gonna need that internet back thanks

.archive/flake.nix

@@ -11,7 +11,7 @@
     profileModules = [
       ./nixos/profiles/role-workstation.nix
       ./nixos/profiles/role-dev.nix
-      {home-manager.users.jahanson = ./nixos/home/jahanson/workstation.nix;}
+      { home-manager.users.jahanson = ./nixos/home/jahanson/workstation.nix; }
     ];
   };
 
@@ -24,13 +24,13 @@
       inputs.nixos-hardware.nixosModules.lenovo-legion-15arh05h
       ./nixos/profiles/hw-legion-15arh05h.nix
       disko.nixosModules.disko
-      (import ./nixos/profiles/disko-nixos.nix {disks = ["/dev/nvme0n1"];})
+      (import ./nixos/profiles/disko-nixos.nix { disks = [ "/dev/nvme0n1" ]; })
     ];
     profileModules = [
       ./nixos/profiles/role-dev.nix
       ./nixos/profiles/role-gaming.nix
       ./nixos/profiles/role-workstation.nix
-      {home-manager.users.jahanson = ./nixos/home/jahanson/workstation.nix;}
+      { home-manager.users.jahanson = ./nixos/home/jahanson/workstation.nix; }
     ];
   };
 }

.archive/home/modules/programs/de/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./gnome
   ];

.archive/home/modules/programs/de/gnome/default.nix

@@ -6,7 +6,8 @@
   osConfig,
   ...
 }:
-with lib.hm.gvariant; {
+with lib.hm.gvariant;
+{
   config = lib.mkIf osConfig.mySystem.de.gnome.enable {
     # add user packages
     home.packages = with pkgs; [
@@ -22,7 +23,7 @@ with lib.hm.gvariant; {
         workspaces-only-on-primary = false;
       };
       "org/gnome/settings-daemon/plugins/media-keys" = {
-        home = ["<Super>e"];
+        home = [ "<Super>e" ];
       };
       "org/gnome/desktop/wm/preferences" = {
         workspace-names = [

.archive/hosts/durincore/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   config = {
     networking.hostId = "ad4380db";
     networking.hostName = "durincore";
@@ -11,10 +12,10 @@
           "usb_storage"
           "sd_mod"
         ];
-        kernelModules = [];
+        kernelModules = [ ];
       };
-      kernelModules = ["kvm-intel"];
+      kernelModules = [ "kvm-intel" ];
-      extraModulePackages = [];
+      extraModulePackages = [ ];
     };
 
     fileSystems = {
@@ -38,7 +39,7 @@
       };
     };
 
-    swapDevices = [];
+    swapDevices = [ ];
 
     # System settings and services.
     mySystem = {
@@ -47,5 +48,6 @@
         "wlp4s0"
       ];
     };
+
   };
 }

.archive/hosts/gandalf/config/incus-preseed.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   config = {
     "core.https_address" = "10.1.1.15:8445"; # Need quotes around key
   };
@@ -26,7 +27,7 @@
   ];
   profiles = [
     {
-      config = {};
+      config = { };
       description = "";
       devices = {
         eth0 = {
@@ -43,6 +44,6 @@
       name = "default";
     }
   ];
-  projects = [];
+  projects = [ ];
   cluster = null;
 }

.archive/hosts/gandalf/config/samba-config.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   global = {
     "workgroup" = "WORKGROUP";
     "server string" = "gandalf";

.archive/hosts/gandalf/config/sanoid.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   outputs = {
     # ZFS automated snapshots
     templates = {
@@ -13,22 +14,22 @@
     };
     datasets = {
       "eru/xen-backups" = {
-        useTemplate = ["production"];
+        useTemplate = [ "production" ];
       };
       "eru/hansonhive" = {
-        useTemplate = ["production"];
+        useTemplate = [ "production" ];
       };
       "eru/tm_joe" = {
-        useTemplate = ["production"];
+        useTemplate = [ "production" ];
       };
       "eru/tm_elisia" = {
-        useTemplate = ["production"];
+        useTemplate = [ "production" ];
       };
       "eru/containers/volumes/xo-data" = {
-        useTemplate = ["production"];
+        useTemplate = [ "production" ];
       };
       "eru/containers/volumes/xo-redis-data" = {
-        useTemplate = ["production"];
+        useTemplate = [ "production" ];
       };
     };
   };

.archive/hosts/gandalf/default.nix

@@ -17,7 +17,7 @@
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
     inputs.disko.nixosModules.disko
-    (import ../../profiles/disko-nixos.nix {disks = ["/dev/sda"];})
+    (import ../../profiles/disko-nixos.nix { disks = [ "/dev/sda" ]; })
   ];
 
   boot = {
@@ -31,8 +31,8 @@
         "usb_storage"
         "sd_mod"
       ];
-      kernelModules = ["nfs"];
+      kernelModules = [ "nfs" ];
-      supportedFilesystems = ["nfs"];
+      supportedFilesystems = [ "nfs" ];
     };
 
     kernelModules = [
@@ -42,7 +42,7 @@
       "vfio_pci"
       "vfio_virqfd"
     ];
-    extraModulePackages = [];
+    extraModulePackages = [ ];
     kernelParams = [
       "iommu=pt"
       "intel_iommu=on"
@@ -50,7 +50,7 @@
     ]; # 100GB
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAGSFTSVPt43PBpSMSF1dGTzN2JbxztDZUml7g4+PnWe CSI-Driver@talos"
@@ -107,13 +107,13 @@
         sopsFile = ./secrets.sops.yaml;
         owner = "jahanson";
         mode = "400";
-        restartUnits = ["syncthing.service"];
+        restartUnits = [ "syncthing.service" ];
       };
       "syncthing/privateKey" = {
         sopsFile = ./secrets.sops.yaml;
         owner = "jahanson";
         mode = "400";
-        restartUnits = ["syncthing.service"];
+        restartUnits = [ "syncthing.service" ];
       };
     };
   };

.archive/hosts/gandalf/secrets.sops.yaml

@@ -1,65 +1,92 @@
 lego:
     dnsimple:
-        token: ENC[AES256_GCM,data:xWFVA0xhifz+odHKmGaGswT6fZ4G70clfS8AzbWnxc18JF4e75dcG6BhiA==,iv:B4pNvag4nSrw1LwL/OGyXdEcw0gZeBFBBcNzqlimjYc=,tag:ta8l7XqbQqLO+ll8Wr+mug==,type:str]
+        token: ENC[AES256_GCM,data:Lf3sSTJ1XQAMe80p7LnoElvN7uv8bMblcvskiyBZQx0A9inBkoIjBf9/0w==,iv:D53d/uIRZeyXWB64NZFjrnutToua7+6nsh8wvsBfqdQ=,tag:ODzXnRExlTFP0ewl81QE4Q==,type:str]
 borg:
     repository:
-        passphrase: ENC[AES256_GCM,data:qyqATupWXH5Gjx7t1660mvC1YUU=,iv:GhEbT8x5+SNXcF3b3ITk+3Dsv5PxzR56JSEufxQUBio=,tag:qWanlk8ox2uoFtyK7aiMcg==,type:str]
+        passphrase: ENC[AES256_GCM,data:xJ9KLh1V0ykeEusRon3AiXLH9fs=,iv:D5ICrIoTegc9IfdagbqjQ9NpW9fm3yq1CxnOH3v1qbs=,tag:ENnLfTRuQaDx38gGuz9Cew==,type:str]
 syncthing:
-    publicCert: ENC[AES256_GCM,data:q8EYRAkpwrTF8dodEH84ycDAhADLZ1uJvnArn698bueLgxtP4FHgsAHJXADtLj5/KBVJRNSBMl592wNLF9UVg0OM2b+KnMaLcVH6VHlpTQIzQBjVRjjlfU/uUfvDWXcXvfKdkS3RvDMDtR9vD3MRjdLIqjKY+7swmP2L2+WWyMXsZ3dgFvxpzH/yDekklxj8c0QVb+YJV858nNPvTKc8wkbcovsQiIQICmHhxAVU3Y51pjFXYTDaMGS/RkL47JYjYDpkCdetqe0R1wePlz5t7wbNSlg1u9d4xVtcW3yoqLErBI4ArleA/PPNflSzpx6WVLYXZ9T0BzYvDObt5VfpZ7zhNBTzXD0cvQZKyUWD6yY17JcJ+zQQiQqajSnhg8Iv4E/rwy0pRUM+YCBX2D7SiLpnlqYvHHAT8zMHpq0x/iw0t6h4ypxVVr9MU2LxfFxTbfgabJB94nxr/lk0/ONGq+gCxf3K0NOW5n6IDCB3o75KIqIG631E7F6WK2EmXF4KgS8EQEJVWWj4GKcB5dKGI+/jz3MUB4JXVLhME3X3ReDQbkZjr2OmIs6KbxuxWR5TSEj5G/sTXRxpqdKkE/aVfQMYoj7LCP4+HdM6NGP+irOSMSSC4PoHJPYtVDLluNKE+K/4w1MUK0m6EzdNrfHggY/0oS7UF5VCLrHZCNkI7CAIyVoR0A3kOMYhWjwIxDoQCSA1E/kJqYaB0dChL451xXKjvMkPQajZHK9kU/tRTcaAFgAwdLR8SYDpvN7eb1Zf6Cc4g0qP7BKA4FIqBjS+0bNobgO6oiH4TmsmIseLvevnhT0nRu3t/Lmuf2nFxAOlXyvHEp/6ulMIY+aOVcLRpi/5UjbL4rQTddHS0Y/54ofZcnD/yXiUafJAYzk/vmM3RTCj1qzmT8olw2n092LiQ7SjCIIs5PAIqWsq0O/YnyJlE7t83UcfES23DrLjc7ewcskSqG3GsPVp6qCz7/9nFgS7Sr6yHRMKGTCHSzGVlxXP4bHsDfe+DZc0R9ll67AjfErLDVlrwHOo2dpiXWcZD0Rs86h0dVCYSUE=,iv:0b7Jpbp4AXt7ngAZo5J5Fah8LByfmBRJwXQiGU5E0aY=,tag:he2qKsX5ne7tMRyc1EVFGw==,type:str]
+    publicCert: ENC[AES256_GCM,data:AnzODcQM57zYK9krVlydQjQ26Shd65ui/F5n3/CxZuICgMzn4KJujgCJpW+2TtT+apTehmVwnCZH8sdI8EcB09dyjEawncZxeI+n1JqgE+PoLI1A1enjzM1S7OwNUIl09yMiZflKRvQNKtUihd0/HLcoIRkBNYu78UP69uxMeOFkKVeeSl2k+ERvv1tvO7lcY3ksBRV8H554xv139ojJWtIrUCjibx6uCL8I+TWwXIhH+DjAsE2d/bnsJ1NMEuDM5Mg1wVp4ZWIoQU/HoOM3b2Khb9vW+AvuQPeK1IUkYPRqteykUP2eoIwFV9IFfj6w/VrwFazXqg/DoaOC6mWr4/+0uam1uHO4QGfLP3idVBWbAdUoFvlVDUSLYOrG25Xssry7dn+JPBu3n8Y5uzNdfSthYLPRQuippQ34SlYIcgvGVJaNlf4/aglA2x5rC6xRi3/OwIFzbmADonDKsLyNsmiIUUo1VYUYPEEhLYeY3Hu0xV5Y52CMEF8MFpPsS43/9Dv89VYgKTPywY2/PjtpNuc5pysOYzJAvOiD28YTFgz0Dp5m0ShGmXjSFK6ekAzTvJYHzFMNCIBWcYrFbao2OFYqT17kh19+wdQDK4t0q7FHwQVwm8OtpYvstNasBCU+jZCuUUUdHYAAOj5F7U2mr+GqG0rp4wonSU1Qa96M/3KsNR5wbMY1ygpj6ADDCaxL/dUOS5kz2eBlaiMYxakCrAmccfoSMNcG3QmCpyr6QjvIAJPGgNMjVa25LGIs3GCKDrEHfN3I54KV3SNRYeGplw3HDQg9gFpuZ7ZqlhdJOvO62m3rwDTtCF2acouhu3dy/3XENWceCbRuSGktORxklUrLOcXBLXYbTs1hmDI6S1hRGQTxcTXSuVlkjkOcxZ4rpqbIGErpBeQodh69XWbOJ9yFC4XSj4oNydt2JtqDW/H9q4GYt9njcUFP3RoxI2BCUtwOqdaPO3o3svevVgC5SaIcDsMnz+dLRs+cr5FZk/AIDta9+RVBCl5clv4svoWfSOn8ff6mrhYqjo3Wtf7k3KLqmfIDawuKfQU=,iv:UiCdr9U1sTph8VOJNiq7VS1c3JvpRPrti0G7sOJeAmc=,tag:OwFs0+2cIwDi6LLxr4jbFA==,type:str]
-    privateKey: ENC[AES256_GCM,data:2BzXadahdEIAyllwmBLYeiNciPaQ0Ds/MJ450hX361SzNOkSsV/Wpbhr1plG6MyTc72BmD8C++5hlSCrD1O3C8mpKFNKV7om7NEJ36DSnpHlKFwmTvoQQw7cscBpZokWlgBlsRbbnrWWaac+k9tQp2pOfPscwKWMkULxR/59TsvLO5b0tZp8G5uL+Ah00x0eVtqqE/o2mQ7YpH80sgv3qHGKImyflMugvd8CKm6R2pYEN6K3Aw+N8ReVSoKXu7oaoxutHzLjuEMYlXJa1UnbE/8uajhIwXy5XcAHHywrPl4vDm9Jer+7fn8qqslBDD13bSiwuh0+LtB6QS72pg70sHPK/uuNcAbMcJ00Bwx1IsuLah3I2r3yZdh+co5qxcG6,iv:HWAhyDTP8cryZusGyemzr11Ax821aEl/a3O/wXMbPNY=,tag:uK3mGe/bvsmmCGjidKp77g==,type:str]
+    privateKey: ENC[AES256_GCM,data:2Ue/vbCIN8ceJEBRnl5pSrdEPHGDy92eRO0QtesU/FvrrwQq8ga5DCCCB1Cee1zWXrXT1R94b0GSvjfWu9M9JQvNdIjFTzwOIElRL/NrplVbJKSd18P/SHEJHZ+/vWxFkOk0FDmN1xkFrVQEf+g2xbHtcYYA3TT8b4a9eDHJSUQGCYo3LJVkJUbgsNgpoRPOXrA1LKXNsoaUqDHYXoY86j+ShFNlx2wPRkeymIkoULK7gyykeAVFaE/QMXkel/BVNz94lPFlnOymbj0vLa6qAhdRyeV5sh2Q9AdR5tM5bUBoSOCe304Q9P7/BLh3dpmRAeI4dq0FcJlDF2Y8z5A+ZPBsySObYSkDXlwgFOvwJgVVXbcdd9y8FwpV/kVnbPeP,iv:MM9d8VwvWWUxID/9HKa4m5zDeNR5yu7REVDHujIvyA0=,tag:0DvBfO3X58FmjnCWyupVgA==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age:
+        - recipient: age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBucldMTnVlS1dRNHdRSzNt
+            K0pmaU1lSkwrOTZLSDdjM0dkMUZKNXJJS3dZCncvMmZ0K3lwRjJSOUFHTDA2QW5C
+            bW4raVc1RXMrbXV0WmcyVklBU3NZM00KLS0tIHhoTDFHc3MvcDdNV2RBVTAxQjZT
+            dWtaajROWFFSSU81YU45QkdGZVAreVEKdRfFV5aXf+TCLrC9rlIgOIgvXKSRLXV3
+            AaE+DMreP3ipFj3sRtbWhwpwdKG3ww3oUVuSOzkupxBviKLuZjOpZQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMRGp4MWxOclZFZThsZXlU
+            SU5MeWlBUkxyYkpWMTRraG9kUVdkZVZIRTJNCktDdkZMUUJJVG92R1Nrd3g1N0Qw
+            Q05HV3NPaUlxOHgwUzAxSzZEejFCdjAKLS0tIDhZL1JTUEh5eUM1V1RScTZ6bWhW
+            ZDdnOXhGR2JkVjk5YllKVjc2TS9RNDQKyi08QEOaZfb4Dj+CviQoIGKkyi0qGHUC
+            jUeERhVwT346p1Bx5JLcHAyoPMdbxm37pNrC2P/LoI9/enxoWZ/hKw==
+            -----END AGE ENCRYPTED FILE-----
         - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBla1U3d01iTzIxZE9SNFZL
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTR0plTmZ3Q1BuY2Z2bzdR
-            UTJZVDFhN3FUaGxCQkxQQlRwMzZPbTVZQkVFCm85eXQvZUNQVWtISTFCYVh0ZUxP
+            aHlSTFQ2bkl6ekVDdmpxZ2lCMDV4TFYwd0FJCmFHczFwanZTVkx1cytqd2pHYXhr
-            ZE9MRnF4aDZoSGtXNUg3by92S2FYNVkKLS0tIHJta016cmNPNFhTSVdrc2dDRmx0
+            b3I3SnRkM3dMd1VpbjNYbmI4Z2Z0MVkKLS0tIEw0ZjNxK0NUckdFYVpIeDRDSGMv
-            MlNlMHhxQk5wUThFYTZyVjIraXJGYVUKMvTxkSUbaxDj2yy+XpFLyjNeGQkXTLfV
+            b0lObG1iYS91aVNaZ3VRbXBPOFFYYkkKexf0g60IXy+LNqFkXgpfx+FWDeFiO8+3
-            onQ8JwVJ3ZP94O/hBlLsa8/akggDatKVKoDKZI3UrypNA5tWQr4uwQ==
+            9EQWEEQMurYqVzAT+BcJq3LuAex5lEFO1nLav1k2rammA1epB8QYpg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKK0VybENLM1Bpa1l1THo3
+            VnczdzFraWpKMVNOREduVjJ2V1grczdxTUNZCkcrYTExalljWVlOWXFtMmlmemt3
+            eGM0Z1hXaDZXRDcyOVFrc2FRL1J0YjAKLS0tIG9wOWpnV1ZYQy9DWG1zR2dOR2FH
+            MXdmVWkvS2dCNzBJNEJGQzJjSHhXVHcKbVzAr0o45xaS33bYY2Pb11cEHiBTi+7l
+            H1IlJBdJbyJ8NMFJfvnyKBHLttUKb57Xz2mjeaC4vkDHT450r+k5Jw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUHpzUy9EaCtKRTRMNi8y
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKS2tTUzBlZFl6WU92d3M4
-            bHcvMlhWSDMyRGk5eHhLV1dMMEU2L0MrbFRRCjJnWjZVazdDbmZiaWlLZm95blFa
+            Wjg4WVpvRk5mdWRCWnFxK0RFS1BTZGJ4ZUJnCllNY2ZQRUwvN0lKM1V2dURDYXQv
-            Um5qZFBXcEg2cTN0aDYxd2FlT1RuVzgKLS0tIDBpZHZ1bDhUWXZKS2prYnlnaVFB
+            cXNTbmZkcEhMZDRNNjY1a09CRDYweVkKLS0tIG5Qdnp1cFl6UCtpMTh1ZUZoTTRM
-            cEVhTnMvTENleDlzRERZc0JnVEtBcmMKSFePvV4GOeD297tSpKy6Xb+XNfNhjSHM
+            dnpjQ2tkOXFCa1ZvekxBeFR2UXprWEUK9tBZsGeIMLiW8Lrodir6zynFg2I3LqW9
-            j3X3tA+Q0W1H17RijW1h4dyj5qzQsrSf7DSpIxXqwzamEVV40Z3nHA==
+            bMjUyF6CM8U8Aid7ftX5fiEMFCyssrSRBQ4CVs28jic4dYJ/3Nceiw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nkpq8lr09vamgvf8cvzemqjyr3ex8w7azfupdr2gverz9j5zgemsv99t0z
+        - recipient: age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMlVTWFkwcXhBOWJCL0ds
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTQ0hGa2d4VmpMV0ttYis5
-            TXUxOHNmclRKczRJYzVOMFdMNG5Qb2sxeDJ3CklNa3MzbXc5ZGZSeHk4d3hmWnNo
+            OFZibUxkSjdiYVgyajhGblRxMGkrTSsxRlgwClVnVy93YXBMRjM1TEIyUzB4S3My
-            dnFVOTB6QUxUTDQya0ZneWZiM0lyUjAKLS0tIFdoVlg0Unl0aDB0VjRQMit0Mmkr
+            TG9KSjNVc1BpODBvV201dkRmZitvMzQKLS0tIFRLZFJxclJPK1lvMVFGZ2UzaVFu
-            YjVJejg0RVB1U2Rybk1iM1RraXIwbWsKRaqoxEytcx4JhoHFYeL0QBtOhGrqrZjn
+            VFJkcm1QaGdDeTJuVWpNV3pva2RKVzQKI0s2hQHI16T72AYVvaO4f+nIza5768S4
-            z090Ml8zukXq/UVnWlt8GwIf9yKkDSixNywZJZF58/9omOpoHagv7Q==
+            pQN3UUOjug8L7/85ytHvOQOxBC+PMAG/aJABoj7FMhZNRvKtbC2J/g==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMHNsaTRqb0hkdUFhV1VO
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVHU5Z1cyWjFjbjRncmRu
-            QzBHekV3c1VJTVQ5VUNqWnJFSWJlM1JWTUZRCk55bFVrRUxFV2Vpb0Rvc0pZRGN4
+            NklQRGVNK2VZZlhKMFgxT2dGYU15MzRTV0VFCnVDUkY4elNNS0VqZWUrQjdWU1Jh
-            ZThTMWd0SGFoYVZ3cG9TNGZKd1hpd0kKLS0tIEpLTzlBN3FuaXhCQ1ErZG1LaGgx
+            RUZTUE5Qa0FsYmljQThyd3p4bm9FbDAKLS0tIG9MRGZ4UkhteUk1cFk1b3JXZzVY
-            cDNDdDNteVI1ZHBtZUdtSEVxN3RtaFUKntQ9CvSB8BUrJctW3Rj7dxWwgIPGrdVP
+            VTkxcEppQ2Y0VVg1dThQS3FkcFdPTVkKG0/RNreCjjbdsUq4PoXCsfVOnd3fF0jS
-            hLsD6xe4LHoG/hChRamhQOnI0AvubkeXWMWhLU11NT5KFspEsmIlXA==
+            Sw6bTIpifslRFu0JJRB83AxRxjPbl4h6QOz3VlDHWfGCJ5eO9RQfjw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwaTM3RzAyUG4zTFk5WFB0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWStjeTFGVmM0YWN5bWcx
-            anFsNG9QY1p1NTRObFVQL3pLL0V4cm13RnhJCjh4MGhZaHI0WXVoWHY3M3dwRDYw
+            eThvdTNoclNkd0N4VklRc2UrOFFIejFXYVJvCkNlaE5iL2ExcFlZQ0trZGQzenlQ
-            QXpIRjlkZEUydThQVXZxSFI0MjMwVFUKLS0tIGFiYmE5UTQ0NnM5dktZbGZPcmE1
+            WkZMdUtaUUU5NXFWeVlPYkJ5eit5U1UKLS0tIDhONzk1M0pEV3plR3JHdnFRNVQ5
-            REM5NHVzUy9rRkNQL3hjU0lRQklXeFUKhcDEgKFwhoGWPS6JDsgvFeb52H0N6Foh
+            L2FjVW9qREJjUUtZSzROV1lQc1lUaTgKSFx81K8XYD5KFJNBlAyLshwQQQYqdGos
-            10hkCG4eftdrfT1r0Fxcr4LD1oHgOZN61Kfvr0t4UqoEOnLMxOPM/Q==
+            goYyedCpe7JdXp49sSaCdAWpdphznFTdElzFCuM3LSxM76tI0JEe/A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-09T06:33:41Z"
+    lastmodified: "2024-12-27T09:27:41Z"
-    mac: ENC[AES256_GCM,data:Eb/ss98+IxI2RL3Iu7VHIYko7YOiPZhkIUAYF5UNAwyNZsqjiPKtxFejjtuixTzCVuKejSZBkYTCcd5QI9SquQhh9TloTg9lsEI94+vMn7hiJW816rsllx+cvaKM/MVYOaVX1R50QKpzjsjT1hZR8XVQUm1s3pmwaZi9KSesc18=,iv:RtODAtOjuTcWJzCJoHRXj9tp3lC5XYG0+upBPnAas1g=,tag:pOES1vOW7u9tSHkWaPJ1ag==,type:str]
+    mac: ENC[AES256_GCM,data:c91/QM6/I7NYvAKQlnqTvv1n9HXt1LlTAa8OXaKzYB2Pg2Ofsl0z4XFf7dpLiITRFjBZCJWKyg4rVPKpNOUAwE4TS/7D+lh2xjJh5YPW1C4nwmu9dQ4/KSfBH71KKsSLJUnktgZXg7LNhE7QBFxntoJvznjv+vjjkzgovbBqC+Y=,iv:tCy5h0BscT7WKncaB4iCGWx6Up9OqZzRFYFQiLiNxgA=,tag:BPp6dZzKD0zUENoHRTlckg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.1

.archive/hosts/legiondary/default.nix

@@ -6,7 +6,9 @@
   lib,
   modulesPath,
   ...
-}: {
+}:
+
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
@@ -22,9 +24,9 @@
       "usbhid"
       "sd_mod"
     ];
-    initrd.kernelModules = [];
+    initrd.kernelModules = [ ];
-    kernelModules = ["kvm-amd"];
+    kernelModules = [ "kvm-amd" ];
-    extraModulePackages = [];
+    extraModulePackages = [ ];
   };
 
   fileSystems = {
@@ -55,7 +57,7 @@
   #     options = [ "fmask=0022" "dmask=0022" ];
   #   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 

.archive/hosts/telchar/default.nix

@@ -0,0 +1,93 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  networking.hostId = "4488bd1a";
+  networking.hostName = "telchar";
+  boot = {
+    initrd.availableKernelModules = [
+      "nvme"
+      "xhci_pci"
+      "thunderbolt"
+      "usbhid"
+      "usb_storage"
+      "sd_mod"
+    ];
+    initrd.kernelModules = [ "amdgpu" ];
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [ ];
+  };
+
+  swapDevices = [ ];
+  virtualisation.docker.enable = true;
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  # Enable Flatpak support
+  services.flatpak.enable = true;
+
+  ## Base config programs.
+  programs = {
+    # Enable Wireshark
+    wireshark.enable = true;
+    # Enable OpenJDK
+    java.enable = true;
+  };
+
+  # sops
+  sops.secrets = {
+    "syncthing/publicCert" = {
+      sopsFile = ./secrets.sops.yaml;
+      owner = "jahanson";
+      mode = "400";
+      restartUnits = [ "syncthing.service" ];
+    };
+    "syncthing/privateKey" = {
+      sopsFile = ./secrets.sops.yaml;
+      owner = "jahanson";
+      mode = "400";
+      restartUnits = [ "syncthing.service" ];
+    };
+  };
+
+  ## System settings and services.
+  mySystem = {
+    purpose = "Development";
+
+    services.syncthing = {
+      enable = true;
+      user = "jahanson";
+      publicCertPath = config.sops.secrets."syncthing/publicCert".path;
+      privateKeyPath = config.sops.secrets."syncthing/privateKey".path;
+    };
+
+    ## Desktop Environment
+    ## Gnome
+    # de.gnome.enable = true;
+    ## KDE
+    de.kde.enable = true;
+
+    ## Games
+    games.steam.enable = true;
+
+    ## System config
+    system = {
+      motd.networkInterfaces = [ "wlp1s0" ];
+      fingerprint-reader-on-laptop-lid.enable = true;
+    };
+
+    framework_wifi_swap.enable = true;
+    security._1password.enable = true;
+  };
+}

.archive/hosts/telchar/secrets.sops.yaml

@@ -0,0 +1,86 @@
+syncthing:
+    publicCert: ENC[AES256_GCM,data:SVEKnnuq30TJJoxbgTYRHTEdQyNYsn50+223Ly0QmX9V96xNb+qMIgJfOX9dGMZdoxNfQOkeecLvwgNZc6sEXNdlhFt/a/bqL6wNJvRY2PdyNoX2IKZvfZFulZtxuAAWsG0dwP04CT8cDmK4dUQIWEKRUOUAKRFQkD8cgglO7OHDGVZ0gZT1g6P1CAIJ2kWZiO3yRDSBWkcxGoY+Hy+tbCMS1Ut9Evh0bDAHslYvVPVqlNhurADTF0vkJO88027+ODQjts4M2ecgafZE4y8L0CmMF/+sdGtkCRiYqTYmxAwjWZmL8YjmsWI6Cl7VaaH3pqyvgPPBksBbfb4Zj+Nq41DLBz/vHIC8qpsIjrPvl/4lRmesuTUgut0HfiK+h3VpeUtU08wb0UtHixcOhvxEdSShMS1bXvmCEeEIKeagxImCfuwR8nHAkXRVSqhIovDYfL1GYsyjeK5b/zAYdckzk7zuGgTX4wD2TnVG3ve2SGJQ+9HUUiaiDlrQAzyer2kjMIDFqEvSNZ087ATYTaB6FI5DYFCsd3yEM10AcdzaMe2wCvGuNYg+NRKbFrVxYacT7sdb4m+gf7u8SimlEy3e9URQTJ6T5xsg0xeLMmAtOawKSzhVNjxQM64N42cyQmfHBUqj2LneO4/ma3/URpqtxoWBKu3wQlBv9aUAiyWycYmr8DjvyiWOn8D07cCOAj6x/4EnY+Q9gXaj0w6sj9VrsL+fQQKUIWpCt32nmYHLmSFUuCqUAkY+dGnMFWepJWuOsLPLoSK9M6UMuYVxggBNn6lngo+0SRj6pEGspebWku8VfKTWUqBIjrHvhzKmT6FrCXkfzIQ9231+mBUWM9+74TnzwgRKCeHIQW554pynfTqs1M9AiLtHvIt3ixNq5txMZCgqS/Mg3YGEj81c8X+RVvvqIHv5GDeQGAeTJV4Tjof9UiOOr+UOmhgy15PnnZl3Z6Fhty6+bTClDFDXqqBhg/kDEWf416qL53IgoHgE12tWNn28SFFHBvq/YCF72P65+TXhns9pCSe8RDWLeDRawM8rlZ+8VQ==,iv:7vLLWbV7TUe7Dv0KaRvOrgwrjwXMABa5eaR/SxeghvY=,tag:K0Rz8OVUKOS4SRlGwZrfEw==,type:str]
+    privateKey: ENC[AES256_GCM,data:kkBxN6LuI6R+69rbNGfvioNT6d04/S+LF31+FOq2K9goQtGZ2dTbBdMkpsxlmtxNqqV/svVGPOFQc904Mdyy+djOPGUF7YQooRTIiCWMXaCHrpL3okP/ONYYDLVXxNqnBGboWYqlqr2kQANH4DBACUzN1RhPh/Qy0dob4vqx8nnSbutbo9wdVygi9JIzdmS2VmihfNR1bgG7+z0pUi9+dwZ7Y116VUEx/S4qpq+FbOOEctDL0mj/E/iW0dFTZO95nFjG8MpzX2M74Mm64VdZZ/MygSLj6B1+p90rryv0R5YW3zuFj4YIS3GurBEojG+rbk94SWN1SY5s3jc1GaQ3Sjtk+pugmU6sxkOaLxX+XfbytZ1FrUalwGHCvfQbWP1T,iv:PJ6EhA+fW5C6jkBIdfsx2U0uGshyWdAC1T3fC3Hr9p4=,tag:fyToI/FQPI9gFvN7+bSf6A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoYVZMa25OeHo3d0J6NlJv
+            TkFOVUxzNy94Skoxd3pwT1o1WWFtVTBzRFY4CjMrRS9RRk5PNmx2aTlaMnU2WEU0
+            d05pWnhLeFhqY3A1VUN2S0NxTnVDRU0KLS0tIEdPKzlQM0JuMTlsTUQxOGtHS0xD
+            WDdnL1k2YmwxM0JEREJnc0dZZjVuMlUKYLP8F+3/ze0LZAiP+u0aVW/bLSIk1K25
+            NqbqT6SNDXuyeq61ysi6CwhYokUwnLBANv/BRsBLT2JX5tI8uIaKTQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUbm84cFI1eCtqR0hnaUVU
+            SDREVDJFQ2JTN3I4OXdrdTk1MVhheGY1cUFnClhidGRBMDNuTjlCekNOcS9YUEs1
+            ZHFZanFnWmlZbFF1eEhwayt0clhuR2sKLS0tIDFJKzdxNzErRlV5blp2dEg0UGNx
+            d01XeHdJaU5BRUJMVXMra1dNRnJqZUkKgkfspMPpA1rg9d87eFWN1ThdQyXaRM9P
+            8eBkOG0H8W5Afsb0kOqA8gJGL6bzM3fzbVDjK7VPq06zrzY9uaLkCA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVVVlxVHZ4MTBpanBSc1J3
+            bEgwQTh2WHNSUm0wVmtXNUhMbXNQaHVjc0ZVCjBUNUJITStSektTVWhzWXlPb2VJ
+            TTNoNHEyeXhraHJqRzYzQXRMcmp3L2sKLS0tIHRiK05XeVJGMzl1VlVITjNHSDhY
+            N3ZmWWtlSGx2cjFxZ3hUNm0wYlFCMlEKrUEV8phjcnciK+tuOFEBz5PxJKbbwJNM
+            BY4gs0zkhk/jkvdiljgfeyKrlcjwfz1b8kLW316PfkTBJiIAc6Zncw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUTFM2TzB2eDE3bVVNK3FN
+            a3pEVkkzUExKdnRNTGFSaWJOa0lVUmRrT2p3CnV3SGlSa1VFblR3ZDdvRGRlcXp2
+            cjIwTHkwTGhJWHAyVllxV3FZT0NIaWMKLS0tIGRsUDRMcFUwS1c2OVZsbGdvSVlv
+            bXlNeTBaZ0dOYnFIS09haXZOV0Q0azAK/6UGR0cd+gtR/7Yz75v87NWWcz7gP2iU
+            sPtvPHEIYh5gnop2DwZTpATwwvxZWp0b8OpV/2AyUiL6tniCV6qDvg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxVVJEZmxsR1A3a0luU0po
+            ejN2ZHZERlhoeVYwV29LajlXYjY5TzFzZjFnCkFOSHJMbktYZFpBcDdWZ3RsVHo2
+            UlNSeUpxbWVsVzkrblNlZkJhV3dGTWcKLS0tIHhOb1VmaDNCNU1xMzZCVWlFeDF1
+            OVZOcC93M1p0VThDaHRLVTc1N0ZyQk0KZWDWhjrmnqfkbJmZRCwXHGMdRmL0W4Sa
+            4cEGr8XbvJlzFTmbm81X6KLKdYz62V8fa99mAEzffOB0SqegBTb8Ig==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJNDRydUJieU81RVdubEFu
+            OWM0dEF2YTZ2WVZSUFQvakgwa29NNTdrb2hnCmJ0dHZqTE9vMXVHbHBtd1pUY203
+            UFhnZ0ZLOWxCZnptd2pTWU1scXF0TEUKLS0tIGt3a0wwNklQTUR3V2MvQzVkQzBN
+            b2RqWjd2Nkt3YmZ2eHlYOUhJNFB3RjAKdnCRIg3zqLaN9rjjc8tCBj8lOH1SWw2Q
+            s/0TLrsXy62nlWibDxsuiE9mPCediFVbJWxTCAs4ze/jELGESV6S/w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZNUlIQTdQZHNsWEdselAw
+            RWJjazYvK0xSU1NteWs2RFlWVHRYQzF4bnhNCjg5RHQvRm5hWTcrYUxYWGlIWFdW
+            dUNoaEQ1V21DWGdRREZZOHFBeldiTkkKLS0tIFR5aG1TNGJZY3pmMWdJbXhEWG9N
+            aTlZcVdCaWltdURHbEx4b2h5RjlIUm8KfpXCYGLch4RAhEPfgikR60sp5tywKV1R
+            fRsXad3X31fAS42ZeczPn399byImcXoL9n7mIoT6NbDWgCvd+iSiHw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYkM3V282TldQbHBQVmQy
+            bWdielQySUNJaXEvOHA3Q1JqMEdMWEs1bFVVCnJKK0d5dG54aXk4dWtnSkdkbkU3
+            TU5xOFNGcklJdWcvZUlZVjNqanpqRlEKLS0tIGZGc0M5eE0xTTd6LzVjdXI1Ulg3
+            Zk9RdUU5RTdZd1A4dGRUVVVpT0E1SXMKOEL/yUCERTc8aiPmfGJWF9ESzfKbxYCO
+            dCByzJpIsI9IUgmcjMq8bREnATd8cZ65kVMpqME0Xfk3/Fl+OaLm1Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-27T09:27:41Z"
+    mac: ENC[AES256_GCM,data:VrP3O1WKuRBXhzg9hOyeRHRL8Cg47HWvno/B2TUllFUlKLrlgJapazbCs4aQJQka/1gQu2xguHlu/CqF9WKp90B/CxJ8XnYc4mrsMZ104aHSStQInShquRwrpm6iDc61d+ZZqkQbYUTiznm8jAonjjNEKHFsnRw9q+c9SJKYmJU=,iv:WuEJ2kgLHwKSUb8TDNH17N+P5gHsCQ+loP07Ec0y7/Y=,tag:bNhrMV5GY5q/vmmxYlL6Cw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

