              };
+              "/persist" = {
+                mountOptions = ["compress=zstd"]; # Compression for persistent data
+                mountpoint = "/persist"; # Persistent subvolume
+              };
+              "/nix" = {
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                  "noacl"
+                ]; # Optimize for Nix store
+                mountpoint = "/nix"; # Nix subvolume
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/vps/home.nix

@@ -0,0 +1,14 @@
+{username, ...}: {
+  home.persistence."/persist/home/${username}" = {
+    directories = [
+      "Projects"
+      ".ssh"
+    ];
+    files = [
+      ".zsh_history"
+    ];
+    allowOther = true;
+  };
+
+  home.stateVersion = "24.11";
+}

modules/base/default.nix

@@ -0,0 +1,11 @@
+{
+  imports = [
+    ./nix.nix
+    ./nixpkgs.nix
+    ./nh.nix
+    ./overlays.nix
+    ./sops.nix
+    ./substituters.nix
+    ./user.nix
+  ];
+}

modules/base/nh.nix

@@ -0,0 +1,16 @@
+{
+  config,
+  username,
+  ...
+}: {
+  programs.nh = {
+    enable = true;
+
+    clean = {
+      enable = !config.nix.gc.automatic;
+      dates = "weekly";
+    };
+
+    flake = "/home/${username}/Projects/nixos-config";
+  };
+}

modules/base/nix.nix

@@ -0,0 +1,27 @@
+{
+  pkgs,
+  username,
+  ...
+}: {
+  nix = {
+    package = pkgs.lix;
+
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 3d";
+    };
+
+    channel.enable = false;
+
+    settings = {
+      extra-platforms = ["aarch64-linux" "arm-linux"];
+      auto-optimise-store = true;
+      allowed-users = ["${username}"];
+      trusted-users = ["${username}"];
+      experimental-features = "nix-command flakes";
+      keep-going = true;
+      warn-dirty = false;
+      http-connections = 50;
+    };
+  };
+}

modules/base/nixpkgs.nix

@@ -0,0 +1,8 @@
+{
+  nixpkgs = {
+    config = {
+      allowUnfree = true;
+      joypixels.acceptLicense = true;
+    };
+  };
+}

modules/base/overlays.nix

@@ -0,0 +1,9 @@
+{outputs, ...}: {
+  nixpkgs.overlays = [
+    outputs.overlays.additions
+    outputs.overlays.modifications
+    outputs.overlays.stable-packages
+    outputs.overlays.nur
+    outputs.overlays.nix-vscode-extensions
+  ];
+}

modules/base/sops.nix

@@ -0,0 +1,20 @@
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}: let
+  isEd25519 = k: k.type == "ed25519";
+  getKeyPath = k: k.path;
+  keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
+in {
+  imports = [inputs.sops-nix.nixosModules.sops];
+
+  sops.age = {
+    sshKeyPaths = map getKeyPath keys;
+    keyFile = "/var/lib/sops-nix/key.txt";
+    generateKey = true;
+  };
+
+  environment.systemPackages = with pkgs; [sops];
+}

modules/base/substituters.nix

@@ -0,0 +1,27 @@
+{
+  nix.settings = {
+    substituters = [
+      "https://cache.nixos.org?priority=10"
+      "https://anyrun.cachix.org"
+      "https://fufexan.cachix.org"
+      "https://helix.cachix.org"
+      "https://hyprland.cachix.org"
+      "https://nix-community.cachix.org"
+      "https://nix-gaming.cachix.org"
+      "https://yazi.cachix.org"
+      "https://nix-on-droid.cachix.org"
+    ];
+    trusted-substituters = ["https://nix-on-droid.cachix.org"];
+    trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      "anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s="
+      "fufexan.cachix.org-1:LwCDjCJNJQf5XD2BV+yamQIMZfcKWR9ISIFy5curUsY="
+      "helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs="
+      "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
+      "yazi.cachix.org-1:Dcdz63NZKfvUCbDGngQDAZq6kOroIrFoyO064uvLh8k="
+      "nix-on-droid.cachix.org-1:56snoMJTXmDRC1Ei24CmKoUqvHJ9XCp+nidK7qkMQrU="
+    ];
+  };
+}

modules/base/user.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  pkgs,
+  username,
+  email,
+  ...
+}: {
+  users = {
+    mutableUsers = false;
+    defaultUserShell = pkgs.zsh;
+    users.${username} = {
+      hashedPasswordFile = config.sops.secrets.tux-password.path;
+      isNormalUser = true;
+      extraGroups = ["networkmanager" "wheel" "storage"];
+      openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+OzPUe2ECPC929DqpkM39tl/vdNAXfsRnmrGfR+X3D ${email}''
+      ];
+    };
+  };
+}

modules/droid/sshd.nix

@@ -0,0 +1,106 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  # utility functions
+  concatLines = list: builtins.concatStringsSep "\n" list;
+
+  prefixLines = mapper: list: concatLines (map mapper list);
+
+  # could be put in the config
+  configPath = "ssh/sshd_config";
+
+  keysFolder = "/etc/ssh";
+
+  authorizedKeysFolder = "/etc/ssh/authorized_keys.d";
+
+  supportedKeysTypes = [
+    "rsa"
+    "ed25519"
+  ];
+
+  sshd-start-bin = "sshd-start";
+
+  # real config
+  cfg = config.tux.services.openssh;
+
+  pathOfKeyOf = type: "${keysFolder}/ssh_host_${type}_key";
+
+  generateKeyOf = type: ''
+    ${lib.getExe' pkgs.openssh "ssh-keygen"} \
+      -t "${type}" \
+      -f "${pathOfKeyOf type}" \
+      -N ""
+  '';
+
+  generateKeyWhenNeededOf = type: ''
+    if [ ! -f ${pathOfKeyOf type} ]; then
+      mkdir --parents ${keysFolder}
+      ${generateKeyOf type}
+    fi
+  '';
+
+  sshd-start = pkgs.writeScriptBin sshd-start-bin ''
+    #!${pkgs.runtimeShell}
+    ${prefixLines generateKeyWhenNeededOf supportedKeysTypes}
+
+    mkdir --parents "${authorizedKeysFolder}"
+    echo "${lib.concatStringsSep "\n" cfg.authorizedKeys}" > ${authorizedKeysFolder}/${config.user.userName}
+
+    echo "Starting sshd in non-daemonized way on port ${lib.concatMapStrings toString cfg.ports}"
+    ${lib.getExe' pkgs.openssh "sshd"} \
+      -f "/etc/${configPath}" \
+      -D # don't detach into a daemon process
+  '';
+in {
+  options = {
+    tux.services.openssh = {
+      enable = lib.mkEnableOption ''
+        Whether to enable the OpenSSH secure shell daemon, which
+        allows secure remote logins.
+      '';
+
+      ports = lib.mkOption {
+        type = lib.types.listOf lib.types.port;
+        default = [22];
+        description = ''
+          Specifies on which ports the SSH daemon listens.
+        '';
+      };
+
+      authorizedKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [];
+        description = ''
+          Specify a list of public keys to be added to the authorized_keys file.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.etc = {
+      "${configPath}".text = ''
+        ${prefixLines (port: "Port ${toString port}") cfg.ports}
+
+        AuthorizedKeysFile ${authorizedKeysFolder}/%u
+
+        LogLevel VERBOSE
+      '';
+    };
+
+    environment.packages = [
+      sshd-start
+      pkgs.openssh
+    ];
+
+    build.activationAfter.sshd = ''
+      SERVER_PID=$(${lib.getExe' pkgs.procps "ps"} -a | ${lib.getExe' pkgs.toybox "grep"} sshd || true)
+      if [ -z "$SERVER_PID" ]; then
+        $DRY_RUN_CMD ${lib.getExe sshd-start}
+      fi
+    '';
+  };
+}

