home: individualise stateVersion

Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/a13f36255cf4ce99cc4236a34251c2e7106e101d' (2024-02-26)
  → 'github:nix-community/disko/bde7dd352c07d43bd5b8245e6c39074a391fdd46' (2024-03-01)
• Updated input 'home-manager':
    'github:nix-community/home-manager/1d085ea4444d26aa52297758b333b449b2aa6fca' (2024-02-26)
  → 'github:nix-community/home-manager/2f3367769a93b226c467551315e9e270c3f78b15' (2024-02-29)
• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/01467901ec51dd92774040f2b3dff4f21f4e1c45' (2024-02-28)
  → 'github:NixOS/nixos-hardware/33a97b5814d36ddd65ad678ad07ce43b1a67f159' (2024-02-28)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/13aff9b34cc32e59d35c62ac9356e4a41198a538' (2024-02-26)
  → 'github:NixOS/nixpkgs/9099616b93301d5cf84274b184a3a5ec69e94e08' (2024-02-28)
• Updated input 'nixpkgs-unstable-small':
    'github:NixOS/nixpkgs/c1fe227b486d4bfffb319fd225a95ea574d398bf' (2024-02-28)
  → 'github:NixOS/nixpkgs/09c1497ce5d4ed4a0edfdd44450d3048074cb300' (2024-03-01)

.github/workflows/cachix.yaml

@@ -15,10 +15,10 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - uses: cachix/install-nix-action@v27
+    - uses: cachix/install-nix-action@v25
 
     - name: Run alejandra
-      run: nix develop --command alejandra --check .
+      run: nix run nixpkgs#alejandra -- --check .
 
   flake-check:
     name: Flake check
@@ -26,9 +26,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - uses: cachix/install-nix-action@v27
+    - uses: cachix/install-nix-action@v25
 
-    - uses: cachix/cachix-action@v15
+    - uses: cachix/cachix-action@v14
       with:
         name: alarsyo
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -46,6 +46,7 @@ jobs:
       fail-fast: false
       matrix:
         name:
+        - ansel
         - grafanaDashboards/nginx
         - grafanaDashboards/node-exporter
         - kaleidoscope-udev-rules
@@ -55,9 +56,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - uses: cachix/install-nix-action@v27
+    - uses: cachix/install-nix-action@v25
 
-    - uses: cachix/cachix-action@v15
+    - uses: cachix/cachix-action@v14
       with:
         name: alarsyo
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -77,18 +78,15 @@ jobs:
         name:
         - boreal
         - hades
-        - talos
+        - hephaestus
         - thanatos
 
     steps:
-    - name: Delete huge unnecessary tools folder
-      run: rm -rf /opt/hostedtoolcache
-
     - uses: actions/checkout@v4
 
-    - uses: cachix/install-nix-action@v27
+    - uses: cachix/install-nix-action@v25
 
-    - uses: cachix/cachix-action@v15
+    - uses: cachix/cachix-action@v14
       with:
         name: alarsyo
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

base/gui-programs.nix

@@ -23,47 +23,35 @@ in {
     programs.gnupg.agent = {
       enable = true;
       enableSSHSupport = true;
-      pinentryPackage = pkgs.pinentry-qt;
+      pinentryFlavor = "qt";
     };
 
     services = {
       xserver = {
         enable = true;
-        # NOTE: could use `mkOptionDefault` but this feels more explicit
+        windowManager.i3.enable = true;
-        videoDrivers =
-          if config.my.gui.isNvidia
-          then ["nvidia"]
-          else options.services.xserver.videoDrivers.default;
         xkb = {
           layout = "fr";
           variant = "us";
         };
-      };
+        libinput = {
-
+          enable = true;
-      libinput = {
+          touchpad = {
-        enable = true;
+            naturalScrolling = true;
-        touchpad = {
+          };
-          naturalScrolling = true;
         };
       };
 
       logind.lidSwitch = "ignore";
-
-      printing = {
-        enable = true;
-        cups-pdf.enable = true;
-      };
-
-      udev.packages = [pkgs.chrysalis];
     };
 
     environment.systemPackages = builtins.attrValues {
       inherit
         (pkgs)
-        arandr
         chrysalis
-        discord
+        evince
         feh
+        firefox
         ffmpeg
         gimp-with-plugins
         imagemagick
@@ -78,10 +66,58 @@ in {
         zathura
         ;
 
+      inherit (pkgs.gnome) nautilus;
+
       inherit (pkgs.libsForQt5) okular;
+
+      discord = pkgs.discord.override {nss = pkgs.nss_latest;};
     };
 
-    networking.networkmanager.enable = true;
+    networking.networkmanager = {
+      enable = true;
+
+      dispatcherScripts = [
+        {
+          source = let
+            grep = "${pkgs.gnugrep}/bin/grep";
+            nmcli = "${pkgs.networkmanager}/bin/nmcli";
+          in
+            pkgs.writeShellScript "disable_wifi_on_ethernet" ''
+              export LC_ALL=C
+              date >> /tmp/disable_wifi_on_ethernet.log
+              echo START "$@" >> /tmp/disable_wifi_on_ethernet.log
+
+              beginswith() { case $2 in "$1"*) true;; *) false;; esac; }
+
+              is_ethernet_interface ()
+              {
+                  local type="$(${nmcli} dev show "$1" | grep 'GENERAL\.TYPE:' | awk '{ print $2 }')"
+                  test "$type" = "ethernet" || beginswith enp "$1"
+              }
+
+              hotspot_enabled ()
+              {
+                ${nmcli} dev | ${grep} -q "hotspot"
+              }
+
+              if is_ethernet_interface "$1" && ! hotspot_enabled; then
+                echo "change in ethernet and not in hotspot mode" >> /tmp/disable_wifi_on_ethernet.log
+                if [ "$2" = "up" ]; then
+                    echo "turning wifi off" >> /tmp/disable_wifi_on_ethernet.log
+                    nmcli radio wifi off
+                fi
+
+                if [ "$2" = "down" ]; then
+                    echo "turning wifi on" >> /tmp/disable_wifi_on_ethernet.log
+                    nmcli radio wifi on
+                fi
+              fi
+              echo END "$@" >> /tmp/disable_wifi_on_ethernet.log
+            '';
+          type = "basic";
+        }
+      ];
+    };
     programs.nm-applet.enable = true;
     programs.steam.enable = true;
 

base/programs.nix

@@ -26,22 +26,31 @@
       fd
       file
       ripgrep
+      sd
+      tokei
       tree
       wget
+      jq
       pciutils
       usbutils
       # development
       
+      agenix
+      alejandra
       git
       git-crypt
       git-lfs
       gnumake
       gnupg
+      pinentry-qt
       python3
       vim
       # terminal utilities
       
+      dogdns
+      du-dust
       htop
+      ldns # drill
       unzip
       zip
       ;

