Update allowed and trusted users for Gitea actions runner

.github/workflows/build-schemes.yml

@@ -3,8 +3,8 @@ name: Build All Color Schemes
 on:
   push:
     paths:
-      - 'config/schemes.nix'
-      - 'config/scheme-utils.nix'
+      - "config/schemes.nix"
+      - "config/scheme-utils.nix"
   workflow_dispatch:
 
 jobs:
@@ -12,81 +12,81 @@ jobs:
     runs-on: nixos
     env:
       HOSTNAME: server
-    
+
     steps:
-    - uses: actions/checkout@v4
-    
-    - name: Get available schemes
-      id: schemes
-      run: |
-        SCHEMES=$(nix eval --raw --impure --expr '
-          let
-            pkgs = import <nixpkgs> {};
-            inputs = {};
-            utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
-          in
-          builtins.concatStringsSep " " utils.availableSchemes
-        ')
-        echo "schemes=$SCHEMES" >> $GITHUB_OUTPUT
-        echo "Available schemes: $SCHEMES"
-    
-    - name: Configure Attic cache
-      run: |
-        # Configure attic client to use your cache server
-        attic login servidos https://cache.servidos.lat ${{ secrets.ATTIC_TOKEN }}
-    
-    - name: Build and push all schemes
-      run: |
-        echo "Building and pushing all schemes..."
-        
-        # Store original scheme
-        ORIGINAL_SCHEME=$(grep -oP "scheme = schemesFile\.schemes\.\K\w+" config/stylix.nix)
-        echo "Original scheme: $ORIGINAL_SCHEME"
-        
-        # Build and push each scheme
-        for scheme in ${{ steps.schemes.outputs.schemes }}; do
+      - uses: actions/checkout@v4
+
+      - name: Get available schemes
+        id: schemes
+        run: |
+          SCHEMES=$(nix eval --raw --impure --expr '
+            let
+              pkgs = import <nixpkgs> {};
+              inputs = {};
+              utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
+            in
+            builtins.concatStringsSep " " utils.availableSchemes
+          ')
+          echo "schemes=$SCHEMES" >> $GITHUB_OUTPUT
+          echo "Available schemes: $SCHEMES"
+
+      - name: Configure Attic cache
+        run: |
+          # Configure attic client to use your cache server
+          attic login servidos http://127.0.0.1:2343 ${{ secrets.ATTIC_TOKEN }}
+
+      - name: Build and push all schemes
+        run: |
+          echo "Building and pushing all schemes..."
+
+          # Store original scheme
+          ORIGINAL_SCHEME=$(grep -oP "scheme = schemesFile\.schemes\.\K\w+" config/stylix.nix)
+          echo "Original scheme: $ORIGINAL_SCHEME"
+
+          # Build and push each scheme
+          for scheme in ${{ steps.schemes.outputs.schemes }}; do
+            echo "========================================="
+            echo "Processing scheme: $scheme"
+            echo "========================================="
+
+            # Update stylix.nix to use this scheme
+            sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$scheme;/" config/stylix.nix
+
+            # Verify the change
+            grep "scheme = schemesFile.schemes" config/stylix.nix
+
+            # Build the configuration
+            echo "Building $scheme..."
+            nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
+              --out-link ./result-$scheme \
+              --quiet
+
+            # Push to cache
+            echo "Pushing $scheme to cache..."
+            attic push servidos:nixos ./result-$scheme
+
+            # Also push using print-out-paths for better cache coverage
+            nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
+              --print-out-paths \
+              --quiet | attic push servidos:nixos --stdin
+
+            echo "✓ Completed $scheme"
+            echo ""
+          done
+
+          # Restore original scheme
+          echo "Restoring original scheme: $ORIGINAL_SCHEME"
+          sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$ORIGINAL_SCHEME;/" config/stylix.nix
+
           echo "========================================="
-          echo "Processing scheme: $scheme"
+          echo "All schemes built and pushed successfully!"
           echo "========================================="
-          
-          # Update stylix.nix to use this scheme
-          sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$scheme;/" config/stylix.nix
-          
-          # Verify the change
-          grep "scheme = schemesFile.schemes" config/stylix.nix
-          
-          # Build the configuration
-          echo "Building $scheme..."
-          nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
-            --out-link ./result-$scheme \
-            --quiet
-          
-          # Push to cache
-          echo "Pushing $scheme to cache..."
-          attic push servidos:nixos ./result-$scheme
-          
-          # Also push using print-out-paths for better cache coverage
-          nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
-            --print-out-paths \
-            --quiet | attic push servidos:nixos --stdin
-          
-          echo "✓ Completed $scheme"
+
+      - name: Summary
+        run: |
+          SCHEME_COUNT=$(echo "${{ steps.schemes.outputs.schemes }}" | wc -w)
+          echo "✅ Color scheme builds completed successfully!"
+          echo "- Built $SCHEME_COUNT schemes: ${{ steps.schemes.outputs.schemes }}"
+          echo "- Pushed all builds to Atticd cache"
           echo ""
-        done
-        
-        # Restore original scheme
-        echo "Restoring original scheme: $ORIGINAL_SCHEME"
-        sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$ORIGINAL_SCHEME;/" config/stylix.nix
-        
-        echo "========================================="
-        echo "All schemes built and pushed successfully!"
-        echo "========================================="
-    
-    - name: Summary
-      run: |
-        SCHEME_COUNT=$(echo "${{ steps.schemes.outputs.schemes }}" | wc -w)
-        echo "✅ Color scheme builds completed successfully!"
-        echo "- Built $SCHEME_COUNT schemes: ${{ steps.schemes.outputs.schemes }}"
-        echo "- Pushed all builds to Atticd cache"
-        echo ""
-        echo "You can now switch schemes quickly without waiting for builds!"
+          echo "You can now switch schemes quickly without waiting for builds!"

.github/workflows/weekly-build-cache.yml

@@ -38,7 +38,7 @@ jobs:
         if: steps.check_changes.outputs.changes == 'true'
         run: |
           # Configure attic client to use your cache server
-          attic login servidos https://cache.servidos.lat ${{ secrets.ATTIC_TOKEN }}
+          attic login servidos http://127.0.0.1:2343 ${{ secrets.ATTIC_TOKEN }}
 
       - name: Build workstation configuration
         if: steps.check_changes.outputs.changes == 'true'

config/base.nix

@@ -75,6 +75,7 @@
       "dotnet-runtime-6.0.36"
       "dotnet-sdk-wrapped-6.0.428"
       "dotnet-sdk-6.0.428"
+      "mbedtls-2.28.10"
     ];
   };
   nix = {
@@ -124,29 +125,7 @@
         sops
         ;
     };
-    variables =
-      let
-        XDG_DATA_HOME = "\${HOME}/.local/share";
-        XDG_CONFIG_HOME = "\${HOME}/.config";
-        XDG_CACHE_HOME = "\${HOME}/.cache";
-      in
-      {
-        # PATH
-        inherit XDG_DATA_HOME XDG_CONFIG_HOME XDG_CACHE_HOME;
-        XDG_BIN_HOME = "\${HOME}/.local/bin";
-        XDG_STATE_HOME = "\${HOME}/.local/state";
-        # DEV PATH
-        PSQL_HISTORY = "${XDG_DATA_HOME}/psql_history";
-        REDISCLI_HISTFILE = "${XDG_DATA_HOME}/redis/rediscli_history";
-        WINEPREFIX = "${XDG_DATA_HOME}/wine";
-        # OPTIONS
-        ELECTRUMDIR = "${XDG_DATA_HOME}/electrum";
-        WGETRC = "${XDG_CONFIG_HOME}/wgetrc";
-        XCOMPOSECACHE = "${XDG_CACHE_HOME}/X11/xcompose";
-        "_JAVA_OPTIONS" = "-Djava.util.prefs.userRoot=${XDG_CONFIG_HOME}/java";
-        ORG_DEVICE = "workstation";
-        PATH = [ "\${HOME}/.local/bin" ];
-      };
+    variables = inputs.self.lib.xdgEnvironment;
   };
   programs = {
     nh = {

config/home-manager.nix

@@ -14,22 +14,7 @@ let
     ${pokemon-colorscripts}/bin/pokemon-colorscripts -r --no-title
     export command_timeout=60
   '';
-  commonAliases = {
-    cp = "cp -i";
-    mv = "mv -i";
-    mkdir = "mkdir -p";
-    mkcd = "(){ mkdir -p \"$1\" && cd \"$1\" }";
-    copy = "xclip -selection clipboard";
-    cdp = "pwd | copy";
-    cfp = "(){ readlink -f \"$1\" | copy }";
-    ".." = "cd ..";
-    "..." = "cd ../..";
-    ".3" = "cd ../../..";
-    ".4" = "cd ../../../..";
-    ".5" = "cd ../../../../..";
-    c = "cat";
-    sc = "systemctl --user";
-    jc = "journalctl --user -xefu";
+  commonAliases = inputs.self.lib.commonAliases // {
     open-gallery = ''
       cd /srv/pool/scrapping/JawZ/gallery-dl &&
       xdg-open "$(${fd}/bin/fd . ./ Husbands wikifeet -tdirectory -d 1 | ${fzf}/bin/fzf -i)"'';
@@ -46,14 +31,20 @@ in
     };
     git = {
       enable = true;
-      delta.enable = true;
-      userName = "Danilo Reyes";
-      userEmail = osConfig.my.email;
-      extraConfig = {
-        init.defaultBranch = "main";
+      settings = {
         pull.rebase = true;
+        init.defaultBranch = "main";
+        user = {
+          inherit (osConfig.my) email;
+          name = "Danilo Reyes";
+        };
       };
     };
+    delta = {
+      enable = true;
+      enableGitIntegration = true;
+    };
+    ssh.enableDefaultConfig = false;
     bash = lib.mkIf (shellType == "bash") {
       enable = true;
       historyFile = "\${XDG_STATE_HOME}/bash/history";

config/jawz.nix

@@ -1,11 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
 let
   inherit (config.networking) hostName;
-  nixosHosts =
-    lib.attrNames config.my.ips
-    |> lib.filter (
-      name: !(lib.hasPrefix "wg-" name) && name != "vps" && name != "router" && name != hostName
-    );
+  nixosHosts = inputs.self.lib.getNixosHosts config.my.ips hostName lib;
   nixosHostsMatch = lib.concatStringsSep " " nixosHosts;
 in
 {
@@ -29,10 +30,11 @@ in
     home.file.".librewolf/.stignore".source = ../dotfiles/stignore;
     programs.ssh = lib.mkIf config.my.secureHost {
       enable = true;
+      enableDefaultConfig = false;
       matchBlocks = {
         vps = {
           hostname = config.my.ips.vps;
-          user = "fedora";
+          user = "jawz";
           port = 3456;
           identityFile = config.sops.secrets."private_keys/${hostName}".path;
         };
@@ -67,14 +69,15 @@ in
       "plugdev"
       "bluetooth"
     ];
-    openssh.authorizedKeys.keyFiles = [
-      ../secrets/ssh/ed25519_deacero.pub
-      ../secrets/ssh/ed25519_workstation.pub
-      ../secrets/ssh/ed25519_server.pub
-      ../secrets/ssh/ed25519_miniserver.pub
-      ../secrets/ssh/ed25519_galaxy.pub
-      ../secrets/ssh/ed25519_phone.pub
-      ../secrets/ssh/ed25519_vps.pub
+    openssh.authorizedKeys.keyFiles = inputs.self.lib.getSshKeys [
+      "deacero"
+      "workstation"
+      "server"
+      "miniserver"
+      "galaxy"
+      "phone"
+      "vps"
+      "windows_vm"
     ];
   };
 }