modules/flake/flake-parts.nix

@@ -1,4 +0,0 @@
-{ inputs, ... }:
-{
-  imports = [ inputs.flake-parts.flakeModules.modules ];
-}

modules/flake/overlays.nix

@@ -1,36 +0,0 @@
-{
-  inputs,
-  ...
-}:
-{
-  flake.overlays = {
-    modifications = final: prev: {
-      tnvim = inputs.tnvim.packages.${prev.stdenv.hostPlatform.system}.default;
-      tpanel = inputs.tpanel.packages.${prev.stdenv.hostPlatform.system}.default;
-      cyber-tux = inputs.cyber-tux.packages.${prev.stdenv.hostPlatform.system}.default;
-      ags = inputs.tpanel.packages.${prev.stdenv.hostPlatform.system}.ags.default;
-      wezterm-git = inputs.wezterm-flake.packages.${prev.stdenv.hostPlatform.system}.default;
-      hyprland-git = inputs.hyprland.packages.${prev.stdenv.hostPlatform.system};
-      awww = inputs.awww.packages.${prev.stdenv.hostPlatform.system}.awww;
-      vicinae-extensions = inputs.vicinae-extensions.packages.${prev.stdenv.hostPlatform.system};
-    };
-
-    stable-packages = final: _prev: {
-      stable = import inputs.nixpkgs-stable {
-        system = final.stdenv.hostPlatform.system;
-        config.allowUnfree = true;
-      };
-    };
-
-    nur = inputs.nur.overlays.default;
-  };
-
-  perSystem =
-    { system, ... }:
-    {
-      _module.args.pkgs = import inputs.nixpkgs {
-        inherit system;
-        overlays = builtins.attrValues inputs.self.overlays;
-      };
-    };
-}

modules/flake/systems.nix

@@ -1,6 +0,0 @@
-{
-  systems = [
-    "x86_64-linux"
-    "aarch64-linux"
-  ];
-}

modules/flake/treefmt.nix

@@ -1,23 +0,0 @@
-{ inputs, ... }:
-{
-  imports = [
-    inputs.treefmt-nix.flakeModule
-  ];
-
-  perSystem =
-    {
-      config,
-      pkgs,
-      system,
-      ...
-    }:
-    {
-      treefmt.config = {
-        projectRootFile = "flake.nix";
-        flakeCheck = true;
-        programs = {
-          nixfmt.enable = true;
-        };
-      };
-    };
-}

modules/hm/core/hm.nix

@@ -1,13 +0,0 @@
-{
-  flake.modules.homeManager.core =
-    { userName, ... }:
-    {
-      programs.home-manager.enable = true;
-      systemd.user.startServices = "sd-switch";
-
-      home = {
-        username = "${userName}";
-        homeDirectory = "/home/${userName}";
-      };
-    };
-}

modules/hm/core/nixpkgs.nix

@@ -1,18 +0,0 @@
-{ inputs, ... }:
-{
-  flake.modules.homeManager.core =
-    {
-      lib,
-      osConfig ? { },
-      ...
-    }:
-    {
-      nixpkgs = lib.mkIf (!(osConfig.home-manager.useGlobalPkgs or false)) {
-        config = {
-          allowUnfree = true;
-          joypixels.acceptLicense = true;
-        };
-        overlays = builtins.attrValues inputs.self.overlays;
-      };
-    };
-}

modules/hm/desktop/brave.nix

@@ -1,38 +0,0 @@
-{
-  flake.modules.homeManager.desktop =
-    {
-      pkgs,
-      config,
-      ...
-    }:
-    let
-      configDir = "${config.xdg.configHome}/BraveSoftware/Brave-Browser";
-
-      extensionJson = ext: {
-        name = "${configDir}/External Extensions/${ext.id}.json";
-        value.text = builtins.toJSON {
-          external_update_url = "https://clients2.google.com/service/update2/crx";
-        };
-      };
-
-      extensions = [
-        { id = "nkbihfbeogaeaoehlefnkodbefgpgknn"; } # Metamask
-        { id = "gppongmhjkpfnbhagpmjfkannfbllamg"; } # Wappalyzer
-        { id = "nngceckbapebfimnlniiiahkandclblb"; } # Bitwarden
-        { id = "bfnaelmomeimhlpmgjnjophhpkkoljpa"; } # Phantom
-        { id = "eimadpbcbfnmbkopoojfekhnkhdbieeh"; } # DarkReader
-      ];
-    in
-    {
-      programs.chromium = {
-        enable = true;
-        package = pkgs.brave;
-        commandLineArgs = [
-          "--disable-features=WebRtcAllowInputVolumeAdjustment"
-          "--force-device-scale-factor=1.0"
-        ];
-      };
-
-      home.file = builtins.listToAttrs (map extensionJson extensions);
-    };
-}

modules/hm/desktop/discord.nix

@@ -1,45 +0,0 @@
-{
-  flake.modules.homeManager.desktop =
-    { inputs, userName, ... }:
-    {
-      imports = [
-        inputs.nixcord.homeModules.nixcord
-      ];
-
-      programs.nixcord = {
-        enable = true;
-        user = userName;
-        discord.enable = false;
-        vesktop.enable = true;
-        config = {
-          themeLinks = [
-            "https://raw.githubusercontent.com/refact0r/system24/refs/heads/main/archive/flavors/spotify-text.theme.css"
-          ];
-          frameless = true;
-          plugins = {
-            hideMedia.enable = true;
-            ignoreActivities = {
-              enable = true;
-              ignorePlaying = true;
-              ignoreWatching = true;
-            };
-          };
-        };
-        dorion = {
-          theme = "dark";
-          zoom = "1.1";
-          blur = "acrylic";
-          sysTray = true;
-          openOnStartup = true;
-          autoClearCache = true;
-          disableHardwareAccel = false;
-          rpcServer = true;
-          rpcProcessScanner = true;
-          pushToTalk = true;
-          pushToTalkKeys = [ "RControl" ];
-          desktopNotifications = true;
-          unreadBadge = true;
-        };
-      };
-    };
-}

modules/hm/desktop/easyeffects.nix

@@ -1,5 +0,0 @@
-{
-  flake.modules.homeManager.desktop = {
-    services.easyeffects.enable = true;
-  };
-}

