home: individualise stateVersion

flake.lock: Update
Flake lock file updates: • Updated input 'disko': 'github:nix-community/disko/a13f36255cf4ce99cc4236a34251c2e7106e101d' (2024-02-26) → 'github:nix-community/disko/bde7dd352c07d43bd5b8245e6c39074a391fdd46' (2024-03-01) • Updated input 'home-manager': 'github:nix-community/home-manager/1d085ea4444d26aa52297758b333b449b2aa6fca' (2024-02-26) → 'github:nix-community/home-manager/2f3367769a93b226c467551315e9e270c3f78b15' (2024-02-29) • Updated input 'nixos-hardware': 'github:NixOS/nixos-hardware/01467901ec51dd92774040f2b3dff4f21f4e1c45' (2024-02-28) → 'github:NixOS/nixos-hardware/33a97b5814d36ddd65ad678ad07ce43b1a67f159' (2024-02-28) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/13aff9b34cc32e59d35c62ac9356e4a41198a538' (2024-02-26) → 'github:NixOS/nixpkgs/9099616b93301d5cf84274b184a3a5ec69e94e08' (2024-02-28) • Updated input 'nixpkgs-unstable-small': 'github:NixOS/nixpkgs/c1fe227b486d4bfffb319fd225a95ea574d398bf' (2024-02-28) → 'github:NixOS/nixpkgs/09c1497ce5d4ed4a0edfdd44450d3048074cb300' (2024-03-01)
2024-03-01 13:34:33 +01:00 · 2024-03-01 11:43:13 +01:00 · 2024-03-01 10:35:36 +01:00 · 2024-02-29 16:35:17 +01:00 · 2024-02-29 10:58:36 +01:00 · 2024-02-29 03:48:41 +01:00
52 changed files with 813 additions and 770 deletions
--- a/.github/workflows/cachix.yaml
+++ b/.github/workflows/cachix.yaml
@ -15,10 +15,10 @@ jobs:
    steps:
    - uses: actions/checkout@v4

-    - uses: cachix/install-nix-action@v27
+    - uses: cachix/install-nix-action@v25

    - name: Run alejandra
-      run: nix develop --command alejandra --check .
+      run: nix run nixpkgs#alejandra -- --check .

  flake-check:
    name: Flake check
@ -26,9 +26,9 @@ jobs:
    steps:
    - uses: actions/checkout@v4

-    - uses: cachix/install-nix-action@v27
+    - uses: cachix/install-nix-action@v25

-    - uses: cachix/cachix-action@v15
+    - uses: cachix/cachix-action@v14
      with:
        name: alarsyo
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@ -46,6 +46,7 @@ jobs:
      fail-fast: false
      matrix:
        name:
+        - ansel
        - grafanaDashboards/nginx
        - grafanaDashboards/node-exporter
        - kaleidoscope-udev-rules
@ -55,9 +56,9 @@ jobs:
    steps:
    - uses: actions/checkout@v4

-    - uses: cachix/install-nix-action@v27
+    - uses: cachix/install-nix-action@v25

-    - uses: cachix/cachix-action@v15
+    - uses: cachix/cachix-action@v14
      with:
        name: alarsyo
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@ -77,18 +78,15 @@ jobs:
        name:
        - boreal
        - hades
-        - talos
+        - hephaestus
        - thanatos

    steps:
-    - name: Delete huge unnecessary tools folder
-      run: rm -rf /opt/hostedtoolcache
-
    - uses: actions/checkout@v4

-    - uses: cachix/install-nix-action@v27
+    - uses: cachix/install-nix-action@v25

-    - uses: cachix/cachix-action@v15
+    - uses: cachix/cachix-action@v14
      with:
        name: alarsyo
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
--- a/base/gui-programs.nix
+++ b/base/gui-programs.nix
@ -23,47 +23,35 @@ in {
    programs.gnupg.agent = {
      enable = true;
      enableSSHSupport = true;
-      pinentryPackage = pkgs.pinentry-qt;
+      pinentryFlavor = "qt";
    };

    services = {
      xserver = {
        enable = true;
-        # NOTE: could use `mkOptionDefault` but this feels more explicit
-        videoDrivers =
-          if config.my.gui.isNvidia
-          then ["nvidia"]
-          else options.services.xserver.videoDrivers.default;
+        windowManager.i3.enable = true;
        xkb = {
          layout = "fr";
          variant = "us";
        };
-      };
-
-      libinput = {
-        enable = true;
-        touchpad = {
-          naturalScrolling = true;
+        libinput = {
+          enable = true;
+          touchpad = {
+            naturalScrolling = true;
+          };
        };
      };

      logind.lidSwitch = "ignore";
-
-      printing = {
-        enable = true;
-        cups-pdf.enable = true;
-      };
-
-      udev.packages = [pkgs.chrysalis];
    };

    environment.systemPackages = builtins.attrValues {
      inherit
        (pkgs)
-        arandr
        chrysalis
-        discord
+        evince
        feh
+        firefox
        ffmpeg
        gimp-with-plugins
        imagemagick
@ -78,10 +66,58 @@ in {
        zathura
        ;

+      inherit (pkgs.gnome) nautilus;
+
      inherit (pkgs.libsForQt5) okular;
+
+      discord = pkgs.discord.override {nss = pkgs.nss_latest;};
    };

-    networking.networkmanager.enable = true;
+    networking.networkmanager = {
+      enable = true;
+
+      dispatcherScripts = [
+        {
+          source = let
+            grep = "${pkgs.gnugrep}/bin/grep";
+            nmcli = "${pkgs.networkmanager}/bin/nmcli";
+          in
+            pkgs.writeShellScript "disable_wifi_on_ethernet" ''
+              export LC_ALL=C
+              date >> /tmp/disable_wifi_on_ethernet.log
+              echo START "$@" >> /tmp/disable_wifi_on_ethernet.log
+
+              beginswith() { case $2 in "$1"*) true;; *) false;; esac; }
+
+              is_ethernet_interface ()
+              {
+                  local type="$(${nmcli} dev show "$1" | grep 'GENERAL\.TYPE:' | awk '{ print $2 }')"
+                  test "$type" = "ethernet" || beginswith enp "$1"
+              }
+
+              hotspot_enabled ()
+              {
+                ${nmcli} dev | ${grep} -q "hotspot"
+              }
+
+              if is_ethernet_interface "$1" && ! hotspot_enabled; then
+                echo "change in ethernet and not in hotspot mode" >> /tmp/disable_wifi_on_ethernet.log
+                if [ "$2" = "up" ]; then
+                    echo "turning wifi off" >> /tmp/disable_wifi_on_ethernet.log
+                    nmcli radio wifi off
+                fi
+
+                if [ "$2" = "down" ]; then
+                    echo "turning wifi on" >> /tmp/disable_wifi_on_ethernet.log
+                    nmcli radio wifi on
+                fi
+              fi
+              echo END "$@" >> /tmp/disable_wifi_on_ethernet.log
+            '';
+          type = "basic";
+        }
+      ];
+    };
    programs.nm-applet.enable = true;
    programs.steam.enable = true;

--- a/base/programs.nix
+++ b/base/programs.nix
@ -26,22 +26,31 @@
      fd
      file
      ripgrep
+      sd
+      tokei
      tree
      wget
+      jq
      pciutils
      usbutils
      # development
      
+      agenix
+      alejandra
      git
      git-crypt
      git-lfs
      gnumake
      gnupg
+      pinentry-qt
      python3
      vim
      # terminal utilities
      