.archive/modules/nixos/containers/lego-auto/default.nix

@@ -1,9 +1,6 @@
-{
+{ lib, config, ... }:
-  lib,
+with lib;
-  config,
+let
-  ...
-}:
-with lib; let
   app = "lego-auto";
   image = "ghcr.io/bjw-s/lego-auto:v0.3.0";
   user = "999"; # string
@@ -11,7 +8,8 @@ with lib; let
   port = 9898; # int
   cfg = config.mySystem.services.${app};
   appFolder = "/eru/containers/volumes/${app}";
-in {
+in
+{
   options.mySystem.services.${app} = {
     enable = mkEnableOption "${app}";
     dnsimpleTokenPath = mkOption {
@@ -58,11 +56,9 @@ in {
           DNSIMPLE_OAUTH_TOKEN_FILE = "/config/dnsimple-token";
         };
 
-      volumes =
+      volumes = [
-        [
         "${appFolder}/cert:/cert"
-        ]
+      ] ++ optionals (cfg.provider == "dnsimple") [ "${cfg.dnsimpleTokenPath}:/config/dnsimple-token" ];
-        ++ optionals (cfg.provider == "dnsimple") ["${cfg.dnsimpleTokenPath}:/config/dnsimple-token"];
     };
   };
 }

.archive/modules/nixos/containers/unifi/default.nix

@@ -1,17 +1,14 @@
-{
+{ lib, config, ... }:
-  lib,
+with lib;
-  config,
+let
-  ...
-}:
-with lib; let
   app = "unifi";
   # renovate: depName=goofball222/unifi datasource=github-releases
   version = "8.4.62";
   cfg = config.mySystem.services.${app};
   appFolder = "/eru/containers/volumes/${app}";
 in
-  # persistentFolder = "${config.mySystem.persistentFolder}/var/lib/${appFolder}";
+# persistentFolder = "${config.mySystem.persistentFolder}/var/lib/${appFolder}";
-  {
+{
   options.mySystem.services.${app} = {
     enable = mkEnableOption "${app}";
   };
@@ -19,7 +16,7 @@ in
   config = mkIf cfg.enable {
     networking.firewall.interfaces = {
       enp130s0f0 = {
-          allowedTCPPorts = [8443];
+        allowedTCPPorts = [ 8443 ];
       };
       podman0 = {
         allowedTCPPorts = [
@@ -28,7 +25,7 @@ in
           8880
           8843
         ];
-          allowedUDPPorts = [3478];
+        allowedUDPPorts = [ 3478 ];
       };
     };
     virtualisation.oci-containers.containers.${app} = {
@@ -54,4 +51,4 @@ in
       ];
     };
   };
-  }
+}

.archive/modules/nixos/de/gnome.nix

@@ -3,27 +3,24 @@
   config,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.mySystem.de.gnome;
-in {
+in
+{
   options = {
     mySystem.de.gnome = {
-      enable =
+      enable = lib.mkEnableOption "GNOME" // {
-        lib.mkEnableOption "GNOME"
-        // {
         default = false;
       };
-      systrayicons =
+      systrayicons = lib.mkEnableOption "Enable systray icons" // {
-        lib.mkEnableOption "Enable systray icons"
-        // {
         default = true;
       };
-      gsconnect =
+      gsconnect = lib.mkEnableOption "Enable gsconnect (KDEConnect for GNOME)" // {
-        lib.mkEnableOption "Enable gsconnect (KDEConnect for GNOME)"
-        // {
         default = true;
       };
     };
+
   };
 
   config = lib.mkIf cfg.enable {
@@ -52,13 +49,14 @@ in {
         };
       };
 
-      udev.packages = lib.optionals cfg.systrayicons [pkgs.gnome.gnome-settings-daemon]; # support appindicator
+      udev.packages = lib.optionals cfg.systrayicons [ pkgs.gnome.gnome-settings-daemon ]; # support appindicator
     };
 
     # systyray icons
     # extra pkgs and extensions
     environment = {
-      systemPackages = with pkgs;
+      systemPackages =
+        with pkgs;
         [
           wl-clipboard # ls ~/Downloads | wl-copy or wl-paste > clipboard.txt
           playerctl # gsconnect play/pause command
@@ -72,7 +70,7 @@ in {
           gnomeExtensions.caffeine
           gnomeExtensions.dash-to-dock
         ]
-        ++ optionals cfg.systrayicons [pkgs.gnomeExtensions.appindicator];
+        ++ optionals cfg.systrayicons [ pkgs.gnomeExtensions.appindicator ];
     };
 
     # enable gsconnect

.archive/modules/nixos/de/kde.nix

@@ -3,15 +3,15 @@
   config,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.mySystem.de.kde;
-  flameshotOverride = pkgs.unstable.flameshot.override {enableWlrSupport = true;};
+  flameshotOverride = pkgs.unstable.flameshot.override { enableWlrSupport = true; };
-in {
+in
+{
   options = {
     mySystem.de.kde = {
-      enable =
+      enable = lib.mkEnableOption "KDE" // {
-        lib.mkEnableOption "KDE"
-        // {
         default = false;
       };
     };

.archive/modules/nixos/services/cockpit/default.nix

@@ -4,9 +4,11 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.mySystem.services.cockpit;
-in {
+in
+{
   options.mySystem.services.cockpit.enable = mkEnableOption "Cockpit";
 
   config.services.cockpit = mkIf cfg.enable {

.archive/modules/nixos/services/vault/default.nix

@@ -3,9 +3,11 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.mySystem.services.vault;
-in {
+in
+{
   options.mySystem.services.vault = {
     enable = lib.mkEnableOption "vault";
     address = lib.mkOption {

.archive/profiles/disko-telchar.nix

@@ -23,7 +23,7 @@
               size = "100%";
               content = {
                 type = "btrfs";
-                extraArgs = ["-f"]; # Override existing partition
+                extraArgs = [ "-f" ]; # Override existing partition
                 # Subvolumes must set a mountpoint in order to be mounted,
                 # unless their parent is mounted
                 subvolumes = {
@@ -33,11 +33,11 @@
                   };
                   # Subvolume name is the same as the mountpoint
                   "/home" = {
-                    mountOptions = ["compress=zstd"];
+                    mountOptions = [ "compress=zstd" ];
                     mountpoint = "/home";
                   };
                   # Sub(sub)volume doesn't need a mountpoint as its parent is mounted
-                  "/home/user" = {};
+                  "/home/user" = { };
                   # Parent is not mounted so the mountpoint must be set
                   "/nix" = {
                     mountOptions = [

.archive/profiles/hw-framework-16-7840hs.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  mySystem = {
+    security.wheelNeedsSudoPassword = false;
+  };
+
+  boot = {
+    # for managing/mounting nfs
+    supportedFilesystems = [ "nfs" ];
+
+    loader = {
+      systemd-boot.enable = true;
+      efi = {
+        canTouchEfiVariables = true;
+      };
+    };
+  };
+
+  # For updating firmware on the Framework.
+  services.fwupd.enable = true;
+
+  networking = {
+    useDHCP = lib.mkDefault true;
+    networkmanager.enable = true;
+  };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

.archive/profiles/hw-legion-15arh05h.nix

@@ -1,8 +1,5 @@
+{ lib, pkgs, ... }:
 {
-  lib,
-  pkgs,
-  ...
-}: {
   # Support windows partition
   mySystem = {
     security.wheelNeedsSudoPassword = false;
@@ -25,7 +22,7 @@
         device = "nodev";
         mirroredBoots = [
           {
-            devices = ["nodev"];
+            devices = [ "nodev" ];
             path = "/boot";
           }
         ];

.archive/profiles/hw-thinkpad-t470.nix

@@ -1,8 +1,5 @@
+{ config, lib, ... }:
 {
-  config,
-  lib,
-  ...
-}: {
   boot = {
     # Use the systemd-boot EFI boot loader.
     loader = {

.archive/profiles/role-gaming.nix

@@ -1,15 +1,12 @@
+{ lib, pkgs, ... }:
 {
-  lib,
-  pkgs,
-  ...
-}: {
   # Enable module for NVIDIA graphics
   mySystem = {
     hardware.nvidia.enable = true;
   };
 
   # set xserver videodrivers for NVIDIA gpu
-  services.xserver.videoDrivers = ["nvidia"];
+  services.xserver.videoDrivers = [ "nvidia" ];
   # Install steam systemwide
   programs.steam = {
     enable = true;
@@ -38,4 +35,5 @@
     pulse.enable = true;
     jack.enable = true;
   };
+
 }

.archive/profiles/role-workstation.nix

@@ -0,0 +1,79 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Role for workstations
+# Covers desktops/laptops, expected to have a GUI and do workloads
+# Will have home-manager installs
+let
+  vivaldiOverride = pkgs.vivaldi.override {
+    proprietaryCodecs = true;
+    enableWidevine = true;
+  };
+in
+with config;
+{
+  mySystem = {
+    shell.fish.enable = true;
+    editor.vscode.enable = true;
+
+    system.resticBackup.local.enable = false;
+    system.resticBackup.remote.enable = false;
+  };
+
+  boot = {
+    binfmt.emulatedSystems = [ "aarch64-linux" ]; # Enabled for raspi4 compilation
+    plymouth.enable = true; # hide console with splash screen
+  };
+
+  nix.settings = {
+    # Avoid disk full issues
+    max-free = lib.mkDefault (1000 * 1000 * 1000);
+    min-free = lib.mkDefault (128 * 1000 * 1000);
+  };
+
+  services = {
+    # set xserver videodrivers if used
+    xserver.enable = true;
+    # Enable the Gnome keyring for auto unlocking ssh keys on login
+    gnome.gnome-keyring.enable = true;
+    fwupd.enable = config.boot.loader.systemd-boot.enable; # fwupd does not work in BIOS mode
+    thermald.enable = true;
+    smartd.enable = true;
+  };
+
+  hardware = {
+    enableAllFirmware = true;
+    sensor.hddtemp = {
+      enable = true;
+      drives = [ "/dev/disk/by-id/*" ];
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    # Sensors etc
+    lm_sensors
+    cpufrequtils
+    cpupower-gui
+    vivaldiOverride
+    gparted
+    termius
+  ];
+
+  i18n = {
+    defaultLocale = lib.mkDefault "en_US.UTF-8";
+  };
+
+  programs = {
+    mtr.enable = true;
+    ssh.startAgent = true;
+
+    # Enable appimage support and executing them via the appimage-run helper.
+    appimage = {
+      enable = true;
+      binfmt = true;
+    };
+  };
+}

.envrc

@@ -1,2 +1,3 @@
 use nix
 export SOPS_AGE_KEY_FILE="$(expand_path ./age.key)"
+export EDITOR="hx"

.forgejo/workflows/build.yaml

@@ -37,7 +37,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up Cachix
-        uses: https://github.com/cachix/cachix-action@v16
+        uses: https://github.com/cachix/cachix-action@v15
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           name: hsndev

.pre-commit-config.yaml

@@ -9,12 +9,10 @@ repos:
           - --config-file
           - .yamllint.yaml
         id: yamllint
-        exclude: "borgmatic-template.yaml"
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
       - id: trailing-whitespace
-        exclude: "borgmatic-template.yaml"
       - id: end-of-file-fixer
       - id: fix-byte-order-marker
       - id: mixed-line-ending
@@ -28,14 +26,14 @@ repos:
       - id: remove-crlf
       - id: remove-tabs
         exclude: (Makefile|Caddyfile)
-      #  - repo: https://github.com/zricethezav/gitleaks
+  - repo: https://github.com/zricethezav/gitleaks
-      #    rev: v8.23.3
+    rev: v8.22.0
-      #    hooks:
+    hooks:
-      #      - id: gitleaks
+      - id: gitleaks
-      #  - repo: https://github.com/yuvipanda/pre-commit-hook-ensure-sops
+  - repo: https://github.com/yuvipanda/pre-commit-hook-ensure-sops
-      #    rev: v1.1
+    rev: v1.1
-      #    hooks:
+    hooks:
-      #      - id: sops-encryption
+      - id: sops-encryption
-      #        # Uncomment to exclude all markdown files from encryption
+        # Uncomment to exclude all markdown files from encryption
-      #        # exclude: *.\.md
+        # exclude: *.\.md
-      #        files: .*secrets.*
+        files: .*secrets.*

.sops.yaml

@@ -12,16 +12,23 @@ keys:
   - users:
     - &jahanson age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
   - hosts:
+    - &durincore age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+    - &gandalf age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+    - &legiondary age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
     - &shadowfax age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
-      - &telchar age1nkpq8lr09vamgvf8cvzemqjyr3ex8w7azfupdr2gverz9j5zgemsv99t0z
+    - &telchar age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
     - &telperion age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
     - &varda age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
 
+
 creation_rules:
   - path_regex: .*\.sops\.yaml$
     key_groups:
       - age:
+        - *durincore
+        - *gandalf
         - *jahanson
+        - *legiondary
         - *shadowfax
         - *telchar
         - *telperion

.vscode/extensions.json

@@ -1,6 +1,8 @@
 {
   "recommendations": [
     "jnoortheen.nix-ide",
+    "mikestead.dotenv",
+    "redhat.vscode-yaml",
     "signageos.signageos-vscode-sops",
     "pkief.material-icon-theme",
     "ms-vscode-remote.remote-ssh"

.vscode/settings.json

@@ -11,12 +11,12 @@
   "files.trimTrailingWhitespace": true,
   "sops.defaults.ageKeyFile": "age.key",
   "nix.enableLanguageServer": true,
-  "nix.serverPath": "nixd",
+  "nix.serverPath": "/run/current-system/sw/bin/nixd",
-  "nix.formatterPath": "alejandra",
+  "nix.formatterPath": "/run/current-system/sw/bin/nixfmt",
   "nix.serverSettings": {
     "nixd": {
       "formatting": {
-        "command": ["alejandra"]
+        "command": ["nixfmt"]
       },
       "options": {
         "nixos": {
@@ -25,7 +25,7 @@
       }
     },
     "nix": {
-      "binary": "nix",
+      "binary": "/run/current-system/sw/bin/nix",
       "maxMemoryMB": null,
       "flake": {
         "autoEvalInputs": true,

README.md

@@ -22,10 +22,3 @@
 
 - [truxnell/dotfiles](https://github.com//truxnell/nix-config/)
 - [billimek/dotfiles](https://github.com/billimek/dotfiles/)
-
-## Upgrading the borgmatic template for reference
-
-```sh
-borgmatic config generate --source nixos/hosts/shadowfax/config/borgmatic/borgmatic-template.yaml --destination nixos/hosts/shadowfax/config/borgmatic/borgmatic-t
-emplate.yaml  --overwrite
-```

flake.nix

@@ -1,194 +1,10 @@
 {
   description = "My NixOS flake";
 
-  outputs = {
-    self,
-    nixpkgs,
-    nixpkgs-unstable,
-    sops-nix,
-    home-manager,
-    disko,
-    lix-module,
-    vscode-server,
-    nvf,
-    ...
-  } @ inputs: let
-    forAllSystems = nixpkgs.lib.genAttrs [
-      "aarch64-linux"
-      "x86_64-linux"
-    ];
-  in rec {
-    # Use nixpkgs-fmt for 'nix fmt'
-    formatter = forAllSystems (system: nixpkgs.legacyPackages."${system}".nixfmt-rfc-style);
-
-    # setup devshells against shell.nix
-    # devShells = forAllSystems (pkgs: import ./shell.nix { inherit pkgs; });
-
-    # extend lib with my custom functions
-    lib = nixpkgs.lib.extend (
-      final: prev: {
-        inherit inputs;
-        myLib = import ./nixos/lib {
-          inherit inputs;
-          lib = final;
-        };
-      }
-    );
-
-    nixosConfigurations = let
-      inherit inputs;
-      # Import overlays for building nixosconfig with them.
-      overlays = import ./nixos/overlays {inherit inputs;};
-
-      # generate a base nixos configuration with the specified overlays, hardware modules, and any AerModules applied
-      mkNixosConfig = {
-        hostname,
-        system ? "x86_64-linux",
-        nixpkgs ? inputs.nixpkgs,
-        disabledModules ? [],
-        hardwareModules ? [],
-        # basemodules is the base of the entire machine building
-        # here we import all the modules and setup home-manager
-        baseModules ? [
-          sops-nix.nixosModules.sops
-          home-manager.nixosModules.home-manager
-          nvf.nixosModules.default
-          ./nixos/profiles/global.nix # all machines get a global profile
-          ./nixos/modules/nixos # all machines get nixos modules
-          ./nixos/hosts/${hostname} # load this host's config folder for machine-specific config
-          {
-            inherit disabledModules;
-            home-manager = {
-              useUserPackages = true;
-              useGlobalPkgs = true;
-              extraSpecialArgs = {
-                inherit inputs hostname system;
-              };
-            };
-          }
-        ],
-        profileModules ? [],
-      }: let
-        pkgs = import nixpkgs {
-          inherit system;
-          overlays = builtins.attrValues overlays;
-          config = {
-            allowUnfree = true;
-            allowUnfreePredicate = _: true;
-          };
-        };
-      in
-        nixpkgs.lib.nixosSystem {
-          inherit system lib;
-          modules = baseModules ++ hardwareModules ++ profileModules;
-          specialArgs = {
-            inherit self inputs nixpkgs;
-            myPkgs = lib.myLib.mkMyPkgs pkgs;
-          };
-          inherit pkgs;
-        };
-    in {
-      "shadowfax" = mkNixosConfig {
-        # Pro WS WRX80E-SAGE SE WIFI - AMD Ryzen Threadripper PRO 3955WX 16-Cores
-        # Workloads server
-        hostname = "shadowfax";
-        system = "x86_64-linux";
-        disabledModules = [
-          "services/web-servers/minio.nix"
-          "services/web-servers/caddy/default.nix"
-        ];
-        hardwareModules = [
-          lix-module.nixosModules.default
-          ./nixos/profiles/hw-threadripperpro.nix
-        ];
-        profileModules = [
-          vscode-server.nixosModules.default
-          "${nixpkgs-unstable}/nixos/modules/services/web-servers/minio.nix"
-          "${nixpkgs-unstable}/nixos/modules/services/web-servers/caddy/default.nix"
-          ./nixos/profiles/role-dev.nix
-          ./nixos/profiles/role-server.nix
-          {home-manager.users.jahanson = ./nixos/home/jahanson/workstation.nix;}
-        ];
-      };
-
-      "telchar" = mkNixosConfig {
-        # Framework 16 Ryzen 7 7840HS - Radeon 780M Graphics
-        # Hyprland first, QEMU Windows second
-        hostname = "telchar";
-        system = "x86_64-linux";
-        hardwareModules = [
-          inputs.nixos-hardware.nixosModules.framework-16-7040-amd
-          ./nixos/profiles/hw-framework-16-7840hs.nix
-          disko.nixosModules.disko
-          (import ./nixos/profiles/disko/simple-efi.nix)
-          lix-module.nixosModules.default
-        ];
-        profileModules = [
-          ./nixos/profiles/role-dev.nix
-          ./nixos/profiles/role-workstation.nix
-          {home-manager.users.jahanson = ./nixos/home/jahanson/workstation.nix;}
-        ];
-      };
-
-      "telperion" = mkNixosConfig {
-        # HP-S01 Intel G5900
-        # Network services server
-        hostname = "telperion";
-        system = "x86_64-linux";
-        hardwareModules = [
-          ./nixos/profiles/hw-hp-s01.nix
-          disko.nixosModules.disko
-          (import ./nixos/profiles/disko-nixos.nix {disks = ["/dev/nvme0n1"];})
-        ];
-        profileModules = [
-          ./nixos/profiles/role-server.nix
-          {home-manager.users.jahanson = ./nixos/home/jahanson/server.nix;}
-        ];
-      };
-
-      "varda" = mkNixosConfig {
-        # Arm64 cax21 @ Hetzner
-        # forgejo server
-        hostname = "varda";
-        system = "aarch64-linux";
-        hardwareModules = [
-          ./nixos/profiles/hw-hetzner-cax.nix
-        ];
-        profileModules = [
-          ./nixos/profiles/role-server.nix
-          {home-manager.users.jahanson = ./nixos/home/jahanson/server.nix;}
-        ];
-      };
-    };
-
-    # Convenience output that aggregates the outputs for home, nixos.
-    # Also used in ci to build targets generally.
-    top = let
-      nixtop = nixpkgs.lib.genAttrs (builtins.attrNames inputs.self.nixosConfigurations) (
-        attr: inputs.self.nixosConfigurations.${attr}.config.system.build.toplevel
-      );
-    in
-      nixtop;
-  };
-
-  nixConfig.extra-substituters = [
-    "https://hsndev.cachix.org"
-    "https://nix-community.cachix.org"
-    "https://numtide.cachix.org"
-    "https://hyprland.cachix.org"
-  ];
-  nixConfig.extra-trusted-public-keys = [
-    "hsndev.cachix.org-1:vN1/XGBZtMLnTFYDmTLDrullgZHSUYY3Kqt+Yg/C+tE="
-    "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-    "numtide.cachix.org-1:2ps1kLBUWjxIneOy1Ik6cQjb41X0iXVXeHigGmycPPE="
-    "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
-  ];
-
   inputs = {
     # Nixpkgs and unstable
     nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
     # Lix - Substitution of the Nix package manager, focused on correctness, usability, and growth – and committed to doing right by its community.
     # https://git.lix.systems/lix-project/lix
@@ -255,6 +71,13 @@
     # vscode-server - NixOS module for running vscode-server
     vscode-server.url = "github:nix-community/nixos-vscode-server";
 
+    # krewfile - Declarative krew plugin management
+    krewfile = {
+      # url = "github:brumhard/krewfile";
+      url = "github:brumhard/krewfile";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # nix-minecraft - Minecraft server management
     # https://github.com/infinidoge/nix-minecraft
     nix-minecraft = {
@@ -263,37 +86,158 @@
     };
 
     # Hyprland
-    hyprland = {
+    hyprland.url = "github:hyprwm/Hyprland";
-      url = "github:hyprwm/Hyprland";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    # Hyprlock
-    hyprlock = {
-      url = "github:hyprwm/hyprlock";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     # Hyprland plugins
     hyprland-plugins = {
       url = "github:hyprwm/hyprland-plugins";
       inputs.hyprland.follows = "hyprland";
     };
-    # Hyprland AGS (Application Grouping System)
-    ags.url = "github:Aylur/ags/v1";
-
-    # nvf -  A highly modular, extensible and distro-agnostic Neovim configuration framework for Nix/NixOS.
-    nvf.url = "github:notashelf/nvf";
-
-    # Zen Browser
-    zen-browser.url = "github:0xc000022070/zen-browser-flake";
-
-    # Buildbot for Nix
-    buildbot-nix = {
-      url = "github:nix-community/buildbot-nix";
   };
 
-    # Ghostty 👻 - Awesome terminal that uses GPU acceleration
+  outputs = {
-    ghostty = {
+    self,
-      url = "github:ghostty-org/ghostty/v1.1.2";
+    nixpkgs,
+    nixpkgs-unstable,
+    sops-nix,
+    home-manager,
+    nix-vscode-extensions,
+    disko,
+    talhelper,
+    lix-module,
+    vscode-server,
+    krewfile,
+    ...
+  } @ inputs: let
+    forAllSystems = nixpkgs.lib.genAttrs [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+  in rec {
+    # Use nixpkgs-fmt for 'nix fmt'
+    formatter = forAllSystems (system: nixpkgs.legacyPackages."${system}".nixfmt-rfc-style);
+
+    # setup devshells against shell.nix
+    # devShells = forAllSystems (pkgs: import ./shell.nix { inherit pkgs; });
+
+    # extend lib with my custom functions
+    lib = nixpkgs.lib.extend (
+      final: prev: {
+        inherit inputs;
+        myLib = import ./nixos/lib {
+          inherit inputs;
+          lib = final;
         };
+      }
+    );
+
+    nixosConfigurations = let
+      inherit inputs;
+      # Import overlays for building nixosconfig with them.
+      overlays = import ./nixos/overlays {inherit inputs;};
+      # generate a base nixos configuration with the specified overlays, hardware modules, and any AerModules applied
+      mkNixosConfig = {
+        hostname,
+        system ? "x86_64-linux",
+        nixpkgs ? inputs.nixpkgs,
+        disabledModules ? [],
+        hardwareModules ? [],
+        # basemodules is the base of the entire machine building
+        # here we import all the modules and setup home-manager
+        baseModules ? [
+          sops-nix.nixosModules.sops
+          home-manager.nixosModules.home-manager
+          ./nixos/profiles/global.nix # all machines get a global profile
+          ./nixos/modules/nixos # all machines get nixos modules
+          ./nixos/hosts/${hostname} # load this host's config folder for machine-specific config
+          {
+            home-manager = {
+              useUserPackages = true;
+              useGlobalPkgs = true;
+              extraSpecialArgs = {
+                inherit inputs hostname system;
+              };
+            };
+            disabledModules = disabledModules;
+          }
+        ],
+        profileModules ? [],
+      }:
+        nixpkgs.lib.nixosSystem {
+          inherit system lib;
+          modules = baseModules ++ hardwareModules ++ profileModules;
+          specialArgs = {inherit self inputs nixpkgs;};
+          # Add our overlays
+          pkgs = import nixpkgs {
+            inherit system;
+            overlays = builtins.attrValues overlays;
+            config = {
+              allowUnfree = true;
+              allowUnfreePredicate = _: true;
+            };
+          };
+        };
+    in {
+      "shadowfax" = mkNixosConfig {
+        # Pro WS WRX80E-SAGE SE WIFI - AMD Ryzen Threadripper PRO 3955WX 16-Cores
+        # Workloads server
+        hostname = "shadowfax";
+        system = "x86_64-linux";
+        disabledModules = [
+          "services/web-servers/minio.nix"
+          "services/web-servers/caddy/default.nix"
+        ];
+        hardwareModules = [
+          lix-module.nixosModules.default
+          ./nixos/profiles/hw-threadripperpro.nix
+        ];
+        profileModules = [
+          vscode-server.nixosModules.default
+          "${nixpkgs-unstable}/nixos/modules/services/web-servers/minio.nix"
+          "${nixpkgs-unstable}/nixos/modules/services/web-servers/caddy/default.nix"
+          ./nixos/profiles/role-dev.nix
+          ./nixos/profiles/role-server.nix
+          {home-manager.users.jahanson = ./nixos/home/jahanson/server.nix;}
+        ];
+      };
+
+      "telperion" = mkNixosConfig {
+        # HP-S01 Intel G5900
+        # Network services server
+        hostname = "telperion";
+        system = "x86_64-linux";
+        hardwareModules = [
+          ./nixos/profiles/hw-hp-s01.nix
+          disko.nixosModules.disko
+          (import ./nixos/profiles/disko-nixos.nix {disks = ["/dev/nvme0n1"];})
+        ];
+        profileModules = [
+          ./nixos/profiles/role-server.nix
+          {home-manager.users.jahanson = ./nixos/home/jahanson/server.nix;}
+        ];
+      };
+
+      "varda" = mkNixosConfig {
+        # Arm64 cax21 @ Hetzner
+        # forgejo server
+        hostname = "varda";
+        system = "aarch64-linux";
+        hardwareModules = [
+          ./nixos/profiles/hw-hetzner-cax.nix
+        ];
+        profileModules = [
+          ./nixos/profiles/role-server.nix
+          {home-manager.users.jahanson = ./nixos/home/jahanson/server.nix;}
+        ];
+      };
+    };
+
+    # Convenience output that aggregates the outputs for home, nixos.
+    # Also used in ci to build targets generally.
+    top = let
+      nixtop = nixpkgs.lib.genAttrs (builtins.attrNames inputs.self.nixosConfigurations) (
+        attr: inputs.self.nixosConfigurations.${attr}.config.system.build.toplevel
+      );
+    in
+      nixtop;
   };
 }

nixos/home/jahanson/global.nix

@@ -2,7 +2,9 @@
   pkgs,
   config,
   ...
-}: {
+}:
+with config;
+{
   imports = [
     ../modules
   ];
@@ -30,6 +32,7 @@
     };
 
     home = {
+
       # Install these packages for my user
       packages = with pkgs; [
         # misc
@@ -54,7 +57,6 @@
         direnv
         git
         python3
-        pipx
         fzf
         ripgrep
         lsd
@@ -104,6 +106,7 @@
         # backup tools
         unstable.rclone
         unstable.restic
+
       ];
     };
   };

nixos/home/jahanson/server.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./global.nix
   ];

nixos/home/jahanson/workstation.nix

@@ -1,16 +1,37 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  coderMainline = pkgs.coder.override { channel = "mainline"; };
+in
+{
   imports = [
     ./global.nix
+    inputs.krewfile.homeManagerModules.krewfile
   ];
   config = {
-    # Custom Home Manager Configuration
+    # Krewfile management
-    myHome = {
+    programs.krewfile = {
-      de.hyprland.enable = true;
+      enable = true;
-      programs = {
+      krewPackage = pkgs.krew;
-        firefox.enable = true;
+      indexes = {
-        thunderbird.enable = true;
+        "netshoot" = "https://github.com/nilic/kubectl-netshoot.git";
       };
+      plugins = [
+        "netshoot/netshoot"
+        "resource-capacity"
+        "rook-ceph"
+      ];
+    };
+
+    myHome = {
+      programs.firefox.enable = true;
+      programs.thunderbird.enable = true;
       shell = {
+        wezterm.enable = true;
+
         git = {
           enable = true;
           username = "Joseph Hanson";
@@ -20,16 +41,15 @@
       };
     };
 