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1716561646,
+        "lastModified": 1707830867,
-        "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
+        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
+        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
         "type": "github"
       },
       "original": {
@@ -48,11 +48,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1717032306,
+        "lastModified": 1709286488,
-        "narHash": "sha256-s3Sis+M1qTSVIehHrEKBzHBpqprIFJli5V6WojkJnYE=",
+        "narHash": "sha256-RDpTZ72zLu05djvXRzK76Ysqp9zSdh84ax/edEaJucs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "8ea5bcccc03111bdedaeaae9380dfab61e9deb33",
+        "rev": "bde7dd352c07d43bd5b8245e6c39074a391fdd46",
         "type": "github"
       },
       "original": {
@@ -67,11 +67,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1710146030,
+        "lastModified": 1709126324,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
         "type": "github"
       },
       "original": {
@@ -81,39 +81,6 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flakey-profile": {
-      "locked": {
-        "lastModified": 1712898590,
-        "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
-        "owner": "lf-",
-        "repo": "flakey-profile",
-        "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lf-",
-        "repo": "flakey-profile",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -142,62 +109,27 @@
         ]
       },
       "locked": {
-        "lastModified": 1726989464,
+        "lastModified": 1709204054,
-        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
+        "narHash": "sha256-U1idK0JHs1XOfSI1APYuXi4AEADf+B+ZU4Wifc0pBHk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
+        "rev": "2f3367769a93b226c467551315e9e270c3f78b15",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "master",
         "repo": "home-manager",
         "type": "github"
       }
     },
-    "lix": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1729298361,
-        "narHash": "sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U=",
-        "rev": "ad9d06f7838a25beec425ff406fe68721fef73be",
-        "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/ad9d06f7838a25beec425ff406fe68721fef73be.tar.gz?rev=ad9d06f7838a25beec425ff406fe68721fef73be"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://git.lix.systems/lix-project/lix/archive/2.91.1.tar.gz"
-      }
-    },
-    "lix-module": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "flakey-profile": "flakey-profile",
-        "lix": "lix",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729360442,
-        "narHash": "sha256-6U0CyPycIBc04hbYy2hBINnVso58n/ZyywY2BD3hu+s=",
-        "rev": "9098ac95768f7006d7e070b88bae76939f6034e6",
-        "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/9098ac95768f7006d7e070b88bae76939f6034e6.tar.gz?rev=9098ac95768f7006d7e070b88bae76939f6034e6"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz"
-      }
-    },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1731797098,
+        "lastModified": 1709147990,
-        "narHash": "sha256-UhWmEZhwJZmVZ1jfHZFzCg+ZLO9Tb/v3Y6LC0UNyeTo=",
+        "narHash": "sha256-vpXMWoaCtMYJ7lisJedCRhQG9BSsInEyZnnG5GfY9tQ=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "672ac2ac86f7dff2f6f3406405bddecf960e0db6",
+        "rev": "33a97b5814d36ddd65ad678ad07ce43b1a67f159",
         "type": "github"
       },
       "original": {
@@ -225,11 +157,11 @@
     },
     "nixpkgs-unstable-small": {
       "locked": {
-        "lastModified": 1729493358,
+        "lastModified": 1709271102,
-        "narHash": "sha256-Ti+Y9nWt5Fcs3JlarxLPgIOVlbqQo7jobz/qOwOaziM=",
+        "narHash": "sha256-Z2sBL/HRRTNABsU8E5XsP+FXBEyBoi6oMwm5bV7lSFw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a5e6a9e979367ee14f65d9c38119c30272f8455f",
+        "rev": "09c1497ce5d4ed4a0edfdd44450d3048074cb300",
         "type": "github"
       },
       "original": {
@@ -241,11 +173,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1716914467,
+        "lastModified": 1708815994,
-        "narHash": "sha256-KkT6YM/yNQqirtYj/frn6RRakliB8RDvGqVGGaNhdcU=",
+        "narHash": "sha256-hL7N/ut2Xu0NaDxDMsw2HagAjgDskToGiyZOWriiLYM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4a3fc4cf736b7d2d288d7a8bf775ac8d4c0920b4",
+        "rev": "9a9dae8f6319600fa9aebde37f340975cab4b8c0",
         "type": "github"
       },
       "original": {
@@ -257,16 +189,16 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1731797254,
+        "lastModified": 1709150264,
-        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
+        "narHash": "sha256-HofykKuisObPUfj0E9CJVfaMhawXkYx3G8UIFR/XQ38=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
+        "rev": "9099616b93301d5cf84274b184a3a5ec69e94e08",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.05",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -277,7 +209,6 @@
         "disko": "disko",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager_2",
-        "lix-module": "lix-module",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable-small": "nixpkgs-unstable-small"
@@ -312,21 +243,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -5,7 +5,7 @@
       type = "github";
       owner = "NixOS";
       repo = "nixpkgs";
-      ref = "nixos-24.05";
+      ref = "nixos-unstable";
     };
 
     nixpkgs-unstable-small = {
@@ -25,7 +25,7 @@
       type = "github";
       owner = "nix-community";
       repo = "home-manager";
-      ref = "release-24.05";
+      ref = "master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -49,11 +49,6 @@
       repo = "disko";
       ref = "master";
     };
-
-    lix-module = {
-      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs = {
@@ -62,18 +57,26 @@
     home-manager,
     agenix,
     disko,
-    lix-module,
     ...
   } @ inputs:
     {
       nixosModules = {
         home = {
-          home-manager.backupFileExtension = "hm-backup";
           home-manager.useGlobalPkgs = true;
           home-manager.useUserPackages = true;
           home-manager.users.alarsyo = import ./home;
           home-manager.verbose = true;
         };
+        nix-path = {
+          nix = {
+            nixPath = [
+              "nixpkgs=${inputs.nixpkgs}"
+            ];
+            registry = {
+              nixpkgs.flake = inputs.nixpkgs;
+            };
+          };
+        };
       };
 
       overlays = import ./overlays;
@@ -99,7 +102,6 @@
           [
             agenix.nixosModules.default
             home-manager.nixosModules.default
-            lix-module.nixosModules.default
             {
               nixpkgs = {
                 overlays = shared_overlays;
@@ -139,6 +141,20 @@
             ++ sharedModules;
         };
 
+        hephaestus = nixpkgs.lib.nixosSystem rec {
+          inherit system;
+          modules =
+            [
+              ./hephaestus.nix
+
+              inputs.nixos-hardware.nixosModules.common-cpu-amd
+              inputs.nixos-hardware.nixosModules.common-gpu-amd
+              inputs.nixos-hardware.nixosModules.common-pc-laptop
+              inputs.nixos-hardware.nixosModules.common-pc-ssd
+            ]
+            ++ sharedModules;
+        };
+
         talos = nixpkgs.lib.nixosSystem {
           inherit system;
           modules =
@@ -161,16 +177,11 @@
         };
       };
     }
-    // inputs.flake-utils.lib.eachDefaultSystem (system: let
+    // inputs.flake-utils.lib.eachDefaultSystem (system: {
-      pkgs = nixpkgs.legacyPackages.${system};
-    in {
       packages =
         inputs.flake-utils.lib.flattenTree
-        (import ./pkgs {inherit pkgs;});
+        (import ./pkgs {
-      devShells.default = pkgs.mkShellNoCC {
+          pkgs = import nixpkgs {inherit system;};
-        buildInputs = [
+        });
-          pkgs.alejandra
-        ];
-      };
     });
 }

hephaestus.nix

@@ -0,0 +1,23 @@
+{...}: {
+  imports = [
+    # Default configuration
+    ./base
+
+    # Module definitions
+    ./modules
+
+    # Service definitions
+    ./services
+
+    # Host-specific config
+    ./hosts/hephaestus
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+}

home/default.nix

@@ -2,7 +2,6 @@
   imports = [
     ./alacritty.nix
     ./bat.nix
-    ./direnv.nix
     ./emacs.nix
     ./env.nix
     ./firefox.nix
@@ -11,6 +10,7 @@
     ./git.nix
     ./gtk.nix
     ./laptop.nix
+    ./lorri.nix
     ./mail.nix
     ./rbw.nix
     ./rofi.nix

home/emacs.nix

@@ -43,7 +43,7 @@ in {
 
     programs.emacs = {
       enable = true;
-      package = pkgs.emacs29-pgtk;
+      package = pkgs.emacs29;
       extraPackages = epkgs: [epkgs.vterm epkgs.pdf-tools pkgs.lilypond epkgs.mu4e];
     };
   };

home/fish/functions/nfl.fish

@@ -1,4 +1,7 @@
 function nfl
     set -l flags "--commit-lock-file"
-    nix flake update $flags $argv
+    for flake in $argv
+        set -a flags "--update-input" "$flake"
+    end
+    nix flake lock $flags
 end

home/lorri.nix

@@ -9,15 +9,17 @@
     mkIf
     ;
 