+      dogdns
+      du-dust
      htop
+      ldns # drill
      unzip
      zip
      ;
--- a/flake.lock
+++ b/flake.lock
@ -8,11 +8,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1716561646,
-        "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
+        "lastModified": 1707830867,
+        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
+        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
        "type": "github"
      },
      "original": {
@ -48,11 +48,11 @@
        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1717032306,
-        "narHash": "sha256-s3Sis+M1qTSVIehHrEKBzHBpqprIFJli5V6WojkJnYE=",
+        "lastModified": 1709286488,
+        "narHash": "sha256-RDpTZ72zLu05djvXRzK76Ysqp9zSdh84ax/edEaJucs=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "8ea5bcccc03111bdedaeaae9380dfab61e9deb33",
+        "rev": "bde7dd352c07d43bd5b8245e6c39074a391fdd46",
        "type": "github"
      },
      "original": {
@ -67,11 +67,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
        "type": "github"
      },
      "original": {
@ -81,39 +81,6 @@
        "type": "github"
      }
    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flakey-profile": {
-      "locked": {
-        "lastModified": 1712898590,
-        "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
-        "owner": "lf-",
-        "repo": "flakey-profile",
-        "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lf-",
-        "repo": "flakey-profile",
-        "type": "github"
-      }
-    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@ -142,62 +109,27 @@
        ]
      },
      "locked": {
-        "lastModified": 1726989464,
-        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
+        "lastModified": 1709204054,
+        "narHash": "sha256-U1idK0JHs1XOfSI1APYuXi4AEADf+B+ZU4Wifc0pBHk=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
+        "rev": "2f3367769a93b226c467551315e9e270c3f78b15",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "master",
        "repo": "home-manager",
        "type": "github"
      }
    },
-    "lix": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1729298361,
-        "narHash": "sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U=",
-        "rev": "ad9d06f7838a25beec425ff406fe68721fef73be",
-        "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/ad9d06f7838a25beec425ff406fe68721fef73be.tar.gz?rev=ad9d06f7838a25beec425ff406fe68721fef73be"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://git.lix.systems/lix-project/lix/archive/2.91.1.tar.gz"
-      }
-    },
-    "lix-module": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "flakey-profile": "flakey-profile",
-        "lix": "lix",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729360442,
-        "narHash": "sha256-6U0CyPycIBc04hbYy2hBINnVso58n/ZyywY2BD3hu+s=",
-        "rev": "9098ac95768f7006d7e070b88bae76939f6034e6",
-        "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/9098ac95768f7006d7e070b88bae76939f6034e6.tar.gz?rev=9098ac95768f7006d7e070b88bae76939f6034e6"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz"
-      }
-    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1731797098,
-        "narHash": "sha256-UhWmEZhwJZmVZ1jfHZFzCg+ZLO9Tb/v3Y6LC0UNyeTo=",
+        "lastModified": 1709147990,
+        "narHash": "sha256-vpXMWoaCtMYJ7lisJedCRhQG9BSsInEyZnnG5GfY9tQ=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "672ac2ac86f7dff2f6f3406405bddecf960e0db6",
+        "rev": "33a97b5814d36ddd65ad678ad07ce43b1a67f159",
        "type": "github"
      },
      "original": {
@ -225,11 +157,11 @@
    },
    "nixpkgs-unstable-small": {
      "locked": {
-        "lastModified": 1729493358,
-        "narHash": "sha256-Ti+Y9nWt5Fcs3JlarxLPgIOVlbqQo7jobz/qOwOaziM=",
+        "lastModified": 1709271102,
+        "narHash": "sha256-Z2sBL/HRRTNABsU8E5XsP+FXBEyBoi6oMwm5bV7lSFw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a5e6a9e979367ee14f65d9c38119c30272f8455f",
+        "rev": "09c1497ce5d4ed4a0edfdd44450d3048074cb300",
        "type": "github"
      },
      "original": {
@ -241,11 +173,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1716914467,
-        "narHash": "sha256-KkT6YM/yNQqirtYj/frn6RRakliB8RDvGqVGGaNhdcU=",
+        "lastModified": 1708815994,
+        "narHash": "sha256-hL7N/ut2Xu0NaDxDMsw2HagAjgDskToGiyZOWriiLYM=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "4a3fc4cf736b7d2d288d7a8bf775ac8d4c0920b4",
+        "rev": "9a9dae8f6319600fa9aebde37f340975cab4b8c0",
        "type": "github"
      },
      "original": {
@ -257,16 +189,16 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1731797254,
-        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
+        "lastModified": 1709150264,
+        "narHash": "sha256-HofykKuisObPUfj0E9CJVfaMhawXkYx3G8UIFR/XQ38=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
+        "rev": "9099616b93301d5cf84274b184a3a5ec69e94e08",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-24.05",
+        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
@ -277,7 +209,6 @@
        "disko": "disko",
        "flake-utils": "flake-utils",
        "home-manager": "home-manager_2",
-        "lix-module": "lix-module",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_3",
        "nixpkgs-unstable-small": "nixpkgs-unstable-small"
@ -312,21 +243,6 @@
        "repo": "default",
        "type": "github"
      }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -5,7 +5,7 @@
      type = "github";
      owner = "NixOS";
      repo = "nixpkgs";
-      ref = "nixos-24.05";
+      ref = "nixos-unstable";
    };

    nixpkgs-unstable-small = {
@ -25,7 +25,7 @@
      type = "github";
      owner = "nix-community";
      repo = "home-manager";
-      ref = "release-24.05";
+      ref = "master";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@ -49,11 +49,6 @@
      repo = "disko";
      ref = "master";
    };
-
-    lix-module = {
-      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
  };

  outputs = {
@ -62,18 +57,26 @@
    home-manager,
    agenix,
    disko,
-    lix-module,
    ...
  } @ inputs:
    {
      nixosModules = {
        home = {
-          home-manager.backupFileExtension = "hm-backup";
          home-manager.useGlobalPkgs = true;
          home-manager.useUserPackages = true;
          home-manager.users.alarsyo = import ./home;
          home-manager.verbose = true;
        };
+        nix-path = {
+          nix = {
+            nixPath = [
+              "nixpkgs=${inputs.nixpkgs}"
+            ];
+            registry = {
+              nixpkgs.flake = inputs.nixpkgs;
+            };
+          };
+        };
      };

      overlays = import ./overlays;
@ -99,7 +102,6 @@
          [
            agenix.nixosModules.default
            home-manager.nixosModules.default
-            lix-module.nixosModules.default
            {
              nixpkgs = {
                overlays = shared_overlays;
@ -139,6 +141,20 @@
            ++ sharedModules;
        };

+        hephaestus = nixpkgs.lib.nixosSystem rec {
+          inherit system;
+          modules =
+            [
+              ./hephaestus.nix
+
+              inputs.nixos-hardware.nixosModules.common-cpu-amd
+              inputs.nixos-hardware.nixosModules.common-gpu-amd
+              inputs.nixos-hardware.nixosModules.common-pc-laptop
+              inputs.nixos-hardware.nixosModules.common-pc-ssd
+            ]
+            ++ sharedModules;
+        };
+
        talos = nixpkgs.lib.nixosSystem {
          inherit system;
          modules =
@ -161,16 +177,11 @@
        };
      };
    }
-    // inputs.flake-utils.lib.eachDefaultSystem (system: let
-      pkgs = nixpkgs.legacyPackages.${system};
-    in {
+    // inputs.flake-utils.lib.eachDefaultSystem (system: {
      packages =
        inputs.flake-utils.lib.flattenTree
-        (import ./pkgs {inherit pkgs;});
-      devShells.default = pkgs.mkShellNoCC {
-        buildInputs = [
-          pkgs.alejandra
-        ];
-      };
+        (import ./pkgs {
+          pkgs = import nixpkgs {inherit system;};
+        });
    });
 }
--- a/hephaestus.nix
+++ b/hephaestus.nix
@ -0,0 +1,23 @@
+{...}: {
+  imports = [
+    # Default configuration
+    ./base
+
+    # Module definitions
+    ./modules
+
+    # Service definitions
+    ./services
+
+    # Host-specific config
+    ./hosts/hephaestus
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+}
--- a/home/default.nix
+++ b/home/default.nix
@ -2,7 +2,6 @@
  imports = [
    ./alacritty.nix
    ./bat.nix
-    ./direnv.nix
    ./emacs.nix
    ./env.nix
    ./firefox.nix
@ -11,6 +10,7 @@
    ./git.nix
    ./gtk.nix
    ./laptop.nix
+    ./lorri.nix
    ./mail.nix
    ./rbw.nix
    ./rofi.nix
--- a/home/emacs.nix
+++ b/home/emacs.nix
@ -43,7 +43,7 @@ in {

    programs.emacs = {
      enable = true;
-      package = pkgs.emacs29-pgtk;
+      package = pkgs.emacs29;
      extraPackages = epkgs: [epkgs.vterm epkgs.pdf-tools pkgs.lilypond epkgs.mu4e];
    };
  };
--- a/home/fish/functions/nfl.fish
+++ b/home/fish/functions/nfl.fish
@ -1,4 +1,7 @@
 function nfl
    set -l flags "--commit-lock-file"
-    nix flake update $flags $argv
+    for flake in $argv
+        set -a flags "--update-input" "$flake"
+    end
+    nix flake lock $flags
 end
--- a/home/direnv.nix
+++ b/home/direnv.nix
@ -9,15 +9,17 @@
    mkIf
    ;