config/stylix.nix

@@ -11,7 +11,7 @@ let
   };
   scheme = schemesFile.schemes.febroary;
   cfg = config.my.stylix;
-  gnomeEnabled = config.services.xserver.desktopManager.gnome.enable;
+  gnomeEnabled = config.services.desktopManager.gnome.enable;
 in
 {
   options.my.stylix.enable = lib.mkEnableOption "system-wide theming with Stylix";

dotfiles/stignore

@@ -1,6 +1,7 @@
 (?d)jawz/chrome/userChrome.css
 (?d)jawz/chrome/userContent.css
 (?d)jawz/lock
+(?d)jawz/storage
 (?d)jawz/user.js
 (?d)native-messaging-hosts/org.gnome.browser_connector.json
 (?d)native-messaging-hosts/org.gnome.chrome_gnome_shell.json

environments/gnome.nix

@@ -1,21 +1,13 @@
 {
   pkgs,
-  lib,
   ...
 }:
 {
   qt.enable = true;
   services = {
     gvfs.enable = true;
-    libinput.enable = true;
-    xserver = {
-      enable = true;
-      displayManager.gdm.enable = true;
-      desktopManager = {
-        gnome.enable = true;
-        xterm.enable = lib.mkForce false;
-      };
-    };
+    displayManager.gdm.enable = true;
+    desktopManager.gnome.enable = true;
   };
   environment.gnome.excludePackages = builtins.attrValues {
     inherit (pkgs)

environments/hyprland.nix

@@ -23,13 +23,11 @@ in
       wl-clipboard-rs
       wf-recorder
       grimblast # screenshots
-
       mako # notification daemon
       libnotify # dependency of mako
       swaylock-effects # screen locker
       yazi # file manager
       imv # images
-
       playerctl # media player control
       ;
   };
@@ -78,27 +76,22 @@ in
           "${mod}, bracketright, changegroupactive, f"
           "${mod}, S, exec, wofi --show drun icons"
           "${mod}, P, pin, active"
-
           "${mod}, left, movefocus, l"
           "${mod}, right, movefocus, r"
           "${mod}, up, movefocus, u"
           "${mod}, down, movefocus, d"
-
           "${mod}, h, movefocus, l"
           "${mod}, l, movefocus, r"
           "${mod}, k, movefocus, u"
           "${mod}, j, movefocus, d"
-
           "${mod} SHIFT, left, movewindow, l"
           "${mod} SHIFT, right, movewindow, r"
           "${mod} SHIFT, up, movewindow, u"
           "${mod} SHIFT, down, movewindow, d"
-
           "${mod} SHIFT, h, movewindow, l"
           "${mod} SHIFT, l, movewindow, r"
           "${mod} SHIFT, k, movewindow, u"
           "${mod} SHIFT, j, movewindow, d"
-
           "${mod}, 1, workspace, 1"
           "${mod}, 2, workspace, 2"
           "${mod}, 3, workspace, 3"
@@ -119,7 +112,6 @@ in
           "${mod} SHIFT, 8, movetoworkspace, 8"
           "${mod} SHIFT, 9, movetoworkspace, 9"
           "${mod} SHIFT, 0, movetoworkspace, 10"
-
           "${mod}, F3, exec, grimblast save area ~/Pictures/screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
           "${mod} SHIFT, F3, exec, grimblast save screen ~/Pictures/screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
         ];
@@ -128,12 +120,10 @@ in
           "${mod} SHIFT, l, moveactive, 20 0"
           "${mod} SHIFT, k, moveactive, 0 -20"
           "${mod} SHIFT, j, moveactive, 0 20"
-
           "${mod} CTRL, l, resizeactive, 30 0"
           "${mod} CTRL, h, resizeactive, -30 0"
           "${mod} CTRL, k, resizeactive, 0 -10"
           "${mod} CTRL, j, resizeactive, 0 10"
-
           ",XF86AudioRaiseVolume, exec, wpctl set-volume -l 1.4 @DEFAULT_AUDIO_SINK@ 5%+"
           ",XF86AudioLowerVolume, exec, wpctl set-volume -l 1.4 @DEFAULT_AUDIO_SINK@ 5%-"
         ];

environments/waybar-style.nix

@@ -30,12 +30,10 @@ in
     border: none;
     min-width: 20px;
   }
-
   #workspaces button.active {
     background: #${colors.base02};
     color: #${colors.base05};
   }
-
   #workspaces button:hover {
     background: #${colors.base01};
     color: #${colors.base04};