modules/hm/desktop/firefox.nix

@@ -1,75 +0,0 @@
-{
-  flake.modules.homeManager.desktop =
-    {
-      pkgs,
-      userName,
-      ...
-    }:
-    {
-      programs.firefox = {
-        enable = true;
-
-        package = pkgs.firefox.override {
-          extraPolicies = {
-            CaptivePortal = false;
-            DisableFirefoxStudies = true;
-            DisablePocket = true;
-            DisableTelemetry = true;
-            DisableFirefoxAccounts = false;
-            NoDefaultBookmarks = true;
-            OfferToSaveLogins = false;
-            OfferToSaveLoginsDefault = false;
-            PasswordManagerEnabled = false;
-            FirefoxHome = {
-              Search = true;
-              Pocket = false;
-              Snippets = false;
-              TopSites = false;
-              Highlights = false;
-            };
-            UserMessaging = {
-              ExtensionRecommendations = false;
-              SkipOnboarding = true;
-            };
-          };
-        };
-
-        profiles = {
-          ${userName} = {
-            id = 0;
-            name = "tux";
-            search = {
-              force = true;
-              default = "google";
-            };
-            settings = {
-              "general.smoothScroll" = true;
-              "extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
-              "layout.css.prefers-color-scheme.content-override" = 0;
-              "browser.compactmode.show" = true;
-              "browser.tabs.firefox-view" = false;
-              "browser.bookmarks.addedImportButton" = false;
-              "extensions.pocket.enabled" = false;
-              "browser.fullscreen.autohide" = false;
-            };
-            extraConfig = ''
-              user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true);
-              user_pref("full-screen-api.ignore-widgets", true);
-              user_pref("media.ffmpeg.vaapi.enabled", true);
-              user_pref("media.rdd-vpx.enabled", true);
-            '';
-
-            extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
-              ublock-origin
-              facebook-container
-              metamask
-              darkreader
-              bitwarden
-              wappalyzer
-              clearurls
-            ];
-          };
-        };
-      };
-    };
-}

modules/hm/desktop/ghostty.nix

@@ -1,47 +0,0 @@
-{
-  flake.modules.homeManager.desktop = {
-    programs.ghostty = {
-      enable = true;
-      enableZshIntegration = true;
-      systemd.enable = true;
-
-      settings = {
-        confirm-close-surface = false;
-        gtk-titlebar = false;
-        window-padding-x = 10;
-        window-padding-y = 10;
-        font-size = 12;
-        font-family = "JetBrainsMono Nerd Font";
-        theme = "poimandres";
-      };
-
-      themes = {
-        poimandres = {
-          background = "#0f0f0f";
-          foreground = "#a6accd";
-          cursor-color = "#f2eacf";
-          selection-background = "#1a1a1a";
-          selection-foreground = "#f1f1f1";
-          palette = [
-            "0=#252b37"
-            "1=#d0679d"
-            "2=#5de4c7"
-            "3=#fffac2"
-            "4=#89ddff"
-            "5=#fae4fc"
-            "6=#add7ff"
-            "7=#ffffff"
-            "8=#a6accd"
-            "9=#d0679d"
-            "10=#5de4c7"
-            "11=#fffac2"
-            "12=#add7ff"
-            "13=#89ddff"
-            "14=#fcc5e9"
-            "15=#ffffff"
-          ];
-        };
-      };
-    };
-  };
-}

modules/hm/desktop/hyprland.nix

@@ -1,39 +0,0 @@
-{
-  flake.modules.homeManager.desktop =
-    { config, pkgs, ... }:
-    {
-      wayland.windowManager.hyprland = {
-        enable = true;
-        package = null;
-        portalPackage = null;
-        xwayland.enable = true;
-        systemd.variables = [ "--all" ];
-      };
-
-      # TODO: Hyprland 0.55 switched to Lua-based configuration.
-      # Until the Home Manager module is updated, we symlink our config instead.
-      home.file = {
-        ".config/hypr/config".source =
-          config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Projects/hypr/config";
-        ".config/hypr/hyprland.lua".source =
-          config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Projects/hypr/hyprland.lua";
-      };
-
-      home.packages = with pkgs; [
-        ags
-        awww
-        grim
-        slurp
-        hyprshot
-        wl-clipboard
-        wl-screenrec
-        (writeShellScriptBin "hypr-screenshot" ''
-          hyprshot -m region -r ppm - | satty --filename -
-        '')
-
-        (writeShellScriptBin "hypr-screenrecord" ''
-          wl-screenrec -g "$(slurp)"
-        '')
-      ];
-    };
-}

modules/hm/desktop/lan-mouse.nix

@@ -1,39 +0,0 @@
-{ inputs, ... }:
-{
-  flake.modules.homeManager.desktop =
-    {
-      config,
-      pkgs,
-      lib,
-      ...
-    }:
-    with lib;
-    let
-      cfg = config.tnix.services.lan-mouse;
-    in
-    {
-      imports = [ inputs.lan-mouse.homeManagerModules.default ];
-
-      options.tnix.services.lan-mouse = {
-        enable = mkEnableOption "Enable Lan-Mouse";
-
-        settings = mkOption {
-          type = (pkgs.formats.toml { }).type;
-          default = { };
-          description = ''
-            TOML configuration for lan-mouse.
-            See <https://github.com/feschber/lan-mouse/> for available options.
-          '';
-        };
-      };
-
-      config = mkIf cfg.enable {
-
-        programs.lan-mouse = {
-          enable = true;
-          systemd = true;
-          settings = cfg.settings;
-        };
-      };
-    };
-}