-  cfg = config.my.home.direnv;
+  cfg = config.my.home.lorri;
 in {
-  options.my.home.direnv = {
-    enable = (mkEnableOption "setup direnv usage") // {default = true;};
+  options.my.home.lorri = {
+    enable = (mkEnableOption "lorri daemon setup") // {default = true;};
  };

  config = mkIf cfg.enable {
+    services.lorri.enable = true;
    programs.direnv = {
      enable = true;
+      # FIXME: proper file, not lorri.nix
      nix-direnv = {
        enable = true;
      };
--- a/home/tridactylrc
+++ b/home/tridactylrc
@ -18,10 +18,8 @@ bind ,<Space> nohlsearch
 " case insensitive if lowercase, case sensitive if using some uppercase letters
 set findcase smart

-set modeindicatormodes {"ignore": "false"}
-
 " New reddit is bad
-" autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
+autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")

 " Orange site / Reddit / Lobste.rs specific hints to toggle comments
 bind ;c hint -Jc [class*="expand"],[class="togg"],[class="comment_folder"]
@ -38,6 +36,3 @@ blacklistadd localhost
 blacklistadd netflix.com
 blacklistadd primevideo.com
 blacklistadd youtube.com
-
-" prevent teams from crashing
-seturl teams.microsoft.com superignore true
--- a/home/x/i3.nix
+++ b/home/x/i3.nix
@ -6,12 +6,11 @@
 }: let
  inherit
    (lib)
-    mkEnableOption
    mkIf
    mkOptionDefault
    ;

-  isEnabled = config.my.home.x.i3.enable;
+  isEnabled = config.my.home.x.enable;

  myTerminal =
    # FIXME: fix when terminal is setup in home
@ -27,10 +26,6 @@

  i3Theme = config.my.theme.i3Theme;
 in {
-  options.my.home.x.i3 = {
-    enable = mkEnableOption "i3wm configuration";
-  };
-
  config = mkIf isEnabled {
    my.home = {
      flameshot.enable = true;
--- a/hosts/boreal/default.nix
+++ b/hosts/boreal/default.nix
@ -24,12 +24,10 @@

  boot.tmp.useTmpfs = true;

-  boot.supportedFilesystems = {
-    btrfs = true;
-    ntfs = true;
-  };
-
-  services.xserver.windowManager.i3.enable = true;
+  boot.supportedFilesystems = [
+    "btrfs"
+    "ntfs"
+  ];

  services.btrfs = {
    autoScrub = {
@ -86,6 +84,7 @@
  services = {
    openssh = {
      enable = true;
+      forwardX11 = true;
    };
  };
  my.gui = {
@ -93,14 +92,18 @@
    isNvidia = true;
  };

-  hardware = {
-    bluetooth = {
-      enable = true;
-      powerOnBoot = false;
-    };
-    nvidia = {
-      open = true;
-      modesetting.enable = true;
-    };
+  my.wakeonwlan.interfaces.phy0.methods = [
+    "magic-packet"
+    "disconnect"
+    "gtk-rekey-failure"
+    "eap-identity-request"
+    "rfkill-release"
+  ];
+
+  services.udev.packages = [pkgs.chrysalis];
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = false;
  };
 }
--- a/hosts/boreal/home.nix
+++ b/hosts/boreal/home.nix
@ -4,11 +4,11 @@
  ...
 }: {
  home-manager.users.alarsyo = {
-    home.stateVersion = "20.09";
+    # TODO: can probably upgrade me
+    home.stateVersion = "21.05";

    # Keyboard settings & i3 settings
    my.home.x.enable = true;
-    my.home.x.i3.enable = true;
    my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
    my.home.x.i3bar.temperature.inputs = ["Tccd1"];
    my.home.x.i3bar.networking.throughput_interfaces = ["enp8s0" "wlp4s0"];
--- a/hosts/hades/default.nix
+++ b/hosts/hades/default.nix
@ -57,7 +57,7 @@ in {
  my.services = {
    fail2ban.enable = true;

-    forgejo = {
+    gitea = {
      enable = true;
      privatePort = 8082;
    };
@ -81,11 +81,6 @@ in {
      secretConfigFile = config.age.secrets."matrix-synapse/secret-config".path;
    };

-    mealie = {
-      enable = true;
-      port = 8090;
-    };
-
    microbin = {
      enable = true;
      privatePort = 8088;
@ -117,6 +112,11 @@ in {
      secretKeyFile = config.age.secrets."paperless/secret-key".path;
    };

+    photoprism = {
+      enable = true;
+      port = 8084;
+    };
+
    pleroma = {
      enable = true;
      port = 8086;
--- a/hosts/hades/home.nix
+++ b/hosts/hades/home.nix
@ -1,6 +1,8 @@
 {config, ...}: {
  home-manager.users.alarsyo = {
-    home.stateVersion = "22.05";
+    # TODO: can probably upgrade me
+    home.stateVersion = "21.05";
+
    my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
  };
 }
--- a/hosts/hades/secrets.nix
+++ b/hosts/hades/secrets.nix
@ -13,6 +13,8 @@
        // attrs;
    in
      lib.mapAttrs toSecret {
+        "gandi/api-key" = {};
+
        "lohr/shared-secret" = {};

        "matrix-synapse/secret-config" = {
@ -27,8 +29,6 @@
          owner = "nextcloud";
        };

-        "ovh/credentials" = {};
-
        "paperless/admin-password" = {};
        "paperless/secret-key" = {};