-    # Home Manager Configuration
     home = {
       # Install these packages for my user
       packages = with pkgs; [
         # apps
-        # parsec-bin
+        obsidian
+        parsec-bin
         solaar # open source manager for logitech unifying receivers
         unstable.bruno
         # unstable.fractal
-        unstable.obsidian
         unstable.httpie
         unstable.jetbrains.datagrip
         unstable.jetbrains.rust-rover
@@ -37,13 +57,23 @@
         unstable.talosctl # overlay override
         unstable.telegram-desktop
         unstable.tidal-hifi
-        # unstable.xpipe
+        unstable.xpipe
         # unstable.vesktop # gpu issues. Using the flatpak version solves this issue.
         vlc
         yt-dlp
 
         # cli
         brightnessctl
+
+        # dev utils
+        kubectl
+        minio-client # S3 management
+        pre-commit # Pre-commit tasks for git
+        shellcheck # shell script linting
+        unstable.act # run GitHub actions locally
+        unstable.kubebuilder # k8s controller development
+        unstable.nodePackages_latest.prettier # code formatter
+        coderMainline # VSCode in the browser -- has overlay
       ];
     };
   };

nixos/home/modules/de/default.nix

@@ -1,5 +0,0 @@
-{...}: {
-  imports = [
-    ./hyprland.nix
-  ];
-}

nixos/home/modules/de/hyprland.nix

@@ -1,91 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  inputs,
-  ...
-}:
-with lib; let
-  cfg = config.myHome.de.hyprland;
-in {
-  options.myHome.de.hyprland.enable = mkEnableOption "Hyprland";
-
-  imports = [inputs.ags.homeManagerModules.default];
-  config = mkIf cfg.enable {
-    # Downloads the Theme Resources
-    home.packages = with pkgs; [
-      andromeda-gtk-theme
-      flat-remix-icon-theme
-      bibata-cursors
-    ];
-    # 'Installs' (sym-links) the Theme Resources
-    home.file = {
-      ".themes/Andromeda".source = "${pkgs.andromeda-gtk-theme}/share/themes/Andromeda";
-      ".icons/Flat-Remix-Blue-Dark".source = "${pkgs.flat-remix-icon-theme}/share/icons/Flat-Remix-Blue-Dark";
-      ".icons/Bibata-Modern-Ice".source = "${pkgs.bibata-cursors}/share/icons/Bibata-Modern-Ice";
-    };
-    # Theme settings
-    gtk = {
-      enable = true;
-      # Some apps just need the good ol' ini files.
-      gtk3.extraConfig = {
-        gtk-application-prefer-dark-theme = 1;
-        gtk-theme-name = "Andromeda";
-        gtk-icon-theme-name = "Flat-Remix-Blue-Dark";
-        gtk-font-name = "Fira Code Semi-Bold 14";
-        gtk-cursor-theme-name = "Bibata-Modern-Ice";
-        gtk-cursor-theme-size = 24;
-        gtk-toolbar-style = "GTK_TOOLBAR_ICONS";
-        gtk-toolbar-icon-size = "GTK_ICON_SIZE_LARGE_TOOLBAR";
-        gtk-button-images = 1;
-        gtk-menu-images = 1;
-        gtk-enable-event-sounds = 1;
-        gtk-enable-input-feedback-sounds = 0;
-        gtk-xft-antialias = 1;
-        gtk-xft-hinting = 1;
-        gtk-xft-hintstyle = "hintslight";
-        gtk-xft-rgba = "rgb";
-      };
-      gtk4.extraConfig = {
-        gtk-application-prefer-dark-theme = "1";
-        gtk-theme-name = "Andromeda";
-        gtk-icon-theme-name = "Flat-Remix-Blue-Dark";
-        gtk-font-name = "Fira Code Semi-Bold 14";
-        gtk-cursor-theme-name = "Bibata-Modern-Ice";
-        gtk-cursor-theme-size = 24;
-        gtk-toolbar-style = "GTK_TOOLBAR_ICONS";
-        gtk-toolbar-icon-size = "GTK_ICON_SIZE_LARGE_TOOLBAR";
-        gtk-button-images = 1;
-        gtk-menu-images = 1;
-        gtk-enable-event-sounds = 1;
-        gtk-enable-input-feedback-sounds = 0;
-        gtk-xft-antialias = 1;
-        gtk-xft-hinting = 1;
-        gtk-xft-hintstyle = "hintslight";
-        gtk-xft-rgba = "rgb";
-      };
-    };
-    # Wayland and apps pull from dconf since we're using the gtk portal.
-    dconf.settings = {
-      "org/gnome/desktop/interface" = {
-        color-scheme = "prefer-dark";
-        cursor-size = 24;
-        cursor-theme = "Bibata-Modern-Ice";
-        gtk-theme = "Andromeda";
-        icon-theme = "Flat-Remix-Blue-Dark";
-      };
-    };
-    programs.ags = {
-      enable = true;
-      # I don't want Home Manager to manage these config files.
-      # Just setup the programs.
-      configDir = null;
-
-      extraPackages = with pkgs; [
-        gtksourceview
-        webkitgtk_6_0
-        accountsservice
-      ];
-    };
-  };
-}

nixos/home/modules/default.nix

@@ -1,6 +1,7 @@
-{lib, ...}: {
+{ lib, ... }:
+{
+
   imports = [
-    ./de
     ./shell
     ./programs
     ./security
@@ -32,4 +33,5 @@
       allowUnfree = true;
     };
   };
+
 }

nixos/home/modules/programs/browsers/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./firefox
   ];

nixos/home/modules/programs/browsers/firefox/default.nix

@@ -4,9 +4,11 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.myHome.programs.firefox;
-in {
+in
+{
   options.myHome.programs.firefox.enable = mkEnableOption "Firefox";
 
   config = mkIf cfg.enable {
@@ -16,10 +18,18 @@ in {
         extraPolicies = {
           DontCheckDefaultBrowser = true;
           DisablePocket = true;
+          # See nixpkgs' firefox/wrapper.nix to check which options you can use
+          nativeMessagingHosts = [
+            # Gnome shell native connector
+            pkgs.gnome-browser-connector
+            # plasma connector
+            # plasma5Packages.plasma-browser-integration
+          ];
         };
       };
       policies = import ./policies.nix;
-      profiles.default = import ./profile-default.nix {inherit pkgs;};
+
+      profiles.default = import ./profile-default.nix { inherit pkgs; };
     };
   };
 }

nixos/home/modules/programs/browsers/firefox/policies.nix

@@ -8,9 +8,9 @@
     Fingerprinting = true;
   };
   DisablePocket = true;
-  DisableFirefoxAccounts = true;
+  # DisableFirefoxAccounts = true;
-  DisableAccounts = true;
+  # DisableAccounts = true;
-  DisableFirefoxScreenshots = true;
+  # DisableFirefoxScreenshots = true;
   # OverrideFirstRunPage = "";
   OverridePostUpdatePage = "";
   DontCheckDefaultBrowser = true;

nixos/home/modules/programs/browsers/firefox/profile-default.nix

@@ -1,4 +1,5 @@
-{pkgs}: {
+{ pkgs }:
+{
   id = 0;
   name = "default";
   isDefault = true;
@@ -10,21 +11,22 @@
     # 2 => the last page viewed in Firefox
     # 3 => previous session windows and tabs
     "browser.startup.page" = "3";
+
     "browser.send_pings" = false;
+    # Do not track
+    "privacy.donottrackheader.enabled" = "true";
+    "privacy.donottrackheader.value" = 1;
     "browser.display.use_system_colors" = "true";
+
     "browser.display.use_document_colors" = "false";
     "devtools.theme" = "dark";
+
     "extensions.pocket.enabled" = false;
   };
   extensions = with pkgs.nur.repos.rycee.firefox-addons; [
     ublock-origin
     privacy-badger
+    link-cleaner
     refined-github
-    kagi-search
-    languagetool
-    onepassword-password-manager
-    streetpass-for-mastodon
-    dearrow
-    sponsorblock
   ];
 }

nixos/home/modules/programs/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./browsers
     ./thunderbird

nixos/home/modules/programs/thunderbird/default.nix

@@ -3,7 +3,8 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.myHome.programs.thunderbird;
 
   policies = {
@@ -24,14 +25,15 @@
       };
     };
   };
-in {
+in
+{
   options.myHome.programs.thunderbird.enable = lib.mkEnableOption "Thunderbird";
 
   config = lib.mkIf cfg.enable {
     programs.thunderbird = {
       enable = true;
       package = pkgs.thunderbird-128.override (old: {
-        extraPolicies = (old.extrapPolicies or {}) // policies;
+        extraPolicies = (old.extrapPolicies or { }) // policies;
       });
 
       profiles.default.isDefault = true;

nixos/home/modules/security/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./ssh
   ];

nixos/home/modules/security/ssh/default.nix

@@ -1,16 +1,14 @@
-{
+{ config, lib, ... }:
-  config,
+with lib;
-  lib,
+let
-  ...
-}:
-with lib; let
   cfg = config.myHome.security.ssh;
-in {
+in
+{
   options.myHome.security.ssh = {
     enable = mkEnableOption "ssh";
     matchBlocks = mkOption {
       type = types.attrs;
-      default = {};
+      default = { };
     };
   };
 

nixos/home/modules/shell/atuind/default.nix

@@ -4,9 +4,11 @@
   lib,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.myHome.shell.atuind;
-in {
+in
+{
   options.myHome.shell.atuind = {
     enable = mkEnableOption "atuind";
   };
@@ -15,10 +17,10 @@ in {
     (mkIf cfg.enable {
       systemd.user.services.atuind = {
         Install = {
-          WantedBy = ["default.target"];
+          WantedBy = [ "default.target" ];
         };
         Unit = {
-          After = ["network.target"];
+          After = [ "network.target" ];
         };
         Service = {
           Environment = "ATUIN_LOG=info";

nixos/home/modules/shell/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./atuind
     ./fish

nixos/home/modules/shell/fish/default.nix

@@ -4,10 +4,12 @@
   lib,
   ...
 }:
-with lib; let
+with lib;
+let
   inherit (config.myHome) username homeDirectory;
   cfg = config.myHome.shell.fish;
-in {
+in
+{
   options.myHome.shell.fish = {
     enable = mkEnableOption "fish";
   };
@@ -31,9 +33,16 @@ in {
         };
 
         shellAbbrs = {
-          nrs = "sudo nixos-rebuild switch --flake . --show-trace --accept-flake-config";
+          nrs = "sudo nixos-rebuild switch --flake .";
-          nfc = "nix flake check --show-trace --accept-flake-config";
           nvdiff = "nvd diff /run/current-system result";
+          # rook & ceph versions.
+          rcv = ''
+            kubectl \
+              -n rook-ceph \
+              get deployments \
+              -l rook_cluster=rook-ceph \
+              -o jsonpath='{range .items[*]}{.metadata.name}{"  \treq/upd/avl: "}{.spec.replicas}{"/"}{.status.updatedReplicas}{"/"}{.status.readyReplicas}{"  \trook-version="}{.metadata.labels.rook-version}{"  \tceph-version="}{.metadata.labels.ceph-version}{"\n"}{end}'
+          '';
         };
 
         functions = {
@@ -77,7 +86,6 @@ in {
           update_path ${homeDirectory}/go/bin
           update_path ${homeDirectory}/.cargo/bin
           update_path ${homeDirectory}/.local/bin
-          update_path ${homeDirectory}/.npm-packages/bin
 
           set -gx EDITOR "vim"
 

nixos/home/modules/shell/git/default.nix

@@ -3,9 +3,11 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.myHome.shell.git;
-in {
+in
+{
   options.myHome.shell.git = {
     enable = lib.mkEnableOption "git";
     username = lib.mkOption {
@@ -59,8 +61,6 @@ in {
             "*.decrypted.*"
             # Python virtualenvs
             ".venv"
-            # Aider Chat
-            ".aider*"
           ];
         };
       };

nixos/home/modules/shell/starship/default.nix

@@ -3,9 +3,11 @@
   config,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.myHome.shell.starship;
-in {
+in
+{
   options.myHome.shell.starship = {
     enable = mkEnableOption "starship";
   };

nixos/home/modules/shell/wezterm/default.nix

@@ -4,9 +4,11 @@
   lib,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.myHome.shell.wezterm;
-in {
+in
+{
   options.myHome.shell.wezterm = {
     enable = mkEnableOption "wezterm";
     configPath = mkOption {

nixos/hosts/shadowfax/config/borgmatic/default.nix

@@ -1,12 +0,0 @@
-{lib, ...}:
-# Includes all files with .nix suffix in the current directory except default.nix
-let
-  dir = ./.;
-  files = lib.filterAttrs (
-    name: type:
-      type == "regular" && name != "default.nix" && lib.hasSuffix ".nix" name
-  ) (builtins.readDir dir);
-  imports = map (name: "${dir}/${name}") (builtins.attrNames files);
-in {
-  imports = imports;
-}

nixos/hosts/shadowfax/config/borgmatic/jellyfin.nix

@@ -1,40 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
-  mySystem.services.borgmatic = {
-    configurations.jellyfin = {
-      source_directories = [
-        "/nahar/containers/volumes/jellyfin"
-      ];
-
-      repositories = [
-        {
-          label = "local";
-          path = "/eru/borg/jellyfin";
-        }
-        {
-          label = "remote";
-          path = "ssh://uy5oy4m3@uy5oy4m3.repo.borgbase.com/./repo";
-        }
-      ];
-
-      ssh_command = "${pkgs.openssh}/bin/ssh -i ${config.sops.secrets."borgmatic/jellyfin/append_key".path}";
-
-      encryption_passcommand = ''${pkgs.coreutils-full}/bin/cat ${config.sops.secrets."borgmatic/jellyfin/encryption_passphrase".path}'';
-
-      # Retention settings
-      keep_daily = 14;
-      exclude_patterns = [
-        "*/Cache/*"
-      ];
-
-      zfs = {
-        zfs_command = "${pkgs.zfs}/bin/zfs";
-        mount_command = "${pkgs.util-linux}/bin/mount";
-        umount_command = "${pkgs.util-linux}/bin/umount";
-      };
-    };
-  };
-}

nixos/hosts/shadowfax/config/borgmatic/plex.nix

@@ -1,40 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
-  mySystem.services.borgmatic = {
-    configurations.plex = {
-      source_directories = [
-        "/nahar/containers/volumes/plex"
-      ];
-
-      repositories = [
-        {
-          label = "local";
-          path = "/eru/borg/plex";
-        }
-        {
-          label = "remote";
-          path = "ssh://kvq39z04@kvq39z04.repo.borgbase.com/./repo";
-        }
-      ];
-
-      ssh_command = "${pkgs.openssh}/bin/ssh -i ${config.sops.secrets."borgmatic/plex/append_key".path}";
-
-      encryption_passcommand = ''${pkgs.coreutils-full}/bin/cat ${config.sops.secrets."borgmatic/plex/encryption_passphrase".path}'';
-
-      # Retention settings
-      keep_daily = 14;
-      exclude_patterns = [
-        "*/Cache/*"
-      ];
-
-      zfs = {
-        zfs_command = "${pkgs.zfs}/bin/zfs";
-        mount_command = "${pkgs.util-linux}/bin/mount";
-        umount_command = "${pkgs.util-linux}/bin/umount";
-      };
-    };
-  };
-}

nixos/hosts/shadowfax/config/incus-preseed.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   config = {
     "core.https_address" = "10.1.1.61:8443"; # Need quotes around key
   };
@@ -26,7 +27,7 @@
   ];
   profiles = [
     {
-      config = {};
+      config = { };
       description = "";
       devices = {
         eth0 = {
@@ -43,6 +44,6 @@
       name = "default";
     }
   ];
-  projects = [];
+  projects = [ ];
   cluster = null;
 }

nixos/hosts/shadowfax/config/sanoid.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   outputs = {
     # ZFS automated snapshots
     templates = {
@@ -9,31 +10,31 @@
         daily = 7;
         monthly = 12;
       };
+      "nvr" = {
+        autoprune = true;
+        autosnap = true;
+        hourly = 24;
+        daily = 7;
+      };
     };
-
     datasets = {
-      "nahar/qbittorrent" = {
+      "nahar/scrypted" = {
-        useTemplate = ["production"];
+        useTemplate = [ "nvr" ];
-        recursive = true;
-      };
-      "nahar/sabnzbd" = {
-        useTemplate = ["production"];
-        recursive = true;
-      };
-      "nahar/containers/volumes/jellyfin" = {
-        useTemplate = ["production"];
-        recursive = true;
       };
       "nahar/containers/volumes/plex" = {
-        useTemplate = ["production"];
+        useTemplate = [ "production" ];
-        recursive = true;
-      };
-      "nahar/containers/volumes/scrutiny" = {
-        useTemplate = ["production"];
         recursive = true;
       };
       "nahar/containers/volumes/scrypted" = {
-        useTemplate = ["production"];
+        useTemplate = [ "production" ];
+        recursive = true;
+      };
+      "nahar/containers/volumes/jellyfin" = {
+        useTemplate = [ "production" ];
+        recursive = true;
+      };
+      "nahar/containers/volumes/scrutiny" = {
+        useTemplate = [ "production" ];
         recursive = true;
       };
     };

nixos/hosts/shadowfax/config/soft-serve.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   name = "Soft Serve";
   log = {
     format = "text";
@@ -26,7 +27,6 @@
     public_url = "http://10.1.1.61:23232";
   };
   stats = {
-    enabled = false;
     listen_addr = "10.1.1.61:23233";
   };
   db = {

nixos/hosts/shadowfax/config/sops-secrets.nix

@@ -1,230 +0,0 @@
-{...}: {
-  secrets = {
-    # Minio
-    "minio" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "minio";
-      group = "minio";
-      mode = "400";
-      restartUnits = ["minio.service"];
-    };
-    # Syncthing
-    "syncthing/publicCert" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "jahanson";
-      mode = "400";
-      restartUnits = ["syncthing.service"];
-    };
-    "syncthing/privateKey" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "jahanson";
-      mode = "400";
-      restartUnits = ["syncthing.service"];
-    };
-    # Prowlarr
-    "arr/prowlarr/apiKey" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "prowlarr";
-      mode = "400";
-      restartUnits = ["prowlarr.service"];
-    };
-    "arr/prowlarr/postgres/dbName" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "prowlarr";
-      mode = "400";
-      restartUnits = ["prowlarr.service"];
-    };
-    "arr/prowlarr/postgres/user" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "prowlarr";
-      mode = "400";
-      restartUnits = ["prowlarr.service"];
-    };
-    "arr/prowlarr/postgres/password" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "prowlarr";
-      mode = "400";
-      restartUnits = ["prowlarr.service"];
-    };
-    "arr/prowlarr/postgres/host" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "prowlarr";
-      mode = "400";
-      restartUnits = ["prowlarr.service"];
-    };
-    # Sonarr
-    "arr/sonarr/1080p/apiKey" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-tv1080p.service"];
-    };
-    "arr/sonarr/1080p/postgres/dbName" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-tv1080p.service"];
-    };
-    "arr/sonarr/1080p/postgres/user" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-tv1080p.service"];
-    };
-    "arr/sonarr/1080p/postgres/password" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-tv1080p.service"];
-    };
-    "arr/sonarr/1080p/postgres/host" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-tv1080p.service"];
-    };
-    "arr/sonarr/1080p/extraEnvVars" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-tv1080p.service"];
-    };
-    "arr/sonarr/anime/apiKey" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-anime.service"];
-    };
-    "arr/sonarr/anime/postgres/dbName" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-anime.service"];
-    };
-    "arr/sonarr/anime/postgres/user" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-anime.service"];
-    };
-    "arr/sonarr/anime/postgres/password" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-anime.service"];
-    };
-    "arr/sonarr/anime/postgres/host" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-anime.service"];
-    };
-    "arr/sonarr/anime/extraEnvVars" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "sonarr";
-      mode = "400";
-      restartUnits = ["sonarr-anime.service"];
-    };
-    # Radarr
-    "arr/radarr/1080p/apiKey" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-movies1080p.service"];
-    };
-    "arr/radarr/1080p/postgres/dbName" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-movies1080p.service"];
-    };
-    "arr/radarr/1080p/postgres/user" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-movies1080p.service"];
-    };
-    "arr/radarr/1080p/postgres/password" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-movies1080p.service"];
-    };
-    "arr/radarr/1080p/postgres/host" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-movies1080p.service"];
-    };
-    "arr/radarr/1080p/extraEnvVars" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-movies1080p.service"];
-    };
-    "arr/radarr/anime/apiKey" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-anime.service"];
-    };
-    "arr/radarr/anime/postgres/dbName" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-anime.service"];
-    };
-    "arr/radarr/anime/postgres/user" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-anime.service"];
-    };
-    "arr/radarr/anime/postgres/password" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-anime.service"];
-    };
-    "arr/radarr/anime/postgres/host" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-anime.service"];
-    };
-    "arr/radarr/anime/extraEnvVars" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "radarr";
-      mode = "400";
-      restartUnits = ["radarr-anime.service"];
-    };
-    # Unpackerr
-    "arr/unpackerr/extraEnvVars" = {
-      sopsFile = ../secrets.sops.yaml;
-      owner = "unpackerr";
-      mode = "400";
-      restartUnits = ["unpackerr.service"];
-    };
-    # Borgmatic
-    "borgmatic/plex/encryption_passphrase" = {
-      sopsFile = ../secrets.sops.yaml;
-      mode = "400";
-      restartUnits = ["borgmatic.service"];
-    };
-    "borgmatic/plex/append_key" = {
-      sopsFile = ../secrets.sops.yaml;
-      mode = "400";
-      restartUnits = ["borgmatic.service"];
-    };
-    "borgmatic/jellyfin/encryption_passphrase" = {
-      sopsFile = ../secrets.sops.yaml;
-      mode = "400";
-      restartUnits = ["borgmatic.service"];
-    };
-    "borgmatic/jellyfin/append_key" = {
-      sopsFile = ../secrets.sops.yaml;
-      mode = "400";
-      restartUnits = ["borgmatic.service"];
-    };
-  };
-}

nixos/hosts/shadowfax/default.nix

@@ -1,5 +1,6 @@
 {
   config,
+  lib,
   inputs,
   pkgs,
   ...
@@ -7,68 +8,45 @@
   sanoidConfig = import ./config/sanoid.nix {};
   disks = import ./config/disks.nix;
   smartdDevices = map (device: {inherit device;}) disks;
-  pushoverNotify = pkgs.writeShellApplication {
-    name = "pushover-notify";
-
-    runtimeInputs = with pkgs; [
-      curl
-      jo
-      jq
-    ];
-
-    excludeShellChecks = ["SC2154"];
-
-    text = ''
-      ${builtins.readFile ./scripts/pushover-notify.sh}
-    '';
-  };
-  refreshSeries = pkgs.writeShellApplication {
-    name = "refresh-series";
-
-    runtimeInputs = with pkgs; [
-      curl
-      jq
-    ];
-
-    excludeShellChecks = ["SC2154"];
-
-    text = ''
-      ${builtins.readFile ./scripts/refresh-series.sh}
-    '';
-  };
 in {
   imports = [
     inputs.disko.nixosModules.disko
     (import ../../profiles/disko-nixos.nix {
       disks = ["/dev/sda|/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_500GB_S58SNM0W406409E"];
     })
-    ./config/borgmatic
     inputs.nix-minecraft.nixosModules.minecraft-servers
   ];
 
-  environment = {
+  boot = {
-    sessionVariables = {
+    initrd = {
-      # Wayland and Chromium/Electron apps.
+      kernelModules = ["nfs"];
-      NIXOS_OZONE_WL = "1";
+      supportedFilesystems = ["nfs"];
     };
-    # System packages
+
-    systemPackages = with pkgs; [
+    binfmt.emulatedSystems = ["aarch64-linux"]; # Enabled for arm compilation
-      inputs.zen-browser.packages."${system}".default # beta
+
-      inputs.ghostty.packages."${system}".default # terminal
+    kernelModules = [
-      pavucontrol # Pulseaudio volume control
+      "vfio"
-      zulu
+      "vfio_iommu_type1"
-      # dev
+      "vfio_pci"
-      uv
+      "vfio_virqfd"
-      # fun
-      fastfetch
-      prismlauncher # Minecraft launcher
-      # Scripts
-      pushoverNotify
-      refreshSeries
     ];
+    extraModulePackages = [];
+    kernelParams = ["zfs.zfs_arc_max=107374182400"]; # 100GB
+  };
+
+  swapDevices = [];
+
+  hardware = {
+    cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+    nvidia.open = true;
+    graphics.enable = true;
+    # opengl.enable = true;
+    nvidia-container-toolkit.enable = true;
   };
 
   users.users.root.openssh.authorizedKeys.keys = [];
+
   # Network settings
   networking = {
     hostName = "shadowfax";
@@ -93,22 +71,24 @@ in {
     };
   };
 
-  # enable docker socket at /run/docker.sock
-  virtualisation.podman.dockerSocket.enable = true;
-
   programs = {
     # 1Password cli
     _1password.enable = true;
-    _1password-gui.enable = true;
 
     # Mosh
-    mosh = {
+    mosh.enable = true;
-      enable = true;
-      openFirewall = true;
-    };
 
     # VSCode Compatibility Settings
     nix-ld.enable = true;
+
+    # Hyprland
+    hyprland = {
+      enable = true;
+      package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
+      portalPackage =
+        inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
+      withUWSM = true;
+    };
   };
 
   # Open ports in the firewall.
@@ -117,45 +97,14 @@ in {
       # Caddy
       80 # http
       443 # https
-      179 # BGP
       2019 # caddy admin api
       # Minio
       9000 # console web interface
       9001 # api interface
-      # Soft-serve
-      23231 # SSH
-      23232 # HTTP
-      9418 # Git
-      # scrypted
-      45005
     ];
   };
 
   services = {
-    # Minecraft
-    minecraft-servers = {
-      enable = true;
-      eula = true;
-      openFirewall = true;
-      dataDir = "/nahar/minecraft";
-      servers.fabric = {
-        enable = true;
-
-        # Specify the custom minecraft server package
-        package = pkgs.fabricServers.fabric-1_21_4;
-
-        symlinks = {
-          mods = pkgs.linkFarmFromDrvs "mods" (
-            builtins.attrValues {
-              Fabric-API = pkgs.fetchurl {
-                url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar";
-                sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d";
-              };
-            }
-          );
-        };
-      };
-    };
     # Minio
     minio = {
       enable = true;
@@ -187,15 +136,6 @@ in {
     soft-serve = {
       enable = true;
       settings = import ./config/soft-serve.nix {};
-      package = pkgs.unstable.soft-serve;
-    };
-
-    sunshine = {
-      enable = true;
-      autoStart = true;
-      capSysAdmin = true; # only needed for Wayland
-      openFirewall = true;
-      package = pkgs.unstable.sunshine;
     };
 
     # Tailscale
@@ -211,19 +151,33 @@ in {
   };
 
   # sops
-  sops = import ./config/sops-secrets.nix {};
+  sops.secrets = {
+    "minio" = {
+      sopsFile = ./secrets.sops.yaml;
+      owner = "minio";
+      group = "minio";
+      mode = "400";
+      restartUnits = ["minio.service"];
+    };
+    "syncthing/publicCert" = {
+      sopsFile = ./secrets.sops.yaml;
+      owner = "jahanson";
+      mode = "400";
+      restartUnits = ["syncthing.service"];
+    };
+    "syncthing/privateKey" = {
+      sopsFile = ./secrets.sops.yaml;
+      owner = "jahanson";
+      mode = "400";
+      restartUnits = ["syncthing.service"];
+    };
+  };
 