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759499898,
-        "narHash": "sha256-UNzYHLWfkSzLHDep5Ckb5tXc0fdxwPIrT+MY4kpQttM=",
+        "lastModified": 1762356719,
+        "narHash": "sha256-qwd/xdoOya1m8FENle+4hWnydCtlXUWLAW/Auk6WL7s=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "655e067f96fd44b3f5685e17f566b0e4d535d798",
+        "rev": "6d0b3567584691bf9d8fedb5d0093309e2f979c7",
         "type": "github"
       },
       "original": {
@@ -54,16 +54,17 @@
     "base16-fish": {
       "flake": false,
       "locked": {
-        "lastModified": 1622559957,
-        "narHash": "sha256-PebymhVYbL8trDVVXxCvZgc0S5VxI7I1Hv4RMSquTpA=",
+        "lastModified": 1754405784,
+        "narHash": "sha256-l9xHIy+85FN+bEo6yquq2IjD1rSg9fjfjpyGP1W8YXo=",
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "2f6dd973a9075dabccd26f1cded09508180bf5fe",
+        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
         "type": "github"
       },
       "original": {
         "owner": "tomyun",
         "repo": "base16-fish",
+        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
         "type": "github"
       }
     },
@@ -215,11 +216,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1759362264,
-        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
+        "lastModified": 1762440070,
+        "narHash": "sha256-xxdepIcb39UJ94+YydGP221rjnpkDZUlykKuF54PsqI=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
+        "rev": "26d05891e14c88eb4a5d5bee659c0db5afb609d8",
         "type": "github"
       },
       "original": {
@@ -232,6 +233,24 @@
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
+      "locked": {
+        "lastModified": 1762040540,
+        "narHash": "sha256-z5PlZ47j50VNF3R+IMS9LmzI5fYRGY/Z5O5tol1c9I4=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "0010412d62a25d959151790968765a70c436598b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_3"
+      },
       "locked": {
         "lastModified": 1712014858,
         "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
@@ -245,7 +264,7 @@
         "type": "indirect"
       }
     },
-    "flake-parts_3": {
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -266,7 +285,7 @@
         "type": "github"
       }
     },
-    "flake-parts_4": {
+    "flake-parts_5": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -314,11 +333,11 @@
         "rev": "edea9d2aaf2f4e0481fbbb8e26f68a9f39248e3f",
         "revCount": 2,
         "type": "git",
-        "url": "https://git.servidos.lat/jawz/fonts.git"
+        "url": "https://git.lebubu.org/jawz/fonts.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.servidos.lat/jawz/fonts.git"
+        "url": "https://git.lebubu.org/jawz/fonts.git"
       }
     },
     "fromYaml": {
@@ -362,16 +381,16 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "lastModified": 1744584021,
-        "narHash": "sha256-0RJ4mJzf+klKF4Fuoc8VN8dpQQtZnKksFmR2jhWE1Ew=",
+        "lastModified": 1748186689,
+        "narHash": "sha256-UaD7Y9f8iuLBMGHXeJlRu6U1Ggw5B9JnkFs3enZlap0=",
         "owner": "GNOME",
         "repo": "gnome-shell",
-        "rev": "52c517c8f6c199a1d6f5118fae500ef69ea845ae",
+        "rev": "8c88f917db0f1f0d80fa55206c863d3746fa18d0",
         "type": "github"
       },
       "original": {
         "owner": "GNOME",
-        "ref": "48.1",
+        "ref": "48.2",
         "repo": "gnome-shell",
         "type": "github"
       }
@@ -383,16 +402,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1758463745,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "lastModified": 1762463325,
+        "narHash": "sha256-33YUsWpPyeBZEWrKQ2a1gkRZ7i0XCC/2MYpU6BVeQSU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "0562fef070a1027325dd4ea10813d64d2c967b39",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -442,11 +460,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759490292,
-        "narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
+        "lastModified": 1762462052,
+        "narHash": "sha256-6roLYzcDf4V38RUMSqycsOwAnqfodL6BmhRkUtwIgdA=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
+        "rev": "ffc999d980c7b3bca85d3ebd0a9fbadf984a8162",
         "type": "github"
       },
       "original": {
@@ -460,11 +478,11 @@
         "aquamarine": "aquamarine",
         "hyprcursor": "hyprcursor",
         "hyprgraphics": "hyprgraphics",
+        "hyprland-guiutils": "hyprland-guiutils",
         "hyprland-protocols": "hyprland-protocols",
-        "hyprland-qtutils": "hyprland-qtutils",
         "hyprlang": "hyprlang",
         "hyprutils": "hyprutils",
-        "hyprwayland-scanner": "hyprwayland-scanner",
+        "hyprwayland-scanner": "hyprwayland-scanner_2",
         "nixpkgs": [
           "nixpkgs"
         ],
@@ -473,11 +491,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1760143218,
-        "narHash": "sha256-OhJPROcRcwBkjOKkXr/f3/7wuSjhAIqr8WfmEUF9Uuo=",
+        "lastModified": 1762542520,
+        "narHash": "sha256-hMWWVGEoJRNDaAJxHoL1YL+IXGxdQooEw8lABELVopg=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "d599513d4a72d66ac62ffdedc41d6653fa81b39e",
+        "rev": "522edc87126a48f3ce4891747b6a92a22385b1e7",
         "type": "github"
       },
       "original": {
@@ -486,6 +504,48 @@
         "type": "github"
       }
     },
+    "hyprland-guiutils": {
+      "inputs": {
+        "aquamarine": [
+          "hyprland",
+          "aquamarine"
+        ],
+        "hyprgraphics": [
+          "hyprland",
+          "hyprgraphics"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "hyprtoolkit": "hyprtoolkit",
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1762465111,
+        "narHash": "sha256-dS13YZdWjgGGLBjpT4FHB6xf8I/WiAU+mgNWXsZgDUs=",
+        "owner": "hyprwm",
+        "repo": "hyprland-guiutils",
+        "rev": "a415eba866a953f3096d661318f771aa0082eb98",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-guiutils",
+        "type": "github"
+      }
+    },
     "hyprland-protocols": {
       "inputs": {
         "nixpkgs": [
@@ -498,11 +558,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749046714,
-        "narHash": "sha256-kymV5FMnddYGI+UjwIw8ceDjdeg7ToDVjbHCvUlhn14=",
+        "lastModified": 1759610243,
+        "narHash": "sha256-+KEVnKBe8wz+a6dTLq8YDcF3UrhQElwsYJaVaHXJtoI=",
         "owner": "hyprwm",
         "repo": "hyprland-protocols",
-        "rev": "613878cb6f459c5e323aaafe1e6f388ac8a36330",
+        "rev": "bd153e76f751f150a09328dbdeb5e4fab9d23622",
         "type": "github"
       },
       "original": {
@@ -511,74 +571,6 @@
         "type": "github"
       }
     },
-    "hyprland-qt-support": {
-      "inputs": {
-        "hyprlang": [
-          "hyprland",
-          "hyprland-qtutils",
-          "hyprlang"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland-qtutils",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland-qtutils",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1749154592,
-        "narHash": "sha256-DO7z5CeT/ddSGDEnK9mAXm1qlGL47L3VAHLlLXoCjhE=",
-        "owner": "hyprwm",
-        "repo": "hyprland-qt-support",
-        "rev": "4c8053c3c888138a30c3a6c45c2e45f5484f2074",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-qt-support",
-        "type": "github"
-      }
-    },
-    "hyprland-qtutils": {
-      "inputs": {
-        "hyprland-qt-support": "hyprland-qt-support",
-        "hyprlang": [
-          "hyprland",
-          "hyprlang"
-        ],
-        "hyprutils": [
-          "hyprland",
-          "hyprland-qtutils",
-          "hyprlang",
-          "hyprutils"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1759080228,
-        "narHash": "sha256-RgDoAja0T1hnF0pTc56xPfLfFOO8Utol2iITwYbUhTk=",
-        "owner": "hyprwm",
-        "repo": "hyprland-qtutils",
-        "rev": "629b15c19fa4082e4ce6be09fdb89e8c3312aed7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-qtutils",
-        "type": "github"
-      }
-    },
     "hyprlang": {
       "inputs": {
         "hyprutils": [
@@ -608,6 +600,54 @@
         "type": "github"
       }
     },
+    "hyprtoolkit": {
+      "inputs": {
+        "aquamarine": [
+          "hyprland",
+          "hyprland-guiutils",
+          "aquamarine"
+        ],
+        "hyprgraphics": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprgraphics"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprlang"
+        ],
+        "hyprutils": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": "hyprwayland-scanner",
+        "nixpkgs": [
+          "hyprland",
+          "hyprland-guiutils",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "hyprland-guiutils",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1762463729,
+        "narHash": "sha256-2fYkU/mdz8WKY3dkDPlE/j6hTxIwqultsx4gMMsMns0=",
+        "owner": "hyprwm",
+        "repo": "hyprtoolkit",
+        "rev": "88483bdee5329ec985f0c8f834c519cd18cfe532",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprtoolkit",
+        "type": "github"
+      }
+    },
     "hyprutils": {
       "inputs": {
         "nixpkgs": [
@@ -620,11 +660,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759619523,
-        "narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
+        "lastModified": 1762387740,
+        "narHash": "sha256-gQ9zJ+pUI4o+Gh4Z6jhJll7jjCSwi8ZqJIhCE2oqwhQ=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
+        "rev": "926689ddb9c0a8787e58c02c765a62e32d63d1f7",
         "type": "github"
       },
       "original": {
@@ -634,6 +674,35 @@
       }
     },
     "hyprwayland-scanner": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprtoolkit",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprtoolkit",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755184602,
+        "narHash": "sha256-RCBQN8xuADB0LEgaKbfRqwm6CdyopE1xIEhNc67FAbw=",
+        "owner": "hyprwm",
+        "repo": "hyprwayland-scanner",
+        "rev": "b3b0f1f40ae09d4447c20608e5a4faf8bf3c492d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprwayland-scanner",
+        "type": "github"
+      }
+    },
+    "hyprwayland-scanner_2": {
       "inputs": {
         "nixpkgs": [
           "hyprland",
@@ -666,32 +735,32 @@
         "sudoku-solver": "sudoku-solver"
       },
       "locked": {
-        "lastModified": 1760073554,
-        "narHash": "sha256-Ydqg/9lpoha2vgspjviqeRh6/tsWN+pZcUxn1ZyrFZM=",
+        "lastModified": 1762659856,
+        "narHash": "sha256-cyU8tuUPWZnkOnyWoH1x43+mmukaMoN+8vNxjWnVDv8=",
         "ref": "refs/heads/master",
-        "rev": "5c13b806a094f3605e2da70e133551848ad8d9a9",
-        "revCount": 109,
+        "rev": "4e91264f0f2bee992231f91621c10f857fb37edd",
+        "revCount": 118,
         "type": "git",
-        "url": "https://git.servidos.lat/jawz/scripts.git"
+        "url": "https://git.lebubu.org/jawz/scripts.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.servidos.lat/jawz/scripts.git"
+        "url": "https://git.lebubu.org/jawz/scripts.git"
       }
     },
     "nix-gaming": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1760146997,
-        "narHash": "sha256-x2sF8Q4tWz3DI166s+KFDXySrK+cN+/YEd3DfhnhBLQ=",
+        "lastModified": 1762566515,
+        "narHash": "sha256-gIPh4l5MBs0/ETmF8ep7b6u6c2y2wyBBcD9Vk4l4p/Y=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "ad505387568d024654da88fef03d9c5319cba92f",
+        "rev": "9bb3ba9d192aeebc18a14c4c29140a78f0b28a7f",
         "type": "github"
       },
       "original": {
@@ -754,11 +823,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1754788789,
-        "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=",
+        "lastModified": 1761765539,
+        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "a73b9c743612e4244d865a2fdee11865283c04e6",
+        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
         "type": "github"
       },
       "original": {
@@ -768,6 +837,21 @@
       }
     },
     "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1761765539,
+        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_3": {
       "locked": {
         "dir": "lib",
         "lastModified": 1711703276,
@@ -787,27 +871,27 @@
     },
     "nixpkgs-small": {
       "locked": {
-        "lastModified": 1760081104,
-        "narHash": "sha256-n9NgHBtZgLrT1FtJ2W9AvVKM7bXWBgqw/is739m72WQ=",
+        "lastModified": 1762658878,
+        "narHash": "sha256-RG0StVygqNxDkAb0rRs+WvavmU1NOKpQcSFf+IZENgk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "872106a411643f96e2c9576d247cf96e7c8c1b97",
+        "rev": "268853f436c12f665c5d9c4d40caf5e0ccf182d9",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05-small",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1760038930,
-        "narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
+        "lastModified": 1762363567,
+        "narHash": "sha256-YRqMDEtSMbitIMj+JLpheSz0pwEr0Rmy5mC7myl17xs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
+        "rev": "ae814fd3904b621d8ab97418f1d0f2eb0d3716f4",
         "type": "github"
       },
       "original": {
@@ -819,23 +903,23 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1759994382,
-        "narHash": "sha256-wSK+3UkalDZRVHGCRikZ//CyZUJWDJkBDTQX1+G77Ow=",
+        "lastModified": 1762631752,
+        "narHash": "sha256-svy+dTuq/qnfPZHH0Bo3QRYdv+S05ZZGf0vpXfQRd+U=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5da4a26309e796daa7ffca72df93dbe53b8164c7",
+        "rev": "b6dff13a853160527ae3d111e2685df2468431f1",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixtendo-switch": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": [
           "nixpkgs"
         ]
@@ -856,17 +940,17 @@
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1760150127,
-        "narHash": "sha256-McDmxx/bruodgHLD4sFIl0fKkEkNj5VE3DglImfslrk=",
+        "lastModified": 1762630843,
+        "narHash": "sha256-v9KMIzeHdIwdiItAuzZIkuEtoNng3wXNWVa7vSJAcpU=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "886a5646695563cbae3c1e10369c6070c7645e73",
+        "rev": "6dc13799694bfe61e1bedbcaf18200a762ea2d7a",
         "type": "github"
       },
       "original": {
@@ -911,11 +995,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758108966,
-        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
+        "lastModified": 1762441963,
+        "narHash": "sha256-j+rNQ119ffYUkYt2YYS6rnd6Jh/crMZmbqpkGLXaEt0=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
+        "rev": "8e7576e79b88c16d7ee3bbd112c8d90070832885",
         "type": "github"
       },
       "original": {
@@ -943,6 +1027,7 @@
     "root": {
       "inputs": {
         "doom-emacs": "doom-emacs",
+        "flake-parts": "flake-parts",
         "fonts": "fonts",
         "home-manager": "home-manager",
         "hyprland": "hyprland",
@@ -968,11 +1053,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759635238,
-        "narHash": "sha256-UvzKi02LMFP74csFfwLPAZ0mrE7k6EiYaKecplyX9Qk=",
+        "lastModified": 1760998189,
+        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "6e5a38e08a2c31ae687504196a230ae00ea95133",
+        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
         "type": "github"
       },
       "original": {
@@ -988,7 +1073,7 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_5",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
@@ -1002,16 +1087,15 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1759596342,
-        "narHash": "sha256-1Eda1V8pjpviMdBTdDXrFp7jkaUokIgXgBYTZyzDODk=",
+        "lastModified": 1762264356,
+        "narHash": "sha256-QVfC53Ri+8n3e7Ujx9kq6all3+TLBRRPRnc6No5qY5w=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "4d065856e936fc6a99ba55d39ac2df9ded6bedbe",
+        "rev": "647bb8dd96a206a1b79c4fd714affc88b409e10b",
         "type": "github"
       },
       "original": {
         "owner": "danth",
-        "ref": "release-25.05",
         "repo": "stylix",
         "type": "github"
       }
@@ -1224,11 +1308,11 @@
         "rev": "0212af5b70347f0721cfe88c25e1efb77b645a2d",
         "revCount": 2,
         "type": "git",
-        "url": "https://git.servidos.lat/jawz/wallpapers.git"
+        "url": "https://git.lebubu.org/jawz/wallpapers.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.servidos.lat/jawz/wallpapers.git"
+        "url": "https://git.lebubu.org/jawz/wallpapers.git"
       }
     },
     "xdph": {
@@ -1259,11 +1343,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755354946,
-        "narHash": "sha256-zdov5f/GcoLQc9qYIS1dUTqtJMeDqmBmo59PAxze6e4=",
+        "lastModified": 1761431178,
+        "narHash": "sha256-xzjC1CV3+wpUQKNF+GnadnkeGUCJX+vgaWIZsnz9tzI=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "a10726d6a8d0ef1a0c645378f983b6278c42eaa0",
+        "rev": "4b8801228ff958d028f588f0c2b911dbf32297f9",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,16 +1,28 @@
 {
   description = "JawZ NixOS flake setup";
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-25.05";
-    nixpkgs-small.url = "github:nixos/nixpkgs?ref=nixos-25.05-small";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    nixpkgs.url = "github:nixos/nixpkgs?ref=master";
+    nixpkgs-small.url = "github:nixos/nixpkgs?ref=master";
+    # nixpkgs-small.url = "github:nixos/nixpkgs?ref=nixos-25.05-small";
     nixpkgs-unstable.url = "github:nixos/nixpkgs?ref=nixos-unstable";
     ucodenix.url = "github:e-tho/ucodenix/ba7f0a366460e0fbea9622fc770cb982be0e4720";
+    home-manager = {
+      # url = "github:nix-community/home-manager?ref=release-25.05";
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    stylix = {
+      # url = "github:danth/stylix/release-25.05";
+      url = "github:danth/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     doom-emacs = {
       url = "github:marienz/nix-doom-emacs-unstraightened/ad01165af00765af07989b6ad14115960ac675f8";
       inputs.nixpkgs.follows = "";
     };
     jawz-scripts = {
-      url = "git+https://git.servidos.lat/jawz/scripts.git";
+      url = "git+https://git.lebubu.org/jawz/scripts.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nur = {
@@ -25,18 +37,10 @@
       url = "github:hyprwm/Hyprland";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    home-manager = {
-      url = "github:nix-community/home-manager?ref=release-25.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    stylix = {
-      url = "github:danth/stylix/release-25.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     nixtendo-switch = {
       url = "github:nyawox/nixtendo-switch";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -46,11 +50,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     wallpapers = {
-      url = "git+https://git.servidos.lat/jawz/wallpapers.git";
+      url = "git+https://git.lebubu.org/jawz/wallpapers.git";
       flake = false;
     };
     fonts = {
-      url = "git+https://git.servidos.lat/jawz/fonts.git";
+      url = "git+https://git.lebubu.org/jawz/fonts.git";
       flake = false;
     };
     qbit_manage = {
@@ -59,76 +63,13 @@
     };
   };
   outputs =
-    { self, jawz-scripts, ... }@inputs:
-    let
-      inherit (self) outputs;
-      system = "x86_64-linux";
-      mkpkgs =
-        repo:
-        import repo {
-          inherit system;
-          config.allowUnfree = true;
-        };
-      langList = builtins.filter (name: name != "emacs") (
-        builtins.map (file: builtins.replaceStrings [ ".nix" ] [ "" ] (baseNameOf file)) (
-          builtins.attrNames (builtins.readDir ./modules/dev)
-        )
-      );
-      commonModules = name: [
-        {
-          nixpkgs.overlays = [
-            (import ./config/overlay.nix { inherit mkpkgs inputs; })
-            inputs.doom-emacs.overlays.default
-          ];
-        }
-        {
-          nix.registry = {
-            jawz.flake = self;
-            unstable.flake = inputs.nixpkgs-unstable;
-          };
-        }
-        ./hosts/${name}/configuration.nix
-        inputs.nur.modules.nixos.default
-        inputs.sops-nix.nixosModules.sops
-        inputs.stylix.nixosModules.stylix
-        inputs.nixtendo-switch.nixosModules.nixtendo-switch
+    inputs:
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+      imports = [
+        ./parts/core.nix
+        ./parts/hosts.nix
+        ./parts/packages.nix
+        ./parts/devshells.nix
       ];
-      createConfig =
-        name: local-nixpkgs:
-        let
-          lib = local-nixpkgs.lib // inputs.home-manager.lib;
-        in
-        lib.nixosSystem {
-          inherit system;
-          specialArgs = {
-            inherit inputs outputs;
-          };
-          modules = commonModules name;
-        };
-    in
-    {
-      nixosConfigurations = {
-        workstation = createConfig "workstation" inputs.nixpkgs;
-        miniserver = createConfig "miniserver" inputs.nixpkgs-small;
-        server = createConfig "server" inputs.nixpkgs-small;
-        galaxy = createConfig "galaxy" inputs.nixpkgs-small;
-        emacs = createConfig "emacs" inputs.nixpkgs;
-      };
-      packages.${system} = (jawz-scripts.packages.${system} or { }) // {
-        emacs-vm = inputs.nixos-generators.nixosGenerate {
-          inherit system;
-          specialArgs = {
-            inherit inputs outputs;
-          };
-          modules = commonModules "emacs";
-          format = "vm";
-        };
-      };
-      devShells.${system} = builtins.listToAttrs (
-        map (name: {
-          inherit name;
-          value = self.nixosConfigurations.emacs.config.devShells.${name};
-        }) langList
-      );
     };
 }