-  cfg = config.my.home.direnv;
+  cfg = config.my.home.lorri;
 in {
-  options.my.home.direnv = {
+  options.my.home.lorri = {
-    enable = (mkEnableOption "setup direnv usage") // {default = true;};
+    enable = (mkEnableOption "lorri daemon setup") // {default = true;};
   };
 
   config = mkIf cfg.enable {
+    services.lorri.enable = true;
     programs.direnv = {
       enable = true;
+      # FIXME: proper file, not lorri.nix
       nix-direnv = {
         enable = true;
       };

home/tridactylrc

@@ -18,10 +18,8 @@ bind ,<Space> nohlsearch
 " case insensitive if lowercase, case sensitive if using some uppercase letters
 set findcase smart
 
-set modeindicatormodes {"ignore": "false"}
-
 " New reddit is bad
-" autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
+autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
 
 " Orange site / Reddit / Lobste.rs specific hints to toggle comments
 bind ;c hint -Jc [class*="expand"],[class="togg"],[class="comment_folder"]
@@ -38,6 +36,3 @@ blacklistadd localhost
 blacklistadd netflix.com
 blacklistadd primevideo.com
 blacklistadd youtube.com
-
-" prevent teams from crashing
-seturl teams.microsoft.com superignore true

home/x/i3.nix

@@ -6,12 +6,11 @@
 }: let
   inherit
     (lib)
-    mkEnableOption
     mkIf
     mkOptionDefault
     ;
 
-  isEnabled = config.my.home.x.i3.enable;
+  isEnabled = config.my.home.x.enable;
 
   myTerminal =
     # FIXME: fix when terminal is setup in home
@@ -27,10 +26,6 @@
 
   i3Theme = config.my.theme.i3Theme;
 in {
-  options.my.home.x.i3 = {
-    enable = mkEnableOption "i3wm configuration";
-  };
-
   config = mkIf isEnabled {
     my.home = {
       flameshot.enable = true;

hosts/boreal/default.nix

@@ -24,12 +24,10 @@
 
   boot.tmp.useTmpfs = true;
 
-  boot.supportedFilesystems = {
+  boot.supportedFilesystems = [
-    btrfs = true;
+    "btrfs"
-    ntfs = true;
+    "ntfs"
-  };
+  ];
-
-  services.xserver.windowManager.i3.enable = true;
 
   services.btrfs = {
     autoScrub = {
@@ -86,6 +84,7 @@
   services = {
     openssh = {
       enable = true;
+      forwardX11 = true;
     };
   };
   my.gui = {
@@ -93,14 +92,18 @@
     isNvidia = true;
   };
 
-  hardware = {
+  my.wakeonwlan.interfaces.phy0.methods = [
-    bluetooth = {
+    "magic-packet"
-      enable = true;
+    "disconnect"
-      powerOnBoot = false;
+    "gtk-rekey-failure"
-    };
+    "eap-identity-request"
-    nvidia = {
+    "rfkill-release"
-      open = true;
+  ];
-      modesetting.enable = true;
+
-    };
+  services.udev.packages = [pkgs.chrysalis];
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = false;
   };
 }

hosts/boreal/home.nix

@@ -4,11 +4,11 @@
   ...
 }: {
   home-manager.users.alarsyo = {
-    home.stateVersion = "20.09";
+    # TODO: can probably upgrade me
+    home.stateVersion = "21.05";
 
     # Keyboard settings & i3 settings
     my.home.x.enable = true;
-    my.home.x.i3.enable = true;
     my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
     my.home.x.i3bar.temperature.inputs = ["Tccd1"];
     my.home.x.i3bar.networking.throughput_interfaces = ["enp8s0" "wlp4s0"];

hosts/hades/default.nix

@@ -57,7 +57,7 @@ in {
   my.services = {
     fail2ban.enable = true;
 
-    forgejo = {
+    gitea = {
       enable = true;
       privatePort = 8082;
     };
@@ -81,11 +81,6 @@ in {
       secretConfigFile = config.age.secrets."matrix-synapse/secret-config".path;
     };
 
-    mealie = {
-      enable = true;
-      port = 8090;
-    };
-
     microbin = {
       enable = true;
       privatePort = 8088;
@@ -117,6 +112,11 @@ in {
       secretKeyFile = config.age.secrets."paperless/secret-key".path;
     };
 
+    photoprism = {
+      enable = true;
+      port = 8084;
+    };
+
     pleroma = {
       enable = true;
       port = 8086;

hosts/hades/home.nix

@@ -1,6 +1,8 @@
 {config, ...}: {
   home-manager.users.alarsyo = {
-    home.stateVersion = "22.05";
+    # TODO: can probably upgrade me
+    home.stateVersion = "21.05";
+
     my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
   };
 }

hosts/hades/secrets.nix

@@ -13,6 +13,8 @@
         // attrs;
     in
       lib.mapAttrs toSecret {
+        "gandi/api-key" = {};
+
         "lohr/shared-secret" = {};
 
         "matrix-synapse/secret-config" = {
@@ -27,8 +29,6 @@
           owner = "nextcloud";
         };
 
-        "ovh/credentials" = {};
-
         "paperless/admin-password" = {};
         "paperless/secret-key" = {};
 

