refactor(flake): move hosts module to flake

flake.lock

@@ -119,6 +119,25 @@
         "type": "github"
       }
     },
+    "copyparty": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_4"
+      },
+      "locked": {
+        "lastModified": 1786054218,
+        "narHash": "sha256-frbTEfqt6fAOcQ4Xk9o1cR5Eq//XhlmqS+3M86ZH1hY=",
+        "owner": "9001",
+        "repo": "copyparty",
+        "rev": "fbcb7733071560bac490ca60b0bb982a00bbe343",
+        "type": "github"
+      },
+      "original": {
+        "owner": "9001",
+        "repo": "copyparty",
+        "type": "github"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1781825982,
@@ -157,7 +176,7 @@
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat_3",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
         "utils": "utils"
       },
       "locked": {
@@ -388,6 +407,21 @@
       }
     },
     "flake-utils": {
+      "locked": {
+        "lastModified": 1678901627,
+        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
       "inputs": {
         "systems": [
           "mango",
@@ -409,7 +443,7 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
+    "flake-utils_3": {
       "inputs": {
         "systems": "systems_5"
       },
@@ -612,7 +646,7 @@
         "hyprutils": "hyprutils",
         "hyprwayland-scanner": "hyprwayland-scanner",
         "hyprwire": "hyprwire",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
         "pre-commit-hooks": "pre-commit-hooks",
         "systems": "systems_2",
         "xdph": "xdph"
@@ -865,7 +899,7 @@
     "impermanence": {
       "inputs": {
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
         "lastModified": 1769548169,
@@ -898,7 +932,7 @@
     },
     "lan-mouse": {
       "inputs": {
-        "nixpkgs": "nixpkgs_7",
+        "nixpkgs": "nixpkgs_8",
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
@@ -918,7 +952,7 @@
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_9",
         "pre-commit": "pre-commit",
         "rust-overlay": "rust-overlay_3"
       },
@@ -1053,7 +1087,7 @@
     "nixcord": {
       "inputs": {
         "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_9",
+        "nixpkgs": "nixpkgs_10",
         "nixpkgs-nixcord": "nixpkgs-nixcord",
         "treefmt-nix": "treefmt-nix"
       },
@@ -1073,7 +1107,7 @@
     },
     "nixos-hardware": {
       "inputs": {
-        "nixpkgs": "nixpkgs_10"
+        "nixpkgs": "nixpkgs_11"
       },
       "locked": {
         "lastModified": 1785232496,
@@ -1201,6 +1235,22 @@
       }
     },
     "nixpkgs_10": {
+      "locked": {
+        "lastModified": 1785386831,
+        "narHash": "sha256-sPS3CaXH8RAT3FZRuy4VcV47iuYIWMMfa0GbyJKC3o4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "21ea275a7c46aef9d4d6ddc962e6d562e9d94183",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_11": {
       "locked": {
         "lastModified": 1767892417,
         "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
@@ -1213,39 +1263,39 @@
         "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
-    "nixpkgs_11": {
-      "locked": {
-        "lastModified": 1786247143,
-        "narHash": "sha256-8S3Kcxs7D4UtxJxSJZz0m14CGhuW0MxfrIwJxeGWGnQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "279b4a8275f032c566576b3f181fa0f27197f588",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_12": {
       "locked": {
         "lastModified": 1786247143,
         "narHash": "sha256-8S3Kcxs7D4UtxJxSJZz0m14CGhuW0MxfrIwJxeGWGnQ=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
         "rev": "279b4a8275f032c566576b3f181fa0f27197f588",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_13": {
+      "locked": {
+        "lastModified": 1786247143,
+        "narHash": "sha256-8S3Kcxs7D4UtxJxSJZz0m14CGhuW0MxfrIwJxeGWGnQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "279b4a8275f032c566576b3f181fa0f27197f588",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_14": {
       "locked": {
         "lastModified": 1782175435,
         "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
@@ -1261,7 +1311,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_14": {
+    "nixpkgs_15": {
       "locked": {
         "lastModified": 1770107345,
         "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
@@ -1310,6 +1360,21 @@
       }
     },
     "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1748162331,
+        "narHash": "sha256-rqc2RKYTxP3tbjA+PB3VMRQNnjesrT0pEofXQTrMsS8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7c43f080a7f28b2774f3b3f43234ca11661bf334",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-25.05",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1743014863,
         "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=",
@@ -1325,7 +1390,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_6": {
       "locked": {
         "lastModified": 1786106723,
         "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
@@ -1341,7 +1406,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1768564909,
         "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
@@ -1357,7 +1422,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_8": {
       "locked": {
         "lastModified": 1772963539,
         "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
@@ -1373,7 +1438,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_8": {
+    "nixpkgs_9": {
       "locked": {
         "lastModified": 1781577229,
         "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
@@ -1389,22 +1454,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_9": {
-      "locked": {
-        "lastModified": 1785386831,
-        "narHash": "sha256-sPS3CaXH8RAT3FZRuy4VcV47iuYIWMMfa0GbyJKC3o4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "21ea275a7c46aef9d4d6ddc962e6d562e9d94183",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nmd": {
       "inputs": {
         "nixpkgs": [
@@ -1446,7 +1495,7 @@
     "nur": {
       "inputs": {
         "flake-parts": "flake-parts_4",
-        "nixpkgs": "nixpkgs_12"
+        "nixpkgs": "nixpkgs_13"
       },
       "locked": {
         "lastModified": 1786434255,
@@ -1511,6 +1560,7 @@
       "inputs": {
         "awww": "awww",
         "cardwire": "cardwire",
+        "copyparty": "copyparty",
         "cyber-tux": "cyber-tux",
         "deploy-rs": "deploy-rs",
         "disko": "disko",
@@ -1526,7 +1576,7 @@
         "nix-on-droid": "nix-on-droid",
         "nixcord": "nixcord",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_11",
+        "nixpkgs": "nixpkgs_12",
         "nixpkgs-stable": "nixpkgs-stable",
         "nur": "nur",
         "sops-nix": "sops-nix",
@@ -1640,7 +1690,7 @@
     },
     "scenefx": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "mango",
           "nixpkgs"
@@ -1679,7 +1729,7 @@
     },
     "sops-nix": {
       "inputs": {
-        "nixpkgs": "nixpkgs_13"
+        "nixpkgs": "nixpkgs_14"
       },
       "locked": {
         "lastModified": 1786375908,
@@ -1834,7 +1884,7 @@
     },
     "treefmt-nix_2": {
       "inputs": {
-        "nixpkgs": "nixpkgs_14"
+        "nixpkgs": "nixpkgs_15"
       },
       "locked": {
         "lastModified": 1785945821,
@@ -1918,7 +1968,7 @@
     },
     "wezterm-flake": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
         "freetype2": "freetype2",
         "harfbuzz": "harfbuzz",
         "libpng": "libpng",

