emacs main repo parity

linode builds both image and host
time for mcp to build
2026-02-09 18:47:49 -06:00 · 2026-02-09 00:13:59 -06:00 · 2026-02-08 23:33:15 -06:00 · 2026-02-08 15:15:02 -06:00 · 2026-02-08 15:11:59 -06:00 · 2026-02-08 15:09:34 -06:00
56 changed files with 975 additions and 804 deletions
--- a/.codex/config.toml
+++ b/.codex/config.toml
@@ -14,3 +14,8 @@ trust_level = "trusted"
 [mcp_servers.nixos-mcp]
 command = "nixos-mcp"
 cwd = "/home/jawz/Development/NixOS"
+
+[mcp_servers.nixos]
+command = "nix"
+args = ["run", "github:utensils/mcp-nixos", "--"]
+startup_timeout_sec = 300
--- a/.gitea/workflows/mcp-tests.yml
+++ b/.gitea/workflows/mcp-tests.yml
@@ -5,20 +5,30 @@ on:
    branches: [ main ]
    paths:
      - 'scripts/**'
-      - 'docs/**'
+      - 'scripts/mcp-server/**'
+      - 'parts/packages.nix'
+      - 'flake.nix'
+      - 'flake.lock'
      - '.gitea/workflows/mcp-tests.yml'
  pull_request:
    paths:
      - 'scripts/**'
-      - 'docs/**'
+      - 'scripts/mcp-server/**'
+      - 'parts/packages.nix'
+      - 'flake.nix'
+      - 'flake.lock'
      - '.gitea/workflows/mcp-tests.yml'

 jobs:
  mcp-tests:
    runs-on: nixos
+    defaults:
+      run:
+        working-directory: ${{ github.workspace }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run MCP lint/format/tests via nix-shell
-        run: ./scripts/mcp-server/run-tests.sh
+        run: |
+          nix run .#mcp-tests
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -2,7 +2,7 @@ keys:
  - &devkey age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
  - &workstation age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
  - &server age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
-  - &vps age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+  - &vps age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
 creation_rules:
  - path_regex: secrets/secrets.yaml$
    key_groups:
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,7 +7,7 @@ Auto-generated from feature plans. Last updated: 2026-01-30
 - None (in-memory tool definitions; filesystem access for repo interactions) (002-mcp-server)
 - Nix (flakes; nixpkgs 25.11) + nixpkgs, flake-parts, sops-nix (003-vps-image-migration)
 - N/A (configuration repo) (003-vps-image-migration)
- Nix (flakes; nixpkgs 25.11) + NixOS modules, sops-nix, nginx, wireguard, openssh, iptables (004-vps-migration)
+- Nix (flakes; nixpkgs 25.11) + NixOS modules, sops-nix, nginx, wireguard, openssh, nftables (004-vps-migration)
 - Files (configuration and secrets) (004-vps-migration)

 - Documentation set (AI-facing constitution and playbooks) in Markdown (001-ai-docs)
--- a/README.org
+++ b/README.org
@@ -6,198 +6,72 @@

 * Overview

-This repository contains my personal NixOS configuration flake, managing
-multiple hosts with a modular approach. Designed the configuration for a
-self-hosted infrastructure with services and development environments.
+This repository is a NixOS configuration flake with a local MCP server
+(`nixos-mcp`) that helps Codex CLI work with the repo’s documentation and
+maintenance workflows. The README focuses on how to use the MCP server and
+how the repo is structured.

-* Architecture
+* MCP Server (nixos-mcp)

-** Hosts
- =workstation= :: Main development machine with GNOME desktop
- =server= :: Primary server with containerized services
- =miniserver= :: Secondary server for additional services
- =galaxy= :: Minimal configuration host
- =emacs= :: Development VM for Emacs configuration
+** What it is
+Local-only MCP server that exposes repo documentation helpers over stdio so
+Codex CLI can read the constitution, playbooks, and reference map without
+manual navigation.

-** Key Features
- Modular configuration system
- SOPS-based secrets management
- Container orchestration with Podman
- Automated builds and caching
- Multi-language development environments
- Self-hosted service stack
+** Tool Catalog
+- =show-constitution= :: Open =docs/constitution.md=
+- =list-playbooks= :: List =docs/playbooks/=
+- =show-reference= :: Open =docs/reference/index.md=
+- =search-docs= :: Search the docs set
+- =list-mcp-tasks= :: Show MCP tasks from =specs/002-mcp-server/tasks.md=
+- =sync-docs= :: Check tool catalog vs. docs anchors

-* Quick Start
-
-** Prerequisites
- NixOS 23.05 or later
- SOPS configured with age keys
- SSH keys for remote builds
-
-** Initial Setup
+** Quick Start (new users)
 #+BEGIN_SRC bash
-# Clone the repository git clone <repository-url> /home/jawz/Development/NixOS
-cd /home/jawz/Development/NixOS
+# Enter the MCP dev shell (includes codex + nixos-mcp)
+nix develop .#mcp

-# Install dependencies nix flake update
-
-# Build and switch to configuration sudo nixos-rebuild switch --flake
-.#<hostname>
+# Run the MCP server (stdio mode)
+nixos-mcp
 #+END_SRC
+Configure Codex CLI to use a local stdio MCP endpoint and allowlist
+=nixos-mcp= in =.codex/requirements.toml=. The dev shell sets
+=CODEX_HOME=.codex= for a repo-local Codex config.

-** Development Environment
-#+BEGIN_SRC bash
-# Enter development shell for specific language nix develop .#<language>
+** Reference
+Detailed invocation notes live in =docs/reference/mcp-server.md=.

-# Available languages: python, rust, go, haskell, javascript, julia, zig, sh,
-cc, nix
-#+END_SRC
+* Repository Structure

-* Configuration Structure
+** Docs and Guidance
+- =docs/constitution.md= :: AI constitution (authoritative rules)
+- =docs/reference/index.md= :: Reference map
+- =docs/reference/mcp-server.md= :: MCP server reference
+- =docs/playbooks/= :: Repeatable workflows
+- =specs/002-mcp-server/= :: MCP feature plan + tasks

-** Core Configuration
- =config/base.nix= :: Common system configuration
- =config/jawz.nix= :: User and SSH configuration
- =config/stylix.nix= :: Theming configuration
- =config/schemes.nix= :: Color scheme definitions
+** MCP Server
+- =scripts/mcp-server/= :: Python MCP server implementation, tests, and CLI
+- =modules/dev/mcp.nix= :: Dev shell and optional global install

-** Host Configurations
- =hosts/<hostname>/configuration.nix= :: Host-specific settings
- =hosts/<hostname>/hardware-configuration.nix= :: Hardware-specific config
- =hosts/<hostname>/toggles.nix= :: Feature toggles
+** Flake Parts
+- =parts/core.nix= :: Shared library + base composition
+- =parts/hosts.nix= :: Host definitions
+- =parts/packages.nix= :: Package outputs
+- =parts/devshells.nix= :: Dev shells (including MCP)

-** Modules
- =modules/apps/= :: Application packages and configurations
- =modules/dev/= :: Development environment modules
- =modules/servers/= :: Self-hosted service configurations
- =modules/services/= :: System service configurations
- =modules/scripts/= :: Custom scripts and utilities
- =modules/shell/= :: Shell and terminal configurations
+* Flake Inputs (high level)

-* Services
-
-** Core Services
- PostgreSQL 17 :: Database backend
- Nginx :: Reverse proxy and web server
- Podman :: Container runtime
- Syncthing :: File synchronization
- WireGuard :: VPN connectivity
-
-** Self-Hosted Applications
- Nextcloud :: File sharing and collaboration
- Gitea :: Git repository hosting
- Jellyfin :: Media server
- Plex :: Media streaming
- Sonarr/Radarr/Lidarr :: Media management
- Vaultwarden :: Password manager
- Homepage :: Service dashboard
- And more...
-
-* Development
-
-** Available Development Shells
-The configuration provides development shells for my favorite programming
-languages:
-
-#+BEGIN_SRC bash
-# Python development nix develop .#python
-
-# Rust development   nix develop .#rust
-
-# Go development nix develop .#go
-
-# JavaScript/Node.js development nix develop .#javascript
-
-# Haskell development nix develop .#haskell
-
-# Julia development nix develop .#julia
-
-# Zig development nix develop .#zig
-
-# Shell scripting nix develop .#sh
-
-# C/C++ development nix develop .#cc
-
-# Nix development nix develop .#nix
-#+END_SRC
-
-** Adding New Modules
-1. Create module file in appropriate directory under =modules/=
-2. Add module to =modules/modules.nix= if needed
-3. Enable module in host configuration or toggles
-
-** Adding New Hosts
-1. Create host directory under =hosts/<hostname>/
-2. Add =configuration.nix= and =hardware-configuration.nix=
-3. Add host to =flake.nix= outputs
-4. Create =toggles.nix= for feature management
-
-* Secrets Management
-
-** SOPS Configuration
-Manage secrets using SOPS with age encryption:
-
- =secrets/secrets.yaml= :: Main secrets file
- =secrets/keys.yaml= :: SSH and encryption keys
- =secrets/env.yaml= :: Environment variables
- =secrets/wireguard.yaml= :: VPN configuration
- =secrets/certs.yaml= :: SSL certificates
-
-** Adding New Secrets
-#+BEGIN_SRC bash
-# Edit secrets file sops secrets/secrets.yaml
-
-# Add new secret sops -i -a 'new-secret: "value"' secrets/secrets.yaml
-#+END_SRC
-
-* CI/CD
-
-** GitHub Actions
-The repository includes automated workflows:
-
- =weekly-build-cache.yml= :: Weekly builds and cache updates
- =build-schemes.yml= :: Color scheme builds
-
-** Build Cache
-Builds are automatically cached using Atticd for faster rebuilds.
-
-
-* Customization
-
-** Theming
-The configuration uses Stylix for theming. Define color schemes in
-=config/schemes.nix= and can set them via the =config/stylix.nix= file.
-
-** Adding New Services
-1. Create service module in =modules/servers/=
-2. Add service configuration
-3. Enable service in host toggles
-4. Add to homepage if needed
-
-** Custom Scripts
-Scripts are in =modules/scripts/= and toggle them per host.
-
-* Troubleshooting
-
-** Common Issues
-
-*** Build Failures
- Check flake inputs are up to date: =nix flake update=
- Verify all required secrets are present
- Check host-specific configuration
-
-*** Service Issues
- Check service status: =systemctl status <service>=
- View logs: =journalctl -u <service>=
- Verify firewall rules
-
-*** Development Environment
- Rebuild development shell: =nix develop .#<language>=
- Check available packages: =nix search nixpkgs <package>=
-
-** Getting Help
- Check NixOS documentation
- Review module documentation
+** Core Inputs
+- =nixpkgs= (25.11) and =nixpkgs-small= (25.11-small)
+- =nixpkgs-unstable= (rolling)
+- =flake-parts= (structure)
+- =home-manager= (user configs)
+- =stylix= (theming)
+- =sops-nix= (secrets integration)
+- =nur=, =nix-gaming=, =hyprland= (extra packages)
+- Content inputs: =wallpapers=, =fonts=, =qbit_manage=
+- Repo inputs: =jawz-scripts=, =prem2resolve=, =lidarr-mb-gap=
 - Check service-specific documentation