hosts/miniserver/configuration.nix

@@ -1,17 +1,17 @@
-{ config, ... }:
+{ config, inputs, ... }:
 {
   imports = [
     ./hardware-configuration.nix
     ../../config/base.nix
     ../../config/stylix.nix
   ];
-  my = import ./toggles.nix // {
+  my = import ./toggles.nix { inherit inputs; } // {
     nix.cores = 3;
     nix.maxJobs = 8;
     users.nixremote.enable = true;
-    users.nixremote.authorizedKeys = [
-      ../../secrets/ssh/ed25519_nixworkstation.pub
-      ../../secrets/ssh/ed25519_nixserver.pub
+    users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
+      "nixworkstation"
+      "nixserver"
     ];
   };
   nix.buildMachines =

hosts/miniserver/toggles.nix

@@ -1,16 +1,6 @@
+{ inputs }:
 let
-  mkEnabled = name: {
-    inherit name;
-    value.enable = true;
-  };
-  mkEnabledWithProxy = name: {
-    inherit name;
-    value = {
-      enable = true;
-      enableProxy = true;
-    };
-  };
-  enableList = func: list: list |> map func |> builtins.listToAttrs;
+  inherit (inputs.self.lib) mkEnabled mkEnabledWithProxy enableList;
 in
 {
   emacs.enable = true;

hosts/server/configuration.nix

@@ -2,6 +2,7 @@
   pkgs,
   config,
   lib,
+  inputs,
   ...
 }:
 {
@@ -10,12 +11,12 @@
     ../../config/base.nix
     ../../config/stylix.nix
   ];
-  my = import ./toggles.nix { inherit config; } // {
+  my = import ./toggles.nix { inherit config inputs; } // {
     nix.cores = 6;
     users.nixremote.enable = true;
-    users.nixremote.authorizedKeys = [
-      ../../secrets/ssh/ed25519_nixworkstation.pub
-      ../../secrets/ssh/ed25519_nixminiserver.pub
+    users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
+      "nixworkstation"
+      "nixminiserver"
     ];
     network.firewall.enabledServicePorts = true;
     network.firewall.additionalPorts = [

hosts/server/toggles.nix

@@ -1,17 +1,7 @@
-{ config }:
+{ config, inputs }:
 let
-  mkEnabled = name: {
-    inherit name;
-    value.enable = true;
-  };
-  mkEnabledIp = name: {
-    inherit name;
-    value = {
-      enable = true;
-      ip = config.my.ips.wg-server;
-    };
-  };
-  enableList = func: list: list |> map func |> builtins.listToAttrs;
+  inherit (inputs.self.lib) mkEnabled enableList;
+  mkEnabledIp = inputs.self.lib.mkEnabledIp config.my.ips.wg-server;
 in
 {
   mainServer = "server";

hosts/workstation/configuration.nix

@@ -1,6 +1,7 @@
 {
   pkgs,
   config,
+  inputs,
   ...
 }:
 let
@@ -22,29 +23,28 @@ in
     ../../config/stylix.nix
     ../../environments/gnome.nix
   ];
-  my = import ./toggles.nix // {
+  my = import ./toggles.nix { inherit inputs; } // {
     nix.cores = 8;
     nix.maxJobs = 8;
     users.nixremote.enable = true;
-    users.nixremote.authorizedKeys = [
-      ../../secrets/ssh/ed25519_nixserver.pub
-      ../../secrets/ssh/ed25519_nixminiserver.pub
+    users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
+      "nixserver"
+      "nixminiserver"
     ];
   };
-  home-manager.users.jawz = {
-    programs = {
-      vscode = {
-        enable = true;
-        package = pkgs.code-cursor-fhs;
-      };
-      ghostty = {
-        enable = true;
-        package = pkgs.ghostty;
-        enableBashIntegration = shellType == "bash";
-        enableZshIntegration = shellType == "zsh";
-        installBatSyntax = true;
-        installVimSyntax = true;
-      };
+  home-manager.users.jawz.programs = {
+    vscode = {
+      enable = true;
+      package = pkgs.code-cursor;
+    };
+    ghostty = {
+      enable = true;
+      package = pkgs.ghostty;
+      enableBashIntegration = shellType == "bash";
+      enableZshIntegration = shellType == "zsh";
+      installBatSyntax = true;
+      installVimSyntax = true;
+      settings.term = "xterm-256color";
     };
   };
   networking = {
@@ -124,9 +124,9 @@ in
     ../../secrets/ssh/root-private-ca.pem
   ];
   services = {
+    minio.enable = true;
     flatpak.enable = true;
     open-webui.enable = true;
-    tailscale.enable = true;
     scx = {
       enable = true;
       scheduler = "scx_lavd";
@@ -144,11 +144,48 @@ in
       acceleration = "cuda";
       models = "/srv/ai/ollama";
     };
-    sunshine = {
+    postgresql = {
       enable = true;
-      autoStart = false;
-      capSysAdmin = true;
-      openFirewall = true;
+      package = pkgs.postgresql_17;
+      enableTCPIP = true;
+      authentication = pkgs.lib.mkOverride 10 ''
+        local   all    all                                 trust
+        host    all    all    ${config.my.localhost}/32    trust
+        host    all    all    ::1/128                      trust
+      '';
+      ensureDatabases = [ "webref" ];
+      ensureUsers = [
+        {
+          name = "webref";
+          ensureDBOwnership = true;
+        }
+      ];
     };
   };
+  programs.virt-manager.enable = true;
+  users.groups.libvirtd.members = [ "jawz" ];
+  virtualisation.libvirtd.enable = true;
+  systemd.services.minio-init = {
+    description = "Initialize MinIO buckets";
+    after = [ "minio.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      # Wait for MinIO to be ready
+      until ${pkgs.curl}/bin/curl -sf http://localhost:9000/minio/health/live > /dev/null 2>&1; do
+        echo "Waiting for MinIO..."
+        sleep 1
+      done
+
+      # Configure mc alias and create bucket
+      ${pkgs.minio-client}/bin/mc alias set local http://localhost:9000 minioadmin minioadmin || true
+      ${pkgs.minio-client}/bin/mc mb local/webref || true
+      ${pkgs.minio-client}/bin/mc anonymous set public local/webref || true
+
+      echo "MinIO initialized with webref bucket"
+    '';
+  };
 }

hosts/workstation/toggles.nix

@@ -1,9 +1,6 @@
+{ inputs }:
 let
-  mkEnabled = name: {
-    inherit name;
-    value.enable = true;
-  };
-  enableList = func: list: list |> map func |> builtins.listToAttrs;
+  inherit (inputs.self.lib) mkEnabled enableList;
 in
 {
   stylix.enable = true;

modules/apps/internet.nix

@@ -5,29 +5,26 @@
   ...
 }:
 let
-  krisp-patcher =
-    pkgs.writers.writePython3Bin "krisp-patcher"
-      {
-        libraries = builtins.attrValues {
-          inherit (pkgs.python3Packages)
-            capstone
-            pyelftools
-            ;
-        };
-        flakeIgnore = [
-          "E501" # line too long (82 > 79 characters)
-          "F403" # 'from module import *' used; unable to detect undefined names
-          "F405" # name may be undefined, or defined from star imports: module
-        ];
-      }
-      (
-        builtins.readFile (
-          pkgs.fetchurl {
-            url = "https://pastebin.com/raw/8tQDsMVd";
-            sha256 = "sha256-IdXv0MfRG1/1pAAwHLS2+1NESFEz2uXrbSdvU9OvdJ8=";
-          }
-        )
-      );
+  krisp-settings = {
+    libraries = builtins.attrValues {
+      inherit (pkgs.python3Packages)
+        capstone
+        pyelftools
+        ;
+    };
+    flakeIgnore = [
+      "E501" # line too long (82 > 79 characters)
+      "F403" # 'from module import *' used; unable to detect undefined names
+      "F405" # name may be undefined, or defined from star imports: module
+    ];
+  };
+  krisp-patch = builtins.readFile (
+    pkgs.fetchurl {
+      url = "https://pastebin.com/raw/8tQDsMVd";
+      sha256 = "sha256-IdXv0MfRG1/1pAAwHLS2+1NESFEz2uXrbSdvU9OvdJ8=";
+    }
+  );
+  krisp-patcher = pkgs.writers.writePython3Bin "krisp-patcher" krisp-settings krisp-patch;
 in
 {
   options.my.apps.internet.enable = lib.mkEnableOption "internet browsers and communication apps";
@@ -42,7 +39,7 @@ in
         warp # transfer files with based ppl
         nextcloud-client # self-hosted google-drive alternative
         fragments # beautiful torrent client
-        tor-browser-bundle-bin # dark web, so dark!
+        tor-browser # dark web, so dark!
         telegram-desktop # furry chat
         nicotine-plus # remember Ares?
         discord # :3