hosts/hephaestus/default.nix

@@ -0,0 +1,246 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./home.nix
+    ./secrets.nix
+  ];
+
+  hardware.amdgpu.opencl = false;
+
+  boot.kernelPackages = pkgs.linuxPackages;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # boot.initrd.systemd.enable = true;
+  # boot.plymouth.enable = true;
+  # boot.kernelParams = ["quiet"];
+
+  boot.initrd.secrets = {
+    "/crypto_keyfile.bin" = null;
+  };
+
+  boot.tmp.useTmpfs = true;
+
+  services.btrfs = {
+    autoScrub = {
+      enable = true;
+      fileSystems = ["/"];
+    };
+  };
+
+  networking.hostName = "hephaestus"; # Define your hostname.
+  networking.domain = "alarsyo.net";
+
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Paris";
+
+  # List services that you want to enable:
+  my.services = {
+    tailscale = {
+      enable = true;
+      useRoutingFeatures = "client";
+    };
+
+    pipewire.enable = true;
+
+    restic-backup = {
+      enable = true;
+      repo = "b2:hephaestus-backup";
+      passwordFile = config.age.secrets."restic-backup/hephaestus-password".path;
+      environmentFile = config.age.secrets."restic-backup/hephaestus-credentials".path;
+
+      timerConfig = {
+        OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
+      };
+
+      paths = [
+        "/home/alarsyo"
+      ];
+      exclude = [
+        "/home/alarsyo/Downloads"
+
+        # Rust builds using half my storage capacity
+        "/home/alarsyo/**/target"
+        "/home/alarsyo/work/rust/build"
+
+        # don't backup nixpkgs
+        "/home/alarsyo/work/nixpkgs"
+
+        "/home/alarsyo/go"
+
+        # C build crap
+        "*.a"
+        "*.o"
+        "*.so"
+
+        ".direnv"
+
+        # test vms
+        "*.qcow2"
+
+        # secrets stay offline
+        "/home/alarsyo/**/secrets"
+
+        # ignore all dotfiles as .config and .cache can become quite big
+        "/home/alarsyo/.*"
+      ];
+    };
+  };
+
+  virtualisation.docker.enable = true;
+  virtualisation.libvirtd.enable = true;
+  programs.dconf.enable = true;
+
+  services = {
+    tlp = {
+      enable = true;
+      settings = {
+        START_CHARGE_THRESH_BAT0 = 70;
+        STOP_CHARGE_THRESH_BAT0 = 80;
+      };
+    };
+    fwupd.enable = true;
+    openssh.enable = true;
+  };
+
+  my.gui.enable = true;
+  my.displayManager.sddm.enable = lib.mkForce false;
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = false;
+    settings.General.Experimental = true;
+  };
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "fr_FR.UTF-8";
+    LC_IDENTIFICATION = "fr_FR.UTF-8";
+    LC_MEASUREMENT = "fr_FR.UTF-8";
+    LC_MONETARY = "fr_FR.UTF-8";
+    LC_NAME = "fr_FR.UTF-8";
+    LC_PAPER = "fr_FR.UTF-8";
+    LC_TELEPHONE = "fr_FR.UTF-8";
+  };
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the KDE Plasma Desktop Environment.
+  services.xserver.displayManager.sddm.enable = true;
+  services.xserver.desktopManager.plasma5.enable = true;
+  services.power-profiles-daemon.enable = false;
+
+  services.autorandr = {
+    enable = true;
+    profiles = {
+      default = {
+        fingerprint = {
+          "eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
+        };
+        config = {
+          "eDP-1" = {
+            enable = true;
+            crtc = 0;
+            primary = true;
+            position = "0x0";
+            mode = "1920x1080";
+          };
+        };
+      };
+      dock = {
+        fingerprint = {
+          "eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
+          "DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
+          "DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
+        };
+        config = {
+          "eDP-1" = {
+            enable = true;
+            primary = false;
+            position = "3000x840";
+            mode = "1920x1080";
+          };
+          "DP-4" = {
+            enable = true;
+            primary = true;
+            position = "0x420";
+            mode = "1920x1080";
+          };
+          "DP-5" = {
+            enable = true;
+            primary = false;
+            position = "1920x0";
+            mode = "1920x1080";
+            rotate = "left";
+          };
+        };
+      };
+      dock-lid-closed = {
+        fingerprint = {
+          "DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
+          "DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
+        };
+        config = {
+          "DP-4" = {
+            enable = true;
+            primary = true;
+            position = "0x420";
+            mode = "1920x1080";
+          };
+          "DP-5" = {
+            enable = true;
+            primary = false;
+            position = "1920x0";
+            mode = "1920x1080";
+            rotate = "left";
+          };
+        };
+      };
+    };
+  };
+
+  systemd.services.autorandr-lid-listener = {
+    wantedBy = ["multi-user.target"];
+    description = "Listening for lid events to invoke autorandr";
+
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = let
+        stdbufExe = lib.getExe' pkgs.coreutils "stdbuf";
+        libinputExe = lib.getExe' pkgs.libinput "libinput";
+        grepExe = lib.getExe pkgs.gnugrep;
+        autorandrExe = lib.getExe pkgs.autorandr;
+      in
+        pkgs.writeShellScript "lid-listener.sh" ''
+          ${stdbufExe} -oL ${libinputExe} debug-events |
+            ${grepExe} -E --line-buffered '^[[:space:]-]+event[0-9]+[[:space:]]+SWITCH_TOGGLE[[:space:]]' |
+            while read line; do
+              ${pkgs.systemd}/bin/systemctl start --no-block autorandr.service
+            done
+        '';
+      Restart = "always";
+      RestartSec = "30";
+    };
+  };
+
+  # Configure console keymap
+  console.keyMap = "us";
+
+  programs.light.enable = true;
+}

hosts/hephaestus/hardware-configuration.nix

@@ -0,0 +1,45 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-amd"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/54ded736-367c-4081-9978-9e2d8f61cb1b";
+    fsType = "btrfs";
+    options = ["subvol=@"];
+  };
+
+  boot.initrd.luks.devices."luks-df96458d-45a1-4a30-8633-58feeff603f8".device = "/dev/disk/by-uuid/df96458d-45a1-4a30-8633-58feeff603f8";
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/826A-23F7";
+    fsType = "vfat";
+  };
+
+  swapDevices = [];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0f0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/hephaestus/home.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  home-manager.users.alarsyo = {
+    # TODO: can probably upgrade me
+    home.stateVersion = "21.05";
+
+    my.home.laptop.enable = true;
+
+    # Keyboard settings & i3 settings
+    my.home.x.enable = true;
+    my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
+    my.home.x.i3bar.temperature.inputs = ["Tctl"];
+    my.home.x.i3bar.networking.throughput_interfaces = ["wlp3s0" "enp6s0f3u1u1"];
+    my.home.emacs.enable = true;
+
+    my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
+
+    # TODO: place in global home conf
+    services.dunst.enable = true;
+
+    home.packages = builtins.attrValues {
+      inherit
+        (pkgs)
+        # some websites only work there :(
+        
+        chromium
+        darktable
+        # dev
+        
+        rustup
+        gdb
+        valgrind
+        arandr
+        zotero
+        ;
+
+      inherit
+        (pkgs.packages)
+        ansel
+        spot
+        ;
+
+      inherit (pkgs.wineWowPackages) stable;
+    };
+  };
+}

hosts/hephaestus/secrets.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  options,
+  ...
+}: {
+  config.age = {
+    secrets = let
+      toSecret = name: {...} @ attrs:
+        {
+          file = ./../../modules/secrets + "/${name}.age";
+        }
+        // attrs;
+    in
+      lib.mapAttrs toSecret {
+        "restic-backup/hephaestus-credentials" = {};
+        "restic-backup/hephaestus-password" = {};
+
+        "users/alarsyo-hashed-password" = {};
+        "users/root-hashed-password" = {};
+      };
+  };
+}

hosts/talos/default.nix

@@ -16,16 +16,9 @@
     ./secrets.nix
   ];
 
-  boot.kernelPackages = pkgs.linuxPackages_6_11;
+  hardware.amdgpu.opencl = false;
-  # Set Wi-Fi regulatory domain. Currently always set to '00' (world), and could
+
-  # lead to bad Wi-Fi performance
+  boot.kernelPackages = pkgs.linuxPackages_6_6;
-  boot.kernelParams = ["cfg80211.ieee80211_regdom=FR"];
-  boot.extraModulePackages = with config.boot.kernelPackages; [
-    v4l2loopback
-  ];
-  boot.extraModprobeConfig = ''
-    options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
-  '';
 
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot = {
@@ -48,10 +41,7 @@
   networking.domain = "alarsyo.net";
   # Pick only one of the below networking options.
   # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  networking.networkmanager = {
+  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
-    enable = true;
-    wifi.powersave = true;
-  };
 
   # Set your time zone.
   time.timeZone = "Europe/Paris";
@@ -61,6 +51,7 @@
   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
 
   programs = {
+    dconf.enable = true;
     light.enable = true;
   };
   services = {
@@ -69,10 +60,7 @@
   };
   virtualisation = {
     docker.enable = true;
-    libvirtd.enable = false;
+    libvirtd.enable = true;
-    virtualbox.host = {
-      enable = false;
-    };
   };
 
   my.services = {
@@ -82,54 +70,10 @@
     };
 
     pipewire.enable = true;
-
-    restic-backup = {
-      enable = true;
-      repo = "b2:talos-backup";
-      passwordFile = config.age.secrets."restic-backup/talos-password".path;
-      environmentFile = config.age.secrets."restic-backup/talos-credentials".path;
-
-      timerConfig = {
-        OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
-      };
-
-      paths = [
-        "/home/alarsyo"
-      ];
-      exclude = [
-        "/home/alarsyo/Downloads"
-
-        # Rust builds using half my storage capacity
-        "/home/alarsyo/**/target"
-        "/home/alarsyo/work/rust/build"
-
-        # don't backup nixpkgs
-        "/home/alarsyo/work/nixpkgs"
-
-        "/home/alarsyo/go"
-
-        # C build crap
-        "*.a"
-        "*.o"
-        "*.so"
-
-        ".direnv"
-
-        # test vms
-        "*.qcow2"
-        "*.vbox"
-        "*.vdi"
-
-        # secrets stay offline
-        "/home/alarsyo/**/secrets"
-
-        # ignore all dotfiles as .config and .cache can become quite big
-        "/home/alarsyo/.*"
-      ];
-    };
   };
 
   my.gui.enable = true;
+  my.displayManager.sddm.enable = lib.mkForce false;
 
   hardware.bluetooth = {
     enable = true;
@@ -152,21 +96,22 @@
     LC_TELEPHONE = "fr_FR.UTF-8";
   };
 