 * Maintenance
--- a/config/schemes.nix
+++ b/config/schemes.nix
@@ -116,5 +116,28 @@ in
        base0F = "#dc143c"; # crimson
      };
    };
+    punk = mkScheme {
+      color = "red";
+      polarity = "light";
+      image = "${wallpapers}/punk.jpeg";
+      base16Scheme = {
+        base00 = "#f7f3ee";
+        base01 = "#efe6dc";
+        base02 = "#e1d3c6";
+        base03 = "#c8b2a0";
+        base04 = "#a18673";
+        base05 = "#6e5646";
+        base06 = "#3f2f28";
+        base07 = "#1a1512";
+        base08 = "#c7423a";
+        base09 = "#d28b61";
+        base0A = "#c9a24c";
+        base0B = "#7d8b6a";
+        base0C = "#5f8f8a";
+        base0D = "#4f6a86";
+        base0E = "#8a5b6a";
+        base0F = "#8b5a3c";
+      };
+    };
  };
 }
--- a/config/stylix.nix
+++ b/config/stylix.nix
@@ -9,7 +9,7 @@ let
  schemesFile = import ./schemes.nix {
    inherit pkgs inputs;
  };
-  scheme = schemesFile.schemes.space;
+  scheme = schemesFile.schemes.punk;
  cfg = config.my.stylix;
  gnomeEnabled = config.services.desktopManager.gnome.enable;
 in
--- a/docs/constitution.md
+++ b/docs/constitution.md
@@ -7,7 +7,7 @@

 ## Repository Overview
 - Architecture: Flake-based repo using `flake-parts` with inputs for pkgs (stable/unstable), stylix, home-manager, sops-nix, and service overlays. Common modules are composed through `parts/core.nix` and `parts/hosts.nix`.
- Module auto-import: `modules/modules.nix` auto-imports `.nix` files under `modules/apps`, `modules/dev`, `modules/scripts`, `modules/servers`, `modules/services`, `modules/shell`, and `modules/network`, excluding `librewolf.nix`. Factories live in `modules/factories/` (`mkserver`, `mkscript`), and shared options are in `modules/nix` and `modules/users`.
+- Module auto-import: `modules/modules.nix` auto-imports `.nix` files under `modules/apps`, `modules/dev`, `modules/scripts`, `modules/servers`, `modules/services`, `modules/shell`, `modules/websites`, and `modules/network`, excluding `librewolf.nix`. Factories live in `modules/factories/` (`mkserver`, `mkscript`), and shared options are in `modules/nix` and `modules/users`.
 - Hosts and toggles: Host definitions live in `hosts/<name>/configuration.nix` with host-specific toggles in `hosts/<name>/toggles.nix`. The `my` namespace carries toggles for apps/dev/scripts/services/shell, feature flags like `enableProxy` and `enableContainers`, and per-host `interfaces` and `ips` maps.
 - Main server and proxies: `my.mainServer` selects the host that should serve traffic by default (default `vps`). Reverse proxies use helpers in `parts/core.nix` (`proxy`, `proxyReverse`, `proxyReverseFix`, `proxyReversePrivate`) and pick IPs from `my.ips` plus the hostName/ip set by `mkserver` options. Nginx defaults to `proxyReverse` for any server with `enableProxy = true` unless `useDefaultProxy = false` or the server is listed in the Fix/Private proxy lists.
 - Secure hosts and secrets: `my.secureHost` gates SOPS secrets. Secure hosts load secrets from `secrets/*.yaml` and wireguard definitions; non-secure hosts (e.g., `hosts/emacs`) skip secret-dependent services. Default SOPS file is `secrets/secrets.yaml` via `config/base.nix`. Proxy-only services that need private certificates must still define their cert secrets when `enableProxy = true`.
@@ -34,6 +34,7 @@ config.services = {
 - Options: Settings under the `my` namespace (e.g., `my.services.<service>`, `my.scripts.<script>`).
 - Toggles: Enablement maps in `hosts/<name>/toggles.nix` controlling categories (apps/dev/shell/scripts/services/servers/units) and features (`enableProxy`, `enableContainers`).
 - Servers: Reverse-proxied services under `modules/servers/`, normally created with `mkserver` options (including `useDefaultProxy` to opt out of default proxyReverse).
+- Websites: Static nginx vhosts under `modules/websites/` (portfolio/blog, mb-report), gated by `my.websites.*.enableProxy`.
 - Scripts: Units defined via `mkscript` with `enable`, `install`, `service`, `users`, `timer`, and `package` fields.
 - Playbooks: Workflow guides under `docs/playbooks/` for repeatable tasks.
 - Reference map: Navigation index under `docs/reference/index.md` for paths and responsibilities.
@@ -45,8 +46,8 @@ config.services = {
 - VPS enrollment flow: The vps host generates its own key on first boot, then operators enroll the public key, re-encrypt secrets, and redeploy. Follow `docs/playbooks/enroll-vps.md`.

 ## Module Categories and Active Hosts
- Module categories: apps, dev, scripts, servers, services, shell, network, users, nix, patches. Factories sit in `modules/factories/` and are imported explicitly.
- Active hosts: `workstation`, `server`, `miniserver`, `galaxy`, `emacs`. Host roles and secure status are defined in `hosts/<name>/configuration.nix` and toggles in `hosts/<name>/toggles.nix`.
+- Module categories: apps, dev, scripts, servers, services, shell, websites, network, users, nix. Factories sit in `modules/factories/` and are imported explicitly; patch artifacts live at the repo root in `patches/`.
+- Active hosts: `workstation`, `server`, `miniserver`, `galaxy`, `emacs`, `vps`. Host roles and secure status are defined in `hosts/<name>/configuration.nix` and toggles in `hosts/<name>/toggles.nix`.

 ## Precedence and Conflict Resolution
 - Precedence: This constitution is authoritative for AI. Human docs must be updated to match. If conflicts are found, align human docs to the constitution and log the resolution in `specs/001-ai-docs/research.md`.
--- a/docs/playbooks/add-wireguard-peer.md
+++ b/docs/playbooks/add-wireguard-peer.md
@@ -0,0 +1,25 @@
+# Playbook: Add WireGuard Peer (Friend or Guest)
+
+## When to use
+- Adding a new WireGuard peer in the friends (10.8.0.0/24) or guests (10.9.0.0/24) subnet.
+- Updating firewall rules to allow access to specific ports for that peer.
+
+## Inputs
+- Peer name (e.g., `friend5`, `guest2`)
+- Peer public key (WireGuard)
+- Peer IP address (e.g., `10.8.0.6` or `10.9.0.3`)
+- Access scope (ports/services the peer should reach)
+
+## Steps
+1. Add the peer IP to `my.ips` in `modules/modules.nix`.
+2. Add the peer to the VPS WireGuard peers list in `modules/services/wireguard.nix`.
+3. If the peer is a guest/friend, ensure `allowedIPs` includes the relevant subnets in `hosts/server/configuration.nix`.
+4. Add or adjust VPS firewall rules in `hosts/vps/configuration.nix` (`networking.firewall.extraForwardRules`) to allow the requested ports.
+5. Rebuild both hosts:
+   - `nixos-rebuild switch --flake .#vps`
+   - `nixos-rebuild switch --flake .#server`
+
+## Verification
+- On VPS: `sudo wg show`
+- On VPS: `sudo nft list ruleset | rg -n "<peer ip>|<port>"`
+- From peer: confirm access to allowed endpoints (HTTP/TCP/ICMP as defined).
--- a/docs/reference/index.md
+++ b/docs/reference/index.md
@@ -7,16 +7,18 @@
 - servers → `modules/servers/` (reverse-proxied services built via `mkserver`)
 - services → `modules/services/` (supporting services like syncthing, wireguard)
 - shell → `modules/shell/` (shell customizations and CLI tooling)
+- websites → `modules/websites/` (static nginx vhosts for portfolio/blog and reports)
 - network → `modules/network/` (networking rules, firewall helpers)
 - users → `modules/users/` (user-related options)
 - nix → `modules/nix/` (Nix configuration and helpers)
- patches → `patches/` (patch artifacts referenced by modules)
 - factories → `modules/factories/` (`mkserver.nix`, `mkscript.nix` shared helpers)
+## Root Directories
+- patches → `patches/` (patch artifacts referenced by modules)

 ## Auto-Import Rules
 - Source: `modules/modules.nix` uses `inputs.self.lib.autoImport` to load `.nix` files from module directories.
 - Filter: Excludes `librewolf.nix`; all other `.nix` files in target dirs are loaded automatically.
- Implication: Place new modules in the correct category directory with a `.nix` filename; no manual import wiring required unless adding a new factory.
+- Implication: Place new modules in the correct category directory with a `.nix` filename; no manual import wiring required unless adding a new factory. Patch artifacts under `patches/` are not auto-imported.