modules/dev/emacs.nix

@@ -1,5 +1,6 @@
 {
   config,
+  inputs,
   lib,
   pkgs,
   ...
@@ -14,10 +15,12 @@
         "doom/templates/programming.org".source = ../../dotfiles/doom/templates/programming.org;
       };
       services.lorri.enable = true;
-      programs.${config.my.shell.type}.shellAliases = {
-        edit = "emacsclient -t";
-        e = "edit";
-      };
+      programs.${config.my.shell.type}.shellAliases =
+        inputs.self.lib.mergeAliases inputs.self.lib.commonAliases
+          {
+            edit = "emacsclient -t";
+            e = "edit";
+          };
     };
     users.users.jawz.packages = builtins.attrValues {
       inherit (pkgs.xorg) xwininfo;

modules/dev/nix.nix

@@ -1,5 +1,6 @@
 {
   config,
+  inputs,
   lib,
   pkgs,
   ...
@@ -33,12 +34,14 @@ in
   };
   config = lib.mkIf config.my.dev.nix.enable {
     users.users.jawz = { inherit packages; };
-    home-manager.users.jawz.programs.${shellType}.shellAliases = {
-      nixformat = ''
-        deadnix -e && \
-        nix run nixpkgs#nixfmt-tree && \
-        statix fix
-      '';
-    };
+    home-manager.users.jawz.programs.${shellType}.shellAliases =
+      inputs.self.lib.mergeAliases inputs.self.lib.commonAliases
+        {
+          nixformat = ''
+            deadnix -e && \
+            nix run nixpkgs#nixfmt-tree && \
+            statix fix
+          '';
+        };
   };
 }

modules/dev/sh.nix

@@ -7,7 +7,6 @@
 let
   packages = builtins.attrValues {
     inherit (pkgs)
-      bashdb # Debugger and completion support
       shellcheck # Shell script linter
       shfmt # Shell parser and formatter
       ;

modules/factories/mkserver.nix

@@ -53,58 +53,8 @@ let
       default = null;
     };
   };
-  proxy = locations: {
-    inherit locations;
-    forceSSL = true;
-    enableACME = true;
-    http2 = true;
-  };
-  proxyReverse =
-    cfg:
-    proxy {
-      "/" = {
-        proxyPass = "http://${cfg.ip}:${toString cfg.port}/";
-        proxyWebsockets = cfg.enableSocket;
-      };
-    };
-  proxyReverseFix =
-    cfg:
-    let
-      useLocalhost = cfg.hostName == config.networking.hostName;
-      localHeaders = ''
-        proxy_set_header   Host $host;
-        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header   X-Forwarded-Proto $scheme;
-      '';
-    in
-    proxyReverse cfg
-    // {
-      extraConfig = ''
-        ${if useLocalhost then localHeaders else ""}
-        proxy_set_header   X-Forwarded-Host $host;
-        proxy_set_header   Upgrade $http_upgrade;
-        proxy_set_header   Connection $http_connection;
-        proxy_redirect     off;
-        proxy_http_version 1.1;
-      '';
-    };
-  proxyReversePrivate =
-    cfg:
-    proxyReverse cfg
-    // {
-      extraConfig = ''
-        ssl_verify_client on;
-        ssl_client_certificate ${cfg.certPath};
-        error_page 403 /403.html;
-      '';
-    };
 in
 {
-  inherit
-    mkOptions
-    proxy
-    proxyReverse
-    proxyReverseFix
-    proxyReversePrivate
-    ;
+  inherit mkOptions;
+  mkServerOptions = mkOptions;
 }

modules/modules.nix

@@ -1,23 +1,23 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   filterNames = file: file != "librewolf.nix";
-  autoImport =
-    dir:
-    builtins.readDir ./${dir}
-    |> builtins.attrNames
-    |> builtins.filter (file: builtins.match ".*\\.nix" file != null && filterNames file)
-    |> map (file: ./${dir}/${file});
 in
 {
   imports =
-    autoImport "apps"
-    ++ autoImport "dev"
-    ++ autoImport "scripts"
-    ++ autoImport "servers"
-    ++ autoImport "services"
-    ++ autoImport "shell"
-    ++ autoImport "network"
+    inputs.self.lib.autoImport ./apps filterNames
+    ++ inputs.self.lib.autoImport ./dev filterNames
+    ++ inputs.self.lib.autoImport ./scripts filterNames
+    ++ inputs.self.lib.autoImport ./servers filterNames
+    ++ inputs.self.lib.autoImport ./services filterNames
+    ++ inputs.self.lib.autoImport ./shell filterNames
+    ++ inputs.self.lib.autoImport ./network filterNames
     ++ [
+      ./factories/mkscript.nix
       ./nix/build.nix
       ./users/nixremote.nix
     ];
@@ -39,7 +39,7 @@ in
     };
     domain = lib.mkOption {
       type = lib.types.str;
-      default = "servidos.lat";
+      default = "lebubu.org";
       description = "The domain name.";
     };
     ips = lib.mkOption {
@@ -49,7 +49,7 @@ in
         server = "192.168.100.15";
         miniserver = "192.168.1.100";
         workstation = "192.168.100.18";
-        vps = "51.222.141.104";
+        vps = "45.79.25.87";
         wg-vps = "10.77.0.1";
         wg-server = "10.77.0.2";
         wg-friend1 = "10.8.0.2";
@@ -105,65 +105,71 @@ in
     enableProxy = lib.mkEnableOption "nginx reverse proxy for services";
   };
   config = {
-    assertions = [
-      {
-        assertion = config.my.servers.nextcloud.enable -> config.my.servers.postgres.enable;
-        message = "Nextcloud requires PostgreSQL to be enabled";
-      }
-      {
-        assertion = config.my.servers.vaultwarden.enable -> config.my.servers.postgres.enable;
-        message = "Vaultwarden requires PostgreSQL to be enabled";
-      }
-      {
-        assertion = config.my.servers.firefly-iii.enable -> config.my.servers.postgres.enable;
-        message = "Firefly III requires PostgreSQL to be enabled";
-      }
-      {
-        assertion = config.my.servers.mealie.enable -> config.my.servers.postgres.enable;
-        message = "Mealie requires PostgreSQL to be enabled";
-      }
-      {
-        assertion = config.my.servers.shiori.enable -> config.my.servers.postgres.enable;
-        message = "Shiori requires PostgreSQL to be enabled";
-      }
-      {
-        assertion = config.my.servers.ryot.enable -> config.my.servers.postgres.enable;
-        message = "Ryot requires PostgreSQL to be enabled";
-      }
-      {
-        assertion = config.my.servers.synapse.enable -> config.my.servers.postgres.enable;
-        message = "Matrix Synapse requires PostgreSQL to be enabled";
-      }
-      {
-        assertion = config.my.servers.gitea.enable -> config.my.servers.postgres.enable;
-        message = "Gitea requires PostgreSQL to be enabled";
-      }
-      {
-        assertion =
-          config.my.enableProxy
-          -> (builtins.any (s: s.enableProxy or false) (builtins.attrValues config.my.servers));
-        message = "enableProxy is true but no services have enableProxy enabled";
-      }
-      {
-        assertion =
-          config.my.enableContainers
-          || !(builtins.any (opt: opt) [
-            config.my.servers.ryot.enable
-            config.my.servers.lidarr.enable
-            config.my.servers.prowlarr.enable
-            config.my.servers.maloja.enable
-            config.my.servers.multi-scrobbler.enable
-            config.my.servers.flame.enable
-            config.my.servers.flameSecret.enable
-            config.my.servers.metube.enable
-            config.my.servers.go-vod.enable
-            config.my.servers.tranga.enable
-            config.my.servers.drpp.enable
-            config.my.servers.plex-discord-bot.enable
-          ]);
-        message = "Container services are enabled but enableContainers is false";
-      }
-    ];
+    assertions =
+      # PostgreSQL dependency assertions
+      inputs.self.lib.mkPostgresDependencies config [
+        {
+          service = "nextcloud";
+          name = "Nextcloud";
+        }
+        {
+          service = "vaultwarden";
+          name = "Vaultwarden";
+        }
+        {
+          service = "firefly-iii";
+          name = "Firefly III";
+        }
+        {
+          service = "mealie";
+          name = "Mealie";
+        }
+        {
+          service = "shiori";
+          name = "Shiori";
+        }
+        {
+          service = "ryot";
+          name = "Ryot";
+        }
+        {
+          service = "synapse";
+          name = "Matrix Synapse";
+        }
+        {
+          service = "gitea";
+          name = "Gitea";
+        }
+      ]
+      ++
+      # Other assertions
+      [
+        {
+          assertion =
+            config.my.enableProxy
+            -> (builtins.any (s: s.enableProxy or false) (builtins.attrValues config.my.servers));
+          message = "enableProxy is true but no services have enableProxy enabled";
+        }
+        {
+          assertion =
+            config.my.enableContainers
+            || !(builtins.any (opt: opt) [
+              config.my.servers.ryot.enable
+              config.my.servers.lidarr.enable
+              config.my.servers.prowlarr.enable
+              config.my.servers.maloja.enable
+              config.my.servers.multi-scrobbler.enable
+              config.my.servers.flame.enable
+              config.my.servers.flameSecret.enable
+              config.my.servers.metube.enable
+              config.my.servers.go-vod.enable
+              config.my.servers.tranga.enable
+              config.my.servers.drpp.enable
+              config.my.servers.plex-discord-bot.enable
+            ]);
+          message = "Container services are enabled but enableContainers is false";
+        }
+      ];
     virtualisation = {
       containers.enable = true;
       oci-containers.backend = "podman";

modules/network/firewall.nix

@@ -1,18 +1,24 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
-  nativeServicesWithOpenFirewall = [
-    "adguardhome"
-    "plex"
-    "nix-serve"
-    "radarr"
-    "sonarr"
-    "jellyfin"
-    "prowlarr"
-    "bazarr"
-    "stash"
-    "ombi"
-    "flaresolverr"
+  firewallBlacklist = [
+    "sabnzbd"
+    "lidarr"
+    "maloja"
+    "tranga"
+    "flame"
+    "flameSecret"
+    "ryot"
+    "drpp"
+    "metube"
+    "multi-scrobbler"
+    "plex-discord-bot"
   ];
+  nativeServicesWithOpenFirewall = inputs.self.lib.getServicesWithNativeFirewall config firewallBlacklist;
   servicesConfig = lib.listToAttrs (
     map (serviceName: {
       name = serviceName;
@@ -37,17 +43,7 @@ in
   config = lib.mkIf config.my.network.firewall.enabledServicePorts {
     services = servicesConfig;
     networking.firewall.allowedTCPPorts =
-      config.my.network.firewall.staticPorts
-      ++ config.my.network.firewall.additionalPorts
-      ++ (
-        config.my.servers
-        |> lib.filterAttrs (
-          name: srv:
-          (srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServicesWithOpenFirewall)
-        )
-        |> lib.attrValues
-        |> map (srv: srv.port)
-      )
+      inputs.self.lib.generateFirewallPorts config nativeServicesWithOpenFirewall lib
       ++ (lib.optionals config.services.nginx.enable [
         config.services.nginx.defaultHTTPListenPort
         config.services.nginx.defaultSSLListenPort