   # System settings and services.
   mySystem = {
-    ## Desktop Environment
-    # Hyprland
-    de.hyprland.enable = true;
-    # VS Code
-    editor.vscode.enable = true;
     # Containers
     containers = {
       jellyfin.enable = true;
-      jellyseerr.enable = true;
       ollama.enable = true;
       plex.enable = true;
       scrypted.enable = true;
@@ -231,107 +185,9 @@ in {
     purpose = "Production";
     # Services
     services = {
-      borgmatic.enable = true;
       # Misc
       libvirt-qemu.enable = true;
       podman.enable = true;
-      # Prowlarr
-      prowlarr = {
-        enable = true;
-        package = pkgs.unstable.prowlarr;
-        dataDir = "/nahar/prowlarr";
-        port = 9696;
-        openFirewall = true;
-        hardening = true;
-        apiKeyFile = config.sops.secrets."arr/prowlarr/apiKey".path;
-      };
-      # Radarr
-      radarr = {
-        enable = true;
-        instances = {
-          movies1080p = {
-            enable = true;
-            package = pkgs.unstable.radarr;
-            dataDir = "/nahar/radarr/1080p";
-            extraEnvVarFile = config.sops.secrets."arr/radarr/1080p/extraEnvVars".path;
-            moviesDir = "/moria/media/Movies";
-            user = "radarr";
-            group = "kah";
-            port = 7878;
-            openFirewall = true;
-            hardening = true;
-            apiKeyFile = config.sops.secrets."arr/radarr/1080p/apiKey".path;
-          };
-          moviesAnime = {
-            enable = true;
-            package = pkgs.unstable.radarr;
-            dataDir = "/nahar/radarr/anime";
-            extraEnvVarFile = config.sops.secrets."arr/radarr/anime/extraEnvVars".path;
-            moviesDir = "/moria/media/Anime/Movies";
-            user = "radarr";
-            group = "kah";
-            port = 7879;
-            openFirewall = true;
-            hardening = true;
-            apiKeyFile = config.sops.secrets."arr/radarr/anime/apiKey".path;
-          };
-        };
-      };
-      # Sonarr
-      sonarr = {
-        enable = true;
-        instances = {
-          tv1080p = {
-            enable = true;
-            package = pkgs.unstable.sonarr;
-            dataDir = "/nahar/sonarr/1080p";
-            extraEnvVarFile = config.sops.secrets."arr/sonarr/1080p/extraEnvVars".path;
-            tvDir = "/moria/media/TV";
-            user = "sonarr";
-            group = "kah";
-            port = 8989;
-            openFirewall = true;
-            hardening = true;
-            apiKeyFile = config.sops.secrets."arr/sonarr/1080p/apiKey".path;
-          };
-          anime = {
-            enable = true;
-            package = pkgs.unstable.sonarr;
-            dataDir = "/nahar/sonarr/anime";
-            extraEnvVarFile = config.sops.secrets."arr/sonarr/anime/extraEnvVars".path;
-            tvDir = "/moria/media/Anime/Shows";
-            user = "sonarr";
-            group = "kah";
-            port = 8990;
-            openFirewall = true;
-            hardening = true;
-            apiKeyFile = config.sops.secrets."arr/sonarr/anime/apiKey".path;
-          };
-        };
-      };
-      # Sabnzbd
-      sabnzbd = {
-        enable = true;
-        package = pkgs.unstable.sabnzbd;
-        configFile = "/nahar/sabnzbd/sabnzbd.ini";
-        port = 8457;
-        user = "sabnzbd";
-        group = "kah";
-        # Security hardening.
-        dataDir = "/nahar/sabnzbd";
-        downloadsDir = "/eru/media/sabnzbd";
-        hardening = true;
-        openFirewall = true;
-      };
-      # Unpackerr
-      unpackerr = {
-        enable = true;
-        package = pkgs.unstable.unpackerr;
-        configFile = "/tmp/unpackerr/config.yaml";
-        extraEnvVarsFile = config.sops.secrets."arr/unpackerr/extraEnvVars".path;
-        user = "unpackerr";
-        group = "kah";
-      };
       # Sanoid
       sanoid = {
         enable = true;
@@ -360,16 +216,22 @@ in {
         enable = true;
         package = pkgs.unstable.qbittorrent.override {guiSupport = false;};
         user = "qbittorrent";
-        group = "kah";
+        group = "qbittorrent";
         dataDir = "/nahar/qbittorrent";
-        downloadsDir = "/eru/media/qb/downloads";
+        downloadsDir = "/eru/media/qb/downloads/complete";
         webuiPort = 8456;
         openFirewall = true;
         hardening = true;
         qbittorrentPort = 50413;
       };
-
+      # ZFS nightly snapshot of container volumes
-      zfs-nightly-snap.enable = true;
+      zfs-nightly-snap = {
+        enable = true;
+        mountPath = "/mnt/restic_nightly_backup";
+        zfsDataset = "nahar/containers/volumes";
+        snapshotName = "restic_nightly_snap";
+        startAt = "*-*-* 06:30:00 America/Chicago";
+      };
     };
     # System
     system = {

nixos/hosts/shadowfax/scripts/pushover-notify.sh

@@ -1,89 +0,0 @@
-# shellcheck disable=SC2154,2148
-
-# User defined variables for pushover
-PUSHOVER_USER_KEY="${PUSHOVER_USER_KEY:-required}"
-PUSHOVER_TOKEN="${PUSHOVER_TOKEN:-required}"
-PUSHOVER_PRIORITY="${PUSHOVER_PRIORITY:-"-2"}"
-PUSHOVER_TITLE="${sonarr_eventtype} - Title unset"
-PUSHOVER_MESSAGE="${sonarr_eventtype} - Message unset"
-PUSHOVER_URL="${sonarr_eventtype} - url unset"
-PUSHOVER_URL_TITLE="${sonarr_eventtype} - url title unset"
-
-if [[ "${sonarr_eventtype:-}" == "Test" ]]; then
-  PUSHOVER_PRIORITY="1"
-  printf -v PUSHOVER_TITLE \
-    "Test Notification"
-  printf -v PUSHOVER_MESSAGE \
-    "Howdy this is a test notification from %s" \
-    "${sonarr_instancename:-Sonarr}"
-  printf -v PUSHOVER_URL \
-    "%s" \
-    "${sonarr_applicationurl:-localhost}"
-  printf -v PUSHOVER_URL_TITLE \
-    "Open %s" \
-    "${sonarr_instancename:-Sonarr}"
-fi
-
-if [[ "${sonarr_eventtype:-}" == "Download" ]]; then
-  printf -v PUSHOVER_TITLE \
-    "Episode %s" \
-    "$([[ "${sonarr_isupgrade}" == "True" ]] && echo "Upgraded" || echo "Downloaded")"
-  printf -v PUSHOVER_MESSAGE \
-    "<b>%s (S%02dE%02d)</b><small>\n%s</small><small>\n\n<b>Quality:</b> %s</small><small>\n<b>Client:</b> %s</small>" \
-    "${sonarr_series_title}" \
-    "${sonarr_episodefile_seasonnumber}" \
-    "${sonarr_episodefile_episodenumbers}" \
-    "${sonarr_episodefile_episodetitles}" \
-    "${sonarr_episodefile_quality:-Unknown}" \
-    "${sonarr_download_client:-Unknown}"
-  printf -v PUSHOVER_URL \
-    "%s/series/%s" \
-    "${sonarr_applicationurl:-localhost}" \
-    "${sonarr_series_titleslug}"
-  printf -v PUSHOVER_URL_TITLE \
-    "View series in %s" \
-    "${sonarr_instancename:-Sonarr}"
-fi
-
-if [[ "${sonarr_eventtype:-}" == "ManualInteractionRequired" ]]; then
-  PUSHOVER_PRIORITY="1"
-  printf -v PUSHOVER_TITLE \
-    "Episode import requires intervention"
-  printf -v PUSHOVER_MESSAGE \
-    "<b>%s</b><small>\n<b>Client:</b> %s</small>" \
-    "${sonarr_series_title}" \
-    "${sonarr_download_client:-Unknown}"
-  printf -v PUSHOVER_URL \
-    "%s/activity/queue" \
-    "${sonarr_applicationurl:-localhost}"
-  printf -v PUSHOVER_URL_TITLE \
-    "View queue in %s" \
-    "${sonarr_instancename:-Sonarr}"
-fi
-
-json_data=$(
-  jo \
-    token="${PUSHOVER_TOKEN}" \
-    user="${PUSHOVER_USER_KEY}" \
-    title="${PUSHOVER_TITLE}" \
-    message="${PUSHOVER_MESSAGE}" \
-    url="${PUSHOVER_URL}" \
-    url_title="${PUSHOVER_URL_TITLE}" \
-    priority="${PUSHOVER_PRIORITY}" \
-    html="1"
-)
-
-status_code=$(
-  curl \
-    --silent \
-    --write-out "%{http_code}" \
-    --output /dev/null \
-    --request POST \
-    --header "Content-Type: application/json" \
-    --data-binary "${json_data}" \
-    "https://api.pushover.net/1/messages.json"
-)
-
-printf "pushover notification returned with HTTP status code %s and payload: %s\n" \
-  "${status_code}" \
-  "$(echo "${json_data}" | jq --compact-output)" >&2

nixos/hosts/shadowfax/scripts/refresh-series.sh

@@ -1,19 +0,0 @@
-# shellcheck disable=SC2154,2148
-
-CURL_CMD=(curl -fsSL --header "X-Api-Key: ${SONARR__AUTH__APIKEY:-}")
-SONARR_API_URL="http://localhost:${SONARR__SERVER__PORT:-}/api/v3"
-
-if [[ "${sonarr_eventtype:-}" == "Grab" ]]; then
-  tba=$("${CURL_CMD[@]}" "${SONARR_API_URL}/episode?seriesId=${sonarr_series_id:-}" | jq --raw-output '
-        [.[] | select((.title == "TBA") or (.title == "TBD"))] | length
-    ')
-
-  if ((tba > 0)); then
-    echo "INFO: Refreshing series ${sonarr_series_id:-} due to TBA/TBD episodes found"
-    "${CURL_CMD[@]}" \
-      --request POST \
-      --header "Content-Type: application/json" \
-      --data-binary '{"name": "RefreshSeries", "seriesId": '"${sonarr_series_id:-}"'}' \
-      "${SONARR_API_URL}/command" &>/dev/null
-  fi
-fi

nixos/hosts/shadowfax/secrets.sops.yaml

@@ -1,120 +1,91 @@
 syncthing:
-    publicCert: ENC[AES256_GCM,data:qPtXFKL8BrUNMmuF4YOKNAmcL3USnTrMMAahnHCaBFyTNNrSa8zktRG0gryBUvsFTYqwcP6r/FFq5bEpjq6mGPJ942LrYSvv5nqRDnvhEJs3X6wiZfriq2Dyps+2MLqcWjU0tsj+M3IfkOGIry0XSP5EkWFgBJxB3HbRlwqA2ZDAnSOT1OWQbFOl4dYQ7gkssMDyVfrfMoiaw33Q9ttHhLswJIbMK/p1wSWPsEY20ZHEa4fSq06Eks0vUYCmDIrSiFr/fNF5veLO8LAnojJkSm87ZDkX+tAMa7/ZI96fZssHbJHU4dHrsbTlpVyG8AOQ7M9D0cMaH7WjJlV3fn5gAM8xgMjj9YcC3zMFSfBMeVyJF36l0G3jhY+1BO7omqqWY3lwEx/clt/HJ+q6K8z4/uyTfBsuMGPakkDXmplV6j23hwz9jzd/tCMh7/jVFyiwdSf9Ykykf0Qh8af4v1RVzcwbcBnpb4pjMic16WvBWpogt4lTu0o0u9NAMZX/Nu99pxDES7+DLKAIDOoIZwxAYWPY+zTlVusMrbuQ+yvnv1koAi0VJl5n2DpKKxPKKxMYcKN3SqMQ7TX8img3OUIsIje43kbLFnpWwdoBwdKov0PZzBHcH/9SgsBD/aepT1iRkg1Fe6c3EiOF3wKwXBpwuPq61s7+d7ESvOL3sVFEuo6fXhN0aGJK77VnZKqYERjlEOkETjSMNP6ZH1A86YQBFWRXHub1KrhNcZUbTdxuT3UD+gNvoD52InsodblYyDtmSqeEVix9m25buWeurmzSBngPr3L8xxlYt1gRrHZ/4yy2EQPWFo/oMTjqnd1YtcRkNtOzSl7zcXmV0KnY3yAyyyTlwe08PY2rRJ4JUqYS5C3fnv0yQgb7MrYH1Ysau14TOX2WTrTpklPL4zwPz/hVL9hVIeByNshQQZm7KsZXjBGzC8XXRu/3HWNXYXLItHwgNgtVkd8WuYe+bF+u86h1UTDABf4w2tfGVVA6/HqwPQcmdbhQZ+mPHSTbuVcMPLN8MNEK/B1JtBlQID9ybMcbON+pik70d3d+blI=,iv:Ut7rbEVIc2p095rzq9Y6ZS6npa0+atBRLrBjN3mQ6zM=,tag:g1krDi5xhOwr9FfXFQ4mMw==,type:str]
+    publicCert: ENC[AES256_GCM,data:XGQus3CTr8j7LBnOf/Fk5cu2V41X+Udo1yXEq9WP4nJuRvQRQ3IVKrgVyIZfIFM6b02GXJHmvsujZiqLnszTM1ltW67uKhnepj4N8ywogUiEudGyMsu99HchsTN4EhWBeenmOR+Fh1Eruva/fxZlaPMZYEAGSQR8iwC/NqPeGdrS2j4HstxAWd8jn7fJg3MXirTBykiNTGd83gCLjSKoueal8KNF1Sa9peho84u/FrFP5V5JB/E8LT2WLegrdZXEgVwInvYqciZbwWZwP5lWVaiKHPRqVMWCGtBgkxTuD41icFiCFz8OwMFR58+p+LxicGl7IgXDbQtIR+0+WR1Lz+BVOxjUkbr/U0znvta4JYkIbZp3utfbU+K9P7PBCPo4d5WQrVkaEUxNYA0aCgf4ZF4S+upXkV5Dfzc5nnEQi1kme6yScnheKDCMROLnCG1PYZRXk+Q5XQz/iW7KriI1GkNW1u01GB90RwHSTC9btTQEG0c8mgv/4yf8ObGYxDHR2o7QvsEgrfLOrHjBDJ0eGl3sSPH8m6XRGnZBj9prjA1x1h83vZo0omR5nFjA98xRN2U4v4NIeS5KqptDcTsVQdcWpRBjpnZYtb1pJ97p9/gUTNT3UzCt/7LpvO2LyO6CmnV1dVU+HlMVkJJIQHSFnvsk8PsnJEhGcoJIj+GvkkjzgOA2gbtnzpZ3HlM2jPTuSx8VlrLcPb7tsdeGM+ESbDrD/8tHMyOEaoGYOkSLRfE5QhSFuTN7woG3Eg2x+UK92JwkXPpHqr15Vvsw7ElfjnY7NBUz2jcCSJIPLlX1Gs277egZQKumu3TO2h16ced07ABtPPaptAFwh7GR+o5o60mleYdh2NhJGv9Db3i8X+ty3sFEnsIhoOBD75WTsy3cdtls5wWE0Ox162FFhXXqSbxhLaTDkpM6C71+BR97Og8e+/zfN5bK/8pmGUk8EzkL3Anp1rCtD8MxY/CPpxK2oHgPALQwcpGVzpdnk65P5m+61T9boo3UfoC/27G2HyqSj4zz0NCt5Dlqio+hxeZIuaJKx00RIASosXo=,iv:gI/BtvEcAcwTkqpSvpzo1kFR2miK0CiWNY6bQvijbRo=,tag:u6rLmKskE7FClh4V5/3FDA==,type:str]
-    privateKey: ENC[AES256_GCM,data:CFW8XMhLaGFHYqo3+v+4Q8hemV44/Pps/0hBaz8eMwbv5GI34dkSmQ8jh2VY+bRhfGX6sWGXlxBKB44qiTP+jCs4rgBu+AA0j3F4b4/hH/Qj8XoflGMHCfBwsTwYm9vb7Ith3H4F5Fbcv1Dva6mOw3CA65lTfKlxF/NVyj9/cAnqjF0T90jaRYpFN9pLrwkAVBeydc+sofnReFOeI7/IFupxtPKkOaR9wGZK82KQj3+7sXEBgL0HekX677ENBqE4fZHUbe9AKbCe1I4k1RtL9DqANnjTED+ktochzuQ1cUeSnBHtbYD6GDVPisIkJc3Y2a6kmTh5YVF/u8zXMN4n0zwTX+QPA4xms0NCa/528YCSY8VfOfvk9mhQbpmdIob6,iv:gaILRQxX/0poYQedDYZXzL9/ojzIY7BQ+M68HMxD4go=,tag:D0X9OA7ohL5Z8zPsXPdybw==,type:str]
+    privateKey: ENC[AES256_GCM,data:W9+O6G3xhABcztmdqZIy4LKXt9uuoz8fhM56flvJGrJ1WGN9BX9Syn/mblYP2PDWFHBHQtMd+fWsRC1cDPAbwPB8e4CX3gU4NvxQEtkTb6UceP6nF/LZGJkUPIVHflbz4zQxBFet1TDA4pW9IaOrQYYAOcAJtNzF8ybhXepY+RErdnEKIYp5m7M60wvAgs9EDaAbsD3wuzzjs/+s3tR8/Ga8n8qrWSwfbQwRMbXETN0D1PV5HydsBcwiQ2w0FrjQ6w27ASuKQGSAKFNxU8I5/SF5tFLiR8LV+wcUIoUoCN4AxYQQBdxpNcyhxjTFSu7rUvqV7Ni85JUnmnep1cM4j+4hkmj2M06m0SHy87kiJcJfRkwXVKEJUJiUuLQCR+20,iv:FbZnaXDr5+jjSs7wKSE01z0p2Kd9UzGw2alGfd8m1ik=,tag:CD8vp7hloHDYQF/pkm0a7A==,type:str]
 restic:
     plex:
-        resticUri: ENC[AES256_GCM,data:INfsXRDS0oTwxmbUeuns2GtguB+OJvE1UC5uKjR9dqY7tZo9gS7Byjf7RrBhcq3SAAV1yPFnT1F5IZXrwgyBp1h4,iv:nsvINjznTn0PYrCO3sLaOMwSJeZV5gvDTefNKksgep4=,tag:KeA4+WW9+dV7XjScbDzCVg==,type:str]
+        resticUri: ENC[AES256_GCM,data:aA3kc/Wxg/UxrAUeDd0y9z/8mN9LjWsycS3aUuEwgTcAO2NkfUcH9kw/PXOvazA8t5UJ9RVPYYF7910JeftmMNgs,iv:4GaR5XuJKPnQsBehihraCgqBUumDeq6IiRQrSvtQKgg=,tag:U1fVporyT4S48Dmdf5ghSw==,type:str]
-        resticPassword: ENC[AES256_GCM,data:+U4xZIzo7HbuF+MmZAJhj6+ekO4=,iv:GznZk8Ga4w7Zqx6QoXq/SUn1uURLxW9fMN89zTq7BNI=,tag:IuBFTTS0awiVILNx7Z3iLA==,type:str]
+        resticPassword: ENC[AES256_GCM,data:rC5P60IK52dYOSiSkpnkZ2VvqI0=,iv:xIr6BYmpbGXg9zKCKVcstK2ANHN2Y0MzZ1HhDIL9oxI=,tag:J14I0dvIW0FMW1LLB4KuNw==,type:str]
-minio: ENC[AES256_GCM,data:EqFhTRqb5fY7IKZSis71i6aN6Llv2EAQxKjBrmoJKRLKFfQUVzHBgGXse42nd9KD2hirGsBiPgvuXulTw1z+bPmh4EVPaq2uR4fva5g4LA==,iv:4Ru3cHsw2Vyw6mtCoNECMVP/r5toYJ/BBvNNa0m3DK8=,tag:pFtHhgX1WgzRYNe87Zh6dw==,type:str]
+minio: ENC[AES256_GCM,data:IJTwUJOC84a5n798fTDlwRzVc8p5zRiccjdoNTPCNlls0RAyGllijf7GAQG3fxQZQWB2xNd7G0F4/Bv+KmThX2Nxy0c5JFbed+AekuMbNQ==,iv:QDB8JUSehsApBnRhLeGtS2ZczIJA0awN0g0sfkKK810=,tag:NMDfAN8R0mcT7Ec1ldyZbw==,type:str]
-postgres:
-    host: ENC[AES256_GCM,data:NkAc3BN09j4=,iv:M52sslgEY9QXcsG5Z+snGFZ7vt4IWiT6uqowoUUk78I=,tag:n/SXxbBuX2+vZknk/gBs5g==,type:str]
-    port: ENC[AES256_GCM,data:eVFfWA==,iv:sYcdDt9Vw/M0lM7LCVb8wHbwgQ62OfwM+MahvbcG4vs=,tag:uo63B0+r1GOv52bqzeiMZw==,type:int]
-pushover:
-    userKey: ENC[AES256_GCM,data:efCy551JEtPagnRGHkNCKHT+r0yJ/5bqyGTsdeGOdw==,iv:DDAfy3EDSGHo0r5TapW6yjo7XMpVESYYtnUQLBPMg2I=,tag:9ws7n3hlhM4+++aIxOspYg==,type:str]
-borgmatic:
-    plex:
-        encryption_passphrase: ENC[AES256_GCM,data:+PVidwqMgGuZJE0a9TyLda75viaodnZtEPA6nQWNp1KMR7zHQVBjtRojLuRh5Sd78Q==,iv:zJFecISN0l4r2QKfqAw3sds+l5eBHp+wapE+TDUgX3E=,tag:cy4HWmoJw0ygRhaAQ45zwQ==,type:str]
-        append_key: ENC[AES256_GCM,data:ht+OoijAcc8BnuAIoZ0K3kfvzlXYgmi61OHOpaR/H8YpadsMgruym2E2VIAibVhrAt0JamHQ8wEps1/Ur7GPRyQgZmq8dUlEJwVFyD31kOFjJDH3r7hZIMuJopAKYEHxuJ0PANqZO4mHbVd6rnnSvb5oOzACst0oKAoqarmjzVKSfRfRCxSP0df6WhuU4/bMq6u8L4FjMXbrYWbeK77tMdv4eEAHEM6SIuMXOad/AKvgYXIUYmhjohsBXfWQ+gENEVQEpYV48bc/zTC6j4RZI335iZQZq39sg5VWMnSsQtQT+UVzsHBbOYZbzC/FyjUKBNduYoniBQFuswf8IbDgwIcEd8eSRhTGWMOATOdy6MtVstXqZhc9YEHytFrAd6biTt7DHAVUTu9ZqqkyouiuGc8f4kdimGz8kSb3ltKUqN7qTACVHjFXNY5PkdHAy5brKiHp0lPyTiHFQYxabeyPD6VfeDNthK40IzmrIbXJynxNbfOfP3lkmDJ3iD5zM0anU8xcNtRu+1NA9k70GGEvgwTdUbpP+Myicn6u,iv:BAyqOh13D2kRyhKf6qX/gEeRMlmhiR4jD+VrRhKejn8=,tag:GGu1hK8t74cnKbP0dNL6vw==,type:str]
-    jellyfin:
-        encryption_passphrase: ENC[AES256_GCM,data:G7xk+FGsjV7BxwvBGozXcj0n00EjBhDw+Yea4Wf8fmXl,iv:goylWvW4OLWxi3rIyQ5FbmnNtHSuP93Mnb/P4dCes7c=,tag:UiVw9Q0iTw0TxG4hFzg4SA==,type:str]
-        append_key: ENC[AES256_GCM,data:1XPDRh3HtKZbgdXf/YyrIWwvuIsTRADtRea+0G0as5vKfMyrqv60IKvCSDqjlZNhUvtmAMFZS/y5AexLB2qNZNM2qjFvbwr1C2WJw9J1fkpcc2mYRrH2XaghFhwLKuD5PCo4jVztOOMGwXzKcwG5BKr0jm+FiffvoUlB8rlEgIihwmDDf00g4sBAvDpjVQdqxNgc14VALzUiuu4X55xIHW/tQk5R84PDfTR++41EvjDxFQau5TxA3xVeQK/skOSRo4RZRE8vF1I3Dc7njVBMK/PyV0iKLJydfK9Ql33ZwDQmHdt+aw/pPlaPWfMAPzLxbdGuOtUaGQijQmELKQP11101QKHDk2q7LYXfGw62VAqb7W1SJYPczZzdzqyFb4NULykAQOhHGW9I8esRCYn0t4Y5vBEYaPjyBuAJz8ClG4zhxwJPAAQBkntIId0Xjk9NjZDeNKqAXpgs3CDIOJYtGUmtA1Am/B/22/VLl9adheEnTtkYlSTRM8/u5RoiA3utipMFJcdkssmBudH8BvXbJFJChoh3qUDD3Gnz,iv:CZyuBaiKMxNaOlFu/OYFmHOeEVWBNJ3rUIBpV/Oh4GQ=,tag:EX5yoC+KRf6IkVm+7d+Qiw==,type:str]
-arr:
-    prowlarr:
-        apiKey: ENC[AES256_GCM,data:7NKS0QWc/5MIBbasmHHz/EN8wF4ILmsxBQpfZL3J2fs7,iv:WctX4v9GFkseJ+Vqk3U2l5qrgWCcw1Bv3N6RQuwQ1HY=,tag:7FxfWn5ydXu1Pp/B82TOSQ==,type:str]
-        postgres:
-            host: ENC[AES256_GCM,data:++C/D+s30hs=,iv:P0HIuGzVypgxfYmhcNodMXbEufPdrlO/nuQwHZ60kxY=,tag:qHzYYmFaeBXyty6ga6sfQw==,type:str]
-            dbName: ENC[AES256_GCM,data:8t6Ms7cVgSMzN4Vn4w==,iv:mh1nOUuVllIMlj+lhuvXIQqTZ5VCcaU3jj3nOGxAsGs=,tag:OZVFFM2YMENHN3pf9uF+5Q==,type:str]
-            user: ENC[AES256_GCM,data:ji+57XLFMus=,iv:xC+EuVBs9wzZG+leFnAIZCKbxFwtMmSwqhJgVl4SRak=,tag:o7SqVcv33zukUOJ31ORAgw==,type:str]
-            password: ENC[AES256_GCM,data:aSiZR0cTtevhD6s0f6+24qILUmfH5OCBUQ==,iv:xPqiNf9N2Mm6Z7lvcB9xsTjgiJ1tren04pM4rOjRc2A=,tag:NSGr7kedaVgqyM5qwKM40w==,type:str]
-    sonarr:
-        1080p:
-            apiKey: ENC[AES256_GCM,data:h2vPlVVkdOScJg0uvs5yv/WK9NpotcF70bD65gTR8TdY,iv:T6F/u4jFt1k+jaLO0epq5nkTr2c1FvtrEfxadNuQLVU=,tag:GNVgD4oAI1OdBrHlXFlYIA==,type:str]
-            postgres:
-                host: ENC[AES256_GCM,data:8DruSnH9MBs=,iv:WBgn1seW8Tgy8CLB7mv+BgojNk20LUqqVyS+o3aFtWQ=,tag:bNqeKmcXb95167YHIZD8Kw==,type:str]
-                dbName: ENC[AES256_GCM,data:s/XMwlVu648dmAA=,iv:sUtQxqGmpNM7f2Atwm1b5TPj63nynZPIJfHFe2XCjz4=,tag:NTYMuvlBuWDWyUAHPrKlow==,type:str]
-                user: ENC[AES256_GCM,data:OF1jJTDj,iv:u20mF60SJevMeIQAjnIzCbIIKKFqJ95+mG3f5zfX+iI=,tag:BZK7NhoLWDJss/tnf0ZHtQ==,type:str]
-                password: ENC[AES256_GCM,data:2IWE6CK9bOQ9Zhjfkw9WOkwElKtLRiJRKQ==,iv:ySSML6PKNq0JbhcSwQ0rxSEAD+h74u0X5ncfIWbh0KY=,tag:R2nnvakD8SEyEn2GjgkgXg==,type:str]
-            extraEnvVars: ENC[AES256_GCM,data:H6ZGRWsRyZ635t2eELbvz2QvCy47wiN59ViytOxX9SebXC2b4cfvGpGJi1RIOlkcz59BUYUizK58sUNbgMeFn178xVkT24mOXYu5VkO/4n5WuY2zWN9gbnL6RWnrQZw=,iv:RLroNHNseCQeYuNdad9KiFjrKkZI44gP4E/Uj73R3qg=,tag:++t7TZvUEDAiU3Smgffitg==,type:str]
-        anime:
-            apiKey: ENC[AES256_GCM,data:/1GRSCBEgm+MFQRoIddchoe1290/A1hvVCNmp1hfsSGS,iv:GOeXBu7uKklK6KE8RvpewzBaySdoKonVo4rApadoIzw=,tag:EinKbUl+X92plkp9p3AXOA==,type:str]
-            postgres:
-                host: ENC[AES256_GCM,data:hvZGv3MQ0JU=,iv:HFs62YuhV0uypvBGA2kfAlorwWbjRr6M5/VJwx2LVC0=,tag:c7B6eco64WzvC0Uo44q76g==,type:str]
-                dbName: ENC[AES256_GCM,data:aT4STqdwfQ/kRlYQ,iv:XUyJPrqkDaLt5TmJl1+u8xZitY7x1wI2BpykmYQivjA=,tag:YSyzENEHcrv0y4GTYdW7QA==,type:str]
-                user: ENC[AES256_GCM,data:Io5JmxNKuJ33MRgS,iv:DXLRl2ZSRNkdTXRY3UzL0zxM+1m3xpdJgaWZqbl6Vok=,tag:rD/HrAOUF2LJDc13blJyRA==,type:str]
-                password: ENC[AES256_GCM,data:whbjCtd6TOxPKWwvL7L1lKcxr8tEZEx7YTdJNQUtcw==,iv:n3YBj1HSLo1EJ+XnuRXsn9wWXIAaIe4zwkfFLaKx53M=,tag:gtENwItQT6dgr0fBrEipaQ==,type:str]
-            extraEnvVars: ENC[AES256_GCM,data:MYQWHBE8bcttmXhh3HDir1zBJq1t1W4Xik7JnyEVmHKdXQu/GPUvbQLctGIXC9psD7x5lk6xMwg2WxSFLHcGFhadDHnm8rla9wFCSh0VlTyWekvKZ+XZPuhcDFxfYVA=,iv:3HzZU/1wJEXizscc7rSLLmJqe/FMiwqu+RiqvCBxBtY=,tag:3OXclcolF4WgW0Hu2FDojg==,type:str]
-    radarr:
-        1080p:
-            apiKey: ENC[AES256_GCM,data:w4VmflaV51T17tp2Zwa+2Ifm1FfPgVRxLmWomhsHe5wa,iv:xYvuQL2u7GwDxAWpohAJTuX5tmvxwxo6xS4Uz/9MXOc=,tag:uVVxdY0QreC1ZA+LWpKTmg==,type:str]
-            postgres:
-                host: ENC[AES256_GCM,data:wFG60E/SiJg=,iv:glgvp1UsgO16tXjfSBKaQsMSzekMiWFLG1ptcgS00Gs=,tag:LhA3+kQzMF7IsCZEPaEeGg==,type:str]
-                dbName: ENC[AES256_GCM,data:/AWMN9BQw7vDvg8=,iv:CwUt1tur+xdrd+egaVs1ETr9ueWyrb4rpiLWTHtkFuo=,tag:EmYEZJw3j4/D98KXzcLpFw==,type:str]
-                user: ENC[AES256_GCM,data:K4OFAbH9,iv:O2HHLVNC7YUtD/BQWSjUaz/tFdd0O9tYkqTy03/M08c=,tag:Qrwq6x/oxLd/1CjtPXSNJA==,type:str]
-                password: ENC[AES256_GCM,data:QYHNzqggnZ0v9byc41txTX5FcLPjSLZP+Q==,iv:dbrnn9btZd6b/KhnE3nbpljqkjr75PFrBERuju4wvv0=,tag:6/COq83YDfYkpLwW+S6avw==,type:str]
-            extraEnvVars: ENC[AES256_GCM,data:IF6EntbTjCs51DjVfWRJQ7JYLat+ade0bVVyDPxBJXzUJAsGIg2wxsMOCBZONs/VJgh+lUmlYuuCj5Vfy37YTOaFRdSEBEYkHL+iwThHV29nAV2GJyn/E6Fau+Hpj6A=,iv:ysLb5Em4hg+RAkqotLhJ0p29yribQjv5SK87HkfWMcI=,tag:zM40WAugV73e2QorCw1eVQ==,type:str]
-        anime:
-            apiKey: ENC[AES256_GCM,data:pQsxmcLwAOfPlwJIARgsgqObW0weoNfgeX7xNZ8nRLZ1,iv:IjyJdeONnrzcBQj6VScf5mO6IAGGaxLFn00avZchQ30=,tag:z9xqycT/Y9FnZ+qbXjLW1Q==,type:str]
-            postgres:
-                host: ENC[AES256_GCM,data:rmPRKNCDNuY=,iv:+b/NQZS7mPF1t8DlcuI3MXZwX7BcOIb0hiVANXCdfSk=,tag:1YqGTRl0LUz4vqy+SCM1HQ==,type:str]
-                dbName: ENC[AES256_GCM,data:/y8nkutIioMtH7Q=,iv:AcNHukerGYCxW7i3tvXbK1a3cy88623tF2xE2CQhrsA=,tag:YqllmENzjiKzMyLCMhZu/w==,type:str]
-                user: ENC[AES256_GCM,data:XUHlPPiaeUEJM/ii,iv:VHL5CoBf9/dnaFUav3EOwoRlBYt7pQ1b9fhpBN+UJDs=,tag:CZNf0Ix10Us4iS//Fth4wg==,type:str]
-                password: ENC[AES256_GCM,data:Fp13YKpwv9rWhLirbX6k9YG+5w7AWA==,iv:M18dOvzRHt9WXA7ThmOUGTE8o3lTXR6rzwYRbO2x7ns=,tag:alAzOfQCJ8d44S960aT2Bw==,type:str]
-            extraEnvVars: ENC[AES256_GCM,data:HxYI/7VKvP5jheDHg78SY5WL7R8i9tO2nmmOfJQTyz30tHMFucJJ490AovKXxmnUy8NXv0EFIHt6hP5zCUW8cqGf8rKb/aY6pzpga9uBNStM8yzk1K34qVT2VjAMtLk=,iv:wBZfS8gh8dmKYcB2Uba3Hdak2NRZgqUceumgqf97nCY=,tag:dvQEIHFhdyjYof0a6NHMfw==,type:str]
-    unpackerr:
-        extraEnvVars: ENC[AES256_GCM,data:/M7qxzcp5VO1nJfmOg/LKE+o0oqGgx8ohLCBqwsBzAaCcAe+L5PZb9J0Avgf7dFIeYXHXtkPXZNUYo04btsFqCizRrPBa/MxdSp6Wc7vLONaJXx/3PSJI3GgFR4AB0aeGEW4HaodLs6K35JqE7FV9NdX4Sy+O/s4TK5s9EAebVfkTIuaBA685L0JPUUHxdzuyMpMP9C7RoZ7XyoToiVxVJi7cBeXwuevTZJwCY9+p+RjiUcNrHt+HNjSPZMUpYo1d1CAJaAmy10kE3yydjYo+9vZwEpdoKVXlw3pio5rVpGLV5nlk5Mv+XHeZ8h6Ic8LLoDcy616oCmn5Vp0B6spElgSBx1tNjwF902ku+8rteh6931EHdNoD/APhg1h1/u9kBLZfxQ0v6DK3kSYfETW/8X2Y/V7bvSaiYhKjHdOYBxXkmIlpTBR50FPBLQ=,iv:I5jHRJFTZWawfwndvNrjPNLldrZyABynfXKUZMFeZiA=,tag:RnEebZ1LpfJWPiNTxT4ZVA==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age:
+        - recipient: age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOK2piTS9FTXJ3TWMzdVFr
+            aWFUSkJSbTdCR21iQks3OCttNzZOcWg5RlFJCnhQQk5sb2Jjd285bWZaVjVrQzRy
+            REMvZnR4YUREUUwzK1IxRzJwNUdVcncKLS0tIHB0MTRxWWJRR3psMEVBTmQycCtL
+            MjhkT0JGdjBmeUw2MGFLZUFhMW5IKzAKVY5fLZeRk/6dvCimJ7Jgj1hOjqtZ3Q35
+            EH1L3X2/n+fTzYIASj1UJxvAJd6U7rrmfozQQYIKch2Ri+EV3QHRKA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArSFVLTFZqeHNuSENWWWZG
+            QmI4QXEvbG5SeTJHMVhSaThPYkNzZDI1TnpZCkdobm5IaUhESVk3NVVxcTVITUZh
+            Vk0wTjdtS3hxcnEvRkV3bmZJdVlmTUkKLS0tIGhqQkFPcXFKcjhCWEZvR1BrMi83
+            THFOTXdoc2pFKzhZTkNUdC9VN0IvTTAKdmOR0iZ6pzJX/ZgxhxvS6yUCEGjq/ePV
+            NIPJwMMcAatrrFunBdIEOzfu1LO1in5ZADaA54JUIiftLrhA8Lraig==
+            -----END AGE ENCRYPTED FILE-----
         - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTbXJYbUNJaEkzQlJqU1Zx
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZ2lxb0JiYzlmRHZ0Ymhk
-            Zzc1M0RxMFdMQXpIekwwMmhlMWo5d3BRZ2pBCjQzdTd4ZklNUTJYa2c0QW56NVQw
+            OVo2cXFRcmtGdGFqTWlJY1dXVlNZbTFIUFZVCmFuMU9SNjRtU0tTSlRnMHFQSFJi
-            UzBja3pRV3MxSGlROURML0VLTVdKTmMKLS0tIDAzTzJacU9UVTJNakRrWWhPeUM3
+            K21OQ1Z2K0lYWHA1cmRibWFTVUIrRU0KLS0tIHNZTkY1UXY4TjZrWCsyK2hPeEVH
-            OStNbWNzS0V3SXIvNEVWZDVPb245OTQKeFrwTJHVxc13tv0LWU3h+8nZiedbC3II
+            NEpZcU96Q1lobzFVTWNrUFJHQjZhM1UKZQzhD32rkAylJfSp+N648jrs6YvYtg+X
-            pOJlGu1+iAssnu6p2eEefH7Urwlr7Qsa2G55G+l31hzZsFzuL1yLwA==
+            tpT4jvyeAcQJ+txZunhwiTwZslJEQMOZlwAyMO6riQNtATTU4Bycsw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQbGNIemRkQUtobFliUCtx
+            aUNLQUZhM2xVOHI4YUUxR0xKNmROUDQ2cW5ZCi9zQU1LYnBFWC9NMHAvUDBKYWZL
+            TC85ZnllOTgzS3B6QjJxYWhtZG4zbVUKLS0tIHNhUk9ocVhpaUJ3emxHR2pZb2c1
+            S2FOK0gwNGJwbFduNkwyZkZGdmVMY00KH1SjfNNdeKRmqwidEB2MM5EO/8jJk36D
+            86Ehn4wHIW3CSfqJYDLmYBmreFfqgQq/BGThGJs2EdkNb2VkyZnTUg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlSXRDRSs2MDBaNG5SV0ds
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMTVRLeHlFb2FpYUdZNXV0
-            cmRKM0FDbHZnQVZ1R256SlZzUHpwZmZGU0VjCnJVWGQ5WTE0Z2MvVHM2Q3VYZDNM
+            T1dXMTROTk4rM09KaG9SK0FuVEZQTmJIUVZnCkNJODJpY0NZUWthdHBEamRPMlNl
-            Zm15RkVidlFEWkduYVM0TU12YXdWRDQKLS0tIFF0WHM5UytOY0tZSTZNb3ZTbXAr
+            UStpUlphSDFKZ1pJalhjRGIybms0QUEKLS0tIFBlZFAvaE83YmEzU0hnTXhJSVdH
-            S1Z2blBqSWI3cWJOb1JSZUhKcW1GNnMK5EVQb2zVqHdBWQWmmEze7kWSXf7NEt34
+            Vm5pRTB6ZEpZRnZ3Nk5UY3ljcG9lQncKW+/xvvA8gU6f9SlF5jGkddXpmSZlOCfh
-            PnA0DiGCHnHm+UQg6Hw9/duYo71oQ163AbPBxD5hrCOoPgViVKFEHA==
+            xXXAFB50J/9fmBRMXVItzdERKK1MxZm9p1g5gmIYkyH/wm48ZTyrwA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nkpq8lr09vamgvf8cvzemqjyr3ex8w7azfupdr2gverz9j5zgemsv99t0z
+        - recipient: age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZ2FpckhNendHNU5yVWRm
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFd21SSGpTclllWWdIWmda
-            OVNqcmZyckdGTmhuU1psTjA1YzZyU0ZLcG5FCjArMjBGT0pOU05xY1V0aVMwc2ND
+            TzlkZ2VNWDZ3YUVwWDkzZHlyYythZ1JMUTJVCk15TVZUMVdTSWpldnozMVhVQ0dE
-            eUVjdkh4a2o2VGMvakZUMk1GTE1CZGMKLS0tIHpVMmdNN1V4OXpLdVpEUWg1QjAz
+            S3FaTzhLWE1Pd3B2RW1YTU1TVXIxbEkKLS0tIFhoZHBTeEpUekdEajRNZ0xRcnpi
-            L0hmYy9kSktvdmxLcGcvVDlFNGRiYjQKCwUhrXyEWzyFQvmKPnnjQyF/n5SF5yiT
+            d2xDaDBWKzhaK2RzOUoxbDAvQnQwK2cKXifwRj2MHtsPYykP92gkkf2drlSBf/4U
-            42Vh1REycPIWlegr6/j5bF+tFOPT9Wb/Hnmc6FPKjQt5Hwgt+Buhmg==
+            AXvjfndT7yqvlBHfTCusos6AollCJ+QNPQJoCdzZzSyLZS5S55QY5Q==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBESk8vMlpueWVZUW9ndysw
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwbW5HOHp1UUVhN3ljZkpO
-            REc1Qm4vRU5QcjVzOVBBTlNjaFNpSjE3eTNRClZjaVJLZkNOZW9zZUdxRGxJQXNO
+            RlZYdDVsUlYyL2VXdGROalZrRnVxMmFEb1ZrCjVEYmd2a2NrelFkSGt6ZnpYblBi
-            WjQ0eE9Ua1JPMkNINnVmcXI5SzZSalUKLS0tIEk0emhxdmJjRDJQYVU1cVRSejYz
+            aStXRk5YQ05HUkJZMW11QzRUSGhVMWsKLS0tIDBhVXVBTTB3U1dnMWxEd2VaMWd4
-            V25uTVF4Z2RZeEZpMTlxOERaMnRtVG8KHQrPSRD07W0pTH1ynePwXRxXPWn8n9sZ
+            THltK2VHRU1PQkpOc3VyUFN6K2l5OEUK7dWJCGhvw+Xr3ny68iWgo05iApyiqzZI
-            Gxu327fptOKoKjDXrLduoHFuO0m9WJcXYP6v9rtVmrTDhU/Ntye3UQ==
+            pwUG0ZfzQlwC0cvYTqHfc8nGyHcAsjs6LTeBYrn+WGZtvEUBAZvIHQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6OStleHcyMHlUTW5wN2dl
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGbUlTR3d1UTBWOWJPK2E2
-            cHRCMmFmM0tMRzVmYStlUU1mdzYzMkR3Q0JVCjNTeTE2WFZiMzJScWdFMEticHoy
+            OVc4cWNYbm9zcDRydHdFT3pEaWxxZDVkUkUwCktEYWt5dmdmWGRESnFFVnVIcFRa
-            RDd1VVpnU3FVNjdNOWR6L2VqZ25RYnMKLS0tIEdQL2lFS1hINlV2SEZvWkJVQTEx
+            T0Q0WUdjSk1TaVRsdXBRTGo4cjZIZW8KLS0tIENzcUJxeFBtRWx4aTVsTndTWkFC
-            aHY2Wjl0b1FVbG53elRxNWpqcWRrbE0KjAvjOqSEQF2286Bj2jF25BoKuD4OLoHY
+            aVlOSHhFb2I5UnYwVytyQzlWTXBDYUUKdQKilmfJ1F7UYKtQV9zV95FcRIK17p4M
-            U4pqq52per87pnJs4gBkRS8DNoSbRq9JwyTwzKz2BZgPJvVDGXDTOA==
+            vGvu/pGJ32tH8xI7cNs9I5Hmg9c5wOam21W1FDk+VlJ/ClXqQzS0MA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-09T06:33:41Z"
+    lastmodified: "2025-01-23T00:36:34Z"
-    mac: ENC[AES256_GCM,data:MX6qN7VW6B2zR6O2n3znHt8DvB8GuaSjT15OPEc+T4aoXZ6g+OgOCQez8Yyd8B4Nv6joKJrQUKIM4sMSAmQ8bwwvXx1YTUKQxJ05MKGGorZYuZCOvhmsOnhRYJGVt40XZiIMIYDvl+uRjkG4NSBOoYdWF7qldphjTNzXrc5Qcnc=,iv:Xj3cCr6p+cmc41FVhxiiNfjhOKY1rlpT9zUR43hSvGo=,tag:FTVX4awkq5UDXGIAgSbZsA==,type:str]
+    mac: ENC[AES256_GCM,data:2H1NCCVjvR/pSTI6njNkE7RuWWlCSPIvKLBqkJbEKNvc2aaPIUmGLlLpvNRQ1rQJbQa2okVnL4wITeYT+uuBhus4ubTAD7RH3HIjXMcK2HFCA/ey/kJ9GZI6I+0pwyjavUlWitIqUjUpTOK1hGSTzRSm6G38uSLhfQGMG3clUjw=,iv:1qZ6eKIaE/6QF3r4adGw2dvKlrZvjCktmgJ2L3n3kEs=,tag:kZ7wAbXebk0VF1kAbjxRSA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.2