 ## Hosts and Roles
 - Configs: `hosts/<name>/configuration.nix` with toggles in `hosts/<name>/toggles.nix`.
@@ -60,7 +62,7 @@
 - MCP server reference: `docs/reference/mcp-server.md` (tool catalog, `nixos-mcp` wrapper, invocation, sync-docs)

 ## Quick Audit Checklist
- Module coverage: All categories (apps, dev, scripts, servers, services, shell, network, users, nix, patches) have corresponding entries and auto-import rules.
+- Module coverage: All categories (apps, dev, scripts, servers, services, shell, websites, network, users, nix) have corresponding entries and auto-import rules; `patches/` is documented as a root directory.
 - Host coverage: Active hosts listed with roles and secureHost status; `mainServer` noted.
 - Proxy rules: `enableProxy` usage, proxy helper selection, and `my.ips` mappings documented.
 - Secrets map: Every secrets file and secureHost gating captured; new secret types aligned to file purposes.
--- a/dotfiles/doom/init.el
+++ b/dotfiles/doom/init.el
@@ -43,6 +43,7 @@
       ;;neotree           ; a project drawer, like NERDTree for vim
       ophints           ; highlight the region an operation acts on
       (popup +defaults)   ; tame sudden yet inevitable temporary windows
+       (smooth-scroll +interpolate)     ; So smooth you won't believe it's not butter
       ;;tabs              ; a tab bar for Emacs
       (treemacs +lsp)         ; a project drawer, like neotree but cooler
       ;;unicode           ; extended unicode support for various languages
@@ -64,6 +65,7 @@
       ;;parinfer          ; turn lisp into python, sort of
       rotate-text       ; cycle region at point between text candidates
       snippets          ; my elves. They type so I don't have to
+       (whitespace +guess +trim)  ; a butler for your whitespace
       ;;word-wrap         ; soft wrapping with language-aware indent

       :emacs
@@ -71,6 +73,7 @@
       electric          ; smarter, keyword-based electric-indent
       eww ; the internet is gross
       ibuffer         ; interactive buffer management
+       tramp             ; remote files at your arthritic fingertips
       (undo +tree)              ; persistent, smarter undo for your inevitable mistakes
       vc                ; version-control and Emacs, sitting in a tree

@@ -96,21 +99,24 @@
       ;;ein               ; tame Jupyter notebooks with emacs
       (eval +overlay)     ; run code, run (also, repls)
       (lookup +dictionary + offline)              ; navigate your code and its documentation
+       llm               ; when I said you needed friends, I didn't mean...
       (lsp +peek)               ; M-x vscode
       magit             ; a git porcelain for Emacs
       ;;make              ; run make tasks from Emacs
       ;;pass              ; password manager for nerds
       ;;pdf               ; pdf enhancements
       ;;prodigy           ; FIXME managing external services & code builders
-       ;;terraform         ; infrastructure as code
+       (terraform +lsp)        ; infrastructure as code
       tmux              ; an API for interacting with tmux
       ;; tree-sitter       ; syntax and parsing, sitting in a tree...
       upload            ; map local to remote projects via ssh/ftp

       :os
       ;;(:if (featurep :system 'macos) macos) ; improve compatibility with macOS       tty               ; improve the terminal Emacs experience
+       tty               ; improve the terminal Emacs experience

       :lang
+       ;;ada               ; In strong typing we (blindly) trust
       ;;agda              ; types of types of types of types...
       ;;beancount         ; mind the GAAP
       (cc +lsp)         ; C > C++ == 1
@@ -139,6 +145,7 @@
       ;;hy                ; readability of scheme w/ speed of python
       ;;idris             ; a language you can depend on
       (json +lsp)              ; At least it ain't XML
+       ;;janet             ; Fun fact: Janet is me!
       ;;(java +lsp)       ; the poster child for carpal tunnel syndrome
       (javascript +lsp)       ; all(hope(abandon(ye(who(enter(here))))))
       (julia +lsp)            ; a better, faster MATLAB
--- a/dotfiles/doom/packages.el
+++ b/dotfiles/doom/packages.el
@@ -49,15 +49,9 @@
 ;; ...Or *all* packages (NOT RECOMMENDED; will likely break things)
                                        ;(unpin! t)