modules/network/nginx.nix

@@ -1,6 +1,10 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   proxyReverseServices = [
     "firefox-syncserver"
     "readeck"
@@ -44,11 +48,11 @@ let
       cfg = config.my.servers.${serviceName};
       proxyFunc =
         if serviceConfig.type == "proxyReverse" then
-          setup.proxyReverse
+          inputs.self.lib.proxyReverse
         else if serviceConfig.type == "proxyReverseFix" then
-          setup.proxyReverseFix
+          inputs.self.lib.proxyReverseFix
         else if serviceConfig.type == "proxyReversePrivate" then
-          setup.proxyReversePrivate
+          inputs.self.lib.proxyReversePrivate
         else
           throw "Unknown proxy type: ${serviceConfig.type}";
     in

modules/nix/gitea-actions-runners/nixos.nix

@@ -9,22 +9,40 @@ let
 in
 {
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
+    users.groups.gitea-runner = { };
+    users.users.gitea-runner = {
+      isSystemUser = true;
+      group = "gitea-runner";
+      extraGroups = [
+        "docker"
+        "podman"
+      ];
+    };
+    nix.settings = {
+      allowed-users = [ "gitea" "gitea-runner" ];
+      trusted-users = [ "gitea" "gitea-runner" ];
+    };
     services.gitea-actions-runner.instances.nixos = {
       inherit (cfg) url enable;
       name = "${config.networking.hostName}-nixos";
       tokenFile = config.sops.secrets.gitea.path;
       labels = [
+        "nix:host"
         "nixos:host"
       ];
       hostPackages = builtins.attrValues {
         inherit (pkgs)
           bash
+          curl
           coreutils
           gitMinimal
-          nix
           attic-client
-          nodejs # Required for GitHub Actions
-          openssh # Required for SSH git operations
+          podman
+          podman-compose
+          nix
+          nodejs
+          openssh
+          python3
           ;
       };
     };

modules/scripts/download.nix

@@ -6,7 +6,6 @@
   ...
 }:
 {
-  imports = [ ../factories/mkscript.nix ];
   options.my.units = {
     download.enable = lib.mkEnableOption "media download automation scripts";
     downloadManga.enable = lib.mkEnableOption "manga download automation";
@@ -17,32 +16,26 @@
     in
     {
       home-manager.users.jawz.programs.${config.my.shell.type} = {
-        shellAliases = {
+        shellAliases = inputs.self.lib.mergeAliases inputs.self.lib.commonAliases {
           dl = "${download}/bin/download -u jawz -i";
           comic = ''dl "$(cat "$LC" | fzf --multi --exact -i)"'';
           gallery = ''dl "$(cat "$LW" | fzf --multi --exact -i)"'';
         };
       }
-      // (
-        if config.my.shell.type == "bash" then
-          {
-            initExtra = ''
-              list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
-              export LW=$list_root/watch.txt
-              export LI=$list_root/instant.txt
-              export LC=$list_root/comic.txt
-            '';
-          }
-        else
-          {
-            initContent = ''
-              list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
-              export LW=$list_root/watch.txt
-              export LI=$list_root/instant.txt
-              export LC=$list_root/comic.txt
-            '';
-          }
-      );
+      //
+        inputs.self.lib.shellConditional config.my.shell.type
+          ''
+            list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
+            export LW=$list_root/watch.txt
+            export LI=$list_root/instant.txt
+            export LC=$list_root/comic.txt
+          ''
+          ''
+            list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
+            export LW=$list_root/watch.txt
+            export LI=$list_root/instant.txt
+            export LC=$list_root/comic.txt
+          '';
       systemd.user = {
         services =
           let

modules/scripts/ffmpeg4discord.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.ffmpeg4discord = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/ffmpreg.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.ffmpreg = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/find-dup-episode.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.find-dup-episodes = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/library-report.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.library-report = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/manage-library.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.manage-library = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/pika-list.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.pika-list = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/run.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.run = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/split-dir.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.split-dir = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/stream-dl.nix

@@ -6,7 +6,6 @@
   ...
 }:
 {
-  imports = [ ../factories/mkscript.nix ];
   options.my.units.stream-dl.enable = lib.mkEnableOption "streaming media download service";
   config =
     let

modules/scripts/tasks.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.tasks = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/tuh-activity-logger.nix

@@ -1,6 +1,5 @@
 { inputs, lib, ... }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.tuh-activity-logger = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/update-dns.nix

@@ -6,7 +6,6 @@
   ...
 }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config = lib.mkIf config.my.secureHost {
     sops.secrets = {
       cloudflare-api.sopsFile = ../../secrets/env.yaml;

modules/scripts/update-org-agenda-cache.nix

@@ -5,7 +5,6 @@
   ...
 }:
 {
-  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.update-org-agenda-cache = {
     enable = lib.mkDefault false;
     install = config.my.emacs.enable;

modules/servers/atticd.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.atticd;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.atticd;
 in
 {
   options.my.servers.atticd = setup.mkOptions "atticd" "cache" 2343;
@@ -13,21 +17,25 @@ in
       settings = {
         listen = "[::]:${toString cfg.port}";
         jwt = { };
+        database.heartbeat = true; # 5 minutes
         chunking = {
           nar-size-threshold = 64 * 1024; # 64 KiB
           min-size = 16 * 1024; # 16 KiB
           avg-size = 64 * 1024; # 64 KiB
           max-size = 256 * 1024; # 256 KiB
         };
-        compression = {
-          type = "zstd";
-          level = 8;
-        };
         garbage-collection = {
           interval = "7 days";
           default-retention-period = "7 days";
         };
       };
     };
+    systemd.services.atticd = {
+      serviceConfig = {
+        TimeoutStartSec = "15min";
+        TimeoutStopSec = "5min";
+        MemoryMax = "4G";
+      };
+    };
   };
 }

modules/servers/audiobookshelf.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.audiobookshelf;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.audiobookshelf;
 in
 {
   options.my.servers.audiobookshelf = setup.mkOptions "audiobookshelf" "audiobooks" 5687;

modules/servers/bazarr.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.bazarr;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.bazarr;
 in
 {
   options.my.servers.bazarr = setup.mkOptions "bazarr" "subs" config.services.bazarr.listenPort;

modules/servers/drpp.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.drpp;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.drpp;
 in
 {
   options.my.servers.drpp = setup.mkOptions "drpp" "drpp" 0;

modules/servers/firefox-syncserver.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.firefox-syncserver;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.firefox-syncserver;
 in
 {
   options.my.servers.firefox-syncserver = setup.mkOptions "firefox-syncserver" "sync" 4233;

modules/servers/flame.nix

@@ -1,4 +1,8 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
   cfg = config.my.servers.flame;
   cfgS = config.my.servers.flameSecret;

modules/servers/gitea.nix

@@ -5,12 +5,11 @@
   ...
 }:
 let
-  cfg = config.my.servers.gitea;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.gitea;
 in
 {
   imports = [
-    ../nix/gitea-actions-runners/ryujinx.nix
     ../nix/gitea-actions-runners/nixos.nix
   ];
   options.my.servers.gitea = setup.mkOptions "gitea" "git" 9083;

modules/servers/homepage.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.homepage;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.homepage;
 in
 {
   options.my.servers.homepage = setup.mkOptions "homepage" "home" 8082;

modules/servers/homepage/bookmarks/servers.nix

@@ -4,7 +4,7 @@
       readeck = [
         {
           abbr = "RD";
-          href = "https://laters.servidos.lat/";
+          href = "https://laters.lebubu.org/";
           description = "";
         }
       ];
@@ -13,7 +13,7 @@
       maloja = [
         {
           abbr = "ML";
-          href = "https://maloja.servidos.lat/";
+          href = "https://maloja.lebubu.org/";
           description = "";
         }
       ];
@@ -22,7 +22,7 @@
       microbin = [
         {
           abbr = "CP";
-          href = "https://copy.servidos.lat/";
+          href = "https://copy.lebubu.org/";
           description = "";
         }
       ];
@@ -31,7 +31,7 @@
       multi-scrobbler = [
         {
           abbr = "MS";
-          href = "https://scrobble.servidos.lat/";
+          href = "https://scrobble.lebubu.org/";
           description = "";
         }
       ];
@@ -40,7 +40,7 @@
       ryot = [
         {
           abbr = "RT";
-          href = "https://tracker.servidos.lat/";
+          href = "https://tracker.lebubu.org/";
           description = "";
         }
       ];
@@ -49,7 +49,7 @@
       vaultwarden = [
         {
           abbr = "VW";
-          href = "https://vault.servidos.lat";
+          href = "https://vault.lebubu.org";
           description = "";
         }
       ];

modules/servers/jellyfin.nix

@@ -8,6 +8,7 @@
 let
   cfg = config.my.servers.jellyfin;
   inherit (inputs.jawz-scripts.packages.x86_64-linux) sub-sync;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
   sub-sync-path = [
     pkgs.nix
     pkgs.bash
@@ -19,7 +20,6 @@ let
     pkgs.gum
     sub-sync
   ];
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.jellyfin = setup.mkOptions "jellyfin" "flix" 8096;

modules/servers/kavita.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.kavita;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.kavita;
 in
 {
   options.my.servers.kavita = setup.mkOptions "kavita" "library" config.services.kavita.settings.Port;

modules/servers/lidarr.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.lidarr;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.lidarr;
 in
 {
   options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;

modules/servers/maloja.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.maloja;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.maloja;
 in
 {
   options.my.servers.maloja = setup.mkOptions "maloja" "maloja" 42010;

modules/servers/mealie.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.mealie;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.mealie;
 in
 {
   options.my.servers.mealie = setup.mkOptions "mealie" "mealie" 9925;

modules/servers/metube.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.metube;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.metube;
 in
 {
   options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;

modules/servers/microbin.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.microbin;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.microbin;
 in
 {
   options.my.servers.microbin = setup.mkOptions "microbin" "copy" 8086;

modules/servers/multi-scrobbler.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.multi-scrobbler;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.multi-scrobbler;
 in
 {
   options.my.servers.multi-scrobbler = setup.mkOptions "multi-scrobbler" "scrobble" 9078;