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
   # Enable the KDE Plasma Desktop Environment.
-  services.desktopManager.plasma6.enable = true;
+  services.xserver.displayManager.sddm = {
+    enable = true;
+    wayland.enable = true;
+  };
+  services.xserver.desktopManager.plasma5.enable = true;
   services.power-profiles-daemon.enable = true;
 
-  environment.systemPackages = [
+  programs.hyprland.enable = true;
-    pkgs.unstable.zed-editor
-    pkgs.foot
-  ];
-
-  #programs.hyprland.enable = true;
   programs.sway = {
     enable = true;
     wrapperFeatures.gtk = true;
   };
-
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you
   # accidentally delete configuration.nix.

hosts/talos/disko-config.nix

@@ -20,7 +20,7 @@
               };
             };
             luks = {
-              size = "600G";
+              size = "100%";
               content = {
                 type = "luks";
                 name = "crypted";
@@ -35,24 +35,19 @@
                   type = "btrfs";
                   extraArgs = ["-f"];
                   subvolumes = {
-                    "@" = {
+                    "/root" = {
                       mountpoint = "/";
                       mountOptions = ["compress=zstd" "noatime"];
                     };
-                    "@home" = {
+                    "/home" = {
                       mountpoint = "/home";
                       mountOptions = ["compress=zstd" "noatime"];
                     };
-                    "@nix" = {
+                    "/nix" = {
                       mountpoint = "/nix";
                       mountOptions = ["compress=zstd" "noatime"];
                     };
-                    "@persist" = {
+                    "/swap" = {
-                      mountpoint = "/persist";
-                      mountOptions = ["compress=zstd" "noatime"];
-                    };
-                    "@snapshots" = {};
-                    "@swap" = {
                       mountpoint = "/.swapvol";
                       swap.swapfile.size = "8G";
                     };

hosts/talos/home.nix

@@ -1,16 +1,10 @@
 {
   config,
-  lib,
   pkgs,
   ...
-}: let
+}: {
-  inherit
-    (lib)
-    mkOptionDefault
-    ;
-in {
   home-manager.users.alarsyo = {
-    home.stateVersion = "23.11";
+    home.stateVersion = "24.05";
 
     my.home.laptop.enable = true;
 
@@ -29,101 +23,26 @@ in {
     home.packages = builtins.attrValues {
       inherit
         (pkgs)
-        ansel
+        # some websites only work there :(
-        chromium # some websites only work there :(
+        
+        chromium
+        darktable
+        # dev
+        
+        rustup
+        gdb
+        valgrind
+        arandr
         zotero
         ;
 
-      inherit
+      #inherit
-        (pkgs.packages)
+      #  (pkgs.packages)
-        spot
+      #  ansel
-        ;
+      #  spot
-    };
+      #  ;
 
-    wayland.windowManager.sway = {
+      inherit (pkgs.wineWowPackages) stable;
-      enable = true;
-      swaynag.enable = true;
-      wrapperFeatures.gtk = true;
-      config = {
-        modifier = "Mod4";
-        input = {
-          "type:keyboard" = {
-            xkb_layout = "fr";
-            xkb_variant = "us";
-          };
-          "type:touchpad" = {
-            dwt = "enabled";
-            tap = "enabled";
-            middle_emulation = "enabled";
-            natural_scroll = "enabled";
-          };
-        };
-        output = {
-          "eDP-1" = {
-            scale = "1.5";
-          };
-        };
-        fonts = {
-          names = ["Iosevka Fixed" "FontAwesome6Free"];
-          size = 9.0;
-        };
-        bars = [
-          {
-            mode = "dock";
-            hiddenState = "hide";
-            position = "top";
-            workspaceButtons = true;
-            workspaceNumbers = true;
-            statusCommand = "${pkgs.i3status}/bin/i3status";
-            fonts = {
-              names = ["Iosevka Fixed" "FontAwesome6Free"];
-              size = 9.0;
-            };
-            trayOutput = "primary";
-            colors = {
-              background = "#000000";
-              statusline = "#ffffff";
-              separator = "#666666";
-              focusedWorkspace = {
-                border = "#4c7899";
-                background = "#285577";
-                text = "#ffffff";
-              };
-              activeWorkspace = {
-                border = "#333333";
-                background = "#5f676a";
-                text = "#ffffff";
-              };
-              inactiveWorkspace = {
-                border = "#333333";
-                background = "#222222";
-                text = "#888888";
-              };
-              urgentWorkspace = {
-                border = "#2f343a";
-                background = "#900000";
-                text = "#ffffff";
-              };
-              bindingMode = {
-                border = "#2f343a";
-                background = "#900000";
-                text = "#ffffff";
-              };
-            };
-          }
-        ];
-
-        keybindings = mkOptionDefault {
-          "Mod4+i" = "exec emacsclient --create-frame";
-        };
-      };
-    };
-    programs = {
-      fuzzel.enable = true;
-      swaylock.enable = true;
-      waybar = {
-        enable = true;
-      };
     };
   };
 }

hosts/talos/secrets.nix

@@ -13,8 +13,8 @@
         // attrs;
     in
       lib.mapAttrs toSecret {
-        "restic-backup/talos-credentials" = {};
+        #"restic-backup/hephaestus-credentials" = {};
-        "restic-backup/talos-password" = {};
+        #"restic-backup/hephaestus-password" = {};
 
         "users/alarsyo-hashed-password" = {};
         "users/root-hashed-password" = {};

hosts/thanatos/default.nix

@@ -35,56 +35,6 @@ in {
   };
 
   services = {
-    gitlab-runner = {
-      enable = true;
-      settings = {
-        concurrent = 4;
-      };
-      services = {
-        nix = {
-          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-nix-runner-env".path;
-          dockerImage = "alpine";
-          dockerVolumes = [
-            "/nix/store:/nix/store:ro"
-            "/nix/var/nix/db:/nix/var/nix/db:ro"
-            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
-          ];
-          dockerDisableCache = true;
-          preBuildScript = pkgs.writeScript "setup-container" ''
-            mkdir -p -m 0755 /nix/var/log/nix/drvs
-            mkdir -p -m 0755 /nix/var/nix/gcroots
-            mkdir -p -m 0755 /nix/var/nix/profiles
-            mkdir -p -m 0755 /nix/var/nix/temproots
-            mkdir -p -m 0755 /nix/var/nix/userpool
-            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
-            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
-            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
-            mkdir -p -m 0700 "$HOME/.nix-defexpr"
-
-            . ${pkgs.nix}/etc/profile.d/nix.sh
-
-            ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
-
-            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
-            ${pkgs.nix}/bin/nix-channel --update nixpkgs
-
-            mkdir -p ~/.config/nix
-            echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
-          '';
-          environmentVariables = {
-            ENV = "/etc/profile";
-            USER = "root";
-            NIX_REMOTE = "daemon";
-            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
-            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
-          };
-        };
-        default = {
-          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path;
-          dockerImage = "debian:stable";
-        };
-      };
-    };
     openssh.enable = true;
   };
 

hosts/thanatos/home.nix

@@ -1,6 +1,7 @@
 {config, ...}: {
   home-manager.users.alarsyo = {
-    home.stateVersion = "23.11";
+    # TODO: can probably upgrade me
+    home.stateVersion = "21.05";
 
     my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
   };

hosts/thanatos/secrets.nix

@@ -15,8 +15,6 @@
       lib.mapAttrs toSecret {
         "users/alarsyo-hashed-password" = {};
         "users/root-hashed-password" = {};
-        "gitlab-runner/thanatos-runner-env" = {};
-        "gitlab-runner/thanatos-nix-runner-env" = {};
       };
   };
 }

modules/sddm.nix

@@ -15,17 +15,23 @@ in {
   options.my.displayManager.sddm.enable = mkEnableOption "SDDM setup";
 
   config = mkIf cfg.enable {
-    services.displayManager.sddm = {
+    services.xserver.displayManager.sddm = {
       enable = true;
-      theme = "catppuccin-latte";
+      theme = "sugar-candy";
-      wayland.enable = true;
     };
 