flake.nix

@@ -81,5 +81,6 @@
     nixcord.url = "github:kaylorben/nixcord";
     nur.url = "github:nix-community/nur";
     lanzaboote.url = "github:nix-community/lanzaboote/v1.1.0";
+    copyparty.url = "github:9001/copyparty";
   };
 }

modules/flake/hosts.nix

@@ -1,12 +1,11 @@
 {
   self,
   inputs,
-  outputs,
   config,
   ...
 }:
 let
-  mkHost =
+  mkNixOSHost =
     hostName:
     {
       userName ? "tux",
@@ -55,8 +54,6 @@ let
       };
       extraSpecialArgs = {
         inherit
-          inputs
-          outputs
           hostName
           userName
           userEmail
@@ -68,35 +65,47 @@ let
       ];
     };
 
-  mkNixOSNode = hostname: {
+  mkNixOSNode =
-    inherit hostname;
+    hostName:
-    profiles.system = {
+    {
-      user = "root";
+      system ? "x86_64-linux",
-      path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.${hostname};
+    }:
+    {
+      hostname = hostName;
+      profiles.system = {
+        user = "root";
+        path = inputs.deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.${hostName};
+      };
     };
-  };
 
   activateNixOnDroid =
-    configuration:
+    system: configuration:
-    inputs.deploy-rs.lib.aarch64-linux.activate.custom configuration.activationPackage "${configuration.activationPackage}/activate";
+    inputs.deploy-rs.lib.${system}.activate.custom configuration.activationPackage
+      "${configuration.activationPackage}/activate";
 
-  mkDroidNode = hostname: {
+  mkDroidNode =
-    inherit hostname;
+    hostName:
-    profiles.system = {
+    {
-      sshUser = "nix-on-droid";
+      system ? "aarch64-linux",
-      user = "nix-on-droid";
+    }:
-      magicRollback = true;
+    {
-      sshOpts = [
+      hostname = hostName;
-        "-p"
+      profiles.system = {
-        "8033"
+        sshUser = "nix-on-droid";
-      ];
+        user = "nix-on-droid";
-      path = activateNixOnDroid self.nixOnDroidConfigurations.${hostname};
+        magicRollback = true;
+        sshOpts = [
+          "-p"
+          "8033"
+        ];
+        path = activateNixOnDroid system self.nixOnDroidConfigurations.${hostName};
+      };
     };
-  };
+
 in
 {
   flake = {
-    nixosConfigurations = builtins.mapAttrs mkHost {
+    nixosConfigurations = builtins.mapAttrs mkNixOSHost {
       sirius = { };
       canopus = { };
       arcturus = { };
@@ -108,18 +117,14 @@ in
       vega = { };
     };
 