nixos/hosts/telchar/default.nix

@@ -1,88 +0,0 @@
-{
-  pkgs,
-  inputs,
-  ...
-}: {
-  imports = [];
-  swapDevices = [];
-  virtualisation.docker.enable = true;
-
-  # System packages
-  environment = {
-    sessionVariables = {
-      # Wayland and Chromium/Electron apps.
-      NIXOS_OZONE_WL = "1";
-    };
-    systemPackages = with pkgs; [
-      # myPkgs.modrinth-app-unwrapped
-      inputs.zen-browser.packages."${system}".default # beta
-      inputs.ghostty.packages."${system}".default # terminal
-      dconf-editor
-      fastfetch
-      gtk3
-      nodejs_22
-      pavucontrol # Pulseaudio volume control
-      vesktop # Discord custom client
-      zulu # Java OpenJDK
-    ];
-  };
-
-  services = {
-    # Tailscale
-    tailscale = {
-      enable = true;
-      openFirewall = true;
-    };
-    # Pipewire and Pulseaudio
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      pulse.enable = true;
-      extraConfig.pipewire = {
-        "10-clock-rate" = {
-          "context.properties" = {
-            "default.clock.rate" = 48000;
-          };
-        };
-        "10-clock-quantum" = {
-          "context.properties" = {
-            "default.clock.quantum" = 1024;
-          };
-        };
-      };
-    };
-    blueman.enable = true;
-  };
-
-  ## System settings and services.
-  mySystem = {
-    purpose = "Development";
-
-    #services.syncthing = {
-    #  enable = false;
-    #  user = "jahanson";
-    #  publicCertPath = config.sops.secrets."syncthing/publicCert".path;
-    #  privateKeyPath = config.sops.secrets."syncthing/privateKey".path;
-    #};
-
-    ## Desktop Environment
-    ## Gnome
-    # de.gnome.enable = true;
-    ## KDE
-    # de.kde.enable = true;
-    ## Hyprland
-    de.hyprland.enable = true;
-
-    ## Games
-    # games.steam.enable = true;
-
-    ## System config
-    system = {
-      motd.networkInterfaces = ["wlp1s0"];
-      fingerprint-reader-on-laptop-lid.enable = true;
-    };
-
-    framework_wifi_swap.enable = true;
-    security._1password.enable = true;
-  };
-}

nixos/hosts/telchar/secrets.sops.yaml

@@ -1,59 +0,0 @@
-syncthing:
-    publicCert: ENC[AES256_GCM,data:eqTuzoyuzVC5ZITeipdlHWH+o+xPMPQeiwwGkUdQPIEvjhPWQoHeodwPWOXGDQyFwJfD+77bphWTTVImdTNKJbbtjP/oneQRZPLsQThPNHXcOMDjhzhyBVaOrKhn1eZy849Q4MNBArbQn0470Sn8tkpL2SyiwxKeyel7MFIkZpoCPRt0T4lkF3GW0M+CcR83jqagR4dBX8aEj0VReRPYtoqTfHH9SBWM00unzWzG4XGO+MzoFLyBl9SU9cANv+K21xzsChUxUCGgKCr7Fe7400M+U+G3pepI6SJ/VxuTTC063i0oZVmVMafdGYTbM7lsVGj/53PJzLiQOW9EZt+YiYNvPc49F9EpCYYXIbdTKb71NaP4bpgRKaWHx1cUnqfVo9zPqc9cAxEUEEGajwdCkcLNR7P+6Ws/SEKPcaxjoYeGqRPls8IaXFNqq86okIQ90wtR2BPr60tTR2tW22DAxHHngpGYPyl7D2TsjS3ok/E9kicQD2nl9P9VWZDzWN+3HhCYtMxrgb2qK8KYWRd6yAEmexU9Tc6Mh6gKRRhLBfSsDsE1hbo4TxqROtZwFpq7YAn7vvieQ7Pfz98fLjciInlDwmWTgp7Vkd7YLoMTBlzsNFXpxct5Gx24rNHMp13TUtfg9+mNvMoxIHFq5cR6GZonvPlTC278hiowgjkRTlQ+jgsQjgUeusy49/ytB9SNmSrTbtcOakepH3H1H7usedKbJBXcpGfohqd53xHs2dkno+lCg/kGzgkthbGgmTUsz/84x2ep0mVQC0RUQf3lyDeXko9szk683kR+aPw+UTi1q0X6A1u9A1PIKnB0+WpHQSfAcMjytJx9qYkvJ4drP99Y5olHn+JORKhKE80sHabpST6uVR6Ym6epjJop1MkFfD8Kh/NmsuDgz8kP9j/2sYJuusG5/DhX2vua4D2TCB2yby4uLCnXwazbzq+3A1F2FOPn2ynUZAnrKTNEBl/FfHLoIoHUl5rnlaIfz6VuSUWx6LafX0GZ+XTnGIfEv534/C1zc8b3BupbHNz44kNd8BVb+s6gqw==,iv:A2PVFa4J0JPsBh8LU1Z9KqgQGKWqO4hJ/cRTeznJY3Y=,tag:5gumadR51zYVscNt9SE3Jw==,type:str]
-    privateKey: ENC[AES256_GCM,data:qHNpyCmJ/2vM3COwzOqI2Wi4TQRHAI672URYPa7y5irtlBJoRy+hlBvHF+0+gAHRtx9cgFkspKBmxiC8M0VBYULBjVlYxlUySluRnZ9P1rv6Qj0Lv1T6kOrdGaL9VjEI4SWfYmA1/sFALxyZpCDm8oHhUPZfs1+Qd5U3nupLIyNsTO5aKT63MfjSTkLrrlnkQGW7B7Eyia+A/OVhAXaGMaXcKnCIUo7H+t2zSTeUQ6hgTkxE/sHxSyspvB9M2MHF0CtwwLlsyTNj9MtDE7NWwFxt2Hd7AXL5Ho5PhOrgwxp9FSFocdR4j6BPTYTMMgwFcMNOBb5ORveijp6qVA+KUNMBwezYp/TQnaC1DPMdcuh567SxRnstICIsSh1l/5RL,iv:z6DuPK51dBnJCyVI5wSqEqSLdqEXVnxlGakBBr07aYw=,tag:rjaVe4SrVghdG1zqiU1o1A==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRNVh6c3BaZHdMLzZ4NE9G
-            YWQxVTluVE4xWTRwZFdnOHVLZUwxeTBnMWlnCmpRNkVaL1dxSVlvTmExa1B2U1k0
-            V3ZQTUcvMldFZlhJaW5GNVdPakx0ZFUKLS0tIGVkb1A1TlppZjJ4TU83Q1Vld2V4
-            U3IzaWFmZC9oc1ZRZitwb3V2UXRFb3MKyViC3mT4RW11E6XmVVztMmJgm2NP9JX9
-            Bf0jGvYhO7Etg5O05NwTAy1WZLB68hqTHAJ2tMJD2934sJicWfg/kg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBudTg0ZElzdndiSGowNUxk
-            cmRDTS9ZTW9DVHB1dlNYZU0yOFdqdkRVUzNNCjJaY01ISklDQjc4YkVtSyt2UlFm
-            cWJGazNwdklDdTJvOE5ZUWl0VVZpV2cKLS0tIFVRQll0d3lKSTNZZk80YlNhQzlE
-            TXU1WE5wUWdhUnhRemhNYllHK2gyQzAKPuT00v8c2W1iSCx4nAG4XzCz317D3jql
-            ANYcLgmd47N8Jj+jssAPgoG9Oavj4II2NmXpLGKSDyAPtdrTqowAXg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nkpq8lr09vamgvf8cvzemqjyr3ex8w7azfupdr2gverz9j5zgemsv99t0z
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAreExpaEI4YmxLTE5jcTVT
-            dkExSlMzQmJVMVpCcklwRjBGWE1ZZWZjOGpBClVSOEtoUTlGVkIrN2J4U0ppSDdY
-            MmFoNnlzWCtOMDg1NWxQVk1QRzBVazAKLS0tIFdiNFJsWXZLTGpRTVNmRlRJWFQx
-            dUZVMXhMYWlNdGZBY01ZTGxsK1RIa2MKY5F4BSYaeSo7rFUc8DJ8HUGCkUSHwR+/
-            XTKp2FkXD38hFOC1jWtityqEF8vCMA/m567nw0adTCFl5S4vegpy1w==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4WHRxYk82ekZpVUtxVVZZ
-            WFRXR3NZMkt6R2FnSGh3bG96NHRub0EwU3k4CkNmcHdRT3BWTjRVdllGQmtqSHN0
-            T0wzV0xpWkY1UXNFSWtsTHVZTFdEMDQKLS0tICtpbS8zQTFXbllpOWl0Q3lyVjFR
-            WHpJNFAyeGtPUG1lRWdKMFdqNkNWeEkK0DcfsEUECFhSXPQvsmKx5gVdHyZMb5lr
-            XoKOFrrjJ+NtqxfyAuqKmt6TxpPvzgBLdnbmQ0CTG7qb86O3o88tKA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcHB3RVlyaldnaUJqOVpF
-            WDd2d2RKUmR0VnU2SEVvZWR0dnVPZklweTFrCmhhb1VYaW5PM2VaamZtWURQOGhH
-            UlBCV2J5d2xYNjN2RkF2QmxjMHcwNzgKLS0tIGFZY3NhWHhYZzBzVGROZ1ZXckdQ
-            QnoxZlAwRjQwQ0hQc2xrV2E3ZWJLL1UKwrILkzbDJlUdIN9un0RTGNXPzmlddo7r
-            ThuBWigFXDscsIHkwbhqfWPJy4YGcVnhYE9bfTV8k3AWAljWl6kL7w==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-09T06:33:41Z"
-    mac: ENC[AES256_GCM,data:VoNIfkIOFC5EZ7s0Zd4SD0RGLxyGmZ7VDIMz4c19Bp62zsvo2xeXp1z2Q/UFIt3EX8Tr1txRWawDmbImTYNb7Tzk/QvE8NZswDnRGpMloo3aAHT6acalm5z0To7jvsCZnLyR+3cwH9RGuMx76CNbyDrpSbrPawFjj1LAfsiXyvo=,iv:sOU7iOlkHKWRuKSpb6+JVoac/L4lDd2cILV+uoKzOnc=,tag:GTwHnF8X9+TSm7ZjWQI+zQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4

nixos/hosts/telperion/config/bind.nix

@@ -1,4 +1,5 @@
-{config, ...}: ''
+{ config, ... }:
+''
   include "${config.sops.secrets."bind/rndc-keys/externaldns".path}";
 
   acl trusted {

nixos/hosts/telperion/config/haproxy.nix

@@ -1,4 +1,5 @@
-{...}: ''
+{ ... }:
+''
   global
     log /dev/log local0
     log /dev/log local1 notice

nixos/hosts/telperion/default.nix

@@ -7,7 +7,9 @@
   modulesPath,
   pkgs,
   ...
-}: {
+}:
+
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
@@ -23,9 +25,9 @@
       "usb_storage"
       "sd_mod"
     ];
-    initrd.kernelModules = [];
+    initrd.kernelModules = [ ];
-    kernelModules = ["kvm-intel"];
+    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [];
+    extraModulePackages = [ ];
   };
   fileSystems = {
     "/" = {
@@ -49,7 +51,7 @@
     };
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
   # Until I can figure out why the tftp port is not opening, disable the firewall.
@@ -116,12 +118,12 @@
 
       bind = {
         enable = true;
-        extraConfig = import ./config/bind.nix {inherit config;};
+        extraConfig = import ./config/bind.nix { inherit config; };
       };
 
       haproxy = {
         enable = true;
-        config = import ./config/haproxy.nix {inherit config;};
+        config = import ./config/haproxy.nix { inherit config; };
         tcpPorts = [
           6443
           6444