-;; (package! nixos-options) ;; enable when migrating to nixos
-;; (package! quick-preview) ;; preview files with sushi
-
-
-;; (package! codeium :recipe (:host github :repo "Exafunction/codeium.el"))
-(package! config-general-mode)
 (package! dired-open)
 (package! dired-subtree)
-;; (package! doom-modeline-now-playing)
+(package! expand-region)
 (package! ini-mode)
 (package! insert-esv) ;; bible passages
 (package! olivetti) ;; writing mode centering text, looks like word
@@ -68,11 +62,14 @@
 (package! peep-dired) ;; kind of cool but never could make it work
 (package! php-cs-fixer)
 (package! systemd)
+;;   :recipe (:host github :repo "tecosaur/ox-chameleon"))
 ;; (package! 2048-game)
 ;; (package! academic-phrases)
 ;; (package! caddyfile-mode)
 ;; (package! clippy)
+;; (package! codeium :recipe (:host github :repo "Exafunction/codeium.el"))
 ;; (package! crontab-mode) ;; crontab colors
+;; (package! doom-modeline-now-playing)
 ;; (package! evil-tutor) ;; vim tutorial
 ;; (package! ewal) ;; theme colors based on pywal
 ;; (package! ewal-doom-themes)
@@ -81,16 +78,14 @@
 ;; (package! flycheck-aspell)
 ;; (package! ivy-posframe)
 ;; (package! mw-thesaurus)
+;; (package! nixos-options) ;; enable when migrating to nixos
 ;; (package! org-appear) ;; couldn't get it to work
 ;; (package! org-recur) ;; works but I want to keep org vanilla
 ;; (package! ox-chameleon
-;;   :recipe (:host github :repo "tecosaur/ox-chameleon"))
+;; (package! quick-preview) ;; preview files with sushi
 ;; (package! renpy)
 ;; (package! resize-window)
 ;; (package! tldr)
 ;; (package! typit) ;; type speed test
 ;; (package! vimgolf) ;; vim puzzles
 ;; (package! wc-mode) ;; displays character count of buffer
-
-(package! expand-region)
-(package! gptel :recipe (:nonrecursive t))
--- a/flake.lock
+++ b/flake.lock
@@ -422,11 +422,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769580047,
-        "narHash": "sha256-tNqCP/+2+peAXXQ2V8RwsBkenlfWMERb+Uy6xmevyhM=",
+        "lastModified": 1770260404,
+        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "366d78c2856de6ab3411c15c1cb4fb4c2bf5c826",
+        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
        "type": "github"
      },
      "original": {
@@ -513,11 +513,11 @@
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1769965155,
-        "narHash": "sha256-KAgGtueNnwLtekIh9tnmLAUDFbRxSff0OZwQwSi05Nk=",
+        "lastModified": 1770330959,
+        "narHash": "sha256-OPmJ6dBL615GGX7ENJXtJm4zeMv5uXDjmO8WB1MI5wM=",
        "owner": "hyprwm",
        "repo": "Hyprland",
-        "rev": "a0ec2e4daf8e508761f6bc53fc163fbb92ac7aa1",
+        "rev": "562171ab668e7ee98a9d2bbb62a9477ad2b1e24e",
        "type": "github"
      },
      "original": {
@@ -806,11 +806,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769914377,
-        "narHash": "sha256-8wH3ZYNs36V0A3f/ikraqdoVE++BfnXg9Ql8nAuUkHw=",
+        "lastModified": 1770345361,
+        "narHash": "sha256-/kldWxogKCw1ykliO6lLwLE4aqUQ+yZOS9fHiFdI7u0=",
        "owner": "fufexan",
        "repo": "nix-gaming",
-        "rev": "f7d17740ed90663b11ae907d33b3fed9fc9e15a9",
+        "rev": "2b6e7914c9ba6ad7effd53fab40d7acf34873069",
        "type": "github"
      },
      "original": {
@@ -885,11 +885,11 @@
    },
    "nixpkgs-small": {
      "locked": {
-        "lastModified": 1769983561,
-        "narHash": "sha256-Hv7yml1x0gU14H1zxGATCXb+ueeBH7DFBUTIMkLWD4A=",
+        "lastModified": 1770235692,
+        "narHash": "sha256-VvqTQ2RYZE4PUWiefJKAPKW3H4fahCbp3L8yv4c7B8s=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "8dcf33716a525a7a0b6815cd8d0f4fa9b13abb1b",
+        "rev": "39dfe6111bc5b19a710bcf409a9b179688f381eb",
        "type": "github"
      },
      "original": {
@@ -901,11 +901,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1769789167,
-        "narHash": "sha256-kKB3bqYJU5nzYeIROI82Ef9VtTbu4uA3YydSk/Bioa8=",
+        "lastModified": 1770197578,
+        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "62c8382960464ceb98ea593cb8321a2cf8f9e3e5",
+        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
        "type": "github"
      },
      "original": {
@@ -917,11 +917,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1769900590,
-        "narHash": "sha256-I7Lmgj3owOTBGuauy9FL6qdpeK2umDoe07lM4V+PnyA=",
+        "lastModified": 1770136044,
+        "narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "41e216c0ca66c83b12ab7a98cc326b5db01db646",
+        "rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
        "type": "github"
      },
      "original": {
@@ -960,11 +960,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770024533,
-        "narHash": "sha256-EXQWqlbhkkune23d6xq/0bz3iyJzkVklvDsSlYE3n3Y=",
+        "lastModified": 1770368476,
+        "narHash": "sha256-myWSpD+v5TmQ47grn+gbLou1dNy5hCXvfvc6VGF72kk=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "cdb7c463555d7c6de5ba7251f9b4940249b651e8",
+        "rev": "2959831b0338e196f2d864fb5e6bb309fa1c99c1",
        "type": "github"
      },
      "original": {
@@ -1088,11 +1088,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769921679,
-        "narHash": "sha256-twBMKGQvaztZQxFxbZnkg7y/50BW9yjtCBWwdjtOZew=",
+        "lastModified": 1770145881,
+        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "1e89149dcfc229e7e2ae24a8030f124a31e4f24f",
+        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
        "type": "github"
      },
      "original": {
@@ -1122,11 +1122,11 @@
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1769885983,
-        "narHash": "sha256-jLS7410B58f+3WfZ4PQ28aaaTONnmxlfAbDPdNuciLc=",
+        "lastModified": 1770308890,
+        "narHash": "sha256-7bx8Bn9B2g/loBaz+uLwdKI2rUW+RhDPyP/MqAgvrxU=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "fe06391a1e1905fc7e6c13443ea439a89695ca69",
+        "rev": "7e7fa955abac04a8e118b1cedf930a8fd41c34a6",
        "type": "github"
      },
      "original": {
@@ -1331,11 +1331,11 @@
    "wallpapers": {
      "flake": false,
      "locked": {
-        "lastModified": 1759463031,
-        "narHash": "sha256-9goyp+g9N4+9PA9V2QerTsxlVy9MA4LXufJaruj2MMs=",
+        "lastModified": 1770517108,
+        "narHash": "sha256-QYvx6j7r1ItxaaKN/wI0nGB6r5aWG46zfcoXCTOgK18=",
        "ref": "refs/heads/main",
-        "rev": "0212af5b70347f0721cfe88c25e1efb77b645a2d",
-        "revCount": 2,
+        "rev": "dcb86c4c592b8cf838a0fd6d139254619cbbd869",
+        "revCount": 3,
        "type": "git",
        "url": "https://git.lebubu.org/jawz/wallpapers.git"
      },
--- a/hosts/server/configuration.nix
+++ b/hosts/server/configuration.nix
@@ -67,7 +67,7 @@ in
    hostName = "server";
    firewall = {
      allowedUDPPorts = config.networking.firewall.allowedTCPPorts;
-      interfaces.wg0.allowedTCPPorts = [ 8081 ];
+      interfaces.wg0.allowedTCPPorts = [ config.my.servers.nextcloud.port ];
    };
    wireguard.interfaces.wg0 = lib.mkIf config.my.secureHost {
      ips = [ "${config.my.ips.wg-server}/32" ];
@@ -78,8 +78,9 @@ in
          endpoint = "${config.my.ips.vps}:51820";
          allowedIPs = [
            "${config.my.ips.wg-vps}/32"
-            "${config.my.ips.wg-friends}/24" # all friends
-            "${config.my.ips.wg-gs}/24" # all friends
+            config.my.subnets.wg-homelab
+            config.my.subnets.wg-friends
+            config.my.subnets.wg-guests
          ];
          persistentKeepalive = 25;
        }
@@ -117,8 +118,11 @@ in
      sshKeyFile = config.sops.secrets."private_keys/lidarr-mb-gap".path;
      sshKnownHosts = {
        vps = {
-          hostNames = [ config.my.ips.vps ];
-          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMvtTURGBtAFXxxfzMJVoNJrtWLykOloJ5XYjxGh1OUx";
+          hostNames = [
+            config.my.ips.vps
+            "[${config.my.ips.vps}]:3456"
+          ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPp0wAuZXk96OyA/+2YpQalokS9lZdacjJqY9zN8IScP";
        };
      };
    };
--- a/hosts/server/toggles.nix
+++ b/hosts/server/toggles.nix
@@ -67,10 +67,8 @@ in
    "maloja"
    "mealie"
    "metube"
-    "microbin"
    "multi-scrobbler"
    "paperless"
-    "plausible"
    "plex"
    "postgres"
    "prowlarr"
@@ -86,10 +84,10 @@ in
  ]
  // enableList mkEnabledIp [
    "audiobookshelf"
-    "isso"
    "keycloak"
    "linkwarden"
    "oauth2-proxy"
+    "plausible"
    "vaultwarden"
  ];
 }
--- a/hosts/vps/configuration.nix
+++ b/hosts/vps/configuration.nix
@@ -1,53 +1,74 @@
 {
  config,
  lib,
+  pkgs,
  inputs,
  ...
 }:
 let
  externalInterface = config.my.interfaces.${config.networking.hostName};
  wgInterface = "wg0";
-  homeServer = config.my.ips.wg-server;
-  wgFriendsSubnet = "${config.my.ips.wg-friends}/24";
-  wgGuestsSubnet = "${config.my.ips.wg-gs}/24";
-  wgServerSubnet = "${config.my.ips.wg-vps}/24";
-  wgFriend1 = config.my.ips.wg-friend1;
-  wgFriend2 = config.my.ips.wg-friend2;
-  wgFriend3 = config.my.ips.wg-friend3;
-  wgFriend4 = config.my.ips.wg-friend4;
-  wgGuest1 = config.my.ips.wg-g1;
-  giteaSshPort = 22;
-  giteaSshPortStr = toString giteaSshPort;
-  sshPort = 3456;
-  webPorts = [
-    80
-    443
-  ];
-  wgPort = 51820;
-  syncthingPort = toString 22000;
-  synapseFederationPort = toString 8448;
-  synapseClientPort = toString config.my.servers.synapse.port;
-  syncplayPort = toString config.my.servers.syncplay.port;
-  stashPort = toString config.my.servers.stash.port;
+  ips = {
+    homeServer = config.my.ips.wg-server;
+    wgFriend1 = config.my.ips.wg-friend1;
+    wgGuest1 = config.my.ips.wg-guest1;
+    wgGuest2 = config.my.ips.wg-guest2;
+  };
+  subnets = {
+    wgFriends = config.my.subnets.wg-friends;
+    wgGuests = config.my.subnets.wg-guests;
+    wgHomelab = config.my.subnets.wg-homelab;
+  };
+  ports = {
+    giteaSsh = 22;
+    ssh = 3456;
+    web = [
+      80
+      443
+    ];
+    wg = 51820;
+    syncthing = 22000;
+    synapseFederation = 8448;
+  };
+  portsStr = {
+    giteaSsh = toString ports.giteaSsh;
+    syncthing = toString ports.syncthing;
+    synapseFederation = toString ports.synapseFederation;
+    synapseClient = toString config.my.servers.synapse.port;
+    syncplay = toString config.my.servers.syncplay.port;
+    stash = toString config.my.servers.stash.port;
+    jellyfin = toString config.my.servers.jellyfin.port;
+    audiobookshelf = toString config.my.servers.audiobookshelf.port;
+    kavita = toString config.my.servers.kavita.port;
+  };
 in
 {
  imports = [
    ./hardware-configuration.nix
+    ./nginx-nextcloud.nix
    ../../config/base.nix
  ];
-  my = import ./toggles.nix { inherit config inputs; } // {
-    secureHost = true;
-    users.nixremote = {
-      enable = true;
-      authorizedKeys = inputs.self.lib.getSshKeys [
-        "nixworkstation"
-        "nixserver"
-        "nixminiserver"
-      ];
+  my =
+    import ./toggles.nix {
+      inherit config inputs lib;
+    }
+    // {
+      secureHost = true;
+      users.nixremote = {
+        enable = true;
+        authorizedKeys = inputs.self.lib.getSshKeys [
+          "nixworkstation"
+          "nixserver"
+          "nixminiserver"
+        ];
+      };
    };
+  sops.age = {
+    generateKey = true;
+    keyFile = "/var/lib/sops-nix/key.txt";
+    sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  };
  image.modules.linode = { };
-  services.smartd.enable = lib.mkForce false;
  environment.systemPackages = [ ];
  networking = {
    hostName = "vps";
@@ -57,20 +78,20 @@ in
      internalInterfaces = [ "wg0" ];
      forwardPorts = [
        {
-          sourcePort = giteaSshPort;
+          sourcePort = ports.giteaSsh;
          proto = "tcp";
-          destination = "${homeServer}:${giteaSshPortStr}";
+          destination = "${ips.homeServer}:${portsStr.giteaSsh}";
        }
      ];
    };
    nftables = {
      enable = true;
-      tables."vps-snat" = {
+      tables.vps-snat = {
        family = "ip";
        content = ''
          chain postrouting {
            type nat hook postrouting priority srcnat;
-            iifname "${externalInterface}" oifname "${wgInterface}" ip daddr ${homeServer}/32 tcp dport ${giteaSshPortStr} masquerade comment "snat ssh forward"
+            iifname "${externalInterface}" oifname "${wgInterface}" ip daddr ${ips.homeServer}/32 tcp dport ${portsStr.giteaSsh} masquerade comment "snat ssh forward"
          }
        '';
      };
@@ -79,36 +100,30 @@ in
      enable = true;
      filterForward = true;
      checkReversePath = "loose";
-      allowedTCPPorts = [ sshPort ] ++ webPorts;
-      allowedUDPPorts = [ wgPort ];
+      allowedTCPPorts = [ ports.ssh ] ++ ports.web;
+      allowedUDPPorts = [ ports.wg ];
      extraForwardRules = ''
-        iifname "${wgInterface}" ip saddr ${wgFriend1}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${wgFriend2}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${wgFriend3}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${wgFriend4}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend1}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend2}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend3}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend4}/32 tcp dport ${syncthingPort} accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgFriends} ip daddr ${ips.homeServer}/32 tcp dport ${portsStr.syncthing} accept
+        iifname "${wgInterface}" ip saddr ${ips.homeServer}/32 ip daddr ${subnets.wgFriends} tcp dport ${portsStr.syncthing} accept

-        iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} ip daddr ${homeServer}/32 tcp dport { ${synapseClientPort}, ${synapseFederationPort}, ${syncplayPort} } accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgFriends} ip daddr ${ips.homeServer}/32 tcp dport { ${portsStr.synapseClient}, ${portsStr.synapseFederation}, ${portsStr.syncplay} } accept

-        iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} ip daddr ${homeServer}/32 icmp type echo-request accept
-        iifname "${wgInterface}" ip saddr ${wgFriend1}/32 ip daddr ${homeServer}/32 tcp dport ${stashPort} accept
-        iifname "${wgInterface}" ip saddr ${wgGuest1}/32 ip daddr ${homeServer}/32 tcp dport ${stashPort} accept
-        iifname "${wgInterface}" ip saddr ${wgGuestsSubnet} ip daddr ${homeServer}/32 icmp type echo-request accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgFriends} ip daddr ${ips.homeServer}/32 icmp type echo-request accept
+        iifname "${wgInterface}" ip saddr ${ips.wgFriend1}/32 ip daddr ${ips.homeServer}/32 tcp dport ${portsStr.stash} accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgGuests} ip daddr ${ips.homeServer}/32 tcp dport { ${portsStr.stash}, ${portsStr.jellyfin}, ${portsStr.audiobookshelf}, ${portsStr.kavita} } accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgGuests} ip daddr ${ips.homeServer}/32 icmp type echo-request accept

-        iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} oifname "${externalInterface}" accept
-        iifname "${wgInterface}" ip saddr ${wgGuestsSubnet} oifname "${externalInterface}" accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgHomelab} ip daddr ${ips.homeServer}/32 accept

-        iifname "${externalInterface}" ip daddr ${homeServer}/32 tcp dport ${giteaSshPortStr} accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgFriends} oifname "${externalInterface}" accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgGuests} oifname "${externalInterface}" accept