modules/servers/nextcloud.nix

@@ -6,6 +6,7 @@
   ...
 }:
 let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
   commonProxyConfig = ''
     proxy_set_header Host $host;
   '';
@@ -28,10 +29,9 @@ let
       };
     }
   );
-  pytensorflow = pkgs.python311.withPackages (ps: [ ps.tensorflow ]);
+  pytensorflow = pkgs.python3.withPackages (ps: [ ps.tensorflow ]);
   cfg = config.my.servers.nextcloud;
   cfgC = config.my.servers.collabora;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers = {
@@ -175,6 +175,14 @@ in
           ];
           #vps
           serverAliases = [ "cloud.rotehaare.art" ];
+          extraConfig = ''
+            add_header X-XSS-Protection "1; mode=block" always;
+            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header Referrer-Policy "no-referrer-when-downgrade" always;
+            add_header X-Permitted-Cross-Domain-Policies "none" always;
+          '';
           locations = {
             "/".proxyWebsockets = true;
             "~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|oc[ms]-provider/.+|.+/richdocumentscode/proxy).php(?:$|/)" =
@@ -187,6 +195,11 @@ in
           http2 = true;
           locations = {
             # static files
+            "^~ /browser" = {
+              proxyPass = cfgC.local;
+              extraConfig = commonProxyConfig;
+            };
+            # Legacy static files (for compatibility)
             "^~ /loleaflet" = {
               proxyPass = cfgC.local;
               extraConfig = commonProxyConfig;
@@ -202,11 +215,21 @@ in
               extraConfig = commonProxyConfig;
             };
             # download, presentation, image upload and websocket
+            "~ ^/cool" = {
+              proxyPass = cfgC.local;
+              extraConfig = commonWebsocketConfig;
+            };
+            # Legacy websocket (for compatibility)
             "~ ^/lool" = {
               proxyPass = cfgC.local;
               extraConfig = commonWebsocketConfig;
             };
             # Admin Console websocket
+            "^~ /cool/adminws" = {
+              proxyPass = cfgC.local;
+              extraConfig = commonWebsocketConfig;
+            };
+            # Legacy Admin Console websocket (for compatibility)
             "^~ /lool/adminws" = {
               proxyPass = cfgC.local;
               extraConfig = commonWebsocketConfig;
@@ -231,23 +254,23 @@ in
       };
       collabora = lib.mkIf cfgC.enable {
         autoStart = true;
-        image = "collabora/code";
-        imageFile = pkgs.dockerTools.pullImage {
-          imageName = "collabora/code";
-          imageDigest = "sha256:aab41379baf5652832e9237fcc06a768096a5a7fccc66cf8bd4fdb06d2cbba7f";
-          sha256 = "sha256-M66lynhzaOEFnE15Sy1N6lBbGDxwNw6ap+IUJAvoCLs=";
-        };
+        image = "collabora/code:latest";
         ports = [ "9980:9980" ];
         environment = {
           TZ = config.my.timeZone;
           domain = cfg.host;
-          aliasgroup1 = "${cfg.host}:443";
-          aliasgroup2 = "cloud.rotehaare.art:443";
+          aliasgroup1 = "${cfg.url}:443";
+          aliasgroup2 = "https://cloud.rotehaare.art:443";
+          server_name = cfgC.host;
           dictionaries = "en_CA en_US es_MX es_ES fr_FR it pt_BR ru";
           extra_params = ''
             --o:ssl.enable=false
             --o:ssl.termination=true
+            --o:remote_font_config.url=${cfg.url}/apps/richdocuments/settings/fonts.json
+            --o:logging.level=information
           '';
+          DONT_GEN_SSL_CERT = "1";
+          SLEEPFORDEBUGGER = "0";
         };
         extraOptions = [
           "--cap-add"

modules/servers/nix-serve.nix

@@ -5,8 +5,8 @@
   ...
 }:
 let
-  cfg = config.my.servers.nix-serve;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.nix-serve;
 in
 {
   options.my.servers.nix-serve = setup.mkOptions "nix-serve" "cache" 5000;

modules/servers/ombi.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.ombi;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.ombi;
 in
 {
   options.my.servers.ombi = setup.mkOptions "ombi" "requests" 3425;

modules/servers/plex-discord-bot.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.plex-discord-bot;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.plex-discord-bot;
   name = "plex-discord-bot";
 in
 {

modules/servers/plex.nix

@@ -4,8 +4,8 @@
   ...
 }:
 let
-  cfg = config.my.servers.plex;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.plex;
 in
 {
   options.my.servers.plex = setup.mkOptions "plex" "plex" 32400;

modules/servers/portfolio.nix

@@ -4,8 +4,8 @@
   ...
 }:
 let
-  cfg = config.my.websites.portfolio;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.websites.portfolio;
 in
 {
   options.my.websites.portfolio = setup.mkOptions "portfolio" "portfolio" 0;

modules/servers/prowlarr.nix

@@ -4,8 +4,8 @@
   ...
 }:
 let
-  cfg = config.my.servers.prowlarr;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.prowlarr;
 in
 {
   options.my.servers.prowlarr = setup.mkOptions "prowlarr" "indexer" 9696;

modules/servers/qbittorrent.nix

@@ -1,8 +1,8 @@
 {
+  inputs,
   lib,
   config,
   pkgs,
-  inputs,
   ...
 }:
 let
@@ -36,6 +36,10 @@ let
         ;
     }
   );
+  torrentCompletionScript = pkgs.writeShellScript "qbit-torrent-completion" ''
+    chown jawz:piracy -R "$1"
+    chmod -R 775 "$1"
+  '';
 in
 {
   options.my.servers = {
@@ -50,6 +54,7 @@ in
     };
   };
   config = lib.mkIf (config.my.servers.qbittorrent.enable && config.my.secureHost) {
+    my.network.firewall.additionalPorts = [ config.my.servers.qbittorrent.port ];
     home-manager.users.jawz.xdg.dataFile.vuetorrent.source = vuetorrent;
     sops.secrets =
       let
@@ -72,7 +77,10 @@ in
         "unpackerr/radarr-api" = mkUnpackerrSecret;
       };
     systemd = {
-      packages = [ pkgs.qbittorrent-nox ];
+      packages = [
+        pkgs.qbittorrent-nox
+        torrentCompletionScript
+      ];
       services."qbittorrent-nox@jawz" = {
         enable = true;
         overrideStrategy = "asDropin";

modules/servers/radarr.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.radarr;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.radarr;
 in
 {
   options.my.servers.radarr = setup.mkOptions "radarr" "movies" 7878;

modules/servers/readeck.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.readeck;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.readeck;
 in
 {
   options.my.servers.readeck = setup.mkOptions "readeck" "laters" 9546;

modules/servers/ryot.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.ryot;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.ryot;
 in
 {
   options.my.servers.ryot = setup.mkOptions "ryot" "tracker" 8765;

modules/servers/sabnzbd.nix

@@ -12,6 +12,7 @@ in
     };
   };
   config = lib.mkIf cfg.enable {
+    my.network.firewall.additionalPorts = [ cfg.port ];
     services.sabnzbd = {
       inherit (cfg) enable;
       group = "piracy";

modules/servers/shiori.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.shiori;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.shiori;
 in
 {
   options.my.servers.shiori = setup.mkOptions "shiori" "bookmarks" 4368;

modules/servers/sonarr.nix

@@ -1,7 +1,11 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 let
-  cfg = config.my.servers.sonarr;
   setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.sonarr;
 in
 {
   options.my.servers.sonarr = setup.mkOptions "sonarr" "series" 8989;

modules/servers/stash.nix

@@ -5,9 +5,9 @@
   ...
 }:
 let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.stash;
   cfgS = config.services.stash;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   stashPythonFHS = pkgs.buildFHSEnv {
     name = "stash-python-fhs";
     targetPkgs =

modules/servers/synapse.nix

@@ -5,10 +5,10 @@
   ...
 }:
 let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.synapse;
   cfgE = config.my.servers.element;
   domain = "wedsgk5ac2qcaf9yb.click";
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   clientConfig."m.homeserver".base_url = cfg.url;
   serverConfig."m.server" = "${cfg.host}:443";
   mkWellKnown = data: ''
@@ -58,7 +58,7 @@ in
         ];
         settings = {
           server_name = cfg.domain;
-          public_baseurl = cfg.url;
+          public_baseurl = "http://${config.my.ips.wg-server}:${toString cfg.port}";
           federation_domain_whitelist = [ ];
           allow_public_rooms_without_auth = false;
           allow_public_rooms_over_federation = false;

modules/servers/tranga.nix

@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.tranga;

modules/services/network.nix

@@ -13,7 +13,8 @@
       hosts = config.my.ips |> lib.mapAttrs' (hostname: ip: lib.nameValuePair ip [ hostname ]);
       interfaces."${config.my.interfaces.${config.networking.hostName}}".wakeOnLan.enable = true;
     };
-    services.dnscrypt-proxy2 = {
+    systemd.services.dnscrypt-proxy.serviceConfig.StateDirectory = "dnscrypt-proxy";
+    services.dnscrypt-proxy = {
       enable = true;
       settings = {
         ipv6_servers = true;
@@ -43,8 +44,5 @@
         ];
       };
     };
-    systemd.services.dnscrypt-proxy2.serviceConfig = {
-      StateDirectory = "dnscrypt-proxy";
-    };
   };
 }

modules/services/nvidia.nix

@@ -17,7 +17,7 @@
         extraPackages = builtins.attrValues {
           inherit (pkgs)
             nvidia-vaapi-driver
-            vaapiVdpau
+            libva-vdpau-driver
             libvdpau-va-gl
             vulkan-loader
             mesa

modules/shell/multimedia.nix

@@ -1,5 +1,6 @@
 {
   config,
+  inputs,
   lib,
   pkgs,
   ...
@@ -24,7 +25,7 @@
       };
       gallery-dl = {
         enable = true;
-        settings = import ../../dotfiles/gallery-dl.nix;
+        settings = inputs.self.lib.importDotfile ../../dotfiles/gallery-dl.nix;
       };
       ${config.my.shell.type} = {
         initExtra = lib.mkAfter ''

modules/shell/tools.nix

@@ -57,7 +57,7 @@ in
         };
       };
       ${shellType} = {
-        shellAliases = {
+        shellAliases = inputs.self.lib.mergeAliases inputs.self.lib.commonAliases {
           cd = "z";
           hh = "hstr";
           ls = "eza --icons --group-directories-first";
@@ -70,26 +70,20 @@ in
             uniq --count | sort -rn'';
         };
       }
-      // (
-        if shellType == "bash" then
-          {
-            initExtra = ''
-              if command -v fzf-share >/dev/null; then
-              source "$(fzf-share)/key-bindings.bash"
-              source "$(fzf-share)/completion.bash"
-              fi
-            '';
-          }
-        else
-          {
-            initContent = ''
-              if command -v fzf-share >/dev/null; then
-              source "$(fzf-share)/key-bindings.bash"
-              source "$(fzf-share)/completion.bash"
-              fi
-            '';
-          }
-      );
+      //
+        inputs.self.lib.shellConditional shellType
+          ''
+            if command -v fzf-share >/dev/null; then
+            source "$(fzf-share)/key-bindings.bash"
+            source "$(fzf-share)/completion.bash"
+            fi
+          ''
+          ''
+            if command -v fzf-share >/dev/null; then
+            source "$(fzf-share)/key-bindings.bash"
+            source "$(fzf-share)/completion.bash"
+            fi
+          '';
     };
     programs = {
       starship.enable = true;
@@ -103,7 +97,7 @@ in
     users.users.jawz.packages = builtins.attrValues {
       inherit (pkgs)
         ripgrep # modern grep
-        du-dust # rusty du similar to gdu
+        dust # rusty du similar to gdu
         fd # modern find, faster searches
         fzf # fuzzy finder! super cool and useful
         gdu # disk-space utility checker, somewhat useful
@@ -112,8 +106,6 @@ in
         jq # json parser
         yq # yaml parser
         smartmontools # check hard drie health
-        ;
-      inherit (inputs.jawz-scripts.packages.x86_64-linux)
         rmlint # amazing dupe finder that integrates well with BTRFS
         ;
     };