nixos/hosts/telperion/secrets.sops.yaml

@@ -1,63 +1,90 @@
-1password-credentials.json: ENC[AES256_GCM,data:LhPG3XyCRZobdAN77ATiEy+A3d8P+1E0+lS8JXbvY55v/qhXk0xNUMb1KsBjGazsj6jq2j4u0dq55KmTDWckC5C7MIUzI69bbHrEtQ8c/XgBo5ulmsaMgkRNjsXMJ6h318/M5XC5wd/MhWz+80eWvnVu7PI5E0Ar77W+KeoGwCiaZ7oQGoE+e5TJpNlOhtiMNfjtmUzx7L7D2JNB9LhA21Y6LcLToGVm06KguHMPZAK//3fBbJfw7nbY7MHJ5tYCu20pUF2eJWnRcB11QDqPIOszJ/tKZ9JQtXd8DBmXKgrjeOaq0Y8XIgTo0co5gcfriQQ7SC/m0MWE4LkoGOpmbdw+hZhqfIVOl5+IXwXkH2EMn86gJTBxdgtPXz6EPkuPSNamO+uh5L9vjodFcCKZVZnW/QvhzxYaRErB5hbSJ1PrPIRcJsnOkDcIcBtW4b3qvjJtewvX33RDd7qEIoqd71jNOEyxeZgidpUCyfA9bHLVb367DcwbCB5jZ488ZvcjbcEXuvPkQfZ6xR49vuijff03thN+Ob3kQI7ofcasqbRO0eKYEQQapDaTz9IbraRf1z3JgQ+o/Brh8LHxEBgMQA/GwDGz4n/wnMczylH2O/ODsjkI76kYk7qLR9Z+8WT9tazrcPrBs/scuJSHu5Sl6c8K07HN9W0jPnD8dAP4J5Pl+lxpS66SDVfGImYwjuQjfDF+RY7A/UP0iPxdklkfLVQ0Yu4Pa+8Y10YAXY8UG1NQW51REobTGIEF6El6/pzfNElqAdFG4+5JNZF1/4IXWPVJQly1VstUY9D4f+0Z+7X/eAdz7VxWjI8hOSGH+jPbylXe7eNQZdhDZ2PNfoqGNsgLZfT6AcBtLR8eHZlAY9O139YsSzPqae7CRP4TqX0KwUQHiZ1OWh+zG/OFUEPV/IiaGi+aUcfZzzz6mVrXXsyFosDtaqf3HYPcMuhJ8YiTY5g1/OK3EUDR6CBOENJf/iMjC03OBqf5xll5Bzw68pcX2rR8kkTmJx9mWE6SRxqOpVOxNZQaK2O1NrJxBQrR4/b/Vd5Sct+VvT24Kh3eue7+LhKIzJzh499sJ4PgNJ1plbRDzKpfj2qH704xj7YzqsKPcKIq+VHQQakQ3VdAOoMzo7RXchVh2BDTp0I4GljUOoOh9sv2DIrjmpnN5KWwAk7gl1zkcc/DPEqa6UN8z6WVlTIC4pHGm68IyRl0HV34owyLEezGcoidIu7t+AwZZrD4SRHFPFCoFd6ubbcr2/7xZgRaKqGU/82hUEjR/SrxRQpjeN9Vf2PAAGDbVsZGC9f+pthMamlD10oZzfamf9DliYdF2aNH6/IR6IPVBTbUoLuBDbqJH0lPtgLDqmpoS4t5cGvmmlGgjm4I9prrV5Ogz0ct30L1XW+KfxT5alnGZsx46ZaW6hlgmkGqiUUHhUuxW0GT+16UxOQLE/sZVgg=,iv:wPy/dePJ4x0IdPyB7ChN0B2msEAMcAuM69liIOaumZE=,tag:0CA6RZZ8mkDM9gCCDevM5A==,type:str]
+1password-credentials.json: ENC[AES256_GCM,data:mPnJtGeZfSGnMjiJsUUfTnKwGNtuPLK/+XhGTrztiQN3bPh2EFtOg18nihsvdI6klWov9OymwATput//StpRuO2u9XtF3ayET8m8qrrldELi4IGujEBp5rmQ3DIeknhJCNGRscYDEIbRcSuVjPRIJtN42njOOr7SSvJzw0o3MTPwfJrRedOeAbvVLQ5+37JGGvS4mvfyZXXi3LFhmWPqWFyzGCUdaDJ+pBwr6Z2JY89votbh2JaTp+kRIgWm4XI2oi3sKGD+kbORHoVeCS9qzUBdGmGvmqNXLkAYJvOMGk6lT2qaMlN9/6ab57Ob9YBT5qb5CxBZr+JAk0/BrjVakjvf+gS5JFehpLkx2yTllhbcD+GvGu86m37HyMi/PZefxeO9BiGdUhpAapuQzGRk5E484ClbwSW8D7SylKPkTU1gy88L1C2hHbdJdBsTL4r9bkwAwLEuRNri5t0QXNjKlGLtWM0FJvRJC1NkBPwA5rc0Vl7d6Bvf6AV0WQjD0qSh8FDmu2ouMfRJQ6ceM654xQTt6UfVxDJV1AxFEB78rIECuIfkPyMf9GG20l+LdlACHLTBtWGWesjuWag22ONwDsopX52ttAHkMslttpN2PA5wrtoy1KS8mia9BvvdVVv9ykURjYISn85/oHgiw1nCYQQlgPVCb3fmrkQhSZinawIBvKz9xB1xA5JVBuHSOeIzZizkh1S2T3QlSllqWpdHFVsif4gaEfFq9h3DVDcr05sTya6/SV3A1Lv8R5RkpOSO/T0w1Uco8EcXi/ZyaEvQ4v/oJGJBJNiTJI8IEMx8s59tZ660SmefUS8BLVlSxhxJ2PdON2lEbMcva7FvvuRNfMfXEv7psDdXDUWIxPfwsn+llqrosqcDcPNkS/ksVC5kCZlWCxgpnGAKnUkyV9KM484O3W/tVzE5qmUPRUse+bIJ/CX95qK6oSWDK+lBICTayYdgHHwiMJygXUDzWlS1ulL7UyX6M30v7I/WUMNFJ3IeCVuETkNhttP8WsyyNPv7Nh6qSH14Yaz9+EpBRvY8qU7IbNXfeNq6MkMn91l4Mlwfo38AExJ3jtd6ql7eOTPFJYbwY4y4bdkF0kLx0eaw79aLE/fcsnfmxE1zsu0Ihn7NSu0IYgOPsp2t8JS95jVqSc0N6cfCUo4/N6YYfpDsfiNVCAz6poqIHAWo69oD224xAz6Qx9k01/d341KHC1GhjgZ5gdK0caGhQJ633V8w6v5IBR1Uz0Q/F5/rCfRmFE7sCWf8eqMoQaJ+CpmEvdgQpl9Zao1LSObJjk36X5R0YLY8Q5lkh/di0/E2KEDgcId4Z3gBHvpK+TKXJR3ajF8oWgGJO/o+WfsJstyJqcTS8uxWiQaG6vBkomrujEmwNu7r32Z4WC0NBI32TtzT1FOslBEIsruosRJ0gXaDBaXCQuycJS2NFvDZoOdDW6dBIKg=,iv:uyFfI8iGwRHBbVS7zsyAewFlaHe38enW5sBW+J/ipG0=,tag:cZy0HBx64HpRCdzOnTDS5Q==,type:str]
 bind:
     rndc-keys:
-        main: ENC[AES256_GCM,data:HETQLs4FDXeZINlCSnGYqF6Mntd7EurCRSyf5NIAz2Qmq87IAj2TbvesC8PnIBXMul5Uj8ggDym4xO6Qcoq6KQNfCtVOI/TaA3JYZbIOmNWZR82LsWwO77hd2kx8U+E9K6kFtBbV,iv:WGmWjcW1RkOWSoBjrbkyQkDbI6yYB7hakOrmXo4Q6eA=,tag:CfAe/x+HOu7tf0ZY4HIB/Q==,type:str]
+        main: ENC[AES256_GCM,data:2K8QGlLH4TVdqUh4Qx99+/IhBqEldfdEnuVxzWrSiJpCXA8IVD8oQ+43hvfbxTG4Q5Jx1T1dx1VlQLjOikWhW0feYT7Uexn7Q+qNb9il5ioKoiqSHGvPbiy8KceDx2xHcFGquhN7,iv:ibeYbWtFCq0MGMbwIsNrjTTTrqio8gdrEvTIkBHw6+4=,tag:+59enmEps91uROm2jjtm3w==,type:str]
-        externaldns: ENC[AES256_GCM,data:5kIBIpRYdGmBZBvwWSIufUzAs2Z+9scgMQOMHtDLFgcQ8OFKYbKlOQ2+G7exo/YfrD8QQfbPjHD/ScQbbs0SyFYhx9ivX2vizyV82uYqZ1hODKBsMHCuEvWMNydopbT5/vobKCnAER2T,iv:AA1uUmyTxfovgRnvktRQxmu2Bj5mStWd7MRrvUaI6LE=,tag:NPGhBf5yBbTPD63QnBA9PA==,type:str]
+        externaldns: ENC[AES256_GCM,data:yRNBvr/dq3+2MFANmtIvj0iHZ0Qz705VxA1vg0jl9IkYZhzUtwUlIJF25vDQCsS30BzsXIAQgfncoPxMnqmswoH2Cd3a7W2Pf/Ck9aDMKaCSNJYrl/D86Crwq8nhMJLiDyta7zkwkMTE,iv:V1fQB2zdL1ReBY2f5ofwJju8zrxdh7yxbGCKQ6p29AA=,tag:Qn8PQcTJ4it092qQyAh6gw==,type:str]
     zones:
-        jahanson.tech: ENC[AES256_GCM,data:HGvI3MRQHHwFW+ElBQJNuItKP+fi59ZXepjzY4IoRZ3mBDEORBMTreCk6i+HlM2GouVhJo028Ilkl6P/i17O1LchTUcK+NZOkJukIdd/WQknusZOxoQKhRYloyDGa2IYe4YzQDtRd3vrPdHffEkZcRvd7KF7EAYROMmWk6OSfasf1ta3iHQe6xm93Ql8EY1o6oqhjlS31w5XDOMaNvFkJF7pD+C2OQ6pGORYxv0ePH6gDr56FBPI1sZStDQtFFSrJEDKyuR+yrjhpg/fHnxa6XIRASSBSrOIrITE5VACZpuXB3hcUT/4BA+5P0GDayDuZv7ODw6NUPqBxgpgypfaUZjNwJl+MaUPbkFaRECZexbEwvNCl9/xEruBKlbhl2jL4CKLGKaNOSukYq3Gskcqc3qkvQCWEucmMguShSBv7QOq3l1sWOlbHxEQgvdLrZ4cRI0bUQCxk5xO7LRgodf8ACOZVrdHInsARuvX7r2mzGrYA7a6qPXpJOhE7Rai7mg1RQdabJ4i5nd0GSJV9WWrGH9/0yw5uj9f6nwEWuK23gkxK+2B7B+nt703WbDfDmnWNjaxHHz++IBxWiNLUFPGVt9GNx3VpMV70Y9PY5VmL4O8L7Fc+3TcTz+bG0pbWrO6MpwKdieWxmeLLn/blFGzd0acQUtV4UCv3lYjqofCDbfS8S/ADE93bcuxxnsVDwoVVnmWSOsXkERvtrZ9VggeXODZCwPhSbUXXYyF/KNmChbpdJDBbfTPjlWPqy1423SCi6TTX5xCNAbl1JL/2aTVCGOgQ2+QfSKzjbjSsp77ZzCQNWVMOenvSYgb4D98QfDOcukVs0ewa06CxLBEycjq2T6XR8+3/JMPDElmDVfdaOscW6QcpJXJEeWRU0kujHWoaZbmclgnmhPMcoMa5fuC0/p0+/DVOOn4ZINGGdAGy57NVUOOtyLYZn1J1F2EZAXRITRfxHNjHLLsuj8q9iCs7so80LUHejfKjqer8TGLLT948Vs3+Im/iB7dE7k1QmFxVd2lArNFFlPj7QsLtbM7sT6Kj8YRjiSoGer0AQVjkKewSIxnUH+n825Hc0efBFBYDCAN36LwF12FNB5+nTnI0fKIvV/N,iv:GYlqE0pT3vaNufSoM/RZNTW4j5IZHUkKj3KUdmc6ZjU=,tag:89rtkSyISHDzhDtF1VTuzg==,type:str]
+        jahanson.tech: ENC[AES256_GCM,data:bCg54kzMqGJdq6+adMz59mfbeIVIoP9qmyFi0uoQX0KTCKU6XNX3FCzI0ludEfUrFtKqjdbmKJzGJbaCTVyL5yDBq9VFtFnBPeaTG0TlzKxO1VBad97+OqSJge5ZlpeNgUR1LUkHa+h2IkNRjde7kIBVHu8hpOqGpXI3UKi+FSYAUiIV1PKLzVh9pSiLp4kL8K0mursA/wSPzEaZ782FFKwIlXMVoTlWgB+tGIxanOekLpUMRaGaUktSJwmSrdSbs1Wn6/FVdWWjiZxHcDL9BU9RyiTyUh9tT9n2mMk7PICihrl5RINObVqi1tssqivN479NCNnXqeJ9wOJdsDZcVdI9ijGuJzcYsAeH2m+zdUGGiMFVRScdtuxgVqEOg014xL+FSe49X2ZXI41Gt3cyWIwX9HHdFMdzTeL/Si2V6dWmFJpdfA/k5hM7UTIkKYgCKeyc0ymZ6xF21pQck7OSTddcCgMBGgk1acfzJgxAzrLD9MjEVWzCdyYTzW0dWPOTcCN7ox9MCrHJWaIuGbgsZuT+Pc5K+/UrXHETidh527wiR/p5I7kozZj9t1u+gT5SNL9sQg3zOnWq1qL+WDWuW31tXR9vlE98T3ZvRHJOiXYK7eYU97ww1hwa09h92lmwkBWNMNL2ouNNLHTDTevCT+1KjLSWlpo3XjwVmk9RfgAbLrQtPIK1C4Q44WZ59f6l+3daz8EmGy+9aXoCW8bfk9bR7O8su+UO5gCHHp72mWtWpE5z+TRMCPXL53bw0IXh/H8Inj98KP05ebpIXvfbnjdfUFA8ujZcJMlvBCUYPHg+0gQtiANfzr9FbUcHVwMHamWww9EpQ3YGmRG/LYY8kJlPRvLaeg9e6gLbz2l9/GM+G5BAMO1ZqaxyOlQ6/J1bBY0WKQDSER1f1W8U/EAi75y+s3LXz+Y3LU9wmmJ7qWeVULjszlaZr+W0NxkX1Qh+ys/ffV7j+NMwa4nNyC1MJnsjgBzLNGxp3fpcCZTqApfZmCbvz3yG65pTDa7BfTsYy596wPec+kquBGYTVnNbg2oXzAPLV99nzJRISeCBtOiuwbIHzbLIEI820OPdMnA+PWAPRWXMIqAq5PDpsZws65pY73Pp,iv:bck9vjCWvfx31ZKNwfkaSHazIKRvMXX//E2hG9lNNFY=,tag:vrsZ4v+LtsuYZH5XCnrfcQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age:
+        - recipient: age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUzhJTjZHYnRkNC9tQWJu
+            eWZxKzUvRDdoTVVKcXNDRk5MTmV3Q2RtMEFFCkhjY0pRV2dRYlU4R1ZzWGkra2hN
+            YVV0K1g4bmd6a3phVW5tanUreW5tY1kKLS0tIDJOUzViem1vRTFPWXFJWXdQbjZF
+            OW14UDNGTlpQZll3cGVVMWQ0eGQ3clEKuPbfceFH/+MChLOiA6J/LCGKce/k45aw
+            w1KmPaBfFEl4kAAyAXe0qVypNmzQsVh0rdPMlRq4Fnk1EbnkjAlMyQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQOFN3TU1NQ1R2Rk9kd1FZ
+            cFprUlJUajRkK1N2S3JhSERLVHQ1ekczWmxRCk0rMmRrNjdiQmpnQVJmdHM4ZitL
+            V3JVLy8xU3J3T0ZiMDY5dEN2bW9OWUEKLS0tIHBoeU1RbVhsMU0xMm1pcnV3bHA1
+            dGpRU0VvTU8wSTlva0VzMkZVMkxtUFUK1/7ioFSrAsuyRJkk3rTnEy5xbq2q19xW
+            5bE8rMfyOBRVrqIUYooDnR1OCpnfD51D3ro80NTfmKxVhxoTH9Miug==
+            -----END AGE ENCRYPTED FILE-----
         - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzSzIwRUNKSnczYm1Eaklo
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBORGV1RGg3WHRvWmhzRjkz
-            dzlSckxLT1FHc3diSy8rRXBIRTJKUVpkaXdVCkhHSXN3Z0FZLzQ3TFpiUWFZS0FZ
+            aFJOUTVHN3IvdlVHK1QwNlpPN002T1FOSmpFCm02T210R2FYUlcrL2h3RFdQYWhY
-            QnVHTEVKVHNXWkdvRTF2WFJlRUIvNEkKLS0tIHo0OXZMQ0xkUWZyZExEWHhiZnRm
+            NkZxZVpNU3JGNCtWNEtIQmZhd3RKK0UKLS0tIEZudTlEbEFyQ2xOcDV6ODkvQkNz
-            SXBpaUNvWFByMis3dFlCLytRdEpIOTQKDBKJ+gvF84j2KOfPniyjJbmrh7GxgF3m
+            Mjk2SXFka05jYUNBNUxiSll5TVp6cjgKRK1errmBICcb3irz4qysjkd9rYH5K5Tf
-            DLhPHMaRkaQkWZaLTxijyAXv680X2vCFdBjRPA1fQMz55/2m9OdnPQ==
+            l+fTyGb3U26dlvP4Krlx/6dfH76NH/ZkvJ3E11aIvXAhu31upzALgQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiRUhiT1pHa0dYM2FPQlIz
+            dHBadUlLanhYdTB1bjhnQWdsbHllOVFRNUdjCnNyaW45SUhydlErd3dRYnJHa3lD
+            bGRnc1RTdm55VFZlR01icG5NNWJibG8KLS0tIDI5WjBOL3p4M1k2ZWI0d00weHpJ
+            Nk5CeUY2M1VrZm1NZkVRa3ZMbDE3a3MKAb1sjdyJTVu3h52xEqJedn2MdNaFryLX
+            gZOMBhtz4fac11RZC3nFA6RDra3KddQsad5lwK5JOeFFRi688x5cag==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNmg2R3V2b2ZLWGdWSGRp
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2S3VPZHVrbGoxVUVldnJX
-            bGpuWndqd0twcGdkT0xTWEV4MjR0MllhVG1JCnM2ZnFWcHEvb1U4S2xuRzdhMmFP
+            L1dNL0JaRGVNemkzZkMwaDlOQ01RY2YyTmdrCmthaHRYVzV1Qk8xOE1aS29GUDha
-            b2pickR4ZER6MWZHUExyTUw5c1VXR1EKLS0tIEtndm02blQxUlVEeko2SUxrUG9Y
+            MUtlZ2FuVCtycWRMbWxrVURBUDg0dlkKLS0tIDRwSmJsN2FsVVpzOWV5WnZUaGkx
-            am1ZWVlFdm5HNWlhWkFQa3JLV0RCUGsKvlCCLWWui9UVDvI5P6qvSHFGWcbLByFC
+            ODcvNjl3cjE1Nm5DRHhzalRVUGdjUGcKOMfvjsP04O9UoRpyGncQ3Hon91rvXUH6
-            nX7x8fWBxaqF3wK32ndmVMBO6jlPVXcv6NsjpdRpbDxx1iMxFqc2+g==
+            fM6BWVEoH7tYq779YB3qEt2lh5TN/DDd8/ROOx25a4hL7F0/zy3vNA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nkpq8lr09vamgvf8cvzemqjyr3ex8w7azfupdr2gverz9j5zgemsv99t0z
+        - recipient: age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRjhpUXlNUmYvVTE1eklI
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArSzVyTE44NUUzLzZVaDl0
-            OEx4VWNSMXFuTWxIZWZTZUU2TFBYNEZUa1E0CjRzL1ZWc1VlZ1pxa3gyREUwZE1I
+            TmNWYWNuK21mS1RlTy83OFRrUlZSU1FYZGc4Cmx4eExyY3o2OUhmeEdoOEtNSFJQ
-            SnBNTVBQZTU3T3hHNEd1TlVYUkZmUVEKLS0tIG1SV3JUM2tlVVh5Z3B3ak5CNnhF
+            NUx3cnVBVEV1VGgxTWZFSmVoYlJtQUkKLS0tIHRjZTVtKzByWmRJMnpxNWo3RjEr
-            TVhFWnVON3hCVE8xVGRTR2FoNUF6ckEKA3Zy1LJoc+Ij+6nwMyyZ0yVycfpJEtSD
+            NCtmMTNmUWNkbUlIL0pEWUxCVk9XTzQKIxVOgsWjLvKwKpKMFQnkt5zzFMJ1P1AE
-            icqaVJyssOaraf/GjWC03bLWUaIbGg6khBVBvsetS0m83wPeOwkmYQ==
+            XqsOg5bKN7Yzw771PZ7nYPIIvsFPqznVARKTPxnjELjSUqT+VrJT/g==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVk9jNkx5WGFpZjFvdFVz
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpVGNIeTc1VFRRZjB5Q2tR
-            VVVwZ2lLU2lxZWp2bWd0cGhJd2kzQUJFWXdRCkFoOTJtRk9OMEtmamdOL2thc2dw
+            TjB2T3BRNk5xc0cyTE9KODBvMUdkOGxyN3o4CkNoYUl6QVhUN2dmcjYvdWRFTHpT
-            bURQRWNwRzBVVm82b1pKUm9ueTNDMHMKLS0tIHMxdGVQVzhjQ29zYXljUmNoTW1W
+            SDVIVmt3VFk3cHd4d0F2RHFkQ0lQbkEKLS0tIHNhaXhEbmJlMzZ5aWFZNWRRV25O
-            clJScGVoRU00Z0VxWWtSMmZPU3VwR1UKB7+fV7RD9MoiOzgVmTtWyPG+9G9i/VYk
+            emh5UnZpRC9MWE9yWkxNYXQwa05kRWcKbo9ONgyzMWCCkG17nIRWOUkLR8WtPeL4
-            4AK2BSXVJuz8Zhh82+xh04vh28/mT61WVWPMWfVryPuPELLo56HNOg==
+            U4yF9SDKtdwIJKuC097uIEXvF5blEkhf+5Mai0TMrhq+NMggjP7M1w==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1OHBQZDNvSDBVK0dReDZa
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvOXBwN0JoMjlidmVvdHB4
-            Ykpkd3lEWG9zKzRIaHlNL095V3BaM0hPNm5RCi9pYzN0QVlHeVRtTFdQbjlaTWJp
+            QkhqaDRjd0t1SEl1WllVTjVhMENJMGNoK1FjCnExSkJzanpmdWFick9BZy9BMDkv
-            MlcyeDlpTGx1bkdJN245Y2xwaXc1TjgKLS0tIFN5U2xXK2RDcWpNRXBQa0hOVE9n
+            UGV2VTlsL3hZWllkdlcwSGc4RlZJODQKLS0tIEZEM2hTZlN4VFI3Qk5JRXErUVNG
-            cW52OFA2UVR6bnJhcWd2bms4VE8rNlEK8M0dEF85yzzkV1otG0a++a/TDw6n4zcN
+            aUdDTlg0Y25rZHVwSjFnODk4MHZ4aEEKxYeMCkODa2JhGX3zlpmDJ+sbXD5T5DtT
-            YGbRLQTRfwmXgvX0cjU2lSU9tEtdSvHFHNcTLLOo+tbGNg2K45moDg==
+            Iedq5KFLmmvXBOu0sXlVdO+G0/qBgl/5t4pwLFDCx+qsxZgEJkUEMg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-09T06:33:41Z"
+    lastmodified: "2024-12-27T09:27:41Z"
-    mac: ENC[AES256_GCM,data:UaQJeAhm6uIBAG6b/3UQvjTUPaOOVipwCxVJS6PqhGU1xcOL+/9jxh1ULpF5rXArhzLgTSCOIAEj5d7eMkDZVaBtvcdRyEWSqc1J4dD4I/kjFZBW6D6pews9YV4guVIDA49Sc6zFAl8NNzZW116FuUpqPfbBr0HjPWDVP665ZJY=,iv:VDoiyZGFrt3GtUqlFCvcQCPb7u7MukcWyzCKJ0rZ0Qo=,tag:FnV0+6DGc4WZ2oyPCQrrpA==,type:str]
+    mac: ENC[AES256_GCM,data:T2obxwbBbBiR3dPq3wYzrGEMdzUKZ9F5LJSDlG9zlECIsyYdlSCx4n0qrhOioNYpjwUNCGoBL0EH11cmTlUzpV/mA8e7oW2oXbVydP1xu9p8LQHtTO8veLPqfKYqEL6iCF/6iJWh/o+NYCAHzp1BWGR0VbrF4QBgYWSPRjy9HXQ=,iv:cdu2Y5OQ7wpLoAXWP94hU+syjqYhh7Z2G6ezgdDgGRg=,tag:/aHcyP+SmY4SQ9L+sEsemg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.1

nixos/hosts/varda/default.nix

@@ -1,9 +1,6 @@
+{ pkgs, config, ... }:
 {
-  pkgs,
+  imports = [ ./resources/prune-backup.nix ];
-  config,
-  ...
-}: {
-  imports = [./resources/prune-backup.nix];
 
   networking.hostId = "cdab8473";
   networking.hostName = "varda"; # Define your hostname.
@@ -11,7 +8,6 @@
   # Add required CIFS support
   environment.systemPackages = with pkgs; [
     cifs-utils
-    minio-client
   ];
 
   fileSystems = {
@@ -34,15 +30,17 @@
       device = "//u370253-sub2.your-storagebox.de/u370253-sub2";
       fsType = "cifs";
 
-      options = let
+      options =
+        let
           automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s,user,vers=3";
-      in [
+        in
+        [
           "${automount_opts},credentials=${config.sops.secrets.sambaCredentials.path},uid=994,gid=993" # evaluated and deployed from another machine
         ];
     };
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   # sops
   sops = {
@@ -50,49 +48,14 @@
       "sambaCredentials" = {
         sopsFile = ./secrets.sops.yaml;
       };
-      "security/acme/env" = {
-        sopsFile = ./secrets.sops.yaml;
-      };
-    };
-  };
-
-  programs = {
-    # Mosh
-    mosh = {
-      enable = true;
-      openFirewall = true;
-    };
-  };
-
-  services = {
-    zfs = {
-      # This helps a lot when upgrading
-      expandOnBoot = "all";
-      autoScrub.enable = true;
-      trim.enable = true;
-    };
-  };
-
-  # ACME (Let's Encrypt) Configuration
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "admin@${config.networking.domain}";
-
-    certs.${config.networking.domain} = {
-      extraDomainNames = [
-        "${config.networking.domain}"
-        "*.${config.networking.domain}"
-      ];
-      dnsProvider = "dnsimple";
-      dnsResolver = "1.1.1.1:53";
-      credentialsFile = config.sops.secrets."security/acme/env".path;
     };
   };
 
   # System settings and services.
   mySystem = {
     purpose = "Production";
-    system.motd.networkInterfaces = ["enp1s0"];
+    system.motd.networkInterfaces = [ "enp1s0" ];
+    security.acme.enable = true;
     services = {
       forgejo = {
         enable = true;

nixos/hosts/varda/resources/prune-backup.nix

@@ -1,10 +1,13 @@
-{pkgs, ...}: let
+{ pkgs, ... }:
+
+let
   cleanupScript = pkgs.writeShellScriptBin "cleanup-backups.sh" (
     builtins.readFile ./prune-backups.sh
   );
-in {
+in
+{
   systemd.timers.cleanup-backups = {
-    wantedBy = ["timers.target"];
+    wantedBy = [ "timers.target" ];
     timerConfig = {
       OnCalendar = "daily";
       Persistent = true;

nixos/hosts/varda/secrets.sops.yaml

@@ -1,60 +1,84 @@
-sambaCredentials: ENC[AES256_GCM,data:0caF4cBW5TSn36pZQmcjHbM9nrFGF55HmPVD4HMea1Ul7A3y1HHz0Pgl4rrYzdg=,iv:OCme9i0tHhDbypits5TKfsGXnblYqBPouhwSVeu5q+M=,tag:F9zub18fB0zZh5ssHal+Gw==,type:str]
+sambaCredentials: ENC[AES256_GCM,data:/Ghze4VQ0RKyTKZAh9T5rX37c2l+W44bayusTSHzU9jBviThWYHJBhPwgnpGaqw=,iv:3PvwXwTpQTsdKL/jqbOs0z6ErnWjY9YW5yQylUwtBMA=,tag:ecaNKAytyCC+eveQHiOtaA==,type:str]
-security:
-    acme:
-        env: ENC[AES256_GCM,data:LMrK8IIpx1d5Jl60VHDdwVLm4lyFDSELX1pF9wvFrNY0OJZ1EuHQ7Jgtf1wZ/cNy3XYFRxD9lEuNPJd0UN4vCw==,iv:2WEiipdYcsPX4frAvO7Iyp8zKWtydYlaPPKBd/1SFDM=,tag:G0Va5OcgSEO5E+m8jxsrFA==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age:
+        - recipient: age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WXpsV2xYNVdWMkNWZ2NK
+            bUhCaXhpZG5GeWVXakdySzZhNjdnbmVFNFY4CmZiZEZDaDJSdmFCS1dQZ053V1lF
+            Z1ZBa0dWRy9jMVZkYXJlLy9WRmIrREEKLS0tIFFLbEhxaTI5OXQyRFJ2bWF1dU9U
+            WGZxd2dSZGhOVnBLSUNwaEZlMEFydzQKVG18nJUQgS0w69l+x2XD6BA9IEYra4E7
+            Wr7GURRrSnS19eqpJR3NTcVBhRO4wUxaj8Xq+nJ54Duik13X1XXdkw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0NDdTNHlnSkZaT2s2TTVs
+            MnlSSXJFMUdtQ256LzIyZVJ6eFluejMyYmlNCnp5UzFjelN5bXlqRCttMTNiLzg2
+            Z0xzWGZmK2U2Y0xzMlF6QnUzWmRidWcKLS0tIFB4YmJ0bDYzS2llN1RFT1Y5RE40
+            KzhXQ1NtbVBWbGxGZjVMRUsvVnI1aTAKxdac0X3IX2HcKtuGHfqJn0MXhxU8bdGw
+            D1RbcNR1R+uTwZ1IYLG8l6YHXSYV0U6wtv9BuFA7k6ayTA/PmziI6g==
+            -----END AGE ENCRYPTED FILE-----
         - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZjRIRWd5TnRJekYwNFNU
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5U0FjbjFrOVd0Rkp1TDJJ
-            SVRrYUNRandCbTZuN1FlbTQ3cUJPVmx6L0hvCnN3ZXo4TVVqT3d0ZUVBdHAzNVdx
+            RTgrb0Q4cENjcEljTEJZOEI3NHZWVVI3S1dJCjVnS0JpL0dFbmdSN3Bnc3J1cXd5
-            TmlDZkpxekV0R2ZTejhlMERqeGlpY0kKLS0tIEVjNENWd1FYMyt0YzZDVGRQZGRD
+            TE1uai92QVEwZFZKU0VUUEwyK3dyNG8KLS0tIEhZTG1kOWgzU2lCbkcxUTc2NHZH
-            WG9sZWpoVmsrTUdnM1l3R044UUJmVGcKiYd6OSj0vPSGpfWDNBeAYMDp9W7Yvmip
+            VjdjaEsyT1B6RjdsZWpVK3BJaU1EMlEKvOxJ5TyUYfpvCwpGNQpL+munayzBye2+
-            rqqt+Y9/ovF/yd1hDrM8nWru0W299u+ftSvwi/phxkmTBvK20U7Gtw==
+            aWKwNfbJS/0gZy+YpdDRwSliiOMh+DKa0rUHCDt/t79+Bhq/1FEpjA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDL2pSS2JQeDVDa2EvMFhx
+            OEFOT0RvUXdpT2ZYcHFNcmVxYzM1TS9lWkJvCmMvRE1ueUp0akxhVWxtY1dLTmRC
+            M1U0ajdjT3ppZS81Y1llQll1UGg1emMKLS0tIFFMTEhHRmZrS1hVTjByS3ZmYjJJ
+            Y2VtanY0RU51N2FFRlM1cVhQWktuSFkKRHc3kH4vvDFgFETVDSWZLES5lfWRcwVW
+            eQs/glxlPh6yUhCutuEvrIy/fGwNbVaJsuud8jqFMemggt7x981DWg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRmFJZFV3Qmx5NW96ZW5Z
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBreXVOaSsvQlBsTXB2dlUy
-            Ykl4VDN2NGZGVmtJZWxIQXpoTlpqajdvYnd3CmlwWGErTDNBdHhHeTlXQWYrdmNu
+            VlNNMHhNTVFEamJBMTI0dDl4ZlBDSVNlZVg4CjhCNTlIMmdxUjJ0cHJuYUJUT0dV
-            U0h6cG9sVXY0S1IvQlFNREV0TVk4U1EKLS0tIGhWT0UrMDNYTmlxSkdHRUYyNmhk
+            UWFLNnZwTzVrbitFZTRXVjREYWVlSjQKLS0tIGMvZ25UNkttRTU1dmE1NThBVUR1
-            NUphaExURXRsMVRVVTI0cVBxVWNDakkKbUZ1BOpKbi/Qs32bMhKa2YN2YFHaDlug
+            eWdMcy9rejNncEQ0T282QXpsUU1RWHcKJ5b/n751BlLzhsJNxRjAhMuCOD8ed630
-            ywpwdGaa7IGNZbwN1bKJVNDGBOGXxX+rSqueK4c1AXwGtG3HfAVApg==
+            urmj6eX8piCSGOgChviahqEpyrlhrs0WJJxlJyiYWjQ4e0HRgHZaMg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nkpq8lr09vamgvf8cvzemqjyr3ex8w7azfupdr2gverz9j5zgemsv99t0z
+        - recipient: age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4OVNLRkF2S0RyT3p4a2tT
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZDMwKzlLUnVJdW8zbU1L
-            eURkOGkzTFcxajh5eHRFajlkYmdHQ2xBaVgwCkNqTm1Pem8yVWJUSEYvdnhTbjZN
+            ZDBBMm1zV0tWSWxZSU51NU8yS3JNaDk0T1hrCnpFcy8rVUViODNHT0pJR210WUhR
-            R2h1RG4vMytUZmlFYzlKSXMva2tnYmsKLS0tIDVlT2dsRDRNQUZ1NklvT2Y1YnR6
+            aXp5ZlNENzEyRjI0TXducXpKN1ZsK1EKLS0tIC9HZW9OTnd4WjYxeXNuNDVQeTZx
-            Y1JkSXBEN1NhUUxUODhDS2J5eTVac0UKPR1qGMm94p2sKwXmCHygxZt8mfXJ3hCS
+            LytvMjhzTk9NUVFUckJ1MVJhK2MyeWsKJALG7c/heYITQb/EBTAAQCCr4YovGqsH
-            El5vgLXuzuE/qNB2g88j7bNOBN9g2Mxs2eLNdUEWj8tyahJ4BOTtWw==
+            Y6FhDlwUsPn8SHmHwsi0haAoc7tlMKN6Mtv4MyJ6rSbCBo+c6H0n5A==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOWQ5WGdrNWpNWEFpa0Zq
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlRU56YlJCcHdxQUZ5enJE
-            UTRRYkJMOWZJcWtxNmRpTWpxOE82bVVaYkFzCnNGWkdaaXhySkk2NlJ1YlpsckFQ
+            VGd5cnlKUFpvdGMwVXRDd1B5VmUvVlFUeno4CmF5RVRiSUVTQVJYS2lDdnpFbGgy
-            S3dITHhkNDkxb1VIZDNlQkd1enBvSU0KLS0tIDRGMklHTzNHUE8zUUNaK3l4dnF0
+            OTgzMkVHSWdsTWl6MWtxck5nTU41V1EKLS0tIFpZencxelRCd3R5c2dFSGNRV29l
-            MHlIU3c4V0ZxeDlrTHlMeHpHaFRNYWsKmYaSicrgNvozfO6miBqvBr8voQlkOioZ
+            aU5kS1BnYjNXSC92bFdvV21kRER6TmMK6uKyU0iINdkRXwGfxxFjg+DzowkAFVFa
-            dzBkLr/0de+WBm85GzhuTDpYb0cvzzxwoUlNyxDMjSSSGzLpc/dqxw==
+            vsZAbx1Q7V6prwldJwQz516CfvByqLi8s3GYDU7/s99TjK/V+MPqSw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1NU9nSVpRMnNwQWpIekdT
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNnBWSklCT3RFSExsSDRO
-            b3R1NFhWYitNRFppT1FudlBNK1NZa0l1RlZBCmd5b0x6YThOTUhHN01pMUQvYm9Q
+            V2hPNmtiUGl5bjdaVU13dVFKVW5wL1hGOTBrClBKcG1YS0x5aGFyNGt5dkhPSDVC
-            L0FUdVdRaHczRW1BbDNoYi9NeW4zdE0KLS0tIHJuWHFvSnRoSFZNUTUwaU9DRXJ3
+            VWNDRFd5VHNjTHVWOEZSNEIwdFNNSUUKLS0tIE9abWUwZDdDUmIybnJ2aVJKbEcw
-            UHdRbDBBeXFwR0Vtc1h1N05mN0pVZzgKxLuY/RNLkhPpPDGDkO3yqbelCGng/qm1
+            c3dRV3NmMTFFbUlRUjF4dWZscEV0b3cKgXYOPwLnUyIBOkB2hIlnM42e3TQXXSIf
-            9Yo97TlLq4zyw1cu2z0Fvcid3ZJt107+NN/2DZ4o8eXSnBSVXUcktw==
+            GpaLKqOVw1fMSC0u7l/sTz7c2tAWVAfSXyOFcyUGpV7VAIKPjXj4og==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-09T17:15:11Z"
+    lastmodified: "2025-01-03T20:11:27Z"
-    mac: ENC[AES256_GCM,data:8nCX56znsRy2y1NmkCBJ5e/szd8CTJ1BIbNew40hdT50EruedQTmQWrOhql+na3ZDSWOfPHwufgX6hFwA6UHuOYZCswsS0ST2vtV1Y/f7Y0i20q7jAxslDxUt8MT94Z+WunZ7OgZn+3DVCSVkwtc3VqLT/gcATaA3KgbHTsiEFQ=,iv:PSkQC6oIlKAkwyVrwHJBLNVnhGVkSkVhtOyoV0FwPdY=,tag:bszELdBw3HnK9g5rPaocMQ==,type:str]
+    mac: ENC[AES256_GCM,data:UFU5bQg2/OuCTkqV5efbGh8VPKqJWmyld0r01j97M7+CQGwyWoXlDmaMR+27xSjSDQPxwAhb+ejQue5585VNcztdBoaH0F8wOWgkdlzxiHMvQRC5TXjao4anxNRnedf07+YHQZ74udUa9Qf8UXZqIwb6HNCDmebrNi38GOWfoS0=,iv:YQ8gGj5LgMvaZqwTD3Vtj3tSjaAlmTaCFKaWkgM5WDA=,tag:K2tbaECleS8Rn0uIfL7x9w==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.2

nixos/lib/default.nix

@@ -1,71 +1,63 @@
-{lib, ...}:
+{ lib, ... }:
-with lib; rec {
-  firstOrDefault = first: default:
-    if first != null
-    then first
-    else default;
-  existsOrDefault = x: set: default:
-    if builtins.hasAttr x set
-    then builtins.getAttr x set
-    else default;
 
-  # Create custom package set
+with lib;
-  mkMyPkgs = pkgs: {
+rec {
-    borgmatic = pkgs.callPackage ../../nixos/packages/borgmatic {};
+
-    mods = pkgs.callPackage ../../nixos/packages/charm-mods {};
+  firstOrDefault = first: default: if first != null then first else default;
-    # modrinth-app-unwrapped = pkgs.callPackage ../../nixos/packages/modrinth {};
+  existsOrDefault =
-  };
+    x: set: default:
+    if builtins.hasAttr x set then builtins.getAttr x set else default;
 
   # main service builder
-  mkService = options: (
+  mkService =
+    options:
+    (
       let
         user = existsOrDefault "user" options "568";
         group = existsOrDefault "group" options "568";
 
-      # enableBackups =
+        enableBackups =
-      #   (lib.attrsets.hasAttrByPath ["persistence" "folder"] options)
+          (lib.attrsets.hasAttrByPath [ "persistence" "folder" ] options)
-      #   && (lib.attrsets.attrByPath ["persistence" "enable"] true options);
+          && (lib.attrsets.attrByPath [ "persistence" "enable" ] true options);
 
         # Security options for containers
         containerExtraOptions =
-        lib.optionals (lib.attrsets.attrByPath ["container" "caps" "privileged"] false options) [
+          lib.optionals (lib.attrsets.attrByPath [ "container" "caps" "privileged" ] false options) [
             "--privileged"
           ]
-        ++ lib.optionals (lib.attrsets.attrByPath ["container" "caps" "readOnly"] false options) [
+          ++ lib.optionals (lib.attrsets.attrByPath [ "container" "caps" "readOnly" ] false options) [
             "--read-only"
           ]
-        ++ lib.optionals (lib.attrsets.attrByPath ["container" "caps" "tmpfs"] false options) [
+          ++ lib.optionals (lib.attrsets.attrByPath [ "container" "caps" "tmpfs" ] false options) [
             (map (folders: "--tmpfs=${folders}") tmpfsFolders)
           ]
-        ++ lib.optionals (lib.attrsets.attrByPath ["container" "caps" "noNewPrivileges"] false options) [
+          ++ lib.optionals (lib.attrsets.attrByPath [ "container" "caps" "noNewPrivileges" ] false options) [
             "--security-opt=no-new-privileges"
           ]
-        ++ lib.optionals (lib.attrsets.attrByPath ["container" "caps" "dropAll"] false options) [
+          ++ lib.optionals (lib.attrsets.attrByPath [ "container" "caps" "dropAll" ] false options) [
             "--cap-drop=ALL"
           ];
-    in {
+      in
+      {
         virtualisation.oci-containers.containers.${options.app} = mkIf options.container.enable {
           image = "${options.container.image}";
           user = "${user}:${group}";
-        environment =
+          environment = {
-          {
             TZ = options.timeZone;
-          }
+          } // options.container.env;
-          // options.container.env;
+          environmentFiles = lib.attrsets.attrByPath [ "container" "envFiles" ] [ ] options;
-        environmentFiles = lib.attrsets.attrByPath ["container" "envFiles"] [] options;
           volumes =
-          ["/etc/localtime:/etc/localtime:ro"]
+            [ "/etc/localtime:/etc/localtime:ro" ]
-          ++ lib.optionals (lib.attrsets.hasAttrByPath ["container" "persistentFolderMount"] options) [
+            ++ lib.optionals (lib.attrsets.hasAttrByPath [ "container" "persistentFolderMount" ] options) [
               "${options.persistence.folder}:${options.container.persistentFolderMount}:rw"
             ]
-          ++ lib.attrsets.attrByPath ["container" "volumes"] [] options;
+            ++ lib.attrsets.attrByPath [ "container" "volumes" ] [ ] options;
           extraOptions = containerExtraOptions;
         };
         systemd.tmpfiles.rules = lib.optionals (lib.attrsets.hasAttrByPath [
           "persistence"
           "folder"
-        ]
+        ] options) [ "d ${options.persistence.folder} 0750 ${user} ${group} -" ];
-        options) ["d ${options.persistence.folder} 0750 ${user} ${group} -"];
       }
     );
 }

nixos/modules/nixos/containers/default.nix

@@ -1,7 +1,6 @@
 {
   imports = [
     ./jellyfin
-    ./jellyseerr
     ./ollama
     ./plex
     ./scrutiny

nixos/modules/nixos/containers/jellyfin/default.nix

@@ -11,7 +11,7 @@ with lib; let
   image = "ghcr.io/jellyfin/jellyfin:${version}";
   user = "kah";
   # renovate: depName=ghcr.io/jellyfin/jellyfin datasource=docker
-  version = "10.10.6";
+  version = "10.10.4";
   volumeLocation = "/nahar/containers/volumes/jellyfin";
 in {
   # Options
@@ -88,6 +88,37 @@ in {
       ];
     };
 