-    environment.systemPackages = [
+    environment.systemPackages = builtins.attrValues {
-      (pkgs.catppuccin-sddm.override
+      inherit
-        {
+        (pkgs.packages)
-          flavor = "latte";
+        sddm-sugar-candy
-        })
+        ;
-    ];
+
+      inherit
+        (pkgs.libsForQt5.qt5)
+        qtgraphicaleffects
+        qtquickcontrols2
+        qtsvg
+        ;
+    };
   };
 }

modules/secrets/gitlab-runner/thanatos-runner-env.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 k2gHjw naNq55qkAm47KXPJpYFDjVQuxPz2Ffpima5z1WEqRSA
-ETC3Hh4gglwYpiJCu/EGOUzjN3BJYk8yJshMeMkgYug
--> ssh-ed25519 6UUuZw Azk9jDbUL/nO20lvzs0s36q/4ZcWSpkUbt1J/PE7A2M
-kPKHGLoWHDpFhsRr+CBteWKYsDw0dn/+IKbrh/5qMoE
---- g1akMn28voSQByQR9/ArJ4CsQehcwJ7MfCco+k2fPWo
-› YMZÓíî:ú{R­^
n~ó½±ã¢ÊwPaª§h£8<C2A3>T'hcmªe(<28>‘ÝXx=7”‹‡Ë¢[äË4@b=“&ª®æYÅ;‘€Ü[„ª¹ØÁˆß¿kôk>ˆ5’4‚0ÞGâŒ÷ðÌŸ­±Q<C2B1>Êë·±Ÿw¡

modules/secrets/ovh/credentials.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 k2gHjw XED7gkKAp1ioBegA7ryqULRF1BORpW74esfIGp9zPE8
-ANxnQN+tox9KYdZvNZFZvQxOymckldPQMhFnz6fSIBo
--> ssh-ed25519 pX8y2g 9wgPqL6GoOxad5AAUmDAYj0h/57AEM8VsQKq1pGTtjM
-SxD++XJioZLpt6C8Xse5Nmz4wtL0Fb5NKWo5ijKpyv8
---- 3qOJnkY3Uc4fIex9mgz2+w+su5dS7K7Tmtk1hiqkn9M
-ÁXª¨àeéˆaLQH2*ZÅTé¿ ‘®P;Ý(jCÌ€k‡viäµû<C2B5>ÿ’ħ¡à†kæ`™ô]mò<6D>ÿBñ,³±,ü÷?!¶{àŠ%­eÙì(„Su¿-SŸ
D¢¾“=H#‡„¼Þq=ï<>Uùí;=OÍ<÷R¼ÇÎE±“<+&­èdÂæ<18>>G+_oP¥Þ]ÿê¦RÄßL$Ö³\š°ü0ø¤N!þ"Áã&÷%Nž à<ËÃ,òv°1ÿ‘Ê‘Új1

modules/secrets/restic-backup/hephaestus-credentials.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw tTdHZJpSocTHlznYH9eRzeZkrYBbsdT4F8jV1FKw/yk
+xKIkYhL/A8wTy6LqDkTuUvm4rhDI6+DXwjzl43PcR8E
+-> ssh-ed25519 SYm+hA vzQCZWYdgG0yxUEyGJ4Q8EAh1Kzw5CutDa6q6XSaels
+Y7VqpvLfrUvWZcXqGeulRld9kff03kgzz22UBW77AOw
+-> j-c8-grease
+WeQ
+--- KHLA1KlfWM432GDbPIiKInzZeqVRJZ2YCKtF3qClfgs
+ ü
8Êâ5œ¢|<7C>ŒòQx_5':Á½È´A?îÎÚ¡ÄÛ 	­ØŠ¾þèoA‘x‰)rýd!Š(´®”èѨ5£¸ìô~ý\†ŽLd"^ÑZ¨Z^®…Vï/‡§5Ë•¶¢¨Ý¦<C39D>a诲áḷo]O/®Eueà†

modules/secrets/restic-backup/hephaestus-password.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw 2/spllcr7Fo+1sQ4VJW/MywBVUcpKEbicv4vZQyre0c
+Vc2Wugxc5M4i73UKMFXWA2PeHgUOm/+HekoeYt9ycro
+-> ssh-ed25519 SYm+hA KFjo2JVxpdOey8A7GAKeZci+ezE0RYBRKR8vNtloU3M
+SAzpTjF/RGOgjawT2Sk5H7TNnk/SdbksuAcZZqakJOs
+-> !!6BS-grease Gs<Om0
+d7WvJNMg3OX9CwWvGNWCuViu1X+e9oFE5vZQixfaJI3xKax2lTNh
+--- QICRX2ve/1CFNHjnVXDpue3DRlFbTftu9yrWw745gVk
+|†`F…3Þ°˜¤VEû²ÊósßK³ÞQwÿÙ$ùÉŒ{‘¨¯†>¹Hˆ7Þh™î”Ä©Û’2ÅïÂÈÆcH^¸“×÷Ÿ© X_ñæzv'¢ÄÐ!Zkš_„þÉ0Ë}Yo•je§¼<icé{SkÁ|1Ÿalé*ü7ÓÖ3ÅŒF«Þ9j¬\§X{¢¾#H7ÑŒ¢!><.^¸¿[ï£q4åpP

modules/secrets/restic-backup/talos-credentials.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 k2gHjw WWJQxqfxQzLmBFPpTzuKBMhAl+ZxnQdvnaDvfpwxR00
-tEsf6xSw/MP/qJnr/SyLlkEEf/LaI7IxjVzaxRwh5FI
--> ssh-ed25519 nh0dAQ yRu0VZqx+DuB3SSQaVtg+txuRu9OyJDfLDNCKg9XYk0
-xTpucapaejG2EMrZLIDt46JD3QYM4XXT1Y2F77HPQO8
---- uZjO0dDIFesU2B/GkjpqrOJas1+K6hGbQAdFV/t1GOk
-BV͵
Ç\Õ	8Û‘¾ºý[%<25>½l^>9<>\Eö5¹šþ¿Új(6èÜgå;(I7CS4èv6ièÉÐþSªÐXïC»ï`OòT™ŒÓÚ\ô;I·Ýœò6ƒ<36>_k˜éy-‡±¹½qKl†¾ôKþÓ hŠ?tô

modules/secrets/secrets.nix

@@ -4,18 +4,16 @@ let
 
   boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal";
   hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades";
+  hephaestus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7Cp+n5+huof68QlAoJV8bVf5h5p9kEZFAVpltWopdL root@hephaestus";
   talos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBYcmL9HZJ9SqB9OJwQ0Nt6ZbvHZTS+fzM8A6D5MPZs root@talos";
   thanatos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID8JEAWk/8iSl8fN6/f76JkmVFwtyixTpLol4zSVsnVw root@thanatos";
 
-  machines = [boreal hades talos thanatos];
+  machines = [boreal hades hephaestus talos thanatos];
 
   all = users ++ machines;
 in {
   "gandi/api-key.age".publicKeys = [alarsyo hades];
 
-  "gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
-  "gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];
-
   "lohr/shared-secret.age".publicKeys = [alarsyo hades];
 
   "matrix-synapse/secret-config.age".publicKeys = [alarsyo hades];
@@ -26,8 +24,6 @@ in {
 
   "nextcloud/admin-pass.age".publicKeys = [alarsyo hades];
 
-  "ovh/credentials.age".publicKeys = [alarsyo hades];
-
   "paperless/admin-password.age".publicKeys = [alarsyo hades];
   "paperless/secret-key.age".publicKeys = [alarsyo hades];
 