-    deploy.nodes = {
+    deploy.nodes =
-      sirius = mkNixOSNode "sirius";
+      builtins.mapAttrs (hostName: _: mkNixOSNode hostName { }) self.nixosConfigurations
-      canopus = mkNixOSNode "canopus";
+      // builtins.mapAttrs (hostName: _: mkDroidNode hostName { }) self.nixOnDroidConfigurations;
-      arcturus = mkNixOSNode "arcturus";
-      alpha = mkNixOSNode "alpha";
-      vega = mkDroidNode "vega";
-    };
   };
 
   perSystem = {
     checks = builtins.mapAttrs (
-      _: config: config.config.system.build.toplevel
+      _: hostConfig: hostConfig.config.system.build.toplevel
     ) self.nixosConfigurations;
   };
 }

modules/flake/overlays.nix

@@ -25,6 +25,7 @@
     };
 
     nur = inputs.nur.overlays.default;
+    copyparty = inputs.copyparty.overlays.default;
   };
 
   perSystem =

modules/hosts/arcturus/config.nix

@@ -59,6 +59,22 @@
             domain = "bw.lab.tux.rs";
             configurePangolin = true;
           };
+
+          copyparty = {
+            enable = true;
+            domain = "files.lab.tux.rs";
+            accounts.${userName}.passwordFile = innerArgs.config.sops.secrets.copyparty.path;
+            volumes = {
+              "/" = {
+                path = "/var/lib/copyparty/data";
+                access = {
+                  r = "*";
+                  rwmdgGha = [ userName ];
+                };
+              };
+            };
+            configurePangolin = true;
+          };
         };
 
         virtualisation = {
@@ -101,6 +117,11 @@
           sopsFile = ./secrets.yaml;
           owner = userName;
         };
+
+        copyparty = {
+          sopsFile = ./secrets.yaml;
+          owner = innerArgs.config.services.copyparty.user;
+        };
       };
 