-        ip saddr ${wgFriendsSubnet} ip daddr ${wgServerSubnet} drop
-        ip saddr ${wgServerSubnet} ip daddr ${wgFriendsSubnet} drop
-        ip saddr ${wgGuestsSubnet} ip daddr ${wgServerSubnet} drop
-        ip saddr ${wgServerSubnet} ip daddr ${wgGuestsSubnet} drop
-        ip saddr ${wgGuestsSubnet} ip daddr ${wgFriendsSubnet} drop
-        ip saddr ${wgFriendsSubnet} ip daddr ${wgGuestsSubnet} drop
+        ip saddr ${subnets.wgFriends} ip daddr ${subnets.wgHomelab} drop
+        ip saddr ${subnets.wgHomelab} ip daddr ${subnets.wgFriends} drop
+        ip saddr ${subnets.wgGuests} ip daddr ${subnets.wgHomelab} drop
+        ip saddr ${subnets.wgHomelab} ip daddr ${subnets.wgGuests} drop
+        ip saddr ${subnets.wgGuests} ip daddr ${subnets.wgFriends} drop
+        ip saddr ${subnets.wgFriends} ip daddr ${subnets.wgGuests} drop
      '';
    };
  };
@@ -123,26 +138,44 @@ in
      ];
    }
  ];
-  services.openssh.ports = [ sshPort ];
-  sops.age = {
-    generateKey = true;
-    keyFile = "/var/lib/sops-nix/key.txt";
-    sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  systemd.tmpfiles.rules = [
+    "d /var/www/html 2775 deploy www-data -"
+    "d /var/www/html/portfolio 2775 deploy www-data -"
+    "d /var/www/html/blog 2775 deploy www-data -"
+    "d /var/www/html/lidarr-mb-gap 2775 lidarr-reports lidarr-reports -"
+  ];
+  services = {
+    smartd.enable = lib.mkForce false;
+    openssh.ports = [ ports.ssh ];
  };
  users = {
    groups = {
      deploy = { };
      lidarr-reports = { };
+      www-data = { };
    };
    users = {
+      nginx = lib.mkIf config.my.secureHost {
+        extraGroups = [
+          "www-data"
+          "lidarr-reports"
+        ];
+      };
      deploy = {
        isSystemUser = true;
        group = "deploy";
+        home = "/var/lib/deploy";
+        createHome = true;
+        shell = pkgs.bashInteractive;
+        extraGroups = [ "www-data" ];
        openssh.authorizedKeys.keyFiles = [ ../../secrets/ssh/ed25519_deploy.pub ];
      };
      lidarr-reports = {
        isSystemUser = true;
        group = "lidarr-reports";
+        home = "/var/lib/lidarr-reports";
+        createHome = true;
+        shell = pkgs.bashInteractive;
        openssh.authorizedKeys.keyFiles = [ ../../secrets/ssh/ed25519_lidarr-reports.pub ];
      };
    };
--- a/hosts/vps/hardware-configuration.nix
+++ b/hosts/vps/hardware-configuration.nix
@@ -1,5 +1,6 @@
 {
  lib,
+  config,
  modulesPath,
  ...
 }:
@@ -33,13 +34,17 @@
    };
  };
  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
+    device = lib.mkForce (
+      if config.my.build.baseImage then
+        "/dev/sda"
+      else
+        "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f"
+    );
    fsType = "ext4";
  };
-  swapDevices = [
-    {
-      device = "/dev/disk/by-uuid/f1408ea6-59a0-11ed-bc9d-525400000001";
-    }
+  swapDevices = lib.mkMerge [
+    [ { device = "/dev/disk/by-uuid/f1408ea6-59a0-11ed-bc9d-525400000001"; } ]
+    (lib.mkIf config.my.build.baseImage [ { device = "/dev/sdb"; } ])
  ];
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
--- a/hosts/vps/nginx-nextcloud.nix
+++ b/hosts/vps/nginx-nextcloud.nix
@@ -0,0 +1,116 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.servers.nextcloud;
+in
+{
+  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy && config.my.secureHost) {
+    services.nginx.virtualHosts.${cfg.host} = {
+      forceSSL = true;
+      enableACME = true;
+      http2 = true;
+      default = true;
+      serverAliases = [ "cloud.rotehaare.art" ];
+      extraConfig = ''
+        index index.php index.html /index.php$request_uri;
+        add_header X-Content-Type-Options nosniff always;
+        add_header X-Robots-Tag "noindex, nofollow" always;
+        add_header X-Permitted-Cross-Domain-Policies none always;
+        add_header X-Frame-Options SAMEORIGIN always;
+        add_header Referrer-Policy no-referrer always;
+        add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+      '';
+      locations = {
+        "= /robots.txt" = {
+          priority = 100;
+          extraConfig = ''
+            allow all;
+            access_log off;
+          '';
+        };
+        "= /" = {
+          priority = 100;
+          proxyPass = cfg.local;
+          proxyWebsockets = true;
+          extraConfig = ''
+            if ( $http_user_agent ~ ^DavClnt ) {
+              return 302 /remote.php/webdav/$is_args$args;
+            }
+          '';
+        };
+        "= /.well-known/carddav" = {
+          priority = 210;
+          extraConfig = ''
+            return 301 /remote.php/dav/;
+          '';
+        };
+        "= /.well-known/caldav" = {
+          priority = 210;
+          extraConfig = ''
+            return 301 /remote.php/dav/;
+          '';
+        };
+        "~ ^/\\.well-known/(?!acme-challenge|pki-validation)" = {
+          priority = 210;
+          extraConfig = ''
+            return 301 /index.php$request_uri;
+          '';
+        };
+        "^~ /.well-known" = {
+          priority = 210;
+          extraConfig = ''
+            try_files $uri $uri/ =404;
+          '';
+        };
+        "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)" = {
+          priority = 450;
+          extraConfig = ''
+            return 404;
+          '';
+        };
+        "~ ^/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
+          priority = 450;
+          extraConfig = ''
+            return 404;
+          '';
+        };
+        "~ \\.php(?:$|/)" = {
+          priority = 500;
+          proxyPass = cfg.local;
+          proxyWebsockets = true;
+          extraConfig = ''
+            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
+          '';
+        };
+        "~ \\.(?:css|js|mjs|svg|gif|ico|jpg|jpeg|png|webp|wasm|tflite|map|html|ttf|bcmap|mp4|webm|ogg|flac)$" =
+          {
+            proxyPass = cfg.local;
+            extraConfig = ''
+              expires 6M;
+              access_log off;
+            '';
+          };
+        "~ ^\\/(?:updater|ocs-provider)(?:$|\\/)" = {
+          proxyPass = cfg.local;
+          extraConfig = ''
+            try_files $uri/ =404;
+            index index.php;
+          '';
+        };
+        "/remote" = {
+          priority = 1500;
+          extraConfig = ''
+            return 301 /remote.php$request_uri;
+          '';
+        };
+        "/" = {
+          priority = 1600;
+          proxyPass = cfg.local;
+          proxyWebsockets = true;
+          extraConfig = ''
+            try_files $uri $uri/ /index.php$request_uri;
+          '';
+        };
+      };
+    };
+  };
+}
--- a/hosts/vps/toggles.nix
+++ b/hosts/vps/toggles.nix
@@ -1,61 +1,86 @@
-{ config, inputs }:
+{
+  config,
+  inputs,
+  lib,
+}:
 let
  inherit (inputs.self.lib)
    enableList
    mkEnabled
+    mkEnabledWithProxy
    mkEnabledWithUsers
    ;
  wgServerIp = config.my.ips.wg-server;
  mkEnabledProxyIp = inputs.self.lib.mkEnabledProxyIp wgServerIp;
-in
-{
-  enableProxy = true;
-  enableContainers = true;
-  apps.dictionaries.enable = true;
-  apps.dictionaries.users = "jawz";
-  services = enableList mkEnabled [
-    "network"
-    "wireguard"
-  ];
-  shell = enableList mkEnabledWithUsers [
-    "multimedia"
-    "tools"
-  ];
-  dev = enableList mkEnabledWithUsers [
-    "nix"
-    "sh"
-  ];
-  servers = {
-    nextcloud = {
+  mkEnabledProxySocketIp = name: {
+    inherit name;
+    value = {
      enableProxy = true;
+      enableSocket = true;
      ip = wgServerIp;
-      port = 8081;
    };
-  }
-  // enableList mkEnabledProxyIp [
-    "audiobookshelf"
-    "bazarr"
-    "collabora"
-    "gitea"
-    "homepage"
-    "isso"
-    "jellyfin"
-    "kavita"
-    "keycloak"
-    "lidarr"
-    "linkwarden"
-    "maloja"
-    "mealie"
-    "metube"
-    "microbin"
-    "multi-scrobbler"
-    "oauth2-proxy"
-    "plausible"
-    "plex"
-    "prowlarr"
-    "radarr"
-    "sonarr"
-    "vaultwarden"
-    "yamtrack"
-  ];
-}
+  };
+  baseToggles = {
+    services = enableList mkEnabled [
+      "network"
+      "wireguard"
+    ];
+    shell = enableList mkEnabledWithUsers [
+      "multimedia"
+      "tools"
+    ];
+    dev = enableList mkEnabledWithUsers [
+      "nix"
+      "sh"
+    ];
+    apps.dictionaries = {
+      enable = true;
+      users = "jawz";
+    };
+  };
+  secureToggles = {
+    enableProxy = true;
+    enableContainers = true;
+    websites = {
+      portfolio.enableProxy = true;
+      lidarrMbReport.enableProxy = true;
+    };
+    servers =
+      enableList mkEnabledWithProxy [
+        "isso"
+        "microbin"
+      ]
+      // enableList mkEnabledProxySocketIp [
+        "audiobookshelf"
+        "collabora"
+        "jellyfin"
+        "nextcloud"
+        "plausible"
+        "plex"
+      ]
+      // enableList mkEnabledProxyIp [
+        "atticd"
+        "bazarr"
+        "gitea"
+        "homepage"
+        "kavita"
+        "keycloak"
+        "lidarr"
+        "linkwarden"
+        "maloja"
+        "mealie"
+        "metube"
+        "multi-scrobbler"
+        "oauth2-proxy"
+        "prowlarr"
+        "radarr"
+        "sonarr"
+        "vaultwarden"
+        "yamtrack"
+      ];
+  };
+in
+lib.mkMerge [
+  baseToggles
+  (lib.mkIf config.my.secureHost secureToggles)
+]
--- a/126
+++ b/126
@@ -1,126 +0,0 @@
-# Generated by iptables-save v1.8.11 (nf_tables) on Fri Jan  2 03:44:23 2026
-*mangle
-:PREROUTING ACCEPT [95853893:179831236298]
-:INPUT ACCEPT [94316554:179510512585]
-:FORWARD ACCEPT [1536524:320567864]
-:OUTPUT ACCEPT [49857522:93072472240]
-:POSTROUTING ACCEPT [51393797:93393029789]
-COMMIT
-# Completed on Fri Jan  2 03:44:23 2026
-# Generated by iptables-save v1.8.11 (nf_tables) on Fri Jan  2 03:44:23 2026
-*raw
-:PREROUTING ACCEPT [95853893:179831236298]
-:OUTPUT ACCEPT [49857522:93072472240]
-COMMIT
-# Completed on Fri Jan  2 03:44:23 2026
-# Generated by iptables-save v1.8.11 (nf_tables) on Fri Jan  2 03:44:23 2026
-*filter
-:INPUT ACCEPT [94315678:179510353216]
-:FORWARD ACCEPT [46534:2774394]
-:OUTPUT ACCEPT [49857520:93072471971]
-
-
-# --- Incoming (INPUT) rules for VPS itself ---
-# Accept SSH on port 3456 (new SSH port)
-# allow SSH to VPS
-A INPUT -p tcp --dport 3456 -m conntrack --ctstate NEW -j ACCEPT
-
-# allow established connections (responses)
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-
-# (Optionally, add other INPUT rules for any services the VPS itself runs, if any, like HTTP/HTTPS if needed)
-
-# If a default DROP policy is desired on INPUT, or an explicit drop rule:
-# -A INPUT -j DROP   # (optional: lock down any other input)
-
-# --- Forwarding (FORWARD) rules for VPN traffic ---
-# allow return traffic for established sessions
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-
-# Syncthing between 10.8.0.2 and home server
-# 10.8.0.2 -> 10.77.0.0 Syncthing
-A FORWARD -s 10.8.0.2/32 -d 10.77.0.2/32 -p tcp --dport 22000 -j ACCEPT
-A FORWARD -s 10.8.0.3/32 -d 10.77.0.2/32 -p tcp --dport 22000 -j ACCEPT
-A FORWARD -s 10.8.0.4/32 -d 10.77.0.2/32 -p tcp --dport 22000 -j ACCEPT
-A FORWARD -s 10.8.0.5/32 -d 10.77.0.2/32 -p tcp --dport 22000 -j ACCEPT
-# home -> 10.8.0.0 Syncthing
-A FORWARD -s 10.77.0.2/32 -d 10.8.0.2/32 -p tcp --dport 22000 -j ACCEPT
-A FORWARD -s 10.77.0.2/32 -d 10.8.0.3/32 -p tcp --dport 22000 -j ACCEPT
-A FORWARD -s 10.77.0.2/32 -d 10.8.0.4/32 -p tcp --dport 22000 -j ACCEPT
-A FORWARD -s 10.77.0.2/32 -d 10.8.0.5/32 -p tcp --dport 22000 -j ACCEPT
-
-# Matrix/Synapse access from 10.8 subnet to home server
-# allow Matrix client port
-A FORWARD -s 10.8.0.0/24 -d 10.77.0.2/32 -p tcp --dport 8008 -j ACCEPT
-# allow Matrix federation port
-A FORWARD -s 10.8.0.0/24 -d 10.77.0.2/32 -p tcp --dport 8448 -j ACCEPT
-# allow TURN/other (if used)
-A FORWARD -s 10.8.0.0/24 -d 10.77.0.2/32 -p tcp --dport 8999 -j ACCEPT
-
-# ICMP between 10.8 subnet and home
-# ping home from 10.8 clients