modules/hm/desktop/mango.nix

@@ -1,256 +0,0 @@
-{ inputs, ... }:
-{
-  flake.modules.homeManager.desktop =
-    {
-      config,
-      pkgs,
-      lib,
-      ...
-    }:
-    with lib;
-    let
-      cfg = config.tnix.desktop.mangowm;
-    in
-    {
-      imports = [
-        inputs.mango.hmModules.mango
-      ];
-
-      options.tnix.desktop.mangowm = {
-        enable = mkEnableOption "Enable MangoWM";
-
-        monitorRule = mkOption {
-          type = with types; listOf str;
-          default = [ ];
-        };
-
-        tagRule = mkOption {
-          type = with types; listOf str;
-          default = [ ];
-        };
-      };
-
-      config = mkIf cfg.enable {
-        wayland.windowManager.mango = {
-          enable = true;
-          settings = {
-            # Monitors
-            monitorrule = cfg.monitorRule;
-
-            focus_cross_monitor = 1;
-            exchange_cross_monitor = 1;
-            drag_tile_to_tile = 1;
-
-            # Keyboard
-            repeat_rate = 25;
-            repeat_delay = 600;
-            numlockon = 0;
-            xkb_rules_layout = "us";
-
-            # Trackpad
-            disable_trackpad = 0;
-            tap_to_click = 1;
-            tap_and_drag = 1;
-            drag_lock = 1;
-            trackpad_natural_scrolling = 1;
-            disable_while_typing = 1;
-            left_handed = 0;
-            middle_button_emulation = 0;
-            swipe_min_threshold = 1;
-
-            # Mouse
-            mouse_natural_scrolling = 0;
-            mouse_accel_profile = 0;
-
-            # Theme
-            border_radius = 8;
-            no_radius_when_single = 0;
-            focused_opacity = 0.9;
-            unfocused_opacity = 0.9;
-
-            # Scroller Layout Setting
-            scroller_structs = 0;
-            scroller_default_proportion = 0.5;
-            scroller_ignore_proportion_single = 0;
-            scroller_default_proportion_single = 1.0;
-
-            # Master-Stack Layout Setting
-            new_is_master = 0;
-            default_mfact = 0.5;
-            default_nmaster = 1;
-            smartgaps = 0;
-
-            # Overview Setting
-            hotarea_size = 10;
-            enable_hotarea = 1;
-            ov_tab_mode = 0;
-            overviewgappi = 15;
-            overviewgappo = 15;
-
-            # layouts
-            tagrule = cfg.tagRule;
-
-            # Keybindings
-            mousebind = [
-              "SUPER, btn_left, moveresize, curmove"
-              "SUPER, btn_right, moveresize, curresize"
-            ];
-
-            gesturebind = [
-              "none, right, 3, viewtoleft_have_client"
-              "none, up, 3, toggleoverview"
-              "none, down, 3, toggleoverview"
-            ];
-
-            bind = [
-              # apps
-              "SUPER, Return, spawn, wezterm"
-              "SUPER, Space, spawn, vicinae toggle"
-              "SUPER, D, spawn, vesktop"
-              "SUPER, T, spawn, Telegram"
-              "SUPER, B, spawn, brave"
-              "SUPER, V, spawn, vicinae vicinae://extensions/vicinae/clipboard/history"
-              "SUPER+SHIFT, W, spawn, vicinae vicinae://extensions/sovereign/awww-switcher/wpgrid"
-
-              # WM
-              "SUPER, Q, killclient"
-              "SUPER+SHIFT, R, reload_config"
-              "SUPER+SHIFT, F, togglefullscreen"
-              "SUPER+SHIFT, Space, togglefloating"
-              "SUPER+SHIFT, Space, centerwin"
-
-              "ALT, Tab, toggleoverview"
-              "ALT+SHIFT, minus, incgaps, -1"
-              "ALT+SHIFT, equal, incgaps, 1"
-              "ALT+SHIFT, R, togglegaps"
-              "SUPER+SHIFT, P, toggleglobal"
-
-              # switch layout
-              "SUPER+SHIFT, H, setlayout, tile"
-              "SUPER+SHIFT, V, setlayout, vertical_tile"
-              "SUPER+SHIFT, S, setlayout, scroller"
-
-              # resize client
-              "SUPER+CTRL, Up, resizewin, +0, -50"
-              "SUPER+CTRL, Down, resizewin, +0, +50"
-              "SUPER+CTRL, Left, resizewin, -50, +0"
-              "SUPER+CTRL, Right, resizewin, +50, +0"
-              "SUPER+CTRL, Equal, setoption, default_mfact, 0.5"
-
-              # swap client
-              "SUPER+SHIFT, Up, exchange_client, up"
-              "SUPER+SHIFT, Down, exchange_client, down"
-              "SUPER+SHIFT, Left, exchange_client, left"
-              "SUPER+SHIFT, Right, exchange_client, right"
-
-              # switch client focus
-              "SUPER, Tab, focusstack, next"
-              "SUPER, Left, focusdir, left"
-              "SUPER, Right, focusdir, right"
-              "SUPER, Up, focusdir, up"
-              "SUPER, Down, focusdir, down"
-
-              # switch view
-              "SUPER, 1, view, 1, 1"
-              "SUPER, 2, view, 2, 1"
-              "SUPER, 3, view, 3, 1"
-              "SUPER, 4, view, 4, 1"
-              "SUPER, 5, view, 5, 1"
-
-              # move client to the tag with focus
-              "SUPER+SHIFT, 1, tagsilent, 1, 1"
-              "SUPER+SHIFT, 2, tagsilent, 2, 1"
-              "SUPER+SHIFT, 3, tagsilent, 3, 1"
-              "SUPER+SHIFT, 4, tagsilent, 4, 1"
-              "SUPER+SHIFT, 5, tagsilent, 5, 1"
-
-              # move client to the tag without focus
-              "SUPER+ALT, 1, tag, 1, 1"
-              "SUPER+ALT, 2, tag, 2, 1"
-              "SUPER+ALT, 3, tag, 3, 1"
-              "SUPER+ALT, 4, tag, 4, 1"
-              "SUPER+ALT, 5, tag, 5, 1"
-            ];
-
-            # Window effect
-            blur = 1;
-            blur_layer = 0;
-            blur_optimized = 1;
-            blur_params_num_passes = 2;
-            blur_params_radius = 5;
-            blur_params_noise = 0.02;
-            blur_params_brightness = 0.9;
-            blur_params_contrast = 0.9;
-            blur_params_saturation = 1.2;
-
-            shadows = 1;
-            layer_shadows = 0;
-            shadow_only_floating = 1;
-            shadows_size = 10;
-            shadows_blur = 15;
-            shadows_position_x = 0;
-            shadows_position_y = 0;
-            shadowscolor = "0x000000ff";
-
-            # Animation
-            animations = 1;
-            layer_animations = 1;
-            animation_type_open = "slide";
-            animation_type_close = "fade";
-            animation_fade_in = 1;
-            animation_fade_out = 1;
-            tag_animation_direction = 0;
-            zoom_initial_ratio = 0.3;
-            zoom_end_ratio = 0.8;
-            fadein_begin_opacity = 0.5;
-            fadeout_begin_opacity = 0.8;
-
-            animation_duration_move = 100;
-            animation_duration_open = 100;
-            animation_duration_close = 100;
-            animation_duration_tag = 200;
-            animation_duration_focus = 0;
-
-            animation_curve_open = "0.46, 1.0, 0.29, 1";
-            animation_curve_move = "0.46, 1.0, 0.29, 1";
-            animation_curve_tag = "0.46, 1.0, 0.29, 1";
-            animation_curve_close = "0.08, 0.92, 0, 1";
-            animation_curve_focus = "0.46, 1.0, 0.29, 1";
-            animation_curve_opafadeout = "0.5, 0.5, 0.5, 0.5";
-            animation_curve_opafadein = "0.46, 1.0, 0.29, 1";
-
-            # Appearance
-            borderpx = 0;
-            gappih = 10;
-            gappiv = 10;
-            gappoh = 10;
-            gappov = 10;
-
-            rootcolor = "0x201b14ff";
-            bordercolor = "0x444444ff";
-            focuscolor = "0xc9b890ff";
-            maximizescreencolor = "0x89aa61ff";
-            urgentcolor = "0xad401fff";
-            scratchpadcolor = "0x516c93ff";
-            globalcolor = "0xb153a7ff";
-            overlaycolor = "0x14a57cff";
-
-            # Misc
-            syncobj_enable = 1;
-
-            exec-once = [
-              "dbus-update-activation-environment --systemd --all; systemctl --user reset-failed && systemctl --user start mango-session.target"
-              "awww-daemon"
-              "dms run"
-            ];
-          };
-        };
-
-        home.packages = with pkgs; [
-          quickshell
-          dms-shell
-          dgop
-        ];
-      };
-    };
-}

modules/hm/desktop/mpv.nix

@@ -1,24 +0,0 @@
-{
-  flake.modules.homeManager.desktop =
-    { pkgs, ... }:
-    {
-      programs.mpv = {
-        enable = true;
-
-        scripts = (
-          with pkgs.mpvScripts;
-          [
-            modernz
-            thumbfast
-            mpris
-            mpv-image-viewer.image-positioning
-          ]
-        );
-
-        config = {
-          osc = "no";
-          border = "no";
-        };
-      };
-    };
-}