--- a/hosts/hephaestus/default.nix
+++ b/hosts/hephaestus/default.nix
@ -0,0 +1,246 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./home.nix
+    ./secrets.nix
+  ];
+
+  hardware.amdgpu.opencl = false;
+
+  boot.kernelPackages = pkgs.linuxPackages;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # boot.initrd.systemd.enable = true;
+  # boot.plymouth.enable = true;
+  # boot.kernelParams = ["quiet"];
+
+  boot.initrd.secrets = {
+    "/crypto_keyfile.bin" = null;
+  };
+
+  boot.tmp.useTmpfs = true;
+
+  services.btrfs = {
+    autoScrub = {
+      enable = true;
+      fileSystems = ["/"];
+    };
+  };
+
+  networking.hostName = "hephaestus"; # Define your hostname.
+  networking.domain = "alarsyo.net";
+
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Paris";
+
+  # List services that you want to enable:
+  my.services = {
+    tailscale = {
+      enable = true;
+      useRoutingFeatures = "client";
+    };
+
+    pipewire.enable = true;
+
+    restic-backup = {
+      enable = true;
+      repo = "b2:hephaestus-backup";
+      passwordFile = config.age.secrets."restic-backup/hephaestus-password".path;
+      environmentFile = config.age.secrets."restic-backup/hephaestus-credentials".path;
+
+      timerConfig = {
+        OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
+      };
+
+      paths = [
+        "/home/alarsyo"
+      ];
+      exclude = [
+        "/home/alarsyo/Downloads"
+
+        # Rust builds using half my storage capacity
+        "/home/alarsyo/**/target"
+        "/home/alarsyo/work/rust/build"
+
+        # don't backup nixpkgs
+        "/home/alarsyo/work/nixpkgs"
+
+        "/home/alarsyo/go"
+
+        # C build crap
+        "*.a"
+        "*.o"
+        "*.so"
+
+        ".direnv"
+
+        # test vms
+        "*.qcow2"
+
+        # secrets stay offline
+        "/home/alarsyo/**/secrets"
+
+        # ignore all dotfiles as .config and .cache can become quite big
+        "/home/alarsyo/.*"
+      ];
+    };
+  };
+
+  virtualisation.docker.enable = true;
+  virtualisation.libvirtd.enable = true;
+  programs.dconf.enable = true;
+
+  services = {
+    tlp = {
+      enable = true;
+      settings = {
+        START_CHARGE_THRESH_BAT0 = 70;
+        STOP_CHARGE_THRESH_BAT0 = 80;
+      };
+    };
+    fwupd.enable = true;
+    openssh.enable = true;
+  };
+
+  my.gui.enable = true;
+  my.displayManager.sddm.enable = lib.mkForce false;
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = false;
+    settings.General.Experimental = true;
+  };
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "fr_FR.UTF-8";
+    LC_IDENTIFICATION = "fr_FR.UTF-8";
+    LC_MEASUREMENT = "fr_FR.UTF-8";
+    LC_MONETARY = "fr_FR.UTF-8";
+    LC_NAME = "fr_FR.UTF-8";
+    LC_PAPER = "fr_FR.UTF-8";
+    LC_TELEPHONE = "fr_FR.UTF-8";
+  };
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the KDE Plasma Desktop Environment.
+  services.xserver.displayManager.sddm.enable = true;
+  services.xserver.desktopManager.plasma5.enable = true;
+  services.power-profiles-daemon.enable = false;
+
+  services.autorandr = {
+    enable = true;
+    profiles = {
+      default = {
+        fingerprint = {
+          "eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
+        };
+        config = {
+          "eDP-1" = {
+            enable = true;
+            crtc = 0;
+            primary = true;
+            position = "0x0";
+            mode = "1920x1080";
+          };
+        };
+      };
+      dock = {
+        fingerprint = {
+          "eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
+          "DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
+          "DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
+        };
+        config = {
+          "eDP-1" = {
+            enable = true;
+            primary = false;
+            position = "3000x840";
+            mode = "1920x1080";
+          };
+          "DP-4" = {
+            enable = true;
+            primary = true;
+            position = "0x420";
+            mode = "1920x1080";
+          };
+          "DP-5" = {
+            enable = true;
+            primary = false;
+            position = "1920x0";
+            mode = "1920x1080";
+            rotate = "left";
+          };
+        };
+      };
+      dock-lid-closed = {
+        fingerprint = {
+          "DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
+          "DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
+        };
+        config = {
+          "DP-4" = {
+            enable = true;
+            primary = true;
+            position = "0x420";
+            mode = "1920x1080";
+          };
+          "DP-5" = {
+            enable = true;
+            primary = false;
+            position = "1920x0";
+            mode = "1920x1080";
+            rotate = "left";
+          };
+        };
+      };
+    };
+  };
+
+  systemd.services.autorandr-lid-listener = {
+    wantedBy = ["multi-user.target"];
+    description = "Listening for lid events to invoke autorandr";
+
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = let
+        stdbufExe = lib.getExe' pkgs.coreutils "stdbuf";
+        libinputExe = lib.getExe' pkgs.libinput "libinput";
+        grepExe = lib.getExe pkgs.gnugrep;
+        autorandrExe = lib.getExe pkgs.autorandr;
+      in
+        pkgs.writeShellScript "lid-listener.sh" ''
+          ${stdbufExe} -oL ${libinputExe} debug-events |
+            ${grepExe} -E --line-buffered '^[[:space:]-]+event[0-9]+[[:space:]]+SWITCH_TOGGLE[[:space:]]' |
+            while read line; do
+              ${pkgs.systemd}/bin/systemctl start --no-block autorandr.service
+            done
+        '';
+      Restart = "always";
+      RestartSec = "30";
+    };
+  };
+
+  # Configure console keymap
+  console.keyMap = "us";
+
+  programs.light.enable = true;
+}
--- a/hosts/hephaestus/hardware-configuration.nix
+++ b/hosts/hephaestus/hardware-configuration.nix
@ -0,0 +1,45 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-amd"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/54ded736-367c-4081-9978-9e2d8f61cb1b";
+    fsType = "btrfs";
+    options = ["subvol=@"];
+  };
+
+  boot.initrd.luks.devices."luks-df96458d-45a1-4a30-8633-58feeff603f8".device = "/dev/disk/by-uuid/df96458d-45a1-4a30-8633-58feeff603f8";
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/826A-23F7";
+    fsType = "vfat";
+  };
+
+  swapDevices = [];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0f0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/hosts/hephaestus/home.nix
+++ b/hosts/hephaestus/home.nix
@ -0,0 +1,49 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  home-manager.users.alarsyo = {
+    # TODO: can probably upgrade me
+    home.stateVersion = "21.05";
+
+    my.home.laptop.enable = true;
+
+    # Keyboard settings & i3 settings
+    my.home.x.enable = true;
+    my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
+    my.home.x.i3bar.temperature.inputs = ["Tctl"];
+    my.home.x.i3bar.networking.throughput_interfaces = ["wlp3s0" "enp6s0f3u1u1"];
+    my.home.emacs.enable = true;
+
+    my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
+
+    # TODO: place in global home conf
+    services.dunst.enable = true;
+
+    home.packages = builtins.attrValues {
+      inherit
+        (pkgs)
+        # some websites only work there :(
+        
+        chromium
+        darktable
+        # dev
+        
+        rustup
+        gdb
+        valgrind
+        arandr
+        zotero
+        ;
+
+      inherit
+        (pkgs.packages)
+        ansel
+        spot
+        ;
+
+      inherit (pkgs.wineWowPackages) stable;
+    };
+  };
+}
--- a/hosts/hephaestus/secrets.nix
+++ b/hosts/hephaestus/secrets.nix
@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  options,
+  ...
+}: {
+  config.age = {
+    secrets = let
+      toSecret = name: {...} @ attrs:
+        {
+          file = ./../../modules/secrets + "/${name}.age";
+        }
+        // attrs;
+    in
+      lib.mapAttrs toSecret {
+        "restic-backup/hephaestus-credentials" = {};
+        "restic-backup/hephaestus-password" = {};
+
+        "users/alarsyo-hashed-password" = {};
+        "users/root-hashed-password" = {};
+      };
+  };
+}
--- a/hosts/talos/default.nix
+++ b/hosts/talos/default.nix
@ -16,16 +16,9 @@
    ./secrets.nix
  ];

-  boot.kernelPackages = pkgs.linuxPackages_6_11;
-  # Set Wi-Fi regulatory domain. Currently always set to '00' (world), and could
-  # lead to bad Wi-Fi performance
-  boot.kernelParams = ["cfg80211.ieee80211_regdom=FR"];
-  boot.extraModulePackages = with config.boot.kernelPackages; [
-    v4l2loopback
-  ];
-  boot.extraModprobeConfig = ''
-    options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
-  '';
+  hardware.amdgpu.opencl = false;
+
+  boot.kernelPackages = pkgs.linuxPackages_6_6;

  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot = {
@ -48,10 +41,7 @@
  networking.domain = "alarsyo.net";
  # Pick only one of the below networking options.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  networking.networkmanager = {
-    enable = true;
-    wifi.powersave = true;
-  };
+  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.

  # Set your time zone.
  time.timeZone = "Europe/Paris";
@ -61,6 +51,7 @@
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  programs = {
+    dconf.enable = true;
    light.enable = true;
  };
  services = {
@ -69,10 +60,7 @@
  };
  virtualisation = {
    docker.enable = true;
-    libvirtd.enable = false;
-    virtualbox.host = {
-      enable = false;
-    };
+    libvirtd.enable = true;
  };

  my.services = {
@ -82,54 +70,10 @@
    };

    pipewire.enable = true;
-
-    restic-backup = {
-      enable = true;
-      repo = "b2:talos-backup";
-      passwordFile = config.age.secrets."restic-backup/talos-password".path;
-      environmentFile = config.age.secrets."restic-backup/talos-credentials".path;
-
-      timerConfig = {
-        OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
-      };
-
-      paths = [
-        "/home/alarsyo"
-      ];
-      exclude = [
-        "/home/alarsyo/Downloads"
-
-        # Rust builds using half my storage capacity
-        "/home/alarsyo/**/target"
-        "/home/alarsyo/work/rust/build"
-
-        # don't backup nixpkgs
-        "/home/alarsyo/work/nixpkgs"
-
-        "/home/alarsyo/go"
-
-        # C build crap
-        "*.a"
-        "*.o"
-        "*.so"
-
-        ".direnv"
-
-        # test vms
-        "*.qcow2"
-        "*.vbox"
-        "*.vdi"
-
-        # secrets stay offline
-        "/home/alarsyo/**/secrets"
-
-        # ignore all dotfiles as .config and .cache can become quite big
-        "/home/alarsyo/.*"
-      ];
-    };
  };

  my.gui.enable = true;
+  my.displayManager.sddm.enable = lib.mkForce false;

  hardware.bluetooth = {
    enable = true;
@ -152,21 +96,22 @@
    LC_TELEPHONE = "fr_FR.UTF-8";
  };

+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
  # Enable the KDE Plasma Desktop Environment.
-  services.desktopManager.plasma6.enable = true;
+  services.xserver.displayManager.sddm = {
+    enable = true;
+    wayland.enable = true;
+  };
+  services.xserver.desktopManager.plasma5.enable = true;
  services.power-profiles-daemon.enable = true;