@@ -37,8 +33,8 @@ in {
   "restic-backup/boreal-credentials.age".publicKeys = [alarsyo boreal];
   "restic-backup/hades-password.age".publicKeys = [alarsyo hades];
   "restic-backup/hades-credentials.age".publicKeys = [alarsyo hades];
-  "restic-backup/talos-password.age".publicKeys = [alarsyo talos];
+  "restic-backup/hephaestus-password.age".publicKeys = [alarsyo hephaestus];
-  "restic-backup/talos-credentials.age".publicKeys = [alarsyo talos];
+  "restic-backup/hephaestus-credentials.age".publicKeys = [alarsyo hephaestus];
 
   "users/root-hashed-password.age".publicKeys = machines ++ [alarsyo];
   "users/alarsyo-hashed-password.age".publicKeys = machines ++ [alarsyo];

pkgs/ansel/default.nix

@@ -0,0 +1,155 @@
+{
+  cmake,
+  colord,
+  colord-gtk,
+  curl,
+  dav1d,
+  desktop-file-utils,
+  exiftool,
+  exiv2,
+  fetchFromGitHub,
+  glib,
+  gmic,
+  graphicsmagick,
+  gtk3,
+  icu,
+  intltool,
+  isocodes,
+  jasper,
+  json-glib,
+  lcms,
+  lensfun,
+  lib,
+  libXdmcp,
+  libXtst,
+  libaom,
+  libavif,
+  libdatrie,
+  libde265,
+  libepoxy,
+  libffi,
+  libgcrypt,
+  libgpg-error,
+  libheif,
+  libjpeg,
+  libpsl,
+  librsvg,
+  libsecret,
+  libselinux,
+  libsepol,
+  libsoup,
+  libsysprof-capture,
+  libthai,
+  libwebp,
+  libxkbcommon,
+  libxml2,
+  libxslt,
+  llvmPackages,
+  openexr_3,
+  openjpeg,
+  osm-gps-map,
+  pcre,
+  pcre2,
+  perlPackages,
+  pkg-config,
+  pugixml,
+  python3Packages,
+  rav1e,
+  sqlite,
+  stdenv,
+  util-linux,
+  wrapGAppsHook,
+  x265,
+}:
+stdenv.mkDerivation {
+  pname = "ansel";
+  version = "unstable-2024-01-05";
+
+  src = fetchFromGitHub {
+    owner = "aurelienpierreeng";
+    repo = "ansel";
+    rev = "e2c4a0a60cd80f741dd3d3c6ab72be9ac11234fb";
+    hash = "sha256-Kg020MHy9fn1drCk+66f25twqczvD/5evutDODqOjYM=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    desktop-file-utils
+    exiftool
+    intltool
+    libxml2
+    llvmPackages.clang
+    llvmPackages.llvm
+    pkg-config
+    perlPackages.perl
+    python3Packages.jsonschema
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    colord
+    colord-gtk
+    curl
+    dav1d
+    exiv2
+    json-glib
+    glib
+    gmic
+    graphicsmagick
+    gtk3
+    icu
+    isocodes
+    jasper
+    lcms
+    lensfun
+    libaom
+    libavif
+    libdatrie
+    libde265
+    libepoxy
+    libffi
+    libgcrypt
+    libgpg-error
+    libheif
+    libjpeg
+    libpsl
+    librsvg
+    libsecret
+    libselinux
+    libsepol
+    libsoup
+    libsysprof-capture
+    libthai
+    libwebp
+    libXdmcp
+    libxkbcommon
+    libxslt
+    libXtst
+    openexr_3
+    openjpeg
+    osm-gps-map
+    pcre
+    pcre2
+    perlPackages.Po4a
+    pugixml
+    rav1e
+    sqlite
+    util-linux
+    x265
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH ":" "$out/lib/ansel"
+    )
+  '';
+
+  meta = {
+    description = "A darktable fork minus the bloat plus some design vision";
+    homepage = "https://ansel.photos/";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "ansel";
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/default.nix

@@ -1,4 +1,5 @@
 {pkgs}: {
+  ansel = pkgs.callPackage ./ansel {};
   sddm-sugar-candy = pkgs.callPackage ./sddm-sugar-candy {};
   kaleidoscope-udev-rules = pkgs.callPackage ./kaleidoscope-udev-rules {};
   grafanaDashboards = pkgs.recurseIntoAttrs (pkgs.callPackage ./grafana-dashboards {});

pkgs/spot/default.nix

@@ -3,7 +3,7 @@
   fetchurl,
   python3,
 }: let
-  version = "2.12.1";
+  version = "2.11.6";
 in
   stdenv.mkDerivation {
     inherit version;
@@ -15,6 +15,6 @@ in
 
     src = fetchurl {
       url = "https://www.lrde.epita.fr/dload/spot/spot-${version}.tar.gz";
-      sha256 = "sha256-VHfAjU4dBi8WTC5IaoNVaSXQfXDyGA3nBq96qUnG/1w=";
+      sha256 = "sha256-ppJ5T4nA2zlWulkZvdUxPjcuDeNAAKkCLynhxukcU4o=";
     };
   }

services/default.nix

@@ -3,13 +3,11 @@
     ./vaultwarden.nix
     ./fail2ban.nix
     ./fava.nix
-    ./forgejo
     ./gitea
     ./immich.nix
     ./jellyfin.nix
     ./lohr.nix
     ./matrix.nix
-    ./mealie.nix
     ./media.nix
     ./microbin.nix
     ./miniflux.nix

services/forgejo/default.nix

@@ -1,129 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit
-    (lib)
-    mkEnableOption
-    mkIf
-    mkOption
-    ;
-
-  cfg = config.my.services.forgejo;
-  my = config.my;
-
-  domain = config.networking.domain;
-  hostname = config.networking.hostName;
-  fqdn = "${hostname}.${domain}";
-
-  forgejoUser = "git";
-in {
-  options.my.services.forgejo = let
-    inherit (lib) types;
-  in {
-    enable = mkEnableOption "Personal Git hosting with Forgejo";
-
-    privatePort = mkOption {
-      type = types.port;
-      default = 8082;
-      example = 8082;
-      description = "Port to serve the app";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    # use git as user to have `git clone git@git.domain`
-    users.users.${forgejoUser} = {
-      description = "Forgejo Service";
-      home = config.services.forgejo.stateDir;
-      useDefaultShell = true;
-      group = forgejoUser;
-
-      # the systemd service for the forgejo module seems to hardcode the group as
-      # forgejo, so, uh, just in case?
-      extraGroups = ["forgejo"];
-
-      isSystemUser = true;
-    };
-    users.groups.${forgejoUser} = {};
-
-    services.forgejo = {
-      enable = true;
-      user = forgejoUser;
-      group = config.users.users.${forgejoUser}.group;
-      stateDir = "/var/lib/${forgejoUser}";
-
-      lfs.enable = true;
-
-      settings = {
-        server = {
-          ROOT_URL = "https://git.${domain}/";
-          DOMAIN = "git.${domain}";
-          HTTP_ADDR = "127.0.0.1";
-          HTTP_PORT = cfg.privatePort;
-        };
-        log.LEVEL = "Warn"; # [ "Trace" "Debug" "Info" "Warn" "Error" "Critical" ]
-        repository = {
-          ENABLE_PUSH_CREATE_USER = true;
-          DEFAULT_BRANCH = "main";
-        };
-
-        # NOTE: temporarily remove this for initial setup
-        service.DISABLE_REGISTRATION = true;
-
-        # only send cookies via HTTPS
-        session.COOKIE_SECURE = true;
-
-        DEFAULT.APP_NAME = "Personal Forge";
-      };
-
-      # NixOS module uses `forgejo dump` to backup repositories and the database,
-      # but it produces a single .zip file that's not very restic friendly.
-      # I configure my backup system manually below.
-      dump.enable = false;
-
-      database = {
-        type = "postgres";
-        # user needs to be the same as forgejo user
-        user = forgejoUser;
-        name = forgejoUser;
-      };
-    };
-
-    # FIXME: Borg *could* be backing up files while they're being edited by
-    # forgejo, so it may produce corrupt files in the snapshot if I push stuff
-    # around midnight. I'm not sure how `forgejo dump` handles this either,
-    # though.
-    my.services.restic-backup = {
-      paths = [
-        config.services.forgejo.lfs.contentDir
-        config.services.forgejo.repositoryRoot
-      ];
-    };
-
-    # NOTE: no need to use postgresql.ensureDatabases because the forgejo module
-    # takes care of this automatically
-    services.postgresqlBackup = {
-      databases = [config.services.forgejo.database.name];
-    };
-
-    services.nginx = {
-      virtualHosts = {
-        "git.${domain}" = {
-          forceSSL = true;
-          useACMEHost = fqdn;
-
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
-          };
-        };
-      };
-    };
-
-    security.acme.certs.${fqdn}.extraDomainNames = ["git.${domain}"];
-
-    systemd.services.forgejo.preStart = "${pkgs.coreutils}/bin/ln -sfT ${./templates} ${config.services.forgejo.stateDir}/custom/templates";
-  };
-}