-A FORWARD -s 10.8.0.0/24 -d 10.77.0.2/32 -p icmp -j ACCEPT
-# ping 10.8 clients from home
-A FORWARD -s 10.77.0.2/32 -d 10.8.0.0/24 -p icmp -j ACCEPT
-
-# New Friend's subnet (10.9) access rule
-# allow new subnet to access port 9999 on home
-A FORWARD -s 10.9.0.2/24 -d 10.77.0.2/32 -p tcp --dport 9999 -j ACCEPT
-# allow ping to home
-A FORWARD -s 10.9.0.2/24 -d 10.77.0.2/32 -p icmp -j ACCEPT
-# allow ping reply from home
-A FORWARD -s 10.77.0.2/32 -d 10.9.0.2/24 -p icmp -j ACCEPT
-
-# Allow VPN subnets to reach Internet (MASQUERADE will SNAT them)
-# 10.8 clients to internet
-A FORWARD -s 10.8.0.0/24 -o eth0 -j ACCEPT
-# 10.9 clients to internet
-A FORWARD -s 10.9.0.2/24 -o eth0 -j ACCEPT
-
-# Drop all other traffic between these subnets and home or between subnets (isolation)
-# drop any 10.8 -> home not allowed
-A FORWARD -s 10.8.0.0/24 -d 10.77.0.0/24 -j DROP
-# drop any home -> 10.8 not allowed
-A FORWARD -s 10.77.0.0/24 -d 10.8.0.0/24 -j DROP
-
-# drop any 10.9 -> home not allowed (except 9999/ping above)
-A FORWARD -s 10.9.0.0/24 -d 10.77.0.0/24 -j DROP
-# drop any home -> 10.9 not allowed
-A FORWARD -s 10.77.0.0/24 -d 10.9.0.0/24 -j DROP
-
-# drop 10.9 -> 10.8 (no client-to-client)
-A FORWARD -s 10.9.0.0/24 -d 10.8.0.0/24 -j DROP
-# drop 10.8 -> 10.9
-A FORWARD -s 10.8.0.0/24 -d 10.9.0.0/24 -j DROP
-
-COMMIT
-
-*nat
-:PREROUTING ACCEPT [3368888:178175988]
-:INPUT ACCEPT [3348703:174454011]
-:OUTPUT ACCEPT [30120:1902454]
-:POSTROUTING ACCEPT [32339:2018208]
-# Port forwarding (DNAT) rules:
-# forward SSH (port 22) to home server
-A PREROUTING -p tcp --dport 22 -j DNAT --to-destination 10.77.0.2:22
-# forward port 51412 to home (TCP)
-A PREROUTING -p tcp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-# forward port 51412 to home (UDP)
-A PREROUTING -p udp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-# (Remove the above 51412 rules if not used; keep 22 as it’s for Gitea’s SSH access)
-
-# Masquerade (SNAT) rules:
-# masquerade replies from home for SSH
-A POSTROUTING -d 10.77.0.2/32 -p tcp --dport 22 -j MASQUERADE
-# masquerade replies for 51412 (TCP)
-A POSTROUTING -d 10.77.0.2/32 -p tcp --dport 51412 -j MASQUERADE
-#masquerade replies for 51412 (UDP)
-A POSTROUTING -d 10.77.0.2/32 -p udp --dport 51412 -j MASQUERADE
-# (If 51412 rules removed above, remove their masquerade lines too)
-
-# NAT for 10.8.0.x clients to internet
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-# NAT for 10.9.0.x clients to internet
-A POSTROUTING -s 10.9.0.0/24 -o eth0 -j MASQUERADE
-
-COMMIT
--- a/modules/modules.nix
+++ b/modules/modules.nix
@@ -15,6 +15,7 @@ in
    ++ inputs.self.lib.autoImport ./servers filterNames
    ++ inputs.self.lib.autoImport ./services filterNames
    ++ inputs.self.lib.autoImport ./shell filterNames
+    ++ inputs.self.lib.autoImport ./websites filterNames
    ++ inputs.self.lib.autoImport ./network filterNames
    ++ [
      ./factories/mkscript.nix
@@ -29,7 +30,7 @@ in
    };
    localhost6 = lib.mkOption {
      type = lib.types.str;
-      default = "::1";
+      default = "[::1]";
      description = "The localhost ipv6 address.";
    };
    secureHost = lib.mkOption {
@@ -49,22 +50,39 @@ in
        server = "192.168.100.15";
        miniserver = "192.168.1.100";
        workstation = "192.168.100.18";
-        vps = "45.33.0.228";
-        wg-s = "10.77.0.0";
+        vps = "45.79.25.87";
        wg-vps = "10.77.0.1";
        wg-server = "10.77.0.2";
-        wg-gs = "10.9.0.0";
-        wg-g0 = "10.9.0.1";
-        wg-g1 = "10.9.0.2";
-        wg-friends = "10.8.0.0";
-        wg-friend0 = "10.8.0.1";
+        wg-galaxy = "10.77.0.3";
+        wg-phone = "10.77.0.4";
+        wg-guest1 = "10.9.0.2";
+        wg-guest2 = "10.9.0.3";
        wg-friend1 = "10.8.0.2";
        wg-friend2 = "10.8.0.3";
        wg-friend3 = "10.8.0.4";
        wg-friend4 = "10.8.0.5";
+        wg-friend5 = "10.8.0.6";
      };
      description = "Set of IP's for all my computers.";
    };
+    subnets = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        wg-homelab = "10.77.0.0/24";
+        wg-friends = "10.8.0.0/24";
+        wg-guests = "10.9.0.0/24";
+      };
+      description = "Set of subnets for WireGuard networks.";
+    };
+    wgInterfaces = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        wg-homelab = "10.77.0.1/24";
+        wg-friends = "10.8.0.1/24";
+        wg-guests = "10.9.0.1/24";
+      };
+      description = "WireGuard interface IPs for the VPS.";
+    };
    interfaces = lib.mkOption {
      type = lib.types.attrsOf lib.types.str;
      default = {
@@ -112,6 +130,11 @@ in
    };
    enableContainers = lib.mkEnableOption "container services (Docker/Podman)";
    enableProxy = lib.mkEnableOption "nginx reverse proxy for services";
+    build.baseImage = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to enable base image settings for this host build.";
+    };
    toggleUsers = lib.mkOption {
      type = lib.types.attrsOf (lib.types.either lib.types.str (lib.types.listOf lib.types.str));
      default = {
@@ -199,7 +222,6 @@ in
              config.my.servers.go-vod.enable
              config.my.servers.tranga.enable
              config.my.servers.drpp.enable
-              config.my.servers.plex-discord-bot.enable
            ]);
          message = "Container services are enabled but enableContainers is false";
        }
--- a/modules/network/firewall.nix
+++ b/modules/network/firewall.nix
@@ -16,7 +16,6 @@ let
    "drpp"
    "metube"
    "multi-scrobbler"
-    "plex-discord-bot"
  ];
  nativeServicesWithOpenFirewall = inputs.self.lib.getServicesWithNativeFirewall config firewallBlacklist;
  servicesConfig = lib.listToAttrs (
--- a/modules/servers/flame.nix
+++ b/modules/servers/flame.nix
@@ -21,7 +21,7 @@ in
    virtualisation.oci-containers.containers = lib.mkIf enable {
      flame = lib.mkIf cfg.enable {
        autoStart = true;
-        image = "pawelmalak/flame";
+        image = "pawelmalak/flame:latest";
        ports = [ "${toString cfg.port}:${toString cfg.port}" ];
        volumes = [
          "${config.my.containerData}/flame:/app/data"
@@ -36,7 +36,7 @@ in
      };
      flame-nsfw = lib.mkIf cfgS.enable {
        autoStart = true;
-        image = "pawelmalak/flame";
+        image = "pawelmalak/flame:latest";
        ports = [ "${toString cfgS.port}:${toString cfg.port}" ];
        volumes = [ "${config.my.containerData}/flame-nsfw:/app/data" ];
        environmentFiles = [ config.sops.secrets.flame.path ];
--- a/modules/servers/homepage/service-widgets.nix
+++ b/modules/servers/homepage/service-widgets.nix
@@ -209,7 +209,7 @@
      icon = "${cfg.name}.png";
      href = cfg.url;
      widget = {
-        url = "http://${config.my.ips.wg-server}:8081";
+        url = "http://${config.my.ips.wg-server}:${toString cfg.port}";
        type = cfg.name;
        username = "{{HOMEPAGE_VAR_NEXTCLOUD_USERNAME}}";
        password = "{{HOMEPAGE_VAR_NEXTCLOUD_PASSWORD}}";
--- a/modules/servers/lidarr.nix
+++ b/modules/servers/lidarr.nix
@@ -11,7 +11,7 @@ in
  options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;
  config.virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
    autoStart = true;
-    image = "linuxserver/lidarr:version-3.0.1.4866";
+    image = "linuxserver/lidarr:latest";
    ports = [ "${toString cfg.port}:${toString cfg.port}" ];
    environment = {
      TZ = config.my.timeZone;
--- a/modules/servers/maloja.nix
+++ b/modules/servers/maloja.nix
@@ -12,7 +12,7 @@ in
  config = lib.mkIf (cfg.enable && config.my.secureHost) {
    sops.secrets.maloja.sopsFile = ../../secrets/env.yaml;
    virtualisation.oci-containers.containers.maloja = {
-      image = "krateng/maloja:3.2.4";
+      image = "krateng/maloja:latest";
      ports = [ "${toString cfg.port}:${toString cfg.port}" ];
      environmentFiles = [ config.sops.secrets.maloja.path ];
      environment = {
--- a/modules/servers/metube.nix
+++ b/modules/servers/metube.nix
@@ -10,7 +10,7 @@ in
 {
  options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;
  config.virtualisation.oci-containers.containers.metube = lib.mkIf cfg.enable {
-    image = "ghcr.io/alexta69/metube:2026.01.02";
+    image = "ghcr.io/alexta69/metube:latest";
    ports = [ "${toString cfg.port}:8081" ];
    volumes = [
      "${config.my.containerData}/metube:/downloads"
--- a/modules/servers/multi-scrobbler.nix
+++ b/modules/servers/multi-scrobbler.nix
@@ -12,7 +12,7 @@ in
  config = lib.mkIf (cfg.enable && config.my.secureHost) {
    sops.secrets.multi-scrobbler.sopsFile = ../../secrets/env.yaml;
    virtualisation.oci-containers.containers.multi-scrobbler = {
-      image = "foxxmd/multi-scrobbler:0.10.0";
+      image = "foxxmd/multi-scrobbler:latest";
      ports = [ "${toString cfg.port}:${toString cfg.port}" ];
      environmentFiles = [ config.sops.secrets.multi-scrobbler.path ];
      environment = {
--- a/modules/servers/nextcloud.nix
+++ b/modules/servers/nextcloud.nix
@@ -176,11 +176,11 @@ in
          listen = [
            {
              addr = config.my.ips.wg-server;
-              port = 8081;
+              inherit (cfg) port;
            }
            {
              addr = config.my.localhost;
-              port = 8081;
+              inherit (cfg) port;
            }
          ];
        };
@@ -188,7 +188,7 @@ in
      virtualisation.oci-containers.containers = {
        go-vod = lib.mkIf config.my.servers.go-vod.enable {
          autoStart = true;
-          image = "radialapps/go-vod";
+          image = "radialapps/go-vod:latest";
          environment = {
            TZ = config.my.timeZone;
            NEXTCLOUD_HOST = "https://${config.services.nextcloud.hostName}";
@@ -256,78 +256,51 @@ in
        };
      };
    })
-    (lib.mkIf (cfg.enableProxy && config.my.enableProxy && config.networking.hostName == "vps") {
-      services.nginx.virtualHosts = {
-        "${cfg.host}" = {
-          forceSSL = true;
-          enableACME = true;
-          http2 = true;
-          default = true;
-          serverAliases = [ "cloud.rotehaare.art" ];
-          extraConfig = ''
-            add_header X-XSS-Protection "1; mode=block" always;
-            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-            add_header X-Content-Type-Options "nosniff" always;
-            add_header X-Frame-Options "SAMEORIGIN" always;
-            add_header Referrer-Policy "no-referrer-when-downgrade" always;
-            add_header X-Permitted-Cross-Domain-Policies "none" always;
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Host $host;
-          '';
-          locations = {
-            "/" = {
-              proxyPass = cfg.local;
-              proxyWebsockets = true;
-            };
+    (lib.mkIf (cfgC.enableProxy && config.my.enableProxy) {
+      services.nginx.virtualHosts.${cfgC.host} = {
+        forceSSL = true;
+        enableACME = true;
+        http2 = true;
+        locations = {
+          # static files
+          "^~ /browser" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonProxyConfig;
          };
-        };
-        "${cfgC.host}" = lib.mkIf cfgC.enableProxy {
-          forceSSL = true;
-          enableACME = true;
-          http2 = true;
-          locations = {
-            # static files
-            "^~ /browser" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # Legacy static files (for compatibility)
-            "^~ /loleaflet" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # WOPI discovery URL
-            "^~ /hosting/discovery" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # Capabilities
-            "^~ /hosting/capabilities" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # download, presentation, image upload and websocket
-            "~ ^/cool" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
-            # Legacy websocket (for compatibility)
-            "~ ^/lool" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
-            # Admin Console websocket