-  environment.systemPackages = [
-    pkgs.unstable.zed-editor
-    pkgs.foot
-  ];
-
-  #programs.hyprland.enable = true;
+  programs.hyprland.enable = true;
  programs.sway = {
    enable = true;
    wrapperFeatures.gtk = true;
  };
-
  # Copy the NixOS configuration file and link it from the resulting system
  # (/run/current-system/configuration.nix). This is useful in case you
  # accidentally delete configuration.nix.
--- a/hosts/talos/disko-config.nix
+++ b/hosts/talos/disko-config.nix
@ -20,7 +20,7 @@
              };
            };
            luks = {
-              size = "600G";
+              size = "100%";
              content = {
                type = "luks";
                name = "crypted";
@ -35,24 +35,19 @@
                  type = "btrfs";
                  extraArgs = ["-f"];
                  subvolumes = {
-                    "@" = {
+                    "/root" = {
                      mountpoint = "/";
                      mountOptions = ["compress=zstd" "noatime"];
                    };
-                    "@home" = {
+                    "/home" = {
                      mountpoint = "/home";
                      mountOptions = ["compress=zstd" "noatime"];
                    };
-                    "@nix" = {
+                    "/nix" = {
                      mountpoint = "/nix";
                      mountOptions = ["compress=zstd" "noatime"];
                    };
-                    "@persist" = {
-                      mountpoint = "/persist";
-                      mountOptions = ["compress=zstd" "noatime"];
-                    };
-                    "@snapshots" = {};
-                    "@swap" = {
+                    "/swap" = {
                      mountpoint = "/.swapvol";
                      swap.swapfile.size = "8G";
                    };
--- a/hosts/talos/home.nix
+++ b/hosts/talos/home.nix
@ -1,16 +1,10 @@
 {
  config,
-  lib,
  pkgs,
  ...
-}: let
-  inherit
-    (lib)
-    mkOptionDefault
-    ;
-in {
+}: {
  home-manager.users.alarsyo = {
-    home.stateVersion = "23.11";
+    home.stateVersion = "24.05";

    my.home.laptop.enable = true;

@ -29,101 +23,26 @@ in {
    home.packages = builtins.attrValues {
      inherit
        (pkgs)
-        ansel
-        chromium # some websites only work there :(
+        # some websites only work there :(
+        
+        chromium
+        darktable
+        # dev
+        
+        rustup
+        gdb
+        valgrind
+        arandr
        zotero
        ;

-      inherit
-        (pkgs.packages)
-        spot
-        ;
-    };
+      #inherit
+      #  (pkgs.packages)
+      #  ansel
+      #  spot
+      #  ;

-    wayland.windowManager.sway = {
-      enable = true;
-      swaynag.enable = true;
-      wrapperFeatures.gtk = true;
-      config = {
-        modifier = "Mod4";
-        input = {
-          "type:keyboard" = {
-            xkb_layout = "fr";
-            xkb_variant = "us";
-          };
-          "type:touchpad" = {
-            dwt = "enabled";
-            tap = "enabled";
-            middle_emulation = "enabled";
-            natural_scroll = "enabled";
-          };
-        };
-        output = {
-          "eDP-1" = {
-            scale = "1.5";
-          };
-        };
-        fonts = {
-          names = ["Iosevka Fixed" "FontAwesome6Free"];
-          size = 9.0;
-        };
-        bars = [
-          {
-            mode = "dock";
-            hiddenState = "hide";
-            position = "top";
-            workspaceButtons = true;
-            workspaceNumbers = true;
-            statusCommand = "${pkgs.i3status}/bin/i3status";
-            fonts = {
-              names = ["Iosevka Fixed" "FontAwesome6Free"];
-              size = 9.0;
-            };
-            trayOutput = "primary";
-            colors = {
-              background = "#000000";
-              statusline = "#ffffff";
-              separator = "#666666";
-              focusedWorkspace = {
-                border = "#4c7899";
-                background = "#285577";
-                text = "#ffffff";
-              };
-              activeWorkspace = {
-                border = "#333333";
-                background = "#5f676a";
-                text = "#ffffff";
-              };
-              inactiveWorkspace = {
-                border = "#333333";
-                background = "#222222";
-                text = "#888888";
-              };
-              urgentWorkspace = {
-                border = "#2f343a";
-                background = "#900000";
-                text = "#ffffff";
-              };
-              bindingMode = {
-                border = "#2f343a";
-                background = "#900000";
-                text = "#ffffff";
-              };
-            };
-          }
-        ];
-
-        keybindings = mkOptionDefault {
-          "Mod4+i" = "exec emacsclient --create-frame";
-        };
-      };
-    };
-    programs = {
-      fuzzel.enable = true;
-      swaylock.enable = true;
-      waybar = {
-        enable = true;
-      };
+      inherit (pkgs.wineWowPackages) stable;
    };
  };
 }
--- a/hosts/talos/secrets.nix
+++ b/hosts/talos/secrets.nix
@ -13,8 +13,8 @@
        // attrs;
    in
      lib.mapAttrs toSecret {
-        "restic-backup/talos-credentials" = {};
-        "restic-backup/talos-password" = {};
+        #"restic-backup/hephaestus-credentials" = {};
+        #"restic-backup/hephaestus-password" = {};

        "users/alarsyo-hashed-password" = {};
        "users/root-hashed-password" = {};
--- a/hosts/thanatos/default.nix
+++ b/hosts/thanatos/default.nix
@ -35,56 +35,6 @@ in {
  };

  services = {
-    gitlab-runner = {
-      enable = true;
-      settings = {
-        concurrent = 4;
-      };
-      services = {
-        nix = {
-          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-nix-runner-env".path;
-          dockerImage = "alpine";
-          dockerVolumes = [
-            "/nix/store:/nix/store:ro"
-            "/nix/var/nix/db:/nix/var/nix/db:ro"
-            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
-          ];
-          dockerDisableCache = true;
-          preBuildScript = pkgs.writeScript "setup-container" ''
-            mkdir -p -m 0755 /nix/var/log/nix/drvs
-            mkdir -p -m 0755 /nix/var/nix/gcroots
-            mkdir -p -m 0755 /nix/var/nix/profiles
-            mkdir -p -m 0755 /nix/var/nix/temproots
-            mkdir -p -m 0755 /nix/var/nix/userpool
-            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
-            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
-            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
-            mkdir -p -m 0700 "$HOME/.nix-defexpr"
-
-            . ${pkgs.nix}/etc/profile.d/nix.sh
-
-            ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
-
-            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
-            ${pkgs.nix}/bin/nix-channel --update nixpkgs
-
-            mkdir -p ~/.config/nix
-            echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
-          '';
-          environmentVariables = {
-            ENV = "/etc/profile";
-            USER = "root";
-            NIX_REMOTE = "daemon";
-            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
-            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
-          };
-        };
-        default = {
-          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path;
-          dockerImage = "debian:stable";
-        };
-      };
-    };
    openssh.enable = true;
  };

--- a/hosts/thanatos/home.nix
+++ b/hosts/thanatos/home.nix
@ -1,6 +1,7 @@
 {config, ...}: {
  home-manager.users.alarsyo = {
-    home.stateVersion = "23.11";
+    # TODO: can probably upgrade me
+    home.stateVersion = "21.05";

    my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
  };
--- a/hosts/thanatos/secrets.nix
+++ b/hosts/thanatos/secrets.nix
@ -15,8 +15,6 @@
      lib.mapAttrs toSecret {
        "users/alarsyo-hashed-password" = {};
        "users/root-hashed-password" = {};
-        "gitlab-runner/thanatos-runner-env" = {};
-        "gitlab-runner/thanatos-nix-runner-env" = {};
      };
  };
 }
--- a/modules/sddm.nix
+++ b/modules/sddm.nix
@ -15,17 +15,23 @@ in {
  options.my.displayManager.sddm.enable = mkEnableOption "SDDM setup";

  config = mkIf cfg.enable {
-    services.displayManager.sddm = {
+    services.xserver.displayManager.sddm = {
      enable = true;
-      theme = "catppuccin-latte";
-      wayland.enable = true;
+      theme = "sugar-candy";
    };