       # --- Networking ---

modules/hosts/arcturus/secrets.yaml

@@ -4,6 +4,7 @@ gemini-api-key: ENC[AES256_GCM,data:gLZSoYTdKY+rwIpYiXvN9n9PGkUD6q8Oe7dHnYkjEjwD
 openrouter-api-key: ENC[AES256_GCM,data:6xONCl9lqOoO7b4CEyCz9607tICDUAkpglRjGS5nYq2ppg2UKqYTrWD1BGCA5Xfs/CWskniVhoNG3vscjKiYCCh9gbM6aqdmTQ==,iv:7Iwc9t00HOOBjA7URXcUO41badqYyJCkFHM/uPkLFxY=,tag:Cl39kitr2e0//HVwAdsdUQ==,type:str]
 opencode-go-api-key: ENC[AES256_GCM,data:dmeRKn7TWHnqvpyPQpcEG6yHTb2bRby/rh10ytL0jHj5R+lRmNVdmqUF92GTznY9vEaB6ZYCJecWhpm8g4upNfOWBg==,iv:9UMJpAlD8gpcNiN+liu3nawoAZQKapEg7sCp561N9E8=,tag:OZlASpOa5BQaQwFWjoLCRw==,type:str]
 netbird-key: ENC[AES256_GCM,data:q6eKisca04qn/CvALrvXF79MsToDhvLRLv2JTiUBAZglCC9m,iv:jj0/ZD7IDgopprTVUgSfJmdAJmUP3iqewU3dqssGYbk=,tag:6IPRdCm2FGdlTEIX7jt3qA==,type:str]
+copyparty: ENC[AES256_GCM,data:QXt8IgTekg9rzFyuzpg=,iv:vJYfHqCiheq290K9TGACHNHyOWzIn60j1Kz502SE27w=,tag:ECt7Wavlqw1V6zgXiRZtUg==,type:str]
 newt: ENC[AES256_GCM,data:r5Rd81ZrzrIYbXtFkypbJltoGCOYrW6P4IpwGCtaH7lqCg7wD/WMboMx13HN4Mm0J4qbBpDakpfVv9qUTrisYP1xwpKkmY1kqPlFWRZN8hzuuNS2Tv3qUjavTp5XGotVPLHj1Cg/cwGcf8EAssYTwTy7H0PgdQKwqigQD1f1s/j4iXQ=,iv:1xP38/Ayt1xvn2fJGa5zgOrVNOw2J5taG1Orx6uNgZI=,tag:H9JXu9gzyyvTPWgXaoTsiw==,type:str]
 sops:
     age:
@@ -25,7 +26,7 @@ sops:
             TLKEYsPQgOJ7s8P9gw2uPUY6HRz86CtiC6EbO27u0+8BbI85x1QScg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1huqa3hc7wcxk4dpelrzny437nzrx4fnll3d8g9ahznzk268yju5qufapxy
-    lastmodified: "2026-08-09T11:21:03Z"
+    lastmodified: "2026-08-12T09:47:06Z"
-    mac: ENC[AES256_GCM,data:XFy+AiJRfrLhbX3j+0oO24qiHD5Hj2bVFqTMbUOOzsJzR0r8FBrwSNAZ0FVlFPFPAMitAIpZySS+kvbmEdZUfZ0soo83F5qwH6i/H5PZxqyDHst/Ig6Mrypp2DZMNZXNlqyLLmuaNGDf2pqApxCM3eSsgvCsNxdapRKlLSFJou4=,iv:D7gB4J4dhCfRo+1DaUAvOe3dWpoGvzIFouCJBNpwKiY=,tag:eLBZq/+Lce2S5Hu9OIC3gw==,type:str]
+    mac: ENC[AES256_GCM,data:gh5vEo25SDm0lymsnhJJAl3LhbdJunAjAd01bauFwn13vlLGKITUvYbCUd7iSxTMGg9emTiTueSTTFeIaFF7VEuZbuRPfBb3tGpY0OQJqc8IR1GrzoyvjHFEJfOj7orqPxim2YoRcKEBMOBVIkTDiNP/7HSvAucbfw1mfUVxzHQ=,iv:u3tBnR53UHk4wTPrMClE3eQUwdAlbNEvwWdSnaobrOU=,tag:Us9qZToS53IabsA6O6otpg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3

modules/nixos/services/copyparty.nix

@@ -0,0 +1,118 @@
+{ inputs, ... }: {
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      pkgs,
+      options,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.copyparty;
+      port = toString cfg.port;
+      acmeHost = config.tnix.services.nginx.domain;
+    in
+    {
+      imports = [
+        inputs.copyparty.nixosModules.default
+      ];
+
+      options.tnix.services.copyparty = {
+        enable = mkEnableOption "Copyparty";
+
+        host = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "Host on which Copyparty listens";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 1115;
+          description = "Port on which Copyparty listens";
+        };
+
+        domain = mkOption {
+          type = types.str;
+          default = "";
+          description = "Domain on which Copyparty is available";
+        };
+
+        accounts = options.services.copyparty.accounts;
+        volumes = options.services.copyparty.volumes;
+
+        configureNginx = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Nginx as a reverse proxy for Copyparty";
+        };
+
+        configurePangolin = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Pangolin as a reverse proxy for Copyparty";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        assertions = [
+          {
+            assertion = cfg.domain != "";
+            message = "tnix.services.copyparty.domain must be set when tnix.services.copyparty.enable is true.";
+          }
+        ];
+
+        services = {
+          copyparty = {
+            enable = true;
+            settings = {
+              i = cfg.host;
+              p = cfg.port;
+              no-reload = true;
+              ignored-flag = false;
+            };
+            accounts = cfg.accounts;
+            volumes = cfg.volumes;
+            package = pkgs.copyparty.override {
+              extraPackages = [ pkgs.exiftool ];
+            };
+          };
+
+          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+            forceSSL = acmeHost != "";
+            useACMEHost = mkIf (acmeHost != "") acmeHost;
+            locations."/" = {
+              proxyPass = "http://${cfg.host}:${port}";
+              proxyWebsockets = true;
+            };
+          };
+
+          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
+            copyparty = {
+              auth = {
+                sso-enabled = false;
+              };
+              full-domain = cfg.domain;
+              name = "copyparty";
+              protocol = "http";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = cfg.port;
+                  healthcheck = {
+                    hostname = "localhost";
+                    port = cfg.port;
+                    scheme = "http";
+                    method = "GET";
+                    path = "/";
+                  };
+                }
+              ];
+            };
+          };
+        };
+      };
+    };
+}