services/forgejo/templates/home.tmpl

@@ -1,17 +0,0 @@
-{{template "base/head" .}}
-<div class="page-content home">
-	<div class="ui stackable middle very relaxed page grid">
-		<div class="sixteen wide center aligned centered column">
-			<div>
-				<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
-			</div>
-			<div class="hero">
-				<h1 class="ui icon header title">
-					{{AppName}}
-				</h1>
-				<h2>alarsyo's personal projects are hosted here</h2>
-			</div>
-		</div>
-	</div>
-</div>
-{{template "base/footer" .}}

services/immich.nix

@@ -74,7 +74,7 @@ in {
           proxy_connect_timeout 600;
           proxy_read_timeout 600;
           proxy_send_timeout 600;
-          client_max_body_size 1000m;
+          client_max_body_size 100m;
           access_log syslog:server=unix:/dev/log,tag=immich;
         '';
       };

services/mealie.nix

@@ -1,122 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit
-    (lib)
-    mkEnableOption
-    mkIf
-    mkOption
-    ;
-
-  cfg = config.my.services.mealie;
-  my = config.my;
-
-  domain = config.networking.domain;
-  hostname = config.networking.hostName;
-  fqdn = "${hostname}.${domain}";
-  pkg = pkgs.unstable.mealie;
-  listenAddress = "127.0.0.1";
-in {
-  options.my.services.mealie = let
-    inherit (lib) types;
-  in {
-    enable = mkEnableOption "Mealie";
-    port = mkOption {
-      type = types.port;
-      example = 8080;
-      description = "Internal port for Mealie webapp";
-    };
-    credentialsFile = lib.mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      example = "/run/secrets/mealie-credentials.env";
-      description = ''
-        File containing credentials used in mealie such as {env}`POSTGRES_PASSWORD`
-        or sensitive LDAP options.
-
-        Expects the format of an `EnvironmentFile=`, as described by {manpage}`systemd.exec(5)`.
-      '';
-    };
-  };
-
-  # FIXME(NixOS 24.11) Copy pasted from nixpkgs master module, because some needed changes weren't in stable yet.
-  config = mkIf cfg.enable (let
-    settings = {
-      ALLOW_SIGNUP = "false";
-      BASE_URL = "https://mealie.${domain}";
-      TZ = config.time.timeZone;
-
-      # Use PostgreSQL
-      DB_ENGINE = "postgres";
-
-      # Settings for Mealie 1.7+
-      POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
-    };
-  in {
-    systemd.services = {
-      mealie = {
-        after = ["network-online.target" "postgresql.service"];
-        requires = ["postgresql.service"];
-        wants = ["network-online.target"];
-        wantedBy = ["multi-user.target"];
-
-        description = "Mealie, a self hosted recipe manager and meal planner";
-
-        environment =
-          {
-            PRODUCTION = "true";
-            API_PORT = toString cfg.port;
-            BASE_URL = "http://localhost:${toString cfg.port}";
-            DATA_DIR = "/var/lib/mealie";
-            CRF_MODEL_PATH = "/var/lib/mealie/model.crfmodel";
-          }
-          // (builtins.mapAttrs (_: val: toString val) settings);
-
-        serviceConfig = {
-          DynamicUser = true;
-          User = "mealie";
-          ExecStartPre = "${pkg}/libexec/init_db";
-          ExecStart = "${lib.getExe pkg} -b ${listenAddress}:${builtins.toString cfg.port}";
-          EnvironmentFile = lib.mkIf (cfg.credentialsFile != null) cfg.credentialsFile;
-          StateDirectory = "mealie";
-          StandardOutput = "journal";
-        };
-      };
-    };
-
-    # Set-up database
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = ["mealie"];
-      ensureUsers = [
-        {
-          name = "mealie";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
-    services.postgresqlBackup = {
-      databases = ["mealie"];
-    };
-
-    services.nginx.virtualHosts."mealie.${domain}" = {
-      forceSSL = true;
-      useACMEHost = fqdn;
-
-      locations."/" = {
-        proxyPass = "http://${listenAddress}:${toString cfg.port}/";
-        proxyWebsockets = true;
-      };
-    };
-
-    security.acme.certs.${fqdn}.extraDomainNames = ["mealie.${domain}"];
-
-    my.services.restic-backup = {
-      paths = ["/var/lib/mealie"];
-    };
-  });
-}

services/nextcloud.nix

@@ -62,11 +62,15 @@ in {
 
       hostName = "cloud.${domain}";
       https = true;
-      package = pkgs.nextcloud29;
+      package = pkgs.nextcloud27;
 
       maxUploadSize = "1G";
 
       config = {
+        overwriteProtocol = "https";
+
+        defaultPhoneRegion = "FR";
+
         dbtype = "pgsql";
         dbuser = "nextcloud";
         dbname = dbName;
@@ -75,11 +79,6 @@ in {
         adminuser = "admin";
         adminpassFile = cfg.adminpassFile;
       };
-
-      settings = {
-        default_phone_region = "FR";
-        overwriteprotocol = "https";
-      };
     };
 
     users.groups.media.members = ["nextcloud"];

services/nginx.nix

@@ -66,8 +66,8 @@ in {
         gandiKey = config.my.secrets.gandiKey;
       in {
         "${fqdn}" = {
-          dnsProvider = "ovh";
+          dnsProvider = "gandiv5";
-          credentialsFile = config.age.secrets."ovh/credentials".path;
+          credentialsFile = config.age.secrets."gandi/api-key".path;
           group = "nginx";
         };
       };

services/paperless.nix

@@ -50,7 +50,7 @@ in {
       enable = true;
       port = cfg.port;
       passwordFile = cfg.passwordFile;
-      settings = {
+      extraConfig = {
         # Postgres settings
         PAPERLESS_DBHOST = "/run/postgresql";
         PAPERLESS_DBUSER = "paperless";

services/photoprism.nix

@@ -61,7 +61,7 @@ in {
           proxy_connect_timeout 600;
           proxy_read_timeout 600;
           proxy_send_timeout 600;
-          client_max_body_size 500m;
+          client_max_body_size 100m;
           access_log syslog:server=unix:/dev/log,tag=photoprism;
         '';
       };

services/restic-backup.nix

@@ -98,7 +98,7 @@ in {
       environmentFile = cfg.environmentFile;
 
       extraBackupArgs =
-        ["--verbose=1"]
+        ["--verbose=2"]
         ++ optional (builtins.length cfg.exclude != 0) excludeArg;
 
       timerConfig = cfg.timerConfig;

talos.nix

@@ -19,5 +19,5 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
+  system.stateVersion = "24.05"; # Did you read the comment?
 }

todo.org

@@ -1,5 +0,0 @@
-* TODO Take a look at goldwarden when 24.05 releases
-
-https://github.com/quexten/goldwarden
-
-* TODO Setup sway correctly