-    environment.systemPackages = [
-      (pkgs.catppuccin-sddm.override
-        {
-          flavor = "latte";
-        })
-    ];
+    environment.systemPackages = builtins.attrValues {
+      inherit
+        (pkgs.packages)
+        sddm-sugar-candy
+        ;
+
+      inherit
+        (pkgs.libsForQt5.qt5)
+        qtgraphicaleffects
+        qtquickcontrols2
+        qtsvg
+        ;
+    };
  };
 }
--- a/modules/secrets/gitlab-runner/thanatos-nix-runner-env.age
+++ b/modules/secrets/gitlab-runner/thanatos-nix-runner-env.age
--- a/modules/secrets/gitlab-runner/thanatos-runner-env.age
+++ b/modules/secrets/gitlab-runner/thanatos-runner-env.age
@ -1,7 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 k2gHjw naNq55qkAm47KXPJpYFDjVQuxPz2Ffpima5z1WEqRSA
-ETC3Hh4gglwYpiJCu/EGOUzjN3BJYk8yJshMeMkgYug
-> ssh-ed25519 6UUuZw Azk9jDbUL/nO20lvzs0s36q/4ZcWSpkUbt1J/PE7A2M
-kPKHGLoWHDpFhsRr+CBteWKYsDw0dn/+IKbrh/5qMoE
--- g1akMn28voSQByQR9/ArJ4CsQehcwJ7MfCco+k2fPWo
-› YMZÓíî:ú{R^n~ó½±ã¢ÊwPaª§h£8<C2A3>T'hcmªe(<28>‘ÝXx=7”‹‡Ë¢[äË4@b=“&ª®æYÅ;‘€Ü[„ª¹ØÁˆß¿kôk>ˆ5’4‚0ÞGâŒ÷ðÌŸ±Q<C2B1>Êë·±Ÿw¡
--- a/modules/secrets/ovh/credentials.age
+++ b/modules/secrets/ovh/credentials.age
@ -1,7 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 k2gHjw XED7gkKAp1ioBegA7ryqULRF1BORpW74esfIGp9zPE8
-ANxnQN+tox9KYdZvNZFZvQxOymckldPQMhFnz6fSIBo
-> ssh-ed25519 pX8y2g 9wgPqL6GoOxad5AAUmDAYj0h/57AEM8VsQKq1pGTtjM
-SxD++XJioZLpt6C8Xse5Nmz4wtL0Fb5NKWo5ijKpyv8
--- 3qOJnkY3Uc4fIex9mgz2+w+su5dS7K7Tmtk1hiqkn9M
-ÁXª¨àeéˆaLQH2*ZÅTé¿ ‘®P;Ý(jCÌ€k‡viäµû<C2B5>ÿ’Ä§¡à†kæ`™ô]mò<6D>ÿBñ,³±,ü÷?!¶{àŠ%eÙì(„Su¿-SŸD¢¾“=H#‡„¼Þq=ï<>Uùí;=OÍ<÷R¼ÇÎE±“<+&èdÂæ<18>>G+_oP¥Þ]ÿê¦RÄßL$Ö³\š°ü0ø¤N!þ"Áã&÷%Nž à<ËÃ,òv°1ÿ‘Ê‘Új1
--- a/modules/secrets/restic-backup/hephaestus-credentials.age
+++ b/modules/secrets/restic-backup/hephaestus-credentials.age
@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw tTdHZJpSocTHlznYH9eRzeZkrYBbsdT4F8jV1FKw/yk
+xKIkYhL/A8wTy6LqDkTuUvm4rhDI6+DXwjzl43PcR8E
+-> ssh-ed25519 SYm+hA vzQCZWYdgG0yxUEyGJ4Q8EAh1Kzw5CutDa6q6XSaels
+Y7VqpvLfrUvWZcXqGeulRld9kff03kgzz22UBW77AOw
+-> j-c8-grease
+WeQ
+--- KHLA1KlfWM432GDbPIiKInzZeqVRJZ2YCKtF3qClfgs
+ ü8Êâ5œ¢|<7C>ŒòQx_5':Á½È´A?îÎÚ¡ÄÛ 	ØŠ¾þèoA‘x‰)rýd!Š(´®”èÑ¨5£¸ìô~ý\†ŽLd"^ÑZ¨Z^®…Vï/‡§5Ë•¶¢¨Ý¦<C39D>aè¯²áá¸·o]O/®Eueà†
--- a/modules/secrets/restic-backup/hephaestus-password.age
+++ b/modules/secrets/restic-backup/hephaestus-password.age
@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw 2/spllcr7Fo+1sQ4VJW/MywBVUcpKEbicv4vZQyre0c
+Vc2Wugxc5M4i73UKMFXWA2PeHgUOm/+HekoeYt9ycro
+-> ssh-ed25519 SYm+hA KFjo2JVxpdOey8A7GAKeZci+ezE0RYBRKR8vNtloU3M
+SAzpTjF/RGOgjawT2Sk5H7TNnk/SdbksuAcZZqakJOs
+-> !!6BS-grease Gs<Om0
+d7WvJNMg3OX9CwWvGNWCuViu1X+e9oFE5vZQixfaJI3xKax2lTNh
+--- QICRX2ve/1CFNHjnVXDpue3DRlFbTftu9yrWw745gVk
+|†`F…3Þ°˜¤VEû²ÊósßK³ÞQwÿÙ$ùÉŒ{‘¨¯†>¹Hˆ7Þh™î”Ä©Û’2ÅïÂÈÆcH^¸“×÷Ÿ© X_ñæzv'¢ÄÐ!ZkÂš_„þÉ0Ë}Yo•je§¼<icé{SkÁ|1Ÿalé*ü7ÓÖ3ÅŒF«Þ9j¬\§X{¢¾#H7ÑŒ¢!><.^¸¿[ï£q4åpP
--- a/modules/secrets/restic-backup/talos-credentials.age
+++ b/modules/secrets/restic-backup/talos-credentials.age
@ -1,7 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 k2gHjw WWJQxqfxQzLmBFPpTzuKBMhAl+ZxnQdvnaDvfpwxR00
-tEsf6xSw/MP/qJnr/SyLlkEEf/LaI7IxjVzaxRwh5FI
-> ssh-ed25519 nh0dAQ yRu0VZqx+DuB3SSQaVtg+txuRu9OyJDfLDNCKg9XYk0
-xTpucapaejG2EMrZLIDt46JD3QYM4XXT1Y2F77HPQO8
--- uZjO0dDIFesU2B/GkjpqrOJas1+K6hGbQAdFV/t1GOk
-BVÍµÇ\Õ	8Û‘¾ºý[%<25>½l^>9<>\Eö5¹šþ¿Új(6èÜgå;(I7CS4èv6ièÉÐþSªÐXïC»ï`OòT™ŒÓÚ\ô;I·Ýœò6ƒ<36>_k˜éy-‡±¹½qKl†¾ôKþÓ hŠ?tô
--- a/modules/secrets/restic-backup/talos-password.age
+++ b/modules/secrets/restic-backup/talos-password.age
--- a/modules/secrets/secrets.nix
+++ b/modules/secrets/secrets.nix
@ -4,18 +4,16 @@ let

  boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal";
  hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades";
+  hephaestus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7Cp+n5+huof68QlAoJV8bVf5h5p9kEZFAVpltWopdL root@hephaestus";
  talos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBYcmL9HZJ9SqB9OJwQ0Nt6ZbvHZTS+fzM8A6D5MPZs root@talos";
  thanatos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID8JEAWk/8iSl8fN6/f76JkmVFwtyixTpLol4zSVsnVw root@thanatos";

-  machines = [boreal hades talos thanatos];
+  machines = [boreal hades hephaestus talos thanatos];

  all = users ++ machines;
 in {
  "gandi/api-key.age".publicKeys = [alarsyo hades];

-  "gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
-  "gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];
-
  "lohr/shared-secret.age".publicKeys = [alarsyo hades];

  "matrix-synapse/secret-config.age".publicKeys = [alarsyo hades];
@ -26,8 +24,6 @@ in {

  "nextcloud/admin-pass.age".publicKeys = [alarsyo hades];

-  "ovh/credentials.age".publicKeys = [alarsyo hades];
-
  "paperless/admin-password.age".publicKeys = [alarsyo hades];
  "paperless/secret-key.age".publicKeys = [alarsyo hades];

@ -37,8 +33,8 @@ in {
  "restic-backup/boreal-credentials.age".publicKeys = [alarsyo boreal];
  "restic-backup/hades-password.age".publicKeys = [alarsyo hades];
  "restic-backup/hades-credentials.age".publicKeys = [alarsyo hades];
-  "restic-backup/talos-password.age".publicKeys = [alarsyo talos];
-  "restic-backup/talos-credentials.age".publicKeys = [alarsyo talos];
+  "restic-backup/hephaestus-password.age".publicKeys = [alarsyo hephaestus];
+  "restic-backup/hephaestus-credentials.age".publicKeys = [alarsyo hephaestus];