+    sops.secrets = {
+      "restic/jellyfin/env" = {
+        inherit group;
+        sopsFile = ./secrets.sops.yaml;
+        owner = user;
+        mode = "0400";
+      };
+      "restic/jellyfin/password" = {
+        inherit group;
+        sopsFile = ./secrets.sops.yaml;
+        owner = user;
+        mode = "0400";
+      };
+      "restic/jellyfin/template" = {
+        inherit group;
+        sopsFile = ./secrets.sops.yaml;
+        owner = user;
+        mode = "0400";
+      };
+    };
+
+    # Restic backups for `jellyfin-local` and `jellyfin-remote`
+    services.restic.backups = config.lib.mySystem.mkRestic {
+      inherit app user;
+      environmentFile = config.sops.secrets."restic/jellyfin/env".path;
+      excludePaths = [];
+      localResticTemplate = "/eru/restic/jellyfin";
+      passwordFile = config.sops.secrets."restic/jellyfin/password".path;
+      paths = [volumeLocation];
+      remoteResticTemplateFile = config.sops.secrets."restic/jellyfin/template".path;
+    };
     # TODO add nginx proxy
     # services.nginx.virtualHosts."${app}.${config.networking.domain}" = {
     #   useACMEHost = config.networking.domain;

nixos/modules/nixos/containers/jellyfin/secrets.sops.yaml

@@ -1,61 +1,88 @@
 restic:
     jellyfin:
-        env: ENC[AES256_GCM,data:aau+5TFpye6u/e6Xnlg=,iv:ooDueH38Xukvvh+XORfW4giR+TaeVZEwK+EQnxFMKE8=,tag:u5JaeiGFi4e7gk3Bb1JLsw==,type:str]
+        env: ENC[AES256_GCM,data:293v4afGmUZuHMtdkcs=,iv:Aitx2N/qGXQDCpcgFa72cfvPW9KXLyqBkJ5csDitUMo=,tag:k6t0XYErgU5TuRW/e9AnXw==,type:str]
-        password: ENC[AES256_GCM,data:0tkviPFQsP9wAVcbxspwOdN7eT352pibr/gjSoVmmL77xw==,iv:H2R8HofrrUkTqPuGDkt4xkOhvi16/kdT2/GjvSY5HQg=,tag:atT5aBQgmxBeUsMd5IYXIQ==,type:str]
+        password: ENC[AES256_GCM,data:eR0jFe6o6pLpKR9KjUpH6GWVMAys4EiX981VecNq9Et/fQ==,iv:l9tCvWH80sl+nS0RKdApCqzEr1PPpNQDJlr0ILZYK94=,tag:R4rnUw1y2QBG01XkMp1JSA==,type:str]
-        template: ENC[AES256_GCM,data:9P8G2rwOTMAj0PkHVGEouSLd9h2FrUxakYWQa4BMt6LiHxgwzlAVe9QSJFOr1di+HmfK+3Y2dG27pz/WW1J5OArD,iv:smq5UTpzJJ2GlfCkwjA0q4jl3XJo0M8KhBecXIqipx0=,tag:RA0UpqoBSLgwlHK5Lz9VEA==,type:str]
+        template: ENC[AES256_GCM,data:tj3qrery9dHplVa8ecac2x3yfISuaUSJJDKsXuRF1ek9G43Uj7B3P8m4JEFHBeCK6vvYIK2QGEcUW5QElnuPYCaB,iv:jp5biUiDMpAMghuO6sNaQ+RN0uFCAFgmPOQLB71KdCY=,tag:et41JJnD6/ZZsBLRCyJtHw==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age:
+        - recipient: age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMWnp6K2RsVHRmTFhYNGRs
+            ZnRyVmVZU3hUNVVBZnRtWGVFZTgwTitLWlZrClZ1cUVOSHRCc0xBQ3pYWFI2VUgy
+            NjVCMGxJWVpXNXc0R1p4cnNIazJHNlkKLS0tIFEzdE9pZ2N6cnVUTVdoRHFaZXQ0
+            dVpzQU9tbzlURlVIMllYZEZpaE1PT0UKAqtn9wmQNNy8qMYy6tSc40/1I/4eseVs
+            jsrfZU+73/OM5FvOLDo9EVBYhHGSO9/gTedbX8FJCzTYNcNPR/X6ww==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsS040Q0Y2N0hYczFsdkhT
+            Rm5ERGVxaHJtYmZwUmpDUlpZc2hpZHNlOFI0Cm1oMmJ3SUZkT2pnVVNBS280d3Y0
+            YU1mRWtqSlM0aDh1ZkRuWGpHVHNzTlUKLS0tIEQzU093U091WktCYjRHKzF2ODU4
+            a0ozSGhwVFFkdkUrcFdqR3ZPd1IyNkEK+GZf0el8RwGXSHHSPqZ2NDhr3/788IT/
+            z9A/zz56OcsRCT8l24+nVtx3pDhcqxvg201wtx0t54n1cLInpxAKSA==
+            -----END AGE ENCRYPTED FILE-----
         - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhZ0hkNVA5TXN4UmpZdG1z
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXNjdJaEFYVVd6cElieTN4
-            dGEwUExxcnc4M01TV2hYTHprRTBDek1iMmpFCjhOT01lblB2aVpuRVZXZEJxeGJY
+            Qm1vQVVDWmdNM2F4R3dDaU1SMjh5UWNwQzA4CkNCS1JxZHZHVU14T1pmQXZCS0ZE
-            cGNqWEVUMmlmVzlScng3TCtqSkxUL3MKLS0tIG9wWlVIYnRjOU1ZZ0pEdTFWWE4x
+            cTBHV2dUUmVMYTg2VGJCZTJGTFpMRUEKLS0tIEJ1YTcyOHZtNklVMk9mbDJEWjM0
-            SFh5Tzc5SytvU0ZYbENDT2E4Y1doNHMKT5qjHInpLf8qEc+6FRM2hpQcbOJPFR15
+            VmczY2UybkY5U2tzaitUN2pvWmpHV28KGJ8nlNSA+Fx0GaqMVraMrRGYbPk7BhcM
-            65UbBv00T6K8s8/ltNzwDUtjufIbtyOXjY+QrPGVm1lhFOXRYEBLWw==
+            92aNv8+1QqOU9NDveRapxv02Uo6dffCVH/343wGh9lPr4orF+OlOVg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMDNrQ1Vuck4yTGFuZmp0
+            Tm1GZWViTFF4S3JZUlBEK2Mvait2UE9NM1VBClhXMEpSenlWNkNYVFE4eUhoS0Zu
+            NWt0NjEyUDdoQjRQSUNubDRBbDZGTlkKLS0tIGNJOXB6clUvQUk2dE1hMGV3T2po
+            Q1VMS3J0alQ1bGxkYVFuMUhUalVuSjAKNnHfUtGfNKw+K7pAcyMaybFukjncAjFc
+            AIoJPOiw83Vn1Ps+9tjRrEUzTNkTfaMqeIsN8BEDQ3LzQbX2b+Hnxw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSSDJNYnd6NTFOaXJ0QUpU
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTVDV4eDM2N3ZialBWc2ds
-            M1BCeHo0QmczQXN2ZEc1cXhsbTVaZzlkNDBFCjcwVnhvaC9KRjVzRjVTY3E0Q0RR
+            dWVIY0NQb21VcUxKM2VVWWFrYUd0eFoyY2owCkFQTmIvZDJzalRpUkJTcnNJMWFH
-            QUxRRGdPcEkxWmVPVVNxcXFBNVFDWW8KLS0tIGFBUlh1ZVJvd1dXc2NEM25sd0Fa
+            d3FtcmNVMnNEQkdUUFlTdGN0VmtWZjAKLS0tIGJNM09TVXJiNnR1MGQ0TG43Wno1
-            YWwyUS9LZnJyMEY4VzB0czFoWURSZEUKBg5zxFww39sHfH78p9WnkIcXyvq6VyIQ
+            TFZFU3hPZkJHZkM3TjJyQVlGYW1MMUUK+5RtvM8icCrs8OBcJing+O+rfAiOI+BC
-            f1/zFRkuM8X3iuqOpNjjqThey1HKkvTzH18st5YLciDC6SV299JqZQ==
+            z1p1vesZ7BCjFlPNAOt2QGii5h8XFwPyrXEklNXfIRzOmjIVgVC9Bw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nkpq8lr09vamgvf8cvzemqjyr3ex8w7azfupdr2gverz9j5zgemsv99t0z
+        - recipient: age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2dStpS3Uyb21NWFBJa2hV
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNYThIdzRlZTdYaHI2Z2Ji
-            VTJnSk9iV1ZMNkZnc3JId3hhbE1sSk5LSzJVCnZSeUJBTjNGVkhTYkpGZGZudDUz
+            NTFTUnBaWXAyS2R4Zlk4RjhjQU41YmFNZ0JZCmJjcSsxWFFGVkhUOG82ZTR5a0xa
-            RXc2VFVJNkM3bGpGMUlxc0s1Q2J4Mk0KLS0tIFFsMkdOWnQzeFlmYStaWWlYSHEz
+            VVVna3RTVVRKNWV4VVBoa3ZiUnJldlkKLS0tIDUyK2d1YS96WDZjV2Y3eWFJdHJN
-            SUdtQTc5OVB5eklpVWFxRTNBUFhsVXcKX5xNh9jnOllbRaMyzjh/70ohLcO8BeU5
+            VGJ3cHlCV25HMXIvTmdJcWtJTk9EUGsKpnsANd3XK5sH2bjSZJTZqYb7GjcY97K6
-            hTWmdnTgclbVaFBOPTPY6CCXNnBuvqjdi+ok9QULDE9cvtLUpstbWQ==
+            iEapD1nLkH4XTpqV0RnrKcIJFJ58LIupvSZZanRk3xt8NIvRTBp5OA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaaTlQaWt5QTFHVE9yS3lH
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoenJtK2xtUkJuS3dWZ0Vx
-            MVd5RmI2TVZaVGpodEFvOUhDLzg2Qjl3dDE0CllGWHhGTExVbDJydlhMclQ3RFBz
+            QldCOVkxYmY1VHhIYmYrVUUrelNCTVlybUhjCnVoK3o0VlZsblNTTW1Kbmp1dWpi
-            V2V1a3NTMG80Ykt2eHUwUW9aMXFMYzgKLS0tIHpJeFR3ZEJxWkg5Y2RQR0NUNUND
+            Tkl5bE41Qm9RUnpjWHMwSFczbGhrMGMKLS0tIHlIVVJ5QUxtYjhQcDhlOVpiaEdp
-            RERQbjlZNDJEUWVTd3d6YytVbUt5TzgKksgSnaMHY/wBVZyXBgrxsfxZABNDyuA3
+            WG94a1JLbG9BeXVzdUY4bXFPbGREQncK8GS2wkyL0yFee/zSr7YD1RDyTtIiRp74
-            8kgYBqd8p3g0OyW5h2UzDh7F7oweHhbljdL4CNlGDJ713ZlBggfsaQ==
+            ifygcB6UrJ+IhDLxWdcx8XhxkUHDLwUvLRQ71iRE54NytZbW29+FkQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYY0VXRm5SRTZYQ0JWK3JM
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvWkpMbmNNdW01WTF2bG1Y
-            TW9POGhRVGZ2b0t4SGVEaUczaFBlaDlsc2p3CkhEb2JBTnNFdzl0RHM3aW5jaHFN
+            QUlGbDR1TU5QV0VXa1F0UzYwY1Q5R0hjQ2k4CkRWY0FONlJBS1c3V3BXU1FXOTVr
-            dzl6ellHY2prNk1xeUUwMVE4WVdiYmMKLS0tIDM4YVdMeFpyb0kzRmdLUXduWXdI
+            RnF3Vll0Uzg4bmtvVVRYZ1lVd1l5c28KLS0tIHRmQzRqUnVDUVZwOWtoQ3lib0g4
-            KyswMHA3VDNkV1g1bEhhcUlNdHlFVW8K8fuwy7OtIoybFpaBBsZlxO40XUhDaxDR
+            Z1UxbEtkU29kMndqTE5YbnArY3NEYWMKBpF0XsaNxby01RlquQg0nueXZdz7U+oA
-            W9xy0wVJplCNWDDN0Ff93hEXaYVcF/B3V3EdouzAbdycVTrtXhiO2g==
+            32fA+V8AQ/aHg18JhxScsi4dILfnz7d4WZThbd4HYMKzxiCApguf2w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-09T06:33:40Z"
+    lastmodified: "2024-12-27T09:27:41Z"
-    mac: ENC[AES256_GCM,data:MZx07lkc3i1nJicWlUofCr4gq05g/BYGx3949DSILeAWegrsTQXh8zqBWpultONgABPdYgIb/JwJClMmKQ+p37u+6aTklwZfW+su3tOYwknkPogHSxTFaLW0Yxzy4CvM2VNiFDNuvZT8LjCminBKpjJebYq+HCjNQn6Y9/dPyXI=,iv:LXwamgr7uE0dfKoRJC9IGvzZ+HmRXw8cdVoXG2DuuxM=,tag:tsJo/PFZLGcEoa02nXNbXg==,type:str]
+    mac: ENC[AES256_GCM,data:vCxrV5Y1v6PuRVZI8tEmaai3kLatLQfk2xDR9wl4teTcSzvU1U2OWToEMFz695fgX62Gld8/U961WC0Q6HQWFPL9lrP/0vYoL9DWu7KAKIYI4lpPtAWi4pvudIJnT5Shd0aC6A/JC1iuI/JqekXRTJIqMUth9tIeoT7SmIgFn4E=,iv:BiqBRxMmUeXGiM5DgrInebr3yCXSd0FdVBfeI2Kc1sI=,tag:gsISmRZkL6XcRE9pLpSwWA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.1

nixos/modules/nixos/containers/jellyseerr/default.nix

@@ -1,86 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  app = "jellyseerr";
-  cfg = config.mySystem.containers.${app};
-  group = "kah";
-  image = "ghcr.io/fallenbagel/jellyseerr:${version}";
-  user = "jellyseerr";
-  # renovate: depName=ghcr.io/fallenbagel/jellyseerr datasource=docker
-  version = "2.5.0";
-  volumeLocation = "/nahar/containers/volumes/jellyseerr";
-in {
-  # Options
-  options.mySystem.containers.${app} = {
-    enable = mkEnableOption "${app}";
-    openFirewall =
-      mkEnableOption "Open firewall for ${app}"
-      // {
-        default = true;
-      };
-  };
-
-  # Implementation
-  config = mkIf cfg.enable {
-    # User configuration
-    users = mkIf (user == "jellyseerr") {
-      users.jellyseerr = {
-        inherit group;
-        isSystemUser = true;
-      };
-    };
-
-    # Systemd service for container
-    systemd.services.${app} = {
-      description = "Jellyseerr media request and discovery manager for Jellyfin";
-      wantedBy = ["multi-user.target"];
-      after = ["network.target"];
-
-      serviceConfig = {
-        ExecStartPre = "${pkgs.writeShellScript "jellyseerr-start-pre" ''
-          set -o errexit
-          set -o nounset
-          set -o pipefail
-
-          ${pkgs.podman}/bin/podman rm -f ${app} || true
-          rm -f /run/${app}.ctr-id
-        ''}";
-        ExecStart = ''
-          ${pkgs.podman}/bin/podman run \
-            --rm \
-            --name=${app} \
-            --user="${toString config.users.users."${user}".uid}:${
-            toString config.users.groups."${group}".gid
-          }" \
-            --log-driver=journald \
-            --cidfile=/run/${app}.ctr-id \
-            --cgroups=no-conmon \
-            --sdnotify=conmon \
-            --volume="${volumeLocation}:/app/config:rw" \
-            --volume="/moria/media:/media:rw" \
-            --volume="tmpfs:/cache:rw" \
-            --volume="tmpfs:/transcode:rw" \
-            --volume="tmpfs:/tmp:rw" \
-            --env=TZ=America/Chicago \
-            -p 5055:5055 \
-            ${image}
-        '';
-        ExecStop = "${pkgs.podman}/bin/podman stop --ignore --cidfile=/run/${app}.ctr-id";
-        ExecStopPost = "${pkgs.podman}/bin/podman rm --force --ignore --cidfile=/run/${app}.ctr-id";
-        Type = "simple";
-        Restart = "always";
-      };
-    };
-
-    # Firewall
-    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [
-        5055 # HTTP web interface
-      ];
-    };
-  };
-}

nixos/modules/nixos/containers/ollama/default.nix

@@ -7,7 +7,7 @@
 with lib; let
   app = "ollama";
   # renovate: depName=docker.io/ollama/ollama datasource=docker
-  version = "0.6.0";
+  version = "0.5.7";
   image = "docker.io/ollama/ollama:${version}";
   cfg = config.mySystem.containers.${app};
 in {

nixos/modules/nixos/containers/plex/default.nix

@@ -11,7 +11,7 @@ with lib; let
   image = "ghcr.io/onedr0p/plex:${version}";
   user = "kah";
   # renovate: depName=ghcr.io/onedr0p/plex datasource=docker versioning=loose
-  version = "1.41.5.9522-a96edc606";
+  version = "1.41.3.9314-a0bfb8370";
   volumeLocation = "/nahar/containers/volumes/plex";
 in {
   # Options
@@ -41,6 +41,7 @@ in {
           ${pkgs.podman}/bin/podman rm -f ${app} || true
           rm -f /run/${app}.ctr-id
         ''}";
+        # TODO: mount /config instead of /config/Library/Application Support/Plex Media Server
         ExecStart = ''
           ${pkgs.podman}/bin/podman run \
             --rm \
@@ -79,6 +80,38 @@ in {
       ];
     };
 
+    sops.secrets = {
+      "restic/plex/env" = {
+        inherit group;
+        sopsFile = ./secrets.sops.yaml;
+        owner = user;
+        mode = "0400";
+      };
+      "restic/plex/password" = {
+        inherit group;
+        sopsFile = ./secrets.sops.yaml;
+        owner = user;
+        mode = "0400";
+      };
+      "restic/plex/template" = {
+        inherit group;
+        sopsFile = ./secrets.sops.yaml;
+        owner = user;
+        mode = "0400";
+      };
+    };
+
+    # Restic backups for `plex-local` and `plex-remote`
+    services.restic.backups = config.lib.mySystem.mkRestic {
+      inherit app user;
+      environmentFile = config.sops.secrets."restic/plex/env".path;
+      excludePaths = ["${volumeLocation}/Library/Application Support/Plex Media Server/Cache"];
+      localResticTemplate = "/eru/restic/plex";
+      passwordFile = config.sops.secrets."restic/plex/password".path;
+      paths = ["${volumeLocation}/Library"];
+      remoteResticTemplateFile = config.sops.secrets."restic/plex/template".path;
+    };
+
     # TODO add nginx proxy
     # services.nginx.virtualHosts."${app}.${config.networking.domain}" = {
     #   useACMEHost = config.networking.domain;

nixos/modules/nixos/containers/plex/secrets.sops.yaml

@@ -0,0 +1,88 @@
+restic:
+    plex:
+        env: ENC[AES256_GCM,data:FwBQ9TJTiDGDEyrJkHo=,iv:pxqdwOPoxYAc+yY2xdNTi08jFNz+PvnZ9HYhmchEfiM=,tag:3uIPLUoZmDogmuShXqnAlw==,type:str]
+        password: ENC[AES256_GCM,data:79FMf5T1gYQX0PYTiEUhPQnHbEIekmH2vJxqwhdCw1MpoA==,iv:n3cQ4cLoEKw7rbCgysc14CMmKtYUfhZW2I6V3qrFp3Q=,tag:ooNflv+TnUOD0JX6NAqxvQ==,type:str]
+        template: ENC[AES256_GCM,data:br+HPd37B3rWYPLIYW8MiIHvR+PmsnBXEYLh8MT/v1rbcNH6ppyhwGMgP1kPkUX3o/0Y7PkW1pet5DRHcKUVnXpi,iv:O4MQQBpYCD8hkdTEroUn9+luUdCyz7MYUugjaYhF3Uc=,tag:db5DQBfPGX9ToQzwn1K7GA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCbSs2TFBpbW51aThtcEJL
+            eW80aG50VHJzcWVFSDlTbE40dHZqTnVpWDFBCkUwNVIrZkdyd1dKcjFzMENFdTN5
+            dVBZKzVIYnFJdnkzTlRCT2hITTVsSzgKLS0tIFREVWJENUtoWGR1THlwWXNNV3p4
+            cElGSzFtallzc2xBajRYSGNvOHJnM3cKIdyVG7MySM9caGUXaiTSsz1VVlD7GxRz
+            +5NNPoZgfe1SiptiQl3vO8FcIg5XtutI2nwYqLK5gzxZ7x6+D2Oedw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3dFAxT3ZCZ1BlV2VSQmlr
+            cW9SbWpLRUE4QlNGN21YdGM2NXhGdm1kVmlZClBORG5Mbmtaait4WXZiYkp3cGxR
+            WGFWT3NwaS9RK0IzN1FDR3ZWUjIyQVkKLS0tIDJYaVRORk94UXYySStUN0lJYlB5
+            L01LdFBzYUhmcENPMGIrYWU0dW91c2sKlraBMZ30AerY2YrGnV1pkeL6xJIGUPlX
+            JzjzPmkvqidCaT+gADxM9xTp9S5ZavLn0sGLapqfx2P7pDndRh74Qg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtanl6bWlrQlM2R1Bud0dk
+            cWJZdjJZUFVMY3BudEdRVVFOMy9IMTNGS1NzCnZHNXYzRVl5akFDYlNWVXZtMzNL
+            UnZEN3ZFUDB6b05Wa3lSc291WXVVeGMKLS0tIGk5ZTJ6d3A4M3ZqTm9KSjVudVBX
+            TzNNemlGc1JOckxERUx5V3VCbHBIZlkK+7+PJhU+4hnOiURvfhQOMh3Njl5E8OCj
+            CCH5feYLIOpfgEKQbhW8LFkakoqlU5ASdralMRq5h4OZt8hGciYgwg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3VFovdW1UbjlLZnRFZWZh
+            MUg0RkZqckcxcENRSG5aSkdQNkoraXFTbTNrCnlYWWVOdHVxYUwwaWYvOS8xaG9y
+            eS9za000VmR0T0ZZeHp5RXl0c1FUZDgKLS0tIERjY0hrdDlQb29UWC8ybDgwdXQy
+            WEVNVjBYV3RUZUN2SksvWDlzYnJydWcKEzXYhd0GUZNDdQcJ1lc5Ci4TAebQHzdd
+            Nyrf7Xhgb/vNoScFAvLxpJaEP9aJzWOL7wVHgnzFdf9ViRGF0yynnw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwU3JKelJlUUZxRi90RmRP
+            VUpoYXZaQlZpaEZiL3orb2Rva3U4TkZ2TDBVCmpwQXFtUHlicHh0S2h3TUN0U2dE
+            MXIrcUdhbWZLdFdhRnB1YkhDL2JkV3cKLS0tIFdCZWVmMytST3dHVG5LL1duckRj
+            alZDNkYxVnljUk9Gc25vVElPL0RXSDQKM84i+oIeivQFSIDBhT9Gg3XHk8GFRbzO
+            IwUrRIkj+yDKepz+r2Lc+yD2BOeFo+CNuReoJd2SGou7e628VysB4g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRE5UbGxUenRZVjU2NVF6
+            RHNUOXJ5bnJmdm13YTNKV1YwdFdJS3JpMTBrCkRNQWNiMXp4SHZ6bGdJay9pYjgr
+            UW1CSVRNMFFWNjA5YSttTHBGTWpCcE0KLS0tIDBUV25tdUZHbHpIb3Y1U281dGtl
+            bUNHazJDUnEwc015WXlybTdEK1RHL1UKZE/5YGvUN2tR1t7s/Lq1jG3FoMIOmKDK
+            GXwUQb1HG7PDG9V/pKWs9OVoFxv7qVuuBm29rRnI44pEERARtbs55Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBWHBEUDNuRDhVMmp4QUYr
+            cCtmZ2RMWVFNWVhVck44U3ROTE8xNm9kV0Y4CktSelh0ckdQZHNTVnVsVXJweUly
+            UmphNzRJU3JOSThQVXB3ZXRlY3BOK1UKLS0tIG1nT09WUm1YcVFJRHZyWFJOKzZx
+            OTFDbExmeXBBWmRjSE5BUnpGY0xLRjAKnLWKZEmlI9SsfZgus7tuCOFzokDobz8F
+            s7zQ078Dv7R55EPoYPfq8rsMvFpELrAqrNLAR9x4W5YledBDJV8s+A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRSttM1NDdFJib2FleTY0
+            UnkrUFhBUFlWNkxEZUNLMjVTUWh4VkhPbkY4CllRY3d0ZXpGRkM0ZG45TVE5SGx3
+            ek9BNW9SUGVLZjRiSkVlT2MrSU85VGsKLS0tIEtlcklOOXZldUJwZmVDaWhNeFh2
+            RDgrMDlLVm9rN2JRZ3gxSCtxOWlhWkEKkXtZtmXnRn1ukRI4CkjkYefyGOuCw+GC
+            HCKKdsASQm4JjcnlUbkL97bC0H+VcLNqHm6NR9dghI9IYuYAeLqMNA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-27T09:27:41Z"
+    mac: ENC[AES256_GCM,data:OU23F2vdLKE2aas9xUsx5cmObBmdqybXSfdUT+BGd/mdhThF6vNR3Xwo4PcaK8VPmQ8JmXjOUJ/A9vKvcgz1LuEywgAacayDf6TUu1yXPDm09wFwWGTAYugy2Z54a0VQ8u7Cu/4Ijx0hU0luaYsbCyr7FmKgeO+H+L47JKnrPp8=,iv:dowA2KQqSjNIoPq1A0Yv9g71FSJgey5mMQMuJJMSSWA=,tag:eJrk49soG6dA8UilhuKGaw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

nixos/modules/nixos/containers/scrutiny/default.nix

@@ -1,14 +1,12 @@
-{
+{ lib, config, ... }:
-  lib,
+with lib;
-  config,
+let
-  ...
-}:
-with lib; let
   app = "scrutiny";
   # renovate: depName=AnalogJ/scrutiny datasource=github-releases
   version = "v0.8.1";
   cfg = config.mySystem.services.${app};
-in {
+in
+{
   options.mySystem.services.${app} = {
     enable = mkEnableOption "${app}";
 
@@ -35,7 +33,7 @@ in {
     # --device /dev/disk/by-id/nvme-XXXXXXXXXXXXXXXXXXXXXXXXXXXX
     devices = mkOption {
       type = types.listOf types.str;
-      default = [];
+      default = [ ];
       description = ''
         Devices to monitor on Scrutiny.
       '';

nixos/modules/nixos/containers/scrypted/default.nix

@@ -7,7 +7,7 @@
 with lib; let
   app = "scrypted";
   # renovate: depName=ghcr.io/koush/scrypted datasource=docker versioning=docker
-  version = "v0.138.15-noble-nvidia";
+  version = "v0.127.1-noble-nvidia";
   image = "ghcr.io/koush/scrypted:${version}";
   cfg = config.mySystem.containers.${app};
 in {
@@ -75,7 +75,6 @@ in {
         11080 # Main Scrypted interface
         10443 # HTTPS interface
         8554 # RTSP server
-        33961 # Homekit
       ];
       allowedUDPPorts = [
         10443 # HTTPS interface

nixos/modules/nixos/de/default.nix

@@ -1,7 +0,0 @@
-{
-  imports = [
-    ./gnome.nix
-    ./hyprland.nix
-    ./kde.nix
-  ];
-}

nixos/modules/nixos/de/gnome.nix

@@ -1,114 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}: let
-  cfg = config.mySystem.de.gnome;
-in {
-  options = {
-    mySystem.de.gnome = {
-      enable =
-        lib.mkEnableOption "GNOME"
-        // {
-          default = false;
-        };
-      systrayicons =
-        lib.mkEnableOption "Enable systray icons"
-        // {
-          default = true;
-        };
-      gsconnect =
-        lib.mkEnableOption "Enable gsconnect (KDEConnect for GNOME)"
-        // {
-          default = true;
-        };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Ref: https://nixos.wiki/wiki/GNOME
-
-    services = {
-      displayManager = {
-        defaultSession = "gnome";
-        autoLogin = {
-          enable = false;
-          user = "jahanson"; # TODO move to config overlay
-        };
-      };
-
-      xserver = {
-        enable = true;
-        xkb.layout = "us"; # `localctl` will give you
-
-        displayManager = {
-          gdm.enable = true;
-        };
-        desktopManager = {
-          # GNOME
-          gnome.enable = true;
-        };
-      };
-
-      udev.packages = lib.optionals cfg.systrayicons [pkgs.gnome.gnome-settings-daemon]; # support appindicator
-    };
-
-    # systyray icons
-    # extra pkgs and extensions
-    environment = {
-      systemPackages = with pkgs;
-        [
-          wl-clipboard # ls ~/Downloads | wl-copy or wl-paste > clipboard.txt
-          playerctl # gsconnect play/pause command
-          pamixer # gcsconnect volume control
-          gnome.gnome-tweaks
-          gnome.dconf-editor
-
-          # This installs the extension packages, but
-          # dont forget to enable them per-user in dconf settings -> "org/gnome/shell"
-          gnomeExtensions.vitals
-          gnomeExtensions.caffeine
-          gnomeExtensions.dash-to-dock
-        ]
-        ++ optionals cfg.systrayicons [pkgs.gnomeExtensions.appindicator];
-    };
-
-    # enable gsconnect
-    # this method also opens the firewall ports required when enable = true
-    programs.kdeconnect = lib.mkIf cfg.gsconnect {
-      enable = true;
-      package = pkgs.gnomeExtensions.gsconnect;
-    };
-
-    # GNOME connection to browsers - requires flag on browser as well
-    services.gnome.gnome-browser-connector.enable = lib.any (user: user.programs.firefox.enable) (
-      lib.attrValues config.home-manager.users
-    );
-
-    # And dconf
-    programs.dconf.enable = true;
-
-    # Exclude default GNOME packages that dont interest me.
-    environment.gnome.excludePackages =
-      (with pkgs; [
-        gnome-photos
-        gnome-tour
-        gedit # text editor
-      ])
-      ++ (with pkgs.gnome; [
-        cheese # webcam tool
-        gnome-music
-        gnome-terminal
-        epiphany # web browser
-        geary # email reader
-        evince # document viewer
-        gnome-characters
-        totem # video player
-        tali # poker game
-        iagno # go game
-        hitori # sudoku game
-        atomix # puzzle game
-      ]);
-  };
-}