modules/hm/desktop/satty.nix

@@ -1,19 +0,0 @@
-{
-  flake.modules.homeManager.desktop = {
-    programs.satty = {
-      enable = true;
-      settings = {
-        general = {
-          corner-roundness = 12;
-          initial-tool = "arrow";
-          early-exit = true;
-          copy-command = "wl-copy";
-        };
-
-        font = {
-          family = "JetBrainsMono NerdFont";
-        };
-      };
-    };
-  };
-}

modules/hm/desktop/theme.nix

@@ -1,31 +0,0 @@
-{
-  flake.modules.homeManager.desktop =
-    { pkgs, ... }:
-    {
-      home.pointerCursor = {
-        package = pkgs.bibata-cursors;
-        name = "Bibata-Modern-Ice";
-        size = 28;
-      };
-
-      qt = {
-        enable = true;
-        style = {
-          name = "Breeze";
-          package = pkgs.kdePackages.breeze;
-        };
-      };
-
-      gtk = {
-        enable = true;
-        theme = {
-          name = "Materia-dark";
-          package = pkgs.materia-theme;
-        };
-        iconTheme = {
-          package = pkgs.tela-icon-theme;
-          name = "Tela-black";
-        };
-      };
-    };
-}

modules/hm/desktop/vicinae.nix

@@ -1,68 +0,0 @@
-{
-  flake.modules.homeManager.desktop =
-    {
-      pkgs,
-      ...
-    }:
-    {
-      programs.vicinae = {
-        enable = true;
-        systemd = {
-          enable = true;
-          autoStart = true;
-        };
-        useLayerShell = true;
-
-        extensions = with pkgs.vicinae-extensions; [
-          bluetooth
-          nix
-          ssh
-          awww-switcher
-          process-manager
-          pulseaudio
-          wifi-commander
-          port-killer
-          silverbullet
-        ];
-
-        settings = {
-          close_on_focus_loss = false;
-          consider_preedit = true;
-          pop_to_root_on_close = true;
-          favicon_service = "twenty";
-          search_files_in_root = true;
-          font = {
-            normal = {
-              size = 10;
-              family = "JetBrainsMono Nerd Font";
-            };
-          };
-          theme = {
-            light = {
-              name = "vicinae-light";
-              icon_theme = "default";
-            };
-            dark = {
-              name = "vicinae-dark";
-              icon_theme = "default";
-            };
-          };
-          launcher_window = {
-            opacity = 0.98;
-          };
-
-          imports = [ "/run/secrets/vicinae.json" ];
-
-          providers = {
-            "@sovereign/vicinae-extension-awww-switcher-0" = {
-              "preferences" = {
-                "transitionDuration" = "1";
-                "transitionType" = "center";
-                "wallpaperPath" = "/home/tux/Wallpapers/";
-              };
-            };
-          };
-        };
-      };
-    };
-}

modules/hm/desktop/wezterm.nix

@@ -1,33 +0,0 @@
-{
-  flake.modules.homeManager.desktop =
-    { pkgs, ... }:
-    {
-      programs.wezterm = {
-        enable = true;
-        package = pkgs.wezterm-git;
-        enableZshIntegration = false;
-
-        extraConfig = ''
-          local wezterm = require 'wezterm'
-          local config = {}
-
-          config.check_for_updates = false
-
-          config.window_close_confirmation = 'NeverPrompt'
-          config.color_scheme = 'Poimandres'
-          config.colors = {
-            background = "#0f0f0f"
-          }
-          config.enable_tab_bar = false
-          config.font = wezterm.font_with_fallback {
-            'JetBrainsMono Nerd Font',
-          }
-          config.font_size = 12.0
-          config.window_background_opacity = 1
-          config.audible_bell = "Disabled"
-
-          return config
-        '';
-      };
-    };
-}

modules/hm/desktop/zed.nix

@@ -1,35 +0,0 @@
-{
-  flake.modules.homeManager.desktop = {
-    programs.zed-editor = {
-      enable = true;
-      extensions = [
-        "lua"
-        "nix"
-        "C#"
-        "solidity"
-      ];
-      userKeymaps = [
-        {
-          context = "Workspace";
-          bindings = {
-            F7 = "workspace::NewTerminal";
-          };
-        }
-      ];
-      userSettings = {
-        ui_font_size = 18;
-        buffer_font_size = 18;
-        theme = {
-          mode = "dark";
-          light = "Ayu Light";
-          dark = "Ayu Dark";
-        };
-        vim_mode = true;
-        telemetry = {
-          diagnostics = false;
-          metrics = false;
-        };
-      };
-    };
-  };
-}

modules/hm/shell/bat.nix

@@ -1,5 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.bat.enable = true;
-  };
-}

modules/hm/shell/btop.nix

@@ -1,12 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.btop = {
-      enable = true;
-      settings = {
-        theme_background = false;
-        update_ms = 1000;
-        presets = "cpu:0:default mem:0:default net:0:default";
-      };
-    };
-  };
-}

modules/hm/shell/fastfetch.nix

@@ -1,69 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    home.file.".config/fastfetch/config.jsonc".text = ''
-      {
-        "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json",
-        "logo": {
-          "type": "none",
-        },
-        "display": {
-          "separator": " ",
-          "key": {
-            "width": 18,
-          },
-        },
-        "modules": [
-          {
-            "key": "  ╭───────────╮",
-            "type": "custom",
-          },
-          {
-            "key": "  │           │\u001b[11D{#31}  user",
-            "type": "title",
-            "format": "{1}",
-          },
-          {
-            "key": "  │           │\u001b[11D{#34}  hname",
-            "type": "command",
-            "text": "hostname",
-          },
-          {
-            "key": "  │           │\u001b[11D{#34}󰻀  distro",
-            "type": "os",
-          },
-          {
-            "key": "  │           │\u001b[11D{#35}󰌢  kernel",
-            "type": "kernel",
-          },
-          {
-            "key": "  │           │\u001b[11D{#31}  uptime",
-            "type": "uptime",
-          },
-          {
-            "key": "  │           │\u001b[11D{#32}  shell",
-            "type": "shell",
-          },
-          {
-            "key": "  │           │\u001b[11D{#35}  memory",
-            "type": "memory",
-          },
-          {
-            "key": "  ├───────────┤",
-            "type": "custom",
-          },
-          {
-            "key": "  │           │\u001b[11D{#39}  colors",
-            "type": "colors",
-            "symbol": "circle",
-          },
-          {
-            "key": "  ╰───────────╯",
-            "type": "custom",
-          },
-        ],
-      }
-    '';
-
-    programs.fastfetch.enable = true;
-  };
-}

modules/hm/shell/fzf.nix

@@ -1,8 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.fzf = {
-      enable = true;
-      enableZshIntegration = true;
-    };
-  };
-}

modules/hm/shell/git.nix

@@ -1,26 +0,0 @@
-{
-  flake.modules.homeManager.shell =
-    {
-      userName,
-      userEmail,
-      ...
-    }:
-    {
-      programs.git = {
-        enable = true;
-        signing = {
-          key = "~/.ssh/id_ed25519.pub";
-          signByDefault = true;
-        };
-        settings = {
-          user = {
-            name = "${userName}";
-            email = "${userEmail}";
-          };
-          init.defaultBranch = "main";
-          commit.gpgSign = true;
-          gpg.format = "ssh";
-        };
-      };
-    };
-}