  "users/root-hashed-password.age".publicKeys = machines ++ [alarsyo];
  "users/alarsyo-hashed-password.age".publicKeys = machines ++ [alarsyo];
--- a/pkgs/ansel/default.nix
+++ b/pkgs/ansel/default.nix
@ -0,0 +1,155 @@
+{
+  cmake,
+  colord,
+  colord-gtk,
+  curl,
+  dav1d,
+  desktop-file-utils,
+  exiftool,
+  exiv2,
+  fetchFromGitHub,
+  glib,
+  gmic,
+  graphicsmagick,
+  gtk3,
+  icu,
+  intltool,
+  isocodes,
+  jasper,
+  json-glib,
+  lcms,
+  lensfun,
+  lib,
+  libXdmcp,
+  libXtst,
+  libaom,
+  libavif,
+  libdatrie,
+  libde265,
+  libepoxy,
+  libffi,
+  libgcrypt,
+  libgpg-error,
+  libheif,
+  libjpeg,
+  libpsl,
+  librsvg,
+  libsecret,
+  libselinux,
+  libsepol,
+  libsoup,
+  libsysprof-capture,
+  libthai,
+  libwebp,
+  libxkbcommon,
+  libxml2,
+  libxslt,
+  llvmPackages,
+  openexr_3,
+  openjpeg,
+  osm-gps-map,
+  pcre,
+  pcre2,
+  perlPackages,
+  pkg-config,
+  pugixml,
+  python3Packages,
+  rav1e,
+  sqlite,
+  stdenv,
+  util-linux,
+  wrapGAppsHook,
+  x265,
+}:
+stdenv.mkDerivation {
+  pname = "ansel";
+  version = "unstable-2024-01-05";
+
+  src = fetchFromGitHub {
+    owner = "aurelienpierreeng";
+    repo = "ansel";
+    rev = "e2c4a0a60cd80f741dd3d3c6ab72be9ac11234fb";
+    hash = "sha256-Kg020MHy9fn1drCk+66f25twqczvD/5evutDODqOjYM=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    desktop-file-utils
+    exiftool
+    intltool
+    libxml2
+    llvmPackages.clang
+    llvmPackages.llvm
+    pkg-config
+    perlPackages.perl
+    python3Packages.jsonschema
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    colord
+    colord-gtk
+    curl
+    dav1d
+    exiv2
+    json-glib
+    glib
+    gmic
+    graphicsmagick
+    gtk3
+    icu
+    isocodes
+    jasper
+    lcms
+    lensfun
+    libaom
+    libavif
+    libdatrie
+    libde265
+    libepoxy
+    libffi
+    libgcrypt
+    libgpg-error
+    libheif
+    libjpeg
+    libpsl
+    librsvg
+    libsecret
+    libselinux
+    libsepol
+    libsoup
+    libsysprof-capture
+    libthai
+    libwebp
+    libXdmcp
+    libxkbcommon
+    libxslt
+    libXtst
+    openexr_3
+    openjpeg
+    osm-gps-map
+    pcre
+    pcre2
+    perlPackages.Po4a
+    pugixml
+    rav1e
+    sqlite
+    util-linux
+    x265
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH ":" "$out/lib/ansel"
+    )
+  '';
+
+  meta = {
+    description = "A darktable fork minus the bloat plus some design vision";
+    homepage = "https://ansel.photos/";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "ansel";
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@ -1,4 +1,5 @@
 {pkgs}: {
+  ansel = pkgs.callPackage ./ansel {};
  sddm-sugar-candy = pkgs.callPackage ./sddm-sugar-candy {};
  kaleidoscope-udev-rules = pkgs.callPackage ./kaleidoscope-udev-rules {};
  grafanaDashboards = pkgs.recurseIntoAttrs (pkgs.callPackage ./grafana-dashboards {});
--- a/pkgs/spot/default.nix
+++ b/pkgs/spot/default.nix
@ -3,7 +3,7 @@
  fetchurl,
  python3,
 }: let
-  version = "2.12.1";
+  version = "2.11.6";
 in
  stdenv.mkDerivation {
    inherit version;
@ -15,6 +15,6 @@ in

    src = fetchurl {
      url = "https://www.lrde.epita.fr/dload/spot/spot-${version}.tar.gz";
-      sha256 = "sha256-VHfAjU4dBi8WTC5IaoNVaSXQfXDyGA3nBq96qUnG/1w=";
+      sha256 = "sha256-ppJ5T4nA2zlWulkZvdUxPjcuDeNAAKkCLynhxukcU4o=";
    };
  }
--- a/services/default.nix
+++ b/services/default.nix
@ -3,13 +3,11 @@
    ./vaultwarden.nix
    ./fail2ban.nix
    ./fava.nix
-    ./forgejo
    ./gitea
    ./immich.nix
    ./jellyfin.nix
    ./lohr.nix
    ./matrix.nix
-    ./mealie.nix
    ./media.nix
    ./microbin.nix
    ./miniflux.nix
--- a/services/forgejo/default.nix
+++ b/services/forgejo/default.nix
@ -1,129 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit
-    (lib)
-    mkEnableOption
-    mkIf
-    mkOption
-    ;
-
-  cfg = config.my.services.forgejo;
-  my = config.my;
-
-  domain = config.networking.domain;
-  hostname = config.networking.hostName;
-  fqdn = "${hostname}.${domain}";
-
-  forgejoUser = "git";
-in {
-  options.my.services.forgejo = let
-    inherit (lib) types;
-  in {
-    enable = mkEnableOption "Personal Git hosting with Forgejo";
-
-    privatePort = mkOption {
-      type = types.port;
-      default = 8082;
-      example = 8082;
-      description = "Port to serve the app";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    # use git as user to have `git clone git@git.domain`
-    users.users.${forgejoUser} = {
-      description = "Forgejo Service";
-      home = config.services.forgejo.stateDir;
-      useDefaultShell = true;
-      group = forgejoUser;
-
-      # the systemd service for the forgejo module seems to hardcode the group as
-      # forgejo, so, uh, just in case?
-      extraGroups = ["forgejo"];
-
-      isSystemUser = true;
-    };
-    users.groups.${forgejoUser} = {};
-
-    services.forgejo = {
-      enable = true;
-      user = forgejoUser;
-      group = config.users.users.${forgejoUser}.group;
-      stateDir = "/var/lib/${forgejoUser}";
-
-      lfs.enable = true;
-
-      settings = {
-        server = {
-          ROOT_URL = "https://git.${domain}/";
-          DOMAIN = "git.${domain}";
-          HTTP_ADDR = "127.0.0.1";
-          HTTP_PORT = cfg.privatePort;
-        };
-        log.LEVEL = "Warn"; # [ "Trace" "Debug" "Info" "Warn" "Error" "Critical" ]
-        repository = {
-          ENABLE_PUSH_CREATE_USER = true;
-          DEFAULT_BRANCH = "main";
-        };
-
-        # NOTE: temporarily remove this for initial setup
-        service.DISABLE_REGISTRATION = true;
-
-        # only send cookies via HTTPS
-        session.COOKIE_SECURE = true;
-
-        DEFAULT.APP_NAME = "Personal Forge";
-      };
-
-      # NixOS module uses `forgejo dump` to backup repositories and the database,
-      # but it produces a single .zip file that's not very restic friendly.
-      # I configure my backup system manually below.
-      dump.enable = false;
-
-      database = {
-        type = "postgres";
-        # user needs to be the same as forgejo user
-        user = forgejoUser;
-        name = forgejoUser;
-      };
-    };
-
-    # FIXME: Borg *could* be backing up files while they're being edited by
-    # forgejo, so it may produce corrupt files in the snapshot if I push stuff
-    # around midnight. I'm not sure how `forgejo dump` handles this either,
-    # though.
-    my.services.restic-backup = {
-      paths = [
-        config.services.forgejo.lfs.contentDir
-        config.services.forgejo.repositoryRoot
-      ];
-    };
-
-    # NOTE: no need to use postgresql.ensureDatabases because the forgejo module
-    # takes care of this automatically
-    services.postgresqlBackup = {
-      databases = [config.services.forgejo.database.name];
-    };
-
-    services.nginx = {
-      virtualHosts = {
-        "git.${domain}" = {
-          forceSSL = true;
-          useACMEHost = fqdn;
-
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
-          };
-        };
-      };
-    };
-
-    security.acme.certs.${fqdn}.extraDomainNames = ["git.${domain}"];
-
-    systemd.services.forgejo.preStart = "${pkgs.coreutils}/bin/ln -sfT ${./templates} ${config.services.forgejo.stateDir}/custom/templates";
-  };
-}
--- a/services/forgejo/templates/home.tmpl
+++ b/services/forgejo/templates/home.tmpl
@ -1,17 +0,0 @@
-{{template "base/head" .}}
-<div class="page-content home">
-	<div class="ui stackable middle very relaxed page grid">
-		<div class="sixteen wide center aligned centered column">
-			<div>
-				<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
-			</div>
-			<div class="hero">
-				<h1 class="ui icon header title">
-					{{AppName}}
-				</h1>
-				<h2>alarsyo's personal projects are hosted here</h2>
-			</div>
-		</div>
-	</div>
-</div>
-{{template "base/footer" .}}
--- a/services/immich.nix
+++ b/services/immich.nix
@ -74,7 +74,7 @@ in {
          proxy_connect_timeout 600;
          proxy_read_timeout 600;
          proxy_send_timeout 600;
-          client_max_body_size 1000m;
+          client_max_body_size 100m;
          access_log syslog:server=unix:/dev/log,tag=immich;
        '';
      };
--- a/services/mealie.nix
+++ b/services/mealie.nix
@ -1,122 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit
-    (lib)
-    mkEnableOption
-    mkIf
-    mkOption
-    ;
-
-  cfg = config.my.services.mealie;
-  my = config.my;
-
-  domain = config.networking.domain;
-  hostname = config.networking.hostName;
-  fqdn = "${hostname}.${domain}";
-  pkg = pkgs.unstable.mealie;
-  listenAddress = "127.0.0.1";
-in {
-  options.my.services.mealie = let
-    inherit (lib) types;
-  in {
-    enable = mkEnableOption "Mealie";
-    port = mkOption {
-      type = types.port;
-      example = 8080;
-      description = "Internal port for Mealie webapp";
-    };
-    credentialsFile = lib.mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      example = "/run/secrets/mealie-credentials.env";
-      description = ''
-        File containing credentials used in mealie such as {env}`POSTGRES_PASSWORD`
-        or sensitive LDAP options.
-
-        Expects the format of an `EnvironmentFile=`, as described by {manpage}`systemd.exec(5)`.
-      '';
-    };
-  };
-
-  # FIXME(NixOS 24.11) Copy pasted from nixpkgs master module, because some needed changes weren't in stable yet.
-  config = mkIf cfg.enable (let
-    settings = {
-      ALLOW_SIGNUP = "false";
-      BASE_URL = "https://mealie.${domain}";
-      TZ = config.time.timeZone;
-
-      # Use PostgreSQL
-      DB_ENGINE = "postgres";
-
-      # Settings for Mealie 1.7+
-      POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
-    };
-  in {
-    systemd.services = {
-      mealie = {
-        after = ["network-online.target" "postgresql.service"];
-        requires = ["postgresql.service"];
-        wants = ["network-online.target"];
-        wantedBy = ["multi-user.target"];
-
-        description = "Mealie, a self hosted recipe manager and meal planner";
-
-        environment =
-          {
-            PRODUCTION = "true";
-            API_PORT = toString cfg.port;
-            BASE_URL = "http://localhost:${toString cfg.port}";
-            DATA_DIR = "/var/lib/mealie";
-            CRF_MODEL_PATH = "/var/lib/mealie/model.crfmodel";
-          }
-          // (builtins.mapAttrs (_: val: toString val) settings);
-
-        serviceConfig = {
-          DynamicUser = true;
-          User = "mealie";
-          ExecStartPre = "${pkg}/libexec/init_db";
-          ExecStart = "${lib.getExe pkg} -b ${listenAddress}:${builtins.toString cfg.port}";
-          EnvironmentFile = lib.mkIf (cfg.credentialsFile != null) cfg.credentialsFile;
-          StateDirectory = "mealie";
-          StandardOutput = "journal";
-        };
-      };
-    };
-
-    # Set-up database
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = ["mealie"];
-      ensureUsers = [
-        {
-          name = "mealie";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
-    services.postgresqlBackup = {
-      databases = ["mealie"];
-    };
-
-    services.nginx.virtualHosts."mealie.${domain}" = {
-      forceSSL = true;
-      useACMEHost = fqdn;
-
-      locations."/" = {
-        proxyPass = "http://${listenAddress}:${toString cfg.port}/";
-        proxyWebsockets = true;
-      };
-    };
-
-    security.acme.certs.${fqdn}.extraDomainNames = ["mealie.${domain}"];
-
-    my.services.restic-backup = {
-      paths = ["/var/lib/mealie"];
-    };
-  });
-}
--- a/services/nextcloud.nix
+++ b/services/nextcloud.nix
@ -62,11 +62,15 @@ in {