-            "^~ /cool/adminws" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
-            # Legacy Admin Console websocket (for compatibility)
-            "^~ /lool/adminws" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
+          # Legacy static files (for compatibility)
+          "^~ /loleaflet" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonProxyConfig;
+          };
+          # WOPI discovery URL
+          "^~ /hosting/discovery" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonProxyConfig;
+          };
+          # Capabilities
+          "^~ /hosting/capabilities" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonProxyConfig;
+          };
+          # download, presentation, image upload and websocket
+          "~ ^/cool" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonWebsocketConfig;
+          };
+          # Legacy websocket (for compatibility)
+          "~ ^/lool" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonWebsocketConfig;
+          };
+          # Admin Console websocket
+          "^~ /cool/adminws" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonWebsocketConfig;
+          };
+          # Legacy Admin Console websocket (for compatibility)
+          "^~ /lool/adminws" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonWebsocketConfig;
          };
        };
      };
--- a/modules/servers/plex-discord-bot.nix
+++ b/modules/servers/plex-discord-bot.nix
@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
-  cfg = config.my.servers.plex-discord-bot;
-  name = "plex-discord-bot";
-in
-{
-  options.my.servers.plex-discord-bot = setup.mkOptions name name 0;
-  config.virtualisation.oci-containers.containers.plex-discord-bot = lib.mkIf cfg.enable {
-    image = "ghcr.io/phin05/discord-rich-presence-plex:latest";
-    environment = {
-      DRPP_UID = toString config.users.users.jawz.uid;
-      DRPP_GID = toString config.users.groups.users.gid;
-    };
-    volumes = [
-      "${config.my.containerData}/drpp:/app/data"
-      "/run/user/${toString config.users.users.jawz.uid}:/run/app"
-    ];
-  };
-}
--- a/modules/servers/portfolio.nix
+++ b/modules/servers/portfolio.nix
@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
-  cfg = config.my.websites.portfolio;
-in
-{
-  options.my.websites.portfolio = setup.mkOptions "portfolio" "portfolio" 0;
-  config.services.nginx.virtualHosts."danilo-reyes.com" = lib.mkIf cfg.enableProxy {
-    forceSSL = true;
-    enableACME = true;
-    http2 = true;
-    root = "/srv/www/danilo-reyes.com";
-    # index = "index.html";
-    locations."/".extraConfig = ''
-      try_files $uri $uri/ =404;
-    '';
-  };
-}
--- a/modules/servers/synapse.nix
+++ b/modules/servers/synapse.nix
@@ -75,7 +75,6 @@ in
              inherit (cfg) port;
              bind_addresses = [
                config.my.localhost
-                config.my.localhost6
                config.my.ips.server
                config.my.ips.wg-server
              ];
--- a/modules/servers/yamtrack.nix
+++ b/modules/servers/yamtrack.nix
@@ -12,9 +12,9 @@ in
  config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
    sops.secrets.yamtrack.sopsFile = ../../secrets/env.yaml;
    virtualisation.oci-containers.containers = {
-      yamtrack-redis.image = "redis:7-alpine";
+      yamtrack-redis.image = "redis:latest";
      yamtrack = {
-        image = "ghcr.io/fuzzygrim/yamtrack";
+        image = "ghcr.io/fuzzygrim/yamtrack:latest";
        ports = [ "${toString cfg.port}:8000" ];
        dependsOn = [ "yamtrack-redis" ];
        environmentFiles = [ config.sops.secrets.yamtrack.path ];
--- a/modules/services/network.nix
+++ b/modules/services/network.nix
@@ -1,10 +1,23 @@
 { config, lib, ... }:
+let
+  stripCidr = cidr: cidr |> lib.splitString "/" |> builtins.head;
+  wgListenIps = config.my.wgInterfaces |> builtins.attrValues;
+  wgListenAddrs = wgListenIps |> builtins.map (ip: "${stripCidr ip}:53");
+in
 {
  options.my.services.network.enable = lib.mkEnableOption "network configuration and services";
  config = lib.mkIf config.my.services.network.enable {
    networking = {
      enableIPv6 = true;
-      firewall.enable = true;
+      firewall = {
+        enable = true;
+        interfaces = lib.mkIf config.my.services.wireguard.enable {
+          wg0 = {
+            allowedTCPPorts = [ 53 ];
+            allowedUDPPorts = [ 53 ];
+          };
+        };
+      };
      dhcpcd.extraConfig = "nohook resolv.conf";
      networkmanager = {
        enable = true;
@@ -19,6 +32,16 @@
      settings = {
        ipv6_servers = true;
        require_dnssec = true;
+        log_level = 4;
+        listen_addresses = [
+          "${config.my.localhost}:53"
+          "${config.my.localhost6}:53"
+        ]
+        ++ lib.optionals config.my.services.wireguard.enable wgListenAddrs;
+        query_log = {
+          file = "/var/lib/dnscrypt-proxy/query.log";
+          format = "tsv";
+        };
        sources.public-resolvers = {
          urls = [
            "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
--- a/modules/services/wireguard.nix
+++ b/modules/services/wireguard.nix
@@ -14,9 +14,9 @@ in
      firewall.allowedUDPPorts = [ port ];
      wireguard.interfaces.wg0 = {
        ips = [
-          "${config.my.ips.wg-vps}/24"
-          "${config.my.ips.wg-friend0}/24"
-          "${config.my.ips.wg-g0}/24"
+          config.my.wgInterfaces.wg-homelab
+          config.my.wgInterfaces.wg-friends
+          config.my.wgInterfaces.wg-guests
        ];
        listenPort = port;
        postSetup = "";
@@ -27,6 +27,14 @@ in
            publicKey = "OUiqluRaS4hmGvLJ3csQrnIM3Zzet50gsqtTABaUkH4=";
            allowedIPs = [ "${config.my.ips.wg-server}/32" ];
          }
+          {
+            publicKey = "BwN4uCkMd6eAS5Ugld0oXnA16IhgEEQF8mOJ3+vHliA=";
+            allowedIPs = [ "${config.my.ips.wg-galaxy}/32" ];
+          }
+          {
+            publicKey = "R1xUFOuboQf/yy8ShiXqoCPaPcH3Cn0n4PAWB2rgHTs=";
+            allowedIPs = [ "${config.my.ips.wg-phone}/32" ];
+          }
          {
            publicKey = "rFgT6TXzRazK6GMazMNGjtOvzAAPST0LvCfN7QXsLho=";
            allowedIPs = [ "${config.my.ips.wg-friend1}/32" ];
@@ -43,6 +51,18 @@ in
            publicKey = "yg+2miZCrx89znFaUlU/le/7UIPgEAMY74fZfEwz8g4=";
            allowedIPs = [ "${config.my.ips.wg-friend4}/32" ];
          }
+          {
+            publicKey = "u4/6ZYO7lUJZ9QmSlFPUaadq25gwDljjhsfgs/p2amc=";
+            allowedIPs = [ "${config.my.ips.wg-friend5}/32" ];
+          }
+          {
+            publicKey = "GawtOvsZ75avelIri5CjGoPXd8AFpi9qlZ6dSsqUISE=";
+            allowedIPs = [ "${config.my.ips.wg-guest1}/32" ];
+          }
+          {
+            publicKey = "NvhUnErIb0/hi+Hui/o5l5Pq4ZysFVIn1VBPsjoTeCk=";
+            allowedIPs = [ "${config.my.ips.wg-guest2}/32" ];
+          }
        ];
      };
    };
--- a/modules/websites/lidarr-mb-report.nix
+++ b/modules/websites/lidarr-mb-report.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.websites.lidarrMbReport;
+  mbSecurityHeaders = ''
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+  '';
+in
+{
+  options.my.websites.lidarrMbReport = {
+    enableProxy = lib.mkEnableOption "lidarr mb report static site";
+  };
+  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+    services.nginx.virtualHosts."mb-report.lebubu.org" = {
+      forceSSL = true;
+      enableACME = true;
+      root = "/var/www/html/lidarr-mb-gap";
+      locations = {
+        "/" = {
+          extraConfig = ''
+            try_files $uri /missing_albums.html;
+            ${mbSecurityHeaders}
+          '';
+        };
+        "~* \\.html$" = {
+          extraConfig = ''
+            add_header Content-Type "text/html; charset=utf-8";
+            ${mbSecurityHeaders}
+          '';
+        };
+        "~* \\.json$" = {
+          extraConfig = ''
+            add_header Content-Type "application/json";
+            ${mbSecurityHeaders}
+          '';
+        };
+      };
+    };
+  };
+}
--- a/modules/websites/portfolio.nix
+++ b/modules/websites/portfolio.nix
@@ -0,0 +1,98 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.websites.portfolio;
+  issoCfg = config.my.servers.isso;
+  hugoSecurityHeaders = ''
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  '';
+  hugoLocations = {
+    "/" = {
+      extraConfig = ''
+        try_files $uri $uri/ /index.html;
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "~* \\.html$" = {
+      extraConfig = ''
+        try_files $uri $uri/ /index.html;
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "~* \\.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|xml)$" = {
+      extraConfig = ''
+        expires 1y;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "~ /\\.(?!well-known).*" = {
+      extraConfig = ''
+        return 404;
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "= /js/script.js" = {
+      proxyPass = "https://analytics.lebubu.org";
+      extraConfig = ''
+        proxy_set_header Host analytics.lebubu.org;
+        rewrite ^ /js/script.file-downloads.hash.outbound-links.js break;
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "= /api/event" = {
+      proxyPass = "https://analytics.lebubu.org";
+      extraConfig = ''
+        proxy_set_header Host analytics.lebubu.org;
+        ${hugoSecurityHeaders}
+      '';
+    };
+  };
+in
+{
+  options.my.websites.portfolio = {
+    enableProxy = lib.mkEnableOption "portfolio and blog static sites";
+  };
+  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+    services.nginx.virtualHosts = {
+      "www.danilo-reyes.com" = {
+        forceSSL = true;
+        enableACME = true;
+        globalRedirect = "danilo-reyes.com";
+      };
+      "www.blog.danilo-reyes.com" = {
+        forceSSL = true;
+        enableACME = true;
+        globalRedirect = "blog.danilo-reyes.com";
+      };
+      "danilo-reyes.com" = {
+        forceSSL = true;
+        enableACME = true;
+        root = "/var/www/html/portfolio";
+        locations = hugoLocations;
+      };
+      "blog.danilo-reyes.com" = {
+        forceSSL = true;
+        enableACME = true;
+        root = "/var/www/html/blog";
+        locations = hugoLocations // {
+          "^~ /isso" = {
+            proxyPass = "http://${issoCfg.ip}:${toString issoCfg.port}";
+            extraConfig = ''
+              rewrite ^/isso/?(.*)$ /$1 break;
+              proxy_set_header Host $host;
+              ${hugoSecurityHeaders}
+            '';
+          };
+        };
+      };
+    };
+  };
+}
--- a/parts/packages.nix
+++ b/parts/packages.nix
@@ -26,11 +26,36 @@
          exec ${mcpPython}/bin/python -m mcp_server.server
        '';
      };
+      vpsLinodeConfig = inputs.self.nixosConfigurations.vps.extendModules {
+        modules = [
+          (
+            { lib, ... }:
+            {
+              my.secureHost = lib.mkForce false;
+              my.build.baseImage = true;
+            }
+          )
+        ];
+      };
+      mcpTests = pkgs.writeShellApplication {
+        name = "mcp-tests";
+        runtimeInputs = with pkgs.python3Packages; [
+          black
+          click
+          mypy
+          pytest
+          ruff
+        ];
+        text = ''
+          exec bash ${inputs.self}/scripts/mcp-server/run-tests.sh "$@"
+        '';
+      };
    in
    {
      packages = (inputs.jawz-scripts.packages.${system} or { }) // {
        emacs-vm = inputs.self.nixosConfigurations.emacs.config.system.build.vm;
-        vps-linode = inputs.self.nixosConfigurations.vps.config.system.build.images.linode;
+        vps-linode = vpsLinodeConfig.config.system.build.images.linode;
+        mcp-tests = mcpTests;
        nixos-mcp = nixosMcp;
        nixos-mcp-server = mcpServerPkg;
      };
--- a/scripts/mcp-server/run-tests.sh
+++ b/scripts/mcp-server/run-tests.sh
@@ -6,6 +6,16 @@ set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$here"