modules/users/nixremote.nix

@@ -1,13 +1,18 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 {
   options.my.users.nixremote = {
     enable = lib.mkEnableOption "nixremote user for distributed builds";
     authorizedKeys = lib.mkOption {
       type = lib.types.listOf lib.types.path;
-      default = [
-        ../../secrets/ssh/ed25519_nixworkstation.pub
-        ../../secrets/ssh/ed25519_nixserver.pub
-        ../../secrets/ssh/ed25519_nixminiserver.pub
+      default = inputs.self.lib.getSshKeys [
+        "nixworkstation"
+        "nixserver"
+        "nixminiserver"
       ];
       description = "List of SSH public key files to authorize for nixremote user";
     };

parts/core.nix

@@ -0,0 +1,218 @@
+{ inputs, ... }:
+let
+  system = "x86_64-linux";
+  mkpkgs =
+    repo:
+    import repo {
+      inherit system;
+      config.allowUnfree = true;
+    };
+in
+{
+  systems = [ system ];
+  flake = {
+    lib = {
+      commonModules = name: [
+        ../hosts/${name}/configuration.nix
+        inputs.nur.modules.nixos.default
+        inputs.sops-nix.nixosModules.sops
+        inputs.stylix.nixosModules.stylix
+        inputs.nixtendo-switch.nixosModules.nixtendo-switch
+        {
+          nixpkgs.overlays = [
+            (import ../config/overlay.nix { inherit mkpkgs inputs; })
+            inputs.doom-emacs.overlays.default
+          ];
+        }
+        {
+          nix.registry = {
+            jawz.flake = inputs.self;
+            unstable.flake = inputs.nixpkgs-unstable;
+          };
+        }
+      ];
+      createConfig =
+        name: local-nixpkgs:
+        let
+          lib = local-nixpkgs.lib // inputs.home-manager.lib;
+        in
+        lib.nixosSystem {
+          inherit system;
+          modules = inputs.self.lib.commonModules name;
+          specialArgs = {
+            inherit inputs;
+            outputs = inputs.self;
+          };
+        };
+      langList =
+        builtins.readDir ../modules/dev
+        |> builtins.attrNames
+        |> map (file: baseNameOf file |> builtins.replaceStrings [ ".nix" ] [ "" ])
+        |> builtins.filter (name: name != "emacs");
+      autoImport =
+        dir: filterFn:
+        builtins.readDir dir
+        |> builtins.attrNames
+        |> builtins.filter (file: builtins.match ".*\\.nix" file != null && filterFn file)
+        |> map (file: dir + "/${file}");
+      proxy = locations: {
+        inherit locations;
+        forceSSL = true;
+        enableACME = true;
+        http2 = true;
+      };
+      proxyReverse =
+        cfg:
+        inputs.self.lib.proxy {
+          "/" = {
+            proxyPass = "http://${cfg.ip}:${toString cfg.port}/";
+            proxyWebsockets = cfg.enableSocket or false;
+          };
+        };
+      proxyReverseFix =
+        cfg:
+        let
+          useLocalhost = cfg.hostName == cfg.hostName;
+          localHeaders = ''
+            proxy_set_header   Host $host;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+          '';
+        in
+        inputs.self.lib.proxyReverse cfg
+        // {
+          extraConfig = ''
+            ${if useLocalhost then localHeaders else ""}
+            proxy_set_header   X-Forwarded-Host $host;
+            proxy_set_header   Upgrade $http_upgrade;
+            proxy_set_header   Connection $http_connection;
+            proxy_redirect     off;
+            proxy_http_version 1.1;
+          '';
+        };
+      proxyReversePrivate =
+        cfg:
+        inputs.self.lib.proxyReverse cfg
+        // {
+          extraConfig = ''
+            ssl_verify_client on;
+            ssl_client_certificate ${cfg.certPath};
+            error_page 403 /403.html;
+          '';
+        };
+      commonAliases = {
+        cp = "cp -i";
+        mv = "mv -i";
+        mkdir = "mkdir -p";
+        mkcd = "(){ mkdir -p \"$1\" && cd \"$1\" }";
+        copy = "xclip -selection clipboard";
+        cdp = "pwd | copy";
+        cfp = "(){ readlink -f \"$1\" | copy }";
+        ".." = "cd ..";
+        "..." = "cd ../..";
+        ".3" = "cd ../../..";
+        ".4" = "cd ../../../..";
+        ".5" = "cd ../../../../..";
+        c = "cat";
+        sc = "systemctl --user";
+        jc = "journalctl --user -xefu";
+      };
+      xdgEnvironment =
+        let
+          XDG_DATA_HOME = "\${HOME}/.local/share";
+          XDG_CONFIG_HOME = "\${HOME}/.config";
+          XDG_CACHE_HOME = "\${HOME}/.cache";
+        in
+        {
+          inherit XDG_DATA_HOME XDG_CONFIG_HOME XDG_CACHE_HOME;
+          XDG_BIN_HOME = "\${HOME}/.local/bin";
+          XDG_STATE_HOME = "\${HOME}/.local/state";
+          PSQL_HISTORY = "${XDG_DATA_HOME}/psql_history";
+          REDISCLI_HISTFILE = "${XDG_DATA_HOME}/redis/rediscli_history";
+          WINEPREFIX = "${XDG_DATA_HOME}/wine";
+          ELECTRUMDIR = "${XDG_DATA_HOME}/electrum";
+          WGETRC = "${XDG_CONFIG_HOME}/wgetrc";
+          XCOMPOSECACHE = "${XDG_CACHE_HOME}/X11/xcompose";
+          "_JAVA_OPTIONS" = "-Djava.util.prefs.userRoot=${XDG_CONFIG_HOME}/java";
+          ORG_DEVICE = "workstation";
+          PATH = [ "\${HOME}/.local/bin" ];
+        };
+      getNixosHosts =
+        ips: hostName: lib:
+        builtins.attrNames ips
+        |> builtins.filter (
+          name: !(lib.hasPrefix "wg-" name) && name != "vps" && name != "router" && name != hostName
+        );
+      shellConditional =
+        shellType: bashContent: zshContent:
+        if shellType == "bash" then { initExtra = bashContent; } else { initContent = zshContent; };
+      mergeAliases = baseAliases: extraAliases: baseAliases // extraAliases;
+      importDotfile = path: import path;
+      getServicesWithNativeFirewall =
+        config: blacklist:
+        config.my.servers
+        |> builtins.attrNames
+        |> builtins.filter (
+          name:
+          (config.my.servers.${name}.enable or false)
+          && !(builtins.elem name blacklist)
+          && builtins.hasAttr name config.services
+          && (config.services.${name} ? openFirewall)
+        );
+      generateFirewallPorts =
+        config: nativeServices: lib:
+        config.my.network.firewall.staticPorts
+        ++ config.my.network.firewall.additionalPorts
+        ++ (
+          config.my.servers
+          |> lib.filterAttrs (
+            name: srv: (srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServices)
+          )
+          |> lib.attrValues
+          |> map (srv: srv.port)
+        );
+      mkEnabled = name: {
+        inherit name;
+        value.enable = true;
+      };
+      mkEnabledWithProxy = name: {
+        inherit name;
+        value = {
+          enable = true;
+          enableProxy = true;
+        };
+      };
+      mkEnabledIp = ip: name: {
+        inherit name;
+        value = {
+          enable = true;
+          inherit ip;
+        };
+      };
+      enableList = func: list: list |> map func |> builtins.listToAttrs;
+      mkPostgresDependency = config: serviceName: displayName: {
+        assertion = config.my.servers.${serviceName}.enable -> config.my.servers.postgres.enable;
+        message = "${displayName} requires PostgreSQL to be enabled";
+      };
+      mkPostgresDependencies =
+        config: serviceMap:
+        serviceMap |> map (entry: inputs.self.lib.mkPostgresDependency config entry.service entry.name);
+      sshKeys = {
+        deacero = ../secrets/ssh/ed25519_deacero.pub;
+        workstation = ../secrets/ssh/ed25519_workstation.pub;
+        server = ../secrets/ssh/ed25519_server.pub;
+        miniserver = ../secrets/ssh/ed25519_miniserver.pub;
+        galaxy = ../secrets/ssh/ed25519_galaxy.pub;
+        phone = ../secrets/ssh/ed25519_phone.pub;
+        vps = ../secrets/ssh/ed25519_vps.pub;
+        emacs = ../secrets/ssh/ed25519_emacs.pub;
+        # Build user keys (nixremote)
+        nixworkstation = ../secrets/ssh/ed25519_nixworkstation.pub;
+        nixserver = ../secrets/ssh/ed25519_nixserver.pub;
+        nixminiserver = ../secrets/ssh/ed25519_nixminiserver.pub;
+        windows_vm = ../secrets/ssh/ed25519_windows_vm.pub;
+      };
+      getSshKeys = keyNames: keyNames |> map (name: inputs.self.lib.sshKeys.${name});
+    };
+  };
+}

parts/devshells.nix

@@ -0,0 +1,12 @@
+{ inputs, ... }:
+{
+  perSystem = _: {
+    devShells =
+      inputs.self.lib.langList
+      |> map (name: {
+        inherit name;
+        value = inputs.self.nixosConfigurations.emacs.config.devShells.${name};
+      })
+      |> builtins.listToAttrs;
+  };
+}

parts/hosts.nix

@@ -0,0 +1,10 @@
+{ inputs, ... }:
+{
+  flake.nixosConfigurations = {
+    workstation = inputs.self.lib.createConfig "workstation" inputs.nixpkgs;
+    miniserver = inputs.self.lib.createConfig "miniserver" inputs.nixpkgs-small;
+    server = inputs.self.lib.createConfig "server" inputs.nixpkgs-small;
+    galaxy = inputs.self.lib.createConfig "galaxy" inputs.nixpkgs-small;
+    emacs = inputs.self.lib.createConfig "emacs" inputs.nixpkgs;
+  };
+}

parts/packages.nix

@@ -0,0 +1,18 @@
+{ inputs, ... }:
+{
+  perSystem =
+    { system, ... }:
+    {
+      packages = (inputs.jawz-scripts.packages.${system} or { }) // {
+        emacs-vm = inputs.nixos-generators.nixosGenerate {
+          inherit system;
+          modules = inputs.self.lib.commonModules "emacs";
+          format = "vm";
+          specialArgs = {
+            inherit inputs;
+            outputs = inputs.self;
+          };
+        };
+      };
+    };
+}

scripts/push-to-cache.sh

@@ -11,7 +11,7 @@ NC='\033[0m' # No Color
 
 # Configuration
 CACHE_NAME="servidos:nixos"
-CACHE_URL="https://cache.servidos.lat"
+CACHE_URL="https://cache.lebubu.org"
 
 echo -e "${BLUE}=========================================${NC}"
 echo -e "${BLUE}NixOS Build Cache Pusher${NC}"

secrets/ssh/ed25519_windows_vm.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYwRyCCOXaq7PO1aK58XLRcbuvY6j8rvjZmgTwUKTIZ capta@DESKTOP-JJLTF62