      hostName = "cloud.${domain}";
      https = true;
-      package = pkgs.nextcloud29;
+      package = pkgs.nextcloud27;

      maxUploadSize = "1G";

      config = {
+        overwriteProtocol = "https";
+
+        defaultPhoneRegion = "FR";
+
        dbtype = "pgsql";
        dbuser = "nextcloud";
        dbname = dbName;
@ -75,11 +79,6 @@ in {
        adminuser = "admin";
        adminpassFile = cfg.adminpassFile;
      };
-
-      settings = {
-        default_phone_region = "FR";
-        overwriteprotocol = "https";
-      };
    };

    users.groups.media.members = ["nextcloud"];
--- a/services/nginx.nix
+++ b/services/nginx.nix
@ -66,8 +66,8 @@ in {
        gandiKey = config.my.secrets.gandiKey;
      in {
        "${fqdn}" = {
-          dnsProvider = "ovh";
-          credentialsFile = config.age.secrets."ovh/credentials".path;
+          dnsProvider = "gandiv5";
+          credentialsFile = config.age.secrets."gandi/api-key".path;
          group = "nginx";
        };
      };
--- a/services/paperless.nix
+++ b/services/paperless.nix
@ -50,7 +50,7 @@ in {
      enable = true;
      port = cfg.port;
      passwordFile = cfg.passwordFile;
-      settings = {
+      extraConfig = {
        # Postgres settings
        PAPERLESS_DBHOST = "/run/postgresql";
        PAPERLESS_DBUSER = "paperless";
--- a/services/photoprism.nix
+++ b/services/photoprism.nix
@ -61,7 +61,7 @@ in {
          proxy_connect_timeout 600;
          proxy_read_timeout 600;
          proxy_send_timeout 600;
-          client_max_body_size 500m;
+          client_max_body_size 100m;
          access_log syslog:server=unix:/dev/log,tag=photoprism;
        '';
      };
--- a/services/restic-backup.nix
+++ b/services/restic-backup.nix
@ -98,7 +98,7 @@ in {
      environmentFile = cfg.environmentFile;

      extraBackupArgs =
-        ["--verbose=1"]
+        ["--verbose=2"]
        ++ optional (builtins.length cfg.exclude != 0) excludeArg;

      timerConfig = cfg.timerConfig;
--- a/talos.nix
+++ b/talos.nix
@ -19,5 +19,5 @@
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
+  system.stateVersion = "24.05"; # Did you read the comment?
 }
--- a/todo.org
+++ b/todo.org
@ -1,5 +0,0 @@
-* TODO Take a look at goldwarden when 24.05 releases
-
-https://github.com/quexten/goldwarden
-
-* TODO Setup sway correctly
Author	SHA1	Message	Date
Antoine Martin	beb366f9a5	home: individualise stateVersion	2024-03-01 13:34:33 +01:00
Antoine Martin	93764167e9	flake.lock: Update Flake lock file updates: • Updated input 'disko': 'github:nix-community/disko/a13f36255cf4ce99cc4236a34251c2e7106e101d' (2024-02-26) → 'github:nix-community/disko/bde7dd352c07d43bd5b8245e6c39074a391fdd46' (2024-03-01) • Updated input 'home-manager': 'github:nix-community/home-manager/1d085ea4444d26aa52297758b333b449b2aa6fca' (2024-02-26) → 'github:nix-community/home-manager/2f3367769a93b226c467551315e9e270c3f78b15' (2024-02-29) • Updated input 'nixos-hardware': 'github:NixOS/nixos-hardware/01467901ec51dd92774040f2b3dff4f21f4e1c45' (2024-02-28) → 'github:NixOS/nixos-hardware/33a97b5814d36ddd65ad678ad07ce43b1a67f159' (2024-02-28) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/13aff9b34cc32e59d35c62ac9356e4a41198a538' (2024-02-26) → 'github:NixOS/nixpkgs/9099616b93301d5cf84274b184a3a5ec69e94e08' (2024-02-28) • Updated input 'nixpkgs-unstable-small': 'github:NixOS/nixpkgs/c1fe227b486d4bfffb319fd225a95ea574d398bf' (2024-02-28) → 'github:NixOS/nixpkgs/09c1497ce5d4ed4a0edfdd44450d3048074cb300' (2024-03-01)	2024-03-01 11:43:13 +01:00
Antoine Martin	ae2c988bdb	talos: switch sddm to wayland	2024-03-01 10:35:36 +01:00
Antoine Martin	b05eec42c5	talos: enable some wayland window managers	2024-02-29 16:35:17 +01:00
Antoine Martin	b28266d6ea	talos: update systemd-boot settings	2024-02-29 10:58:36 +01:00
Antoine Martin	401ee0005a	run formatter	2024-02-29 03:48:41 +01:00
Antoine Martin	2d420362ac	base: remove driver config NVIDIA specific settings should just go to boreal	2024-02-29 02:45:20 +01:00
Antoine Martin	79d60288aa	base: update xkb option names	2024-02-29 02:44:24 +01:00
Antoine Martin	3e3f4331d2	talos: initial setup	2024-02-28 23:30:28 +01:00
Antoine Martin	2a2275a87a	flake: update everything	2024-02-28 17:48:56 +01:00