nixos/modules/nixos/de/hyprland.nix

@@ -1,146 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  inputs,
-  ...
-}: let
-  cfg = config.mySystem.de.hyprland;
-  hypr-pkgs = inputs.hyprland.inputs.nixpkgs.legacyPackages.${pkgs.stdenv.hostPlatform.system};
-in {
-  options = {
-    mySystem.de.hyprland = {
-      enable =
-        lib.mkEnableOption "Hyprland"
-        // {
-          default = false;
-        };
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    # We need all hyprland packages to follow the same MESA version
-    hardware = {
-      graphics = {
-        package = hypr-pkgs.mesa.drivers;
-      };
-    };
-    # Hyprland nixpkgs system packages
-    environment.systemPackages = with pkgs; [
-      # Hyprland
-      cava # Audio visualizer
-      cliphist # Clipboard history
-      duf # du tui - Disk Usage
-      greetd.tuigreet # TUI login manager
-      grim # Screenshot tool
-      hypridle # Hyprland idle daemon
-      inputs.ags.packages.${pkgs.stdenv.hostPlatform.system}.ags # AGS
-      inxi # System information tool
-      libva-utils # to view graphics capabilities
-      loupe # Screenshot tool
-      nvtopPackages.full # Video card monitoring
-      nwg-displays # Display manager for Hyprland
-      nwg-look # GTK settings editor, designed for Wayland.
-      pamixer # Volume control
-      pyprland # Python bindings for Hyprland
-      rofi-wayland # Window switcher and run dialog
-      slurp # Select a region in Wayland
-      swappy # Snapshot editor, designed for Wayland.
-      swaynotificationcenter
-      swww # Wallpaper daemon for wayland
-      wallust # Generate and change colors schemes on the fly.
-      waybar # Wayland top bar
-      wl-clipboard # Pipe to and from the clipboard
-      wlogout
-      wlr-randr # Wayland screen management
-      wofi # Rofi for Wayland
-      yad # Display dialog boxes from shell scripts
-      (mpv.override {scripts = [mpvScripts.mpris];})
-      # XDG things
-      xdg-user-dirs
-      xdg-utils
-      # GTK things
-      gnome-system-monitor
-      bc
-      baobab
-      glib
-      # Qt things
-      gsettings-qt
-      libsForQt5.qtstyleplugin-kvantum # Kvantum theme engine
-      # bar
-      libappindicator
-      libnotify
-      busybox
-    ];
-
-    # Enabling Hyprlock to unlock the system
-    security = {
-      pam.services.hyprlock = {};
-      polkit.enable = true;
-    };
-
-    # Hyprland nixpkgs program modules
-    programs = {
-      # Hyprland DE
-      hyprland = {
-        enable = true;
-        package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
-        portalPackage =
-          inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
-        withUWSM = true;
-      };
-      dconf.enable = true;
-      seahorse.enable = true;
-      ssh = {
-        enableAskPassword = true;
-        askPassword = "${pkgs.seahorse}/libexec/seahorse/ssh-askpass";
-      };
-      fuse.userAllowOther = true;
-
-      ## Additional programs for the overall Hyprland experience
-      hyprlock = {
-        enable = true;
-        package = inputs.hyprlock.packages.${pkgs.stdenv.hostPlatform.system}.hyprlock;
-      };
-      nm-applet.indicator = true; # Compatability; Application indicator for NetworkManager
-      thunar.enable = true;
-      thunar.plugins = with pkgs.xfce; [
-        exo
-        mousepad
-        thunar-archive-plugin
-        thunar-volman
-        tumbler
-      ];
-      gnupg.agent = {
-        enable = true;
-        enableSSHSupport = true;
-      };
-    };
-    # Hyprland nixpkgs service modules
-    services = {
-      greetd = {
-        enable = true;
-        vt = 3;
-        settings = {
-          default_session = {
-            user = "jahanson";
-            command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --cmd='uwsm start select'"; # start Hyprland with a TUI login manager
-          };
-        };
-      };
-      gnome.gnome-keyring.enable = true;
-    };
-    # Fonts
-    fonts.packages = with pkgs; [
-      fira-code
-      font-awesome
-      jetbrains-mono
-      noto-fonts
-      noto-fonts-cjk-sans
-      terminus_font
-      victor-mono
-      unstable.nerd-fonts.jetbrains-mono
-      unstable.nerd-fonts.fira-code
-      unstable.nerd-fonts.fantasque-sans-mono
-    ];
-  };
-}

nixos/modules/nixos/de/kde.nix

@@ -1,70 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}: let
-  cfg = config.mySystem.de.kde;
-  flameshotOverride = pkgs.unstable.flameshot.override {enableWlrSupport = true;};
-in {
-  options = {
-    mySystem.de.kde = {
-      enable =
-        lib.mkEnableOption "KDE"
-        // {
-          default = false;
-        };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Ref: https://wiki.nixos.org/wiki/KDE
-
-    # KDE
-    services = {
-      displayManager = {
-        sddm = {
-          enable = true;
-          wayland = {
-            enable = true;
-          };
-        };
-      };
-      desktopManager.plasma6.enable = true;
-    };
-
-    security = {
-      # realtime process priority
-      rtkit.enable = true;
-      # KDE Wallet PAM integration for unlocking the default wallet on login
-      pam.services."sddm".kwallet.enable = true;
-    };
-
-    # enable pipewire for sound
-    services.pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-      jack.enable = true;
-    };
-
-    # extra pkgs and extensions
-    environment = {
-      systemPackages = with pkgs; [
-        wl-clipboard # ls ~/Downloads | wl-copy or wl-paste > clipboard.txt
-        playerctl # gsconnect play/pause command
-        vorta # Borg backup tool
-        flameshotOverride # screenshot tool
-        libsForQt5.qt5.qtbase # for vivaldi compatibility
-        kdePackages.discover # KDE software center -- mainly for flatpak updates
-      ];
-    };
-
-    # enable kdeconnect
-    # this method also opens the firewall ports required when enable = true
-    programs.kdeconnect = {
-      enable = true;
-    };
-  };
-}

nixos/modules/nixos/default.nix

@@ -1,12 +1,8 @@
+{ lib, config, ... }:
+with lib;
 {
-  lib,
-  config,
-  ...
-}:
-with lib; {
   imports = [
     ./containers
-    ./de
     ./editor
     ./hardware
     ./lib.nix
@@ -55,7 +51,7 @@ with lib; {
     monitoring.prometheus.scrapeConfigs = mkOption {
       type = lib.types.listOf lib.types.attrs;
       description = "Prometheus scrape targets";
-      default = [];
+      default = [ ];
     };
   };
 

nixos/modules/nixos/editor/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ./nvim.nix
     ./vim.nix
     ./vscode.nix
   ];

nixos/modules/nixos/editor/nvim.nix

@@ -1,199 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.mySystem.editor.nvim;
-in {
-  options.mySystem.editor.nvim.enable = mkEnableOption "nvim";
-  config = mkIf cfg.enable {
-    # Enable nvim and configure plugins/settings
-    # Uses nvf https://github.com/NotAShelf/nvf to configure nvim on nix.
-    programs.nvf = {
-      enable = true;
-      settings.vim = {
-        keymaps = [
-          {
-            mode = "n";
-            key = "<leader>rp";
-            action = ":lua require('precognition').peek()<CR>";
-            desc = "Peek recognition";
-          }
-        ];
-        viAlias = false;
-        vimAlias = true;
-        lsp = {
-          enable = true;
-          formatOnSave = true;
-          lspsaga.enable = false;
-          trouble.enable = true;
-          lspSignature.enable = true;
-          otter-nvim.enable = true;
-          lsplines.enable = true;
-          nvim-docs-view.enable = true;
-        };
-
-        languages = {
-          enableLSP = true;
-          enableFormat = true;
-          enableTreesitter = true;
-          enableExtraDiagnostics = true;
-
-          nix.enable = true;
-          markdown.enable = true;
-          bash.enable = true;
-          css.enable = true;
-          html.enable = true;
-          sql.enable = true;
-          ts.enable = true;
-          go.enable = true;
-          lua.enable = true;
-          zig.enable = true;
-          python.enable = true;
-          rust = {
-            enable = true;
-            crates.enable = true;
-          };
-          astro.enable = true;
-          nu.enable = true;
-          csharp.enable = true;
-          tailwind.enable = true;
-        };
-        visuals = {
-          nvim-scrollbar.enable = true;
-          nvim-web-devicons.enable = true;
-          nvim-cursorline.enable = true;
-          cinnamon-nvim.enable = true;
-          fidget-nvim.enable = true;
-          highlight-undo.enable = true;
-          indent-blankline.enable = true;
-          cellular-automaton.enable = true;
-        };
-
-        statusline = {
-          lualine = {
-            enable = true;
-            theme = "catppuccin";
-          };
-        };
-
-        theme = {
-          enable = true;
-          name = "catppuccin";
-          style = "mocha";
-          transparent = false;
-        };
-
-        autopairs.nvim-autopairs.enable = true;
-
-        autocomplete.nvim-cmp.enable = true;
-        snippets.luasnip.enable = true;
-
-        filetree.neo-tree.enable = true;
-
-        tabline.nvimBufferline.enable = true;
-
-        treesitter.context.enable = true;
-        binds = {
-          whichKey.enable = true;
-          cheatsheet.enable = true;
-        };
-
-        telescope.enable = true;
-        git = {
-          enable = true;
-          gitsigns = {
-            enable = true;
-            codeActions.enable = false;
-          };
-        };
-
-        minimap = {
-          minimap-vim.enable = false;
-          codewindow.enable = true;
-        };
-
-        dashboard = {
-          dashboard-nvim.enable = false;
-          alpha.enable = true;
-        };
-
-        notify = {
-          nvim-notify.enable = true;
-        };
-
-        projects = {
-          project-nvim.enable = true;
-        };
-
-        utility = {
-          vim-wakatime.enable = true;
-          icon-picker.enable = true;
-          surround.enable = true;
-          diffview-nvim.enable = true;
-          yanky-nvim.enable = false;
-          motion = {
-            hop.enable = true;
-            leap.enable = true;
-            precognition = {
-              enable = true;
-              setupOpts.startVisible = false;
-            };
-          };
-          images = {
-            image-nvim.enable = false;
-          };
-        };
-        notes = {
-          mind-nvim.enable = true;
-          todo-comments.enable = true;
-        };
-
-        terminal = {
-          toggleterm = {
-            enable = true;
-            lazygit.enable = true;
-          };
-        };
-
-        ui = {
-          borders.enable = true;
-          noice.enable = true;
-          colorizer.enable = true;
-          modes-nvim.enable = false;
-          illuminate.enable = true;
-          breadcrumbs = {
-            enable = true;
-            navbuddy.enable = true;
-          };
-          smartcolumn = {
-            enable = true;
-            setupOpts.custom_colorcolumn = {
-              nix = "110";
-              ruby = "120";
-              java = "130";
-              go = ["90" "130"];
-            };
-          };
-          fastaction.enable = true;
-        };
-        assistant = {
-          copilot = {
-            enable = true;
-            cmp.enable = true;
-          };
-        };
-        session = {
-          nvim-session-manager.enable = false;
-        };
-        comments = {
-          comment-nvim.enable = true;
-        };
-        presence = {
-          neocord.enable = false;
-        };
-      };
-    };
-  };
-}

nixos/modules/nixos/editor/vim.nix

@@ -1,13 +1,12 @@
 # /home/jahanson/projects/mochi/nixos/modules/nixos/editor/vim.nix
-{
+
-  config,
+{ config, lib, ... }:
-  lib,
+with lib;
-  ...
+let
-}:
-with lib; let
   cfg = config.mySystem.editor.vim;
-  users = ["jahanson"];
+  users = [ "jahanson" ];
-in {
+in
+{
   options.mySystem.editor.vim.enable = mkEnableOption "vim";
   config = mkIf cfg.enable {
     # Enable vim and set as default editor
@@ -27,9 +26,8 @@ in {
           listToAttrs (
             map (u: {
               name = u;
-            value = {};
+              value = { };
-          })
+            }) users
-          users
           )
         );
   };

nixos/modules/nixos/editor/vscode.nix

@@ -4,19 +4,26 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.mySystem.editor.vscode;
   # VSCode Community Extensions. These are updated daily.
   vscodeCommunityExtensions = [
+    "ahmadalli.vscode-nginx-conf"
+    "astro-build.astro-vscode"
     "bmalehorn.vscode-fish"
+    "coder.coder-remote"
     "dracula-theme.theme-dracula"
-    "catppuccin.catppuccin-vsc"
     "editorconfig.editorconfig"
     "esbenp.prettier-vscode"
     "foxundermoon.shell-format"
+    "github.copilot"
+    "hashicorp.hcl"
     "jnoortheen.nix-ide"
     "mikestead.dotenv"
     "mrmlnc.vscode-json5"
+    "ms-azuretools.vscode-docker"
+    # "ms-python.python" # Python extensions *required* for redhat.ansible/vscode-yaml
     "ms-python.vscode-pylance"
     "ms-vscode-remote.remote-ssh-edit"
     "pkief.material-icon-theme"
@@ -30,11 +37,10 @@ with lib; let
     "fill-labs.dependi"
     "rust-lang.rust-analyzer"
     "dustypomerleau.rust-syntax"
+    "mattheworford.hocon-tools"
+    "pgourlain.erlang"
     "exiasr.hadolint"
-    "astro-build.astro-vscode"
-    # "github.copilot"
     # "github.copilot-chat"
-    # "ms-python.python" # Python extensions *required* for redhat.ansible/vscode-yaml
   ];
   # Nixpkgs Extensions. These are updated whenver they get around to it.
   vscodeNixpkgsExtensions = [
@@ -43,47 +49,52 @@ with lib; let
   ];
   # Straight from the VSCode marketplace.
   marketplaceExtensions = [
-    {
+    # {
-      name = "copilot";
+    #   name = "copilot";
-      publisher = "github";
+    #   publisher = "github";
-      version = "1.277.0";
+    #   version = "1.219.0";
-      sha256 = "sha256-cRz5gby2VOk4QS+Z67Sm/rb5heBANJFitkn+s06yVv0=";
+    #   sha256 = "Y/l59JsmAKtENhBBf965brSwSkTjSOEuxc3tlWI88sY=";
-    }
+    # }
     {
       # Apparently there's no insiders build for copilot-chat so the latest isn't what we want.
       # The latest generally targets insiders build of vs code right now and it won't load on stable.
       name = "copilot-chat";
       publisher = "github";
-      version = "0.25.0";
+      version = "0.21.1";
-      sha256 = "sha256-rureag8PaZwEME41EdaDMIVnYN17CqBhu9Pa5SuWRKU=";
+      sha256 = "sha256-8naCDn6esc1ZR30aX7/+F6ClFjQLPQ3k3r6jyVZ3iNg=";
+    }
+    {
+      name = "remote-ssh";
+      publisher = "ms-vscode-remote";
+      version = "0.113.1";
+      sha256 = "sha256-/tyyjf3fquUmjdEX7Gyt3MChzn1qMbijyej8Lskt6So=";
+
     }
     {
       # Same issue as the above -- auto pulling nightly builds not compatible with vscode stable.
       name = "python";
       publisher = "ms-python";
-      version = "2025.2.0";
+      version = "2024.14.1";
-      sha256 = "sha256-f573A/7s8jVfH1f3ZYZSTftrfBs6iyMWewhorX4Z0Nc=";
+      sha256 = "sha256-NhE3xATR4D6aAqIT/hToZ/qzMvZxjTmpTyDoIrdvuTE=";
     }
   ];
   # Extract extension strings and coerce them to a list of valid attribute paths.
-  vscodeCommunityExtensionsPackages =
+  vscodeCommunityExtensionsPackages = map (
-    map (
     ext: getAttrFromPath (splitString "." ext) pkgs.vscode-marketplace
-    )
+  ) vscodeCommunityExtensions;
-    vscodeCommunityExtensions;
+  nixpkgsExtensionsPackages = map (
-  nixpkgsExtensionsPackages =
-    map (
     ext: getAttrFromPath (splitString "." ext) pkgs.vscode-extensions
-    )
+  ) vscodeNixpkgsExtensions;
-    vscodeNixpkgsExtensions;
   marketplaceExtensionsPackages = pkgs.vscode-utils.extensionsFromVscodeMarketplace marketplaceExtensions;
-in {
+in
+{
   options.mySystem.editor.vscode.enable = mkEnableOption "vscode";
   config = mkIf cfg.enable {
+
     # Enable vscode & addons
     environment.systemPackages = with pkgs; [
       (vscode-with-extensions.override {
-        inherit (master) vscode;
+        inherit (unstable) vscode;
         # Merge all the extension packages together.
         vscodeExtensions =
           vscodeCommunityExtensionsPackages ++ nixpkgsExtensionsPackages ++ marketplaceExtensionsPackages;

nixos/modules/nixos/games/steam/steam.nix

@@ -3,9 +3,11 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.mySystem.games.steam;
-in {
+in
+{
   options.mySystem.games.steam = {
     enable = lib.mkEnableOption "Steam";
   };
@@ -22,5 +24,6 @@ in {
     environment.systemPackages = with pkgs; [
       protonup-qt
     ];
+
   };
 }

nixos/modules/nixos/hardware/nvidia/default.nix

@@ -4,12 +4,15 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.mySystem.hardware.nvidia;
-in {
+in
+{
   options.mySystem.hardware.nvidia.enable = mkEnableOption "NVIDIA config";
 
   config = mkIf cfg.enable {
+
     environment.sessionVariables.NIXOS_OZONE_WL = "1";
     # ref: https://nixos.wiki/wiki/Nvidia
     # Enable OpenGL
@@ -27,6 +30,7 @@ in {
       # This is for the benefit of VSCODE running natively in wayland
 
       nvidia = {
+
         # Modesetting is required.
         modesetting.enable = true;
 

nixos/modules/nixos/lib.nix

@@ -3,39 +3,40 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
+
   # container builder
-  lib.mySystem.mkContainer = options: (
+  lib.mySystem.mkContainer =
+    options:
+    (
       let
         containerExtraOptions =
-        lib.optionals (lib.attrsets.attrByPath ["caps" "privileged"] false options) ["--privileged"]
+          lib.optionals (lib.attrsets.attrByPath [ "caps" "privileged" ] false options) [ "--privileged" ]
-        ++ lib.optionals (lib.attrsets.attrByPath ["caps" "readOnly"] false options) ["--read-only"]
+          ++ lib.optionals (lib.attrsets.attrByPath [ "caps" "readOnly" ] false options) [ "--read-only" ]
-        ++ lib.optionals (lib.attrsets.attrByPath ["caps" "tmpfs"] false options) (
+          ++ lib.optionals (lib.attrsets.attrByPath [ "caps" "tmpfs" ] false options) (
             map (folders: "--tmpfs=${folders}") options.caps.tmpfsFolders
           )
-        ++ lib.optionals (lib.attrsets.attrByPath ["caps" "noNewPrivileges"] false options) [
+          ++ lib.optionals (lib.attrsets.attrByPath [ "caps" "noNewPrivileges" ] false options) [
             "--security-opt=no-new-privileges"
           ]
-        ++ lib.optionals (lib.attrsets.attrByPath ["caps" "dropAll"] false options) ["--cap-drop=ALL"];
+          ++ lib.optionals (lib.attrsets.attrByPath [ "caps" "dropAll" ] false options) [ "--cap-drop=ALL" ];
-    in {
+      in
+      {
         ${options.app} = {
           image = "${options.image}";
           user = "${options.user}:${options.group}";
-        environment =
+          environment = {
-          {
             TZ = config.time.timeZone;
-          }
+          } // lib.attrsets.attrByPath [ "env" ] { } options;
-          // lib.attrsets.attrByPath ["env"] {} options;
+          dependsOn = lib.attrsets.attrByPath [ "dependsOn" ] [ ] options;
-        dependsOn = lib.attrsets.attrByPath ["dependsOn"] [] options;
+          entrypoint = lib.attrsets.attrByPath [ "entrypoint" ] null options;
-        entrypoint = lib.attrsets.attrByPath ["entrypoint"] null options;
+          cmd = lib.attrsets.attrByPath [ "cmd" ] [ ] options;
-        cmd = lib.attrsets.attrByPath ["cmd"] [] options;
+          environmentFiles = lib.attrsets.attrByPath [ "envFiles" ] [ ] options;
-        environmentFiles = lib.attrsets.attrByPath ["envFiles"] [] options;
+          volumes = [
-        volumes =
-          [
             "/etc/localtime:/etc/localtime:ro"
-          ]
+          ] ++ lib.attrsets.attrByPath [ "volumes" ] [ ] options;
-          ++ lib.attrsets.attrByPath ["volumes"] [] options;
+          ports = lib.attrsets.attrByPath [ "ports" ] [ ] options;
-        ports = lib.attrsets.attrByPath ["ports"] [] options;
           extraOptions = containerExtraOptions;
         };
       }
@@ -75,28 +76,25 @@
   # This creates two backup jobs:
   #   - nextcloud-local: backs up to local storage
   #   - nextcloud-remote: backs up to remote storage (e.g. S3)
-  lib.mySystem.mkRestic = options: let
+  lib.mySystem.mkRestic =
+    options:
+    let
       # excludePaths is optional
-    # excludePaths =
+      excludePaths = if builtins.hasAttr "excludePaths" options then options.excludePaths else [ ];
-    #   if builtins.hasAttr "excludePaths" options
-    #   then options.excludePaths
-    #   else [];
       # Decide which mutually exclusive options to use
       remoteResticTemplateFile =
-      if builtins.hasAttr "remoteResticTemplateFile" options
+        if builtins.hasAttr "remoteResticTemplateFile" options then
-      then options.remoteResticTemplateFile
+          options.remoteResticTemplateFile
-      else null;
+        else
+          null;
       remoteResticTemplate =
-      if builtins.hasAttr "remoteResticTemplate" options
+        if builtins.hasAttr "remoteResticTemplate" options then options.remoteResticTemplate else null;
-      then options.remoteResticTemplate
-      else null;
       # 2:05 daily backup with 3h random delay
-    timerConfig = null;
+      timerConfig = {
-    #{
+        OnCalendar = "06:05"; # night snap is taken at 02:10
-    #OnCalendar = "00:20"; # night snap is taken at 02:10
+        Persistent = true;
-    #Persistent = true;
+        RandomizedDelaySec = "30m";
-    #RandomizedDelaySec = "30m";
+      };
-    #};
       # 7 daily, 5 weekly, 12 monthly backups
       pruneOpts = [
         "--keep-daily 7"
@@ -110,7 +108,8 @@
         #
         ${pkgs.restic}/bin/restic unlock --remove-all || true
       '';
-  in {
+    in
+    {
       # local backup
       "${options.app}-local" = {
         inherit
@@ -122,11 +121,9 @@
         inherit (options) user passwordFile environmentFile;
         # Move the path to the zfs snapshot path
         paths = map (x: "${config.mySystem.services.zfs-nightly-snap.mountPath}/${x}") options.paths;
-      exclude =
+        exclude = map (
-        map (
           x: "${config.mySystem.services.zfs-nightly-snap.mountPath}/${x}"
-        )
+        ) options.excludePaths;
-        options.excludePaths;
         repository = "${options.localResticTemplate}";
       };
 
@@ -143,11 +140,9 @@
         paths = map (x: "${config.mySystem.services.zfs-nightly-snap.mountPath}/${x}") options.paths;
         repository = remoteResticTemplate;
         repositoryFile = remoteResticTemplateFile;
-      exclude =
+        exclude = map (
-        map (
           x: "${config.mySystem.services.zfs-nightly-snap.mountPath}/${x}"
-        )
+        ) options.excludePaths;
-        options.excludePaths;
       };
     };
 }

nixos/modules/nixos/programs/shell/fish.nix

@@ -1,11 +1,9 @@
-{
+{ lib, config, ... }:
-  lib,
+with lib;
-  config,
+let
-  ...
-}:
-with lib; let
   cfg = config.mySystem.shell.fish;
-in {
+in
+{
   options.mySystem.shell.fish = {
     enable = mkEnableOption "Fish";
     enablePlugins = mkOption {
@@ -24,4 +22,5 @@ in {
       functions.enable = true;
     };
   };
+
 }

nixos/modules/nixos/security/1password/default.nix

@@ -1,12 +1,10 @@
-{
+{ config, lib, ... }:
-  config,
+with lib;
-  lib,
+let
-  ...
-}:
-with lib; let
   cfg = config.mySystem.security._1password;
   user = "jahanson";
-in {
+in
+{
   options.mySystem.security._1password = {
     enable = mkEnableOption "_1password";
   };
@@ -16,7 +14,7 @@ in {
       _1password.enable = true;
       _1password-gui = {
         enable = true;
-        polkitPolicyOwners = ["${user}"];
+        polkitPolicyOwners = [ "${user}" ];
       };
     };
 
@@ -30,7 +28,6 @@ in {
       "1password/custom_allowed_browsers" = {
         text = ''
           vivaldi-bin
-          zen
         '';
         mode = "0755";
       };

nixos/modules/nixos/security/acme/default.nix

@@ -0,0 +1,30 @@
+{ lib, config, ... }:
+with lib;
+let
+  cfg = config.mySystem.security.acme;
+in
+{
+  options.mySystem.security.acme.enable = mkEnableOption "acme";
+
+  config = mkIf cfg.enable {
+    sops.secrets = {
+      "security/acme/env".sopsFile = ./secrets.sops.yaml;
+      "security/acme/env".restartUnits = [ "lego.service" ];
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "admin@${config.networking.domain}";
+
+      certs.${config.networking.domain} = {
+        extraDomainNames = [
+          "${config.networking.domain}"
+          "*.${config.networking.domain}"
+        ];
+        dnsProvider = "cloudflare";
+        dnsResolver = "1.1.1.1:53";
+        credentialsFile = config.sops.secrets."security/acme/env".path;
+      };
+    };
+  };
+}

nixos/modules/nixos/security/acme/secrets.sops.yaml

@@ -0,0 +1,86 @@
+security:
+    acme:
+        env: ENC[AES256_GCM,data:YTs3BpKlOAmFW2hEXdQINCwznXI6RtpdePwwekG8b/3OuQkAFV6Zkvyn7hXut6FSPSQMOW2RXrc+4HvhYUcJy3o=,iv:GFS1gf58jini93yqrZiceJ/GuXNokZGQ+CRFUWB8OX0=,tag:8BGR6T93Wwxx3GRutr4c7g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1d9p83j52m2xg0vh9k7q0uwlxwhs3y6tlv68yg9s2h9mdw2fmmsqshddz5m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2SWIvMUNEbVpUNUJFSXJk
+            U1V2T1NmbzdqeGhxZkt5MmtYUzRDQVJQOWc0CnkrZjgvbW9ESEpPdUZqVzV0OEk2
+            Y21kVEswUUFlV2hYOFZqMzdnNGpKbFUKLS0tIFhoRlVtSW5RN2E2dWIxMmNleW91
+            bFdPMmZxaVU2VWFPL1RLemlBRnZzTEEKh6ftfs2Q0X1pCDZae3HA2//Ds5MGmj6C
+            U0ZP41k4a9M6q3QR+XbTtRVeQ0ZsgEEtHifCfwZ1zzjvCNtH8/t0cg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1m83ups8xn2jy4ayr8gw0pyn34smr0huqc5v76e4887az4vsl4yzsj0dlhd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArWmFKeWVsTGJ4YnA1Q2R4
+            Wi9KZVVqd1l6TGh3aStaZmNYK29SUXladVZzCjJNVk93dWRSTHkrMkI1NGx5VkNH
+            Y3Rwd01zQkxtTEpVK3BIdGx0eVNsWDgKLS0tIEdwTTIwcjVQbTdRUTBYVXl4Nno2
+            WmxRWHFzKzVGTHhrNmtGYXF6cDlTYWMKmgcQQQBeCVvn8D0J4sDWmutD4FtbIIcM
+            9mvmjb7AC5jZfaLs+XZIghs48vLfE1PnV3eJDo2mVneLvz8H1ZBeVg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age18kj3xhlvgjeg2awwku3r8d95w360uysu0w5ejghnp4kh8qmtge5qwa2vjp
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUnpRakhVOFpyU2NjdDlr
+            OHdNcEtKb3lkTWJjZDc0YzZ2cUdjWlhEcWo4CkxqMGlTU3NKMTljOWZ0VmNWVHZz
+            bXM2L1NSME1CVk9rVUE2QXpzR01TMWMKLS0tIERPNEdxWndwQVc2SkhKV1pBTnRU
+            VENyeERJZC8rRlFsY0Y5ZktxVUNTb2cK9EkFNElu/XBjCcLaLfHTg7FvyUhSYVqh
+            BV8BSLvlk7VKWZXdoDA7l067+rP8i/vHvUToWTmBT+8TTAVrJ5GxdQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1lp6rrlvmytp9ka6q89m0e0am26222kwrn7aqd45hu07s3a6jv3gqty86eu
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4dElKZ0VFclpmRE9LdUkw
+            dFoxdGs4SlBwYWJ0OHU2YUxlN2lpVGZnblNVCitZMm1ad25ZTzc2U0lsN1lLdm4y
+            R3pJNStKMkhTbnRQK2lCZWlxMlJ5WTAKLS0tIFRWYnllU0Y2VlkyVm02bUJRUXdS
+            VlQzeDVoNC9VTWtkNlRkNGRZWkM3RFUK/GXcyCI43ccib9tJRqvUc49AgY+XFY8G
+            xFXyZENlrdok4gLzkZU/6rsREPZvH5f8Wy/N0wckDVbr+ItT5C8Jgw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1e4sd6jjd4uxxsh9xmhdsnu6mqd5h8c4zz4gwme7lkw9ee949fc9q4px9df
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZNnN0MUd3WFgwV1VMeTUr
+            UXhLdEFkVUxEWnhtSDgzTkdDd2NHK0hmcGxzCnk4U3lMWjE5QjIxc3dVRVRyaDdz
+            bGh1cFBhR3Vwa1MzMVlVTFBiZ1hYT28KLS0tIDUvWmY1SUpuU3dOei9HZi9RY1o2
+            ekFnQVVDZyszU09ISUdZVUJveGIxdHcK4fVUOjtKv22HOLehHdnICd3u9/lqWFQc
+            fg0o8ORvx03p3Dkv+EBtiR5xvMhs8o0B5+njpxKpWGcx4/eclQjZbA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age19jm7uuam7gkacm3kh2v7uqgkvmmx0slmm9zwdjhd2ln9r60xzd7qh78c5a
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvbmlucy9xRnVMdkJjcGJm
+            SGc3TFJYdHJjT0wxeTRYd2lsa0Z2Si9kbFJJCjgyZU13VTlENndsY29CZ2FmcWRL
+            NlovK3REWlpsOU4zejBzMGt6Y1d1c00KLS0tIHFScnJIYUs5QnhLQ0JTcC9lU25S
+            R0N4MkwvSkZMcVQyc01UUGY5cHFYRGsK1AChAqWcAF9KHGRjkKXxiWYcgrWg/4Gf
+            7o81nkJTw8IwQdpSZ7wqNEt0q5mNk6EDALNe+uCcoipi9m/8qlWtqA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nwnqxjuaxlt5g7fe8rnspvn2c36uuef4hzwuwa6cfjfalz2lrd4q4n5fpl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYdkQ2U1JVdGtWUlpNQ1hk
+            L2oyWXQxZTdqUkhFWXZMZmFaSDN5ekpLQndBCkN2KzlDdUdOTmRnTmRGQ1ptWDlq
+            eWFtS2ZqMG9ZWm5VRDdvdHJiQTFBeUEKLS0tIG1vRmliWmZ3bmV0QnNaWldqdENr
+            OCtERmcvWm1MRy9JMWpWWW5jeWNDUVEK8mc8dU+Z/tJD25Qo5rKnYwDhpk+OXDvI
+            HepjgAjpl7s00zZlZfizCF1Ekn3RJOY74VEI7aJk5RAzYB2XBNr0Vg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1a8z3p24v32l9yxm5z2l8h7rpc3nhacyfv4jvetk2lenrvsdstd3sdu2kaf
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSnFGUVAxak5aeTAxR09m
+            cm5DajdZS2tnWWNzZm9RZTE4VDQ3U3EvZGprCkc2WkZKOW1MQVpKM0EreUVSRDJ5
+            ZS9ORnlkUnNVVFp4YTZnNkFSNlVaZk0KLS0tIERDbzBUQlRRQ3g3OXR6aVJCa3V2
+            QUs4WVFncENjZ0xjU0xVejZpV3oybm8KdHXR6uxiCmhpznGRg4Mr4nPavgFcCKH1
+            jwpTZ2eiQHKlrfBP+kwgFtCQXofNgtv09rbKW1NRElsXzjQNG9rCbg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-27T09:27:41Z"
+    mac: ENC[AES256_GCM,data:A9ltB8LJC28ysgjiEVdjGRZexorstigJZooqvwi7OPUcV7QfR/A9kRBMagZs5bjU62Ntg05LBel7pnT5ftWspWFBAARpW2eio6yR2UwZh9TCQDJsOzNr9hNykaGuzKcutRsVysgenvClPLoLgXZo71Rt84ExlWJI0qs6y4NHGpA=,iv:p+VB0VP1zJ+TuysH+72LpVMyOsSGOvndCnatOVHdX/E=,tag:M7oOo1yCxBUCckaE5TXtBg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1