modules/hm/shell/lazygit.nix

@@ -1,173 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.lazygit = {
-      enable = true;
-      settings = {
-        gui = {
-          showIcons = true;
-          nerdFontsVersion = "3";
-        };
-        customCommands = [
-          {
-            key = "<c-a>";
-            description = "AI-powered conventional commit";
-            context = "global";
-            command = "git commit -m \"{{.Form.CommitMsg}}\"";
-            loadingText = "Generating commit messages...";
-            prompts = [
-              {
-                type = "menu";
-                key = "Type";
-                title = "Type of change";
-                options = [
-                  {
-                    name = "AI defined";
-                    description = "Let AI analyze and determine the best commit type";
-                    value = "ai-defined";
-                  }
-                  {
-                    name = "build";
-                    description = "Changes that affect the build system or external dependencies";
-                    value = "build";
-                  }
-                  {
-                    name = "feat";
-                    description = "A new feature";
-                    value = "feat";
-                  }
-                  {
-                    name = "fix";
-                    description = "A bug fix";
-                    value = "fix";
-                  }
-                  {
-                    name = "chore";
-                    description = "Other changes that don't modify src or test files";
-                    value = "chore";
-                  }
-                  {
-                    name = "ci";
-                    description = "Changes to CI configuration files and scripts";
-                    value = "ci";
-                  }
-                  {
-                    name = "docs";
-                    description = "Documentation only changes";
-                    value = "docs";
-                  }
-                  {
-                    name = "perf";
-                    description = "A code change that improves performance";
-                    value = "perf";
-                  }
-                  {
-                    name = "refactor";
-                    description = "A code change that neither fixes a bug nor adds a feature";
-                    value = "refactor";
-                  }
-                  {
-                    name = "revert";
-                    description = "Reverts a previous commit";
-                    value = "revert";
-                  }
-                  {
-                    name = "style";
-                    description = "Changes that do not affect the meaning of the code";
-                    value = "style";
-                  }
-                  {
-                    name = "test";
-                    description = "Adding missing tests or correcting existing tests";
-                    value = "test";
-                  }
-                ];
-              }
-              {
-                type = "menuFromCommand";
-                title = "AI Generated Commit Messages";
-                key = "CommitMsg";
-                command = ''
-                  bash -c "
-                  # Check for staged changes
-                  diff=\$(git diff --cached | head -n 10)
-                  if [ -z \"\$diff\" ]; then
-                    echo \"No changes in staging. Add changes first.\"
-                    exit 1
-                  fi
-
-                  SELECTED_TYPE=\"{{.Form.Type}}\"
-                  COMMITS_TO_SUGGEST=8
-
-                  opencode run -m \"google/gemini-2.5-flash-lite\" \"
-                    You are an expert at writing Git commits. Your job is to write commit messages that follow the Conventional Commits format.
-
-                    The user has selected: \$SELECTED_TYPE
-
-                    Your task is to:
-                    1. Analyze the code changes
-                    2. Determine the most appropriate commit type (if user selected 'ai-defined')
-                    3. Determine an appropriate scope (component/area affected)
-                    4. Decide if this is a breaking change
-                    5. Write clear, concise commit messages
-
-                    Available commit types:
-                    - feat: A new feature
-                    - fix: A bug fix
-                    - docs: Documentation only changes
-                    - style: Changes that do not affect the meaning of the code
-                    - refactor: A code change that neither fixes a bug nor adds a feature
-                    - perf: A code change that improves performance
-                    - test: Adding missing tests or correcting existing tests
-                    - build: Changes that affect the build system or external dependencies
-                    - ci: Changes to CI configuration files and scripts
-                    - chore: Other changes that don't modify src or test files
-                    - revert: Reverts a previous commit
-
-                    Follow these guidelines:
-                    - Structure: <type>(<scope>): <description>
-                    - If user selected 'ai-defined', analyze the changes and pick the most suitable type
-                    - If user selected a specific type, use that type: \$SELECTED_TYPE
-                    - Add scope in parentheses if applicable (e.g., auth, api, ui, config)
-                    - Use exclamation mark (!) after type/scope for breaking changes: type(scope)!: description
-                    - Use lowercase for description (except proper nouns)
-                    - Use imperative mood (\\\"add\\\", not \\\"added\\\")
-                    - Keep description under 50 characters when possible
-                    - No period at the end of subject line
-
-                    Examples:
-                    - feat(auth): add OAuth login support
-                    - fix(api): handle null response in user endpoint
-                    - docs(readme): update installation instructions
-                    - style(ui): improve button spacing consistency
-                    - refactor(database): simplify query builder logic
-                    - test(auth): add unit tests for login flow
-                    - build(deps): upgrade React to version 18
-                    - ci(github): fix deployment workflow
-                    - chore(config): update ESLint rules
-                    - perf(api)!: optimize database queries
-
-                    IMPORTANT:
-                    - Generate exactly \$COMMITS_TO_SUGGEST different commit message options
-                    - If user selected 'ai-defined', you can use different types for different options
-                    - If user selected a specific type, all messages must use that type
-                    - Only return commit messages, no explanations
-                    - Do not use markdown code blocks
-                    - One message per line
-
-                    Previous commits for context:
-                    \$(git log --oneline -10)
-
-                    Changes to analyze:
-                    \$(git diff --cached --stat)
-                    \$(git diff --cached)
-                    \"
-                  "
-                '';
-              }
-            ];
-          }
-        ];
-      };
-    };
-  };
-}

modules/hm/shell/lsd.nix

@@ -1,8 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.lsd = {
-      enable = true;
-      enableZshIntegration = true;
-    };
-  };
-}

modules/hm/shell/misc.nix

@@ -1,16 +0,0 @@
-{
-  flake.modules.homeManager.shell =
-    { pkgs, ... }:
-    {
-      home.packages = with pkgs; [
-        systemctl-tui
-        zip
-        unzip
-        pciutils
-        usbutils
-        jq
-        dig
-        lsof
-      ];
-    };
-}

modules/hm/shell/neovim.nix

@@ -1,42 +0,0 @@
-{
-  flake.modules.homeManager.shell =
-    { pkgs, ... }:
-    {
-      home.file = {
-        ".config/nvim" = {
-          recursive = true;
-          source = "${pkgs.tnvim}";
-        };
-      };
-
-      programs = {
-        neovim = {
-          enable = true;
-          defaultEditor = true;
-        };
-
-        vim.enable = true;
-      };
-
-      home = {
-        packages = with pkgs; [
-          python3
-          nodejs
-          bun
-          pnpm
-          go
-          rustup
-          typescript
-          neovide
-          nil
-          statix
-          deadnix
-          alejandra
-          luarocks
-          gdu
-          gcc
-          wakatime-cli
-        ];
-      };
-    };
-}