+cache_root="${TMPDIR:-/tmp}/mcp-tests-cache"
+mkdir -p "$cache_root"
+export HOME="${TMPDIR:-/tmp}/mcp-tests-home"
+mkdir -p "$HOME"
+export XDG_CACHE_HOME="$cache_root/xdg"
+export RUFF_CACHE_DIR="$cache_root/ruff"
+export MYPY_CACHE_DIR="$cache_root/mypy"
+export PYTEST_ADDOPTS="${PYTEST_ADDOPTS:-} -o cache_dir=$cache_root/pytest"
+export PYTHONDONTWRITEBYTECODE=1
+
 fix=false
 for arg in "$@"; do
  if [ "$arg" = "--fix" ]; then
--- a/secrets/certs.yaml
+++ b/secrets/certs.yaml
@@ -22,38 +22,38 @@ sops:
        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5VUMzYjZ5WlZtQ05LdnVt
-            b3V3RmFyM0VZWmh4dC9YZFpsZkRIdC9TRzFrCnBuYnhSaUgwb3JuSUNFSWlwSmVq
-            bEoyQ09XSjNBMks3M2ZYdlh0eDFNYjAKLS0tIERpaGhISDFYd3RCYUV6Y0lmdGNQ
-            VTNibTBMN2RuN3doU3lYK1drNjVTVkkKMmRW0NtiYKBcUQ8kKjXcS6KjoPdVfN5d
-            6vczsKTTbUwI0n6T5xrwRdbVIFsP4HisjceQWxJIVBthR0u9dLfXGw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdVVSeEtOTE1XQTBHVW5C
+            aUVVbUltOGMrV2l6VGhRQXFnbUR1NVpnYmgwCjEzWXB5SVBtbjBzMkx4OUhkUXll
+            b0FkcUl2b0d0YkEwQU9iNFZrcDJTV3MKLS0tIHNrY2JFbVEwNTFaWUdmdFJPZmJI