modules/hm/shell/opencode.nix

@@ -1,29 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.opencode = {
-      enable = true;
-      tui = {
-        theme = "system";
-      };
-      settings = {
-        provider = {
-          google = {
-            options = {
-              apiKey = "{file:/run/secrets/gemini-api-key}";
-            };
-          };
-          openrouter = {
-            options = {
-              apiKey = "{file:/run/secrets/openrouter-api-key}";
-            };
-          };
-          opencode-go = {
-            options = {
-              apiKey = "{file:/run/secrets/opencode-go-api-key}";
-            };
-          };
-        };
-      };
-    };
-  };
-}

modules/hm/shell/ripgrep.nix

@@ -1,5 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.ripgrep.enable = true;
-  };
-}

modules/hm/shell/starship.nix

@@ -1,52 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.starship = {
-      enable = true;
-      settings = {
-        format = "$os$hostname$directory$rust$golang$solidity$nodejs(bold blue)$git_branch$git_status[❯](bold yellow)[❯](bold purple)[❯](bold blue) ";
-        scan_timeout = 60;
-        add_newline = false;
-        line_break.disabled = true;
-
-        os = {
-          format = "[$symbol  ]($style)";
-          style = "bold green";
-          disabled = false;
-          symbols.NixOS = "󰊠";
-          symbols.Linux = "󰊠";
-          symbols.Arch = "󰣇";
-          symbols.Ubuntu = "󰕈";
-        };
-        directory = {
-          format = "[$path]($style)[$read_only ]($read_only_style)";
-          read_only = " 󰌾";
-          style = "bold blue";
-        };
-        git_branch.format = "[$symbol$branch]($style) ";
-        hostname = {
-          ssh_only = false;
-          format = "[$ssh_symbol$hostname]($style) ";
-          style = "bold green";
-          ssh_symbol = "󰇧 ";
-          disabled = false;
-        };
-        rust = {
-          format = "[$symbol]($style)";
-          symbol = " ";
-        };
-        golang = {
-          format = "[$symbol]($style)";
-          symbol = " ";
-        };
-        solidity = {
-          format = "[$symbol]($style)";
-          symbol = "󰡪 ";
-        };
-        nodejs = {
-          format = "[$symbol]($style)";
-          symbol = "󰎙 ";
-        };
-      };
-    };
-  };
-}

modules/hm/shell/superfile.nix

@@ -1,43 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.superfile = {
-      enable = true;
-      settings = {
-        theme = "poimandres";
-        editor = "";
-        dir_editor = "";
-        auto_check_update = false;
-        cd_on_quit = false;
-        default_open_file_preview = true;
-        show_image_preview = true;
-        show_panel_footer_info = true;
-        default_directory = "~";
-        file_size_use_si = false;
-        default_sort_type = 0;
-        sort_order_reversed = false;
-        case_sensitive_sort = false;
-        shell_close_on_success = false;
-        debug = false;
-        ignore_missing_fields = false;
-        nerdfont = true;
-        transparent_background = true;
-        file_preview_width = 0;
-        code_previewer = "bat";
-        sidebar_width = 20;
-        border_top = "─";
-        border_bottom = "─";
-        border_left = "│";
-        border_right = "│";
-        border_top_left = "╭";
-        border_top_right = "╮";
-        border_bottom_left = "╰";
-        border_bottom_right = "╯";
-        border_middle_left = "├";
-        border_middle_right = "┤";
-        metadata = true;
-        zoxide_support = true;
-        enable_md5_checksum = false;
-      };
-    };
-  };
-}

modules/hm/shell/tmux.nix

@@ -1,155 +0,0 @@
-{
-  flake.modules.homeManager.shell =
-    { pkgs, ... }:
-    let
-      bg = "default";
-      fg = "default";
-      bg2 = "brightblack";
-      fg2 = "white";
-      color = c: "#{@${c}}";
-
-      indicator =
-        let
-          accent = color "indicator_color";
-          content = "  ";
-        in
-        "#[reverse,fg=${accent}]#{?client_prefix,${content},}";
-
-      current_window =
-        let
-          accent = color "main_accent";
-          index = "#[reverse,fg=${accent},bg=${fg}] #I ";
-          name = "#[fg=${bg2},bg=${fg2}] #W ";
-          # flags = "#{?window_flags,#{window_flags}, }";
-        in
-        "${index}${name}";
-
-      window_status =
-        let
-          accent = color "window_color";
-          index = "#[reverse,fg=${accent},bg=${fg}] #I ";
-          name = "#[fg=${bg2},bg=${fg2}] #W ";
-          # flags = "#{?window_flags,#{window_flags}, }";
-        in
-        "${index}${name}";
-
-      battery =
-        let
-          percentage = pkgs.writeShellScript "percentage" (
-            if pkgs.stdenv.isDarwin then
-              ''
-                echo $(pmset -g batt | grep -o "[0-9]\+%" | tr '%' ' ')
-              ''
-            else
-              ''
-                path="/org/freedesktop/UPower/devices/DisplayDevice"
-                echo $(${pkgs.upower}/bin/upower -i $path | grep -o "[0-9]\+%" | tr '%' ' ')
-              ''
-          );
-          state = pkgs.writeShellScript "state" (
-            if pkgs.stdenv.isDarwin then
-              ''
-                echo $(pmset -g batt | awk '{print $4}')
-              ''
-            else
-              ''
-                path="/org/freedesktop/UPower/devices/DisplayDevice"
-                echo $(${pkgs.upower}/bin/upower -i $path | grep state | awk '{print $2}')
-              ''
-          );
-          icon = pkgs.writeShellScript "icon" ''
-            percentage=$(${percentage})
-            state=$(${state})
-            if [ "$state" == "charging" ] || [ "$state" == "fully-charged" ]; then echo "󰂄"
-            elif [ $percentage -ge 75 ]; then echo "󱊣"
-            elif [ $percentage -ge 50 ]; then echo "󱊢"
-            elif [ $percentage -ge 25 ]; then echo "󱊡"
-            elif [ $percentage -ge 0  ]; then echo "󰂎"
-            fi
-          '';
-          color = pkgs.writeShellScript "color" ''
-            percentage=$(${percentage})
-            state=$(${state})
-            if [ "$state" == "charging" ] || [ "$state" == "fully-charged" ]; then echo "green"
-            elif [ $percentage -ge 75 ]; then echo "green"
-            elif [ $percentage -ge 50 ]; then echo "${fg2}"
-            elif [ $percentage -ge 30 ]; then echo "yellow"
-            elif [ $percentage -ge 0  ]; then echo "red"
-            fi
-          '';
-        in
-        "#[fg=#(${color})]#(${icon}) #[fg=${fg}]#(${percentage})%";
-
-      pwd =
-        let
-          accent = color "main_accent";
-          icon = "#[fg=${accent}] ";
-          format = "#[fg=${fg}]#{b:pane_current_path}";
-        in
-        "${icon}${format}";
-
-      git =
-        let
-          icon = pkgs.writeShellScript "branch" ''
-            git -C "$1" branch && echo " "
-          '';
-          branch = pkgs.writeShellScript "branch" ''
-            git -C "$1" rev-parse --abbrev-ref HEAD
-          '';
-        in
-        "#[fg=magenta]#(${icon} #{pane_current_path})#(${branch} #{pane_current_path})";
-
-      separator = "#[fg=${fg}]|";
-    in
-    {
-      programs.tmux = {
-        enable = true;
-        baseIndex = 1;
-        escapeTime = 0;
-        mouse = true;
-        extraConfig = ''
-          set-option -sa terminal-overrides ",xterm*:Tc"
-          set-option -g status-position top
-          unbind r
-          bind r source-file ~/.config/tmux/tmux.conf
-
-          # remap prefix from C-b to C-Space
-          # unbind C-b
-          # set -g prefix C-Space
-          # bind C-Space send-prefix
-
-          # split panes using | and -
-          unbind '"'
-          unbind %
-          bind | split-window -h
-          bind - split-window -v
-
-          # Start windows and panes at 1, not 0
-          set -g base-index 1
-          set -g pane-base-index 1
-          set-window-option -g pane-base-index 1
-          set-option -g renumber-windows on
-
-          # switch panes using Alt-arrow without prefix
-          bind -n M-Left select-pane -L
-          bind -n M-Right select-pane -R
-          bind -n M-Up select-pane -U
-          bind -n M-Down select-pane -D
-
-          set-option -g default-terminal "screen-256color"
-          set-option -g status-right-length 100
-          set-option -g @indicator_color "yellow"
-          set-option -g @window_color "magenta"
-          set-option -g @main_accent "blue"
-          set-option -g pane-active-border fg=black
-          set-option -g pane-border-style fg=black
-          set-option -g status-style "bg=${bg} fg=${fg}"
-          set-option -g status-left "${indicator}"
-          set-option -g status-right "${git} ${pwd} ${separator} ${battery}"
-          set-option -g window-status-current-format "${current_window}"
-          set-option -g window-status-format "${window_status}"
-          set-option -g window-status-separator ""
-        '';
-      };
-    };
-}

modules/hm/shell/zoxide.nix

@@ -1,9 +0,0 @@
-{
-  flake.modules.homeManager.shell = {
-    programs.zoxide = {
-      enable = true;
-      options = [ "--cmd cd" ];
-      enableZshIntegration = true;
-    };
-  };
-}

modules/hm/shell/zsh.nix

@@ -1,27 +0,0 @@
-{ lib, ... }:
-{
-  flake.modules.homeManager.shell =
-    { pkgs, ... }:
-    {
-      programs.zsh = {
-        enable = true;
-        history = {
-          append = true;
-          share = true;
-          expireDuplicatesFirst = true;
-          ignoreDups = true;
-          size = 1000000;
-          save = 1000000;
-          path = "$HOME/.local/share/zsh/.zsh_history";
-        };
-        syntaxHighlighting.enable = true;
-        autosuggestion.enable = true;
-        initContent = ''
-          ${lib.getExe pkgs.fastfetch}
-          bindkey "^A" vi-beginning-of-line
-          bindkey "^E" vi-end-of-line
-          bindkey '^R' fzf-history-widget
-        '';
-      };
-    };
-}

modules/home/alacritty/default.nix

@@ -0,0 +1,69 @@
+{...}: {
+  programs.alacritty = {
+    enable = true;
+
+    settings = {
+      font = {
+        normal.family = "JetBrainsMono Nerd Font";
+        bold.family = "JetBrainsMono Nerd Font";
+        italic.family = "JetBrainsMono Nerd Font";
+        bold_italic.family = "JetBrainsMono Nerd Font";
+        size = 16;
+      };
+
+      window = {
+        padding = {
+          x = 15;
+          y = 15;
+        };
+
+        decorations = "none";
+        opacity = 1.0;
+        dynamic_title = true;
+      };
+
+      selection.save_to_clipboard = false;
+
+      live_config_reload = true;
+
+      colors = {
+        primary = {
+          background = "#0d0f18";
+          foreground = "#a5b6cf";
+        };
+        normal = {
+          black = "#1c1e27";
+          blue = "#8baff1";
+          cyan = "#98d3ee";
+          green = "#95d3af";
+          magenta = "#c79bf0";
+          red = "#e26c7c";
+          white = "#d0d3d8";
+          yellow = "#f1d8a5";
+        };
+        bright = {
+          black = "#151720";
+          blue = "#86aaec";
+          cyan = "#93cee9";
+          green = "#90ceaa";
+          magenta = "#c296eb";
+          red = "#dd6777";
+          white = "#cbced3";
+          yellow = "#ecd3a0";
+        };
+        cursor = {
+          cursor = "#a5b6cf";
+          text = "CellForeground";
+        };
+        selection = {
+          text = "CellForeground";
+          background = "0x303340";
+        };
+        vi_mode_cursor = {
+          text = "CellBackground";
+          cursor = "CellForeground";
+        };
+      };
+    };
+  };
+}

modules/home/aria2/default.nix

@@ -0,0 +1,44 @@
+{...}: {
+  programs.aria2 = {
+    enable = true;
+    settings = {
+      file-allocation = "none";
+      log-level = "warn";
+      max-connection-per-server = 16;
+      min-split-size = "1M";
+      human-readable = true;
+      reuse-uri = true;
+      rpc-save-upload-metadata = true;
+      max-file-not-found = 0;
+      remote-time = true;
+      async-dns = true;
+      stop = 0;
+      allow-piece-length-change = true;
+      optimize-concurrent-downloads = true;
+      deferred-input = true;
+      continue = true;
+      check-integrity = true;
+      realtime-chunk-checksum = true;
+      piece-length = "1M";
+      split = 16;
+      # Seconds:
+      save-session-interval = 60;
+      # Caches in memory
+      disk-cache = "32M";
+      save-not-found = true;
+      download-result = "full";
+      truncate-console-readout = true;
+      retry-wait = 30;
+      max-tries = 15;
+      enable-color = true;
+      enable-http-keep-alive = true;
+      enable-http-pipelining = true;
+      http-accept-gzip = true;
+      follow-torrent = true;
+      bt-save-metadata = true;
+      seed-time = 0;
+      bt-load-saved-metadata = true;
+      metalink-preferred-protocol = "https";
+    };
+  };
+}

modules/home/barrier/default.nix

@@ -0,0 +1,7 @@
+{pkgs, ...}: {
+  # services.barrier.client.enable = true;
+
+  home.packages = with pkgs; [
+    barrier
+  ];
+}

modules/home/bitwarden/default.nix

@@ -0,0 +1,17 @@
+{
+  pkgs,
+  email,
+  ...
+}: {
+  programs.rbw = {
+    enable = true;
+    settings = {
+      base_url = "https://bw.tux.rs";
+      email = "${email}";
+    };
+  };
+
+  home.packages = with pkgs; [
+    bitwarden
+  ];
+}

modules/home/brave/default.nix

@@ -0,0 +1,16 @@
+{pkgs, ...}: {
+  programs.chromium = {
+    enable = true;
+    package = pkgs.brave;
+    extensions = [
+      {id = "nkbihfbeogaeaoehlefnkodbefgpgknn";} # Metamask
+      {id = "gppongmhjkpfnbhagpmjfkannfbllamg";} # Wappalyzer
+      {id = "nngceckbapebfimnlniiiahkandclblb";} # Bitwarden
+      {id = "bfnaelmomeimhlpmgjnjophhpkkoljpa";} # Phantom
+      {id = "eimadpbcbfnmbkopoojfekhnkhdbieeh";} # DarkReader
+    ];
+    commandLineArgs = [
+      "--disable-features=WebRtcAllowInputVolumeAdjustment"
+    ];
+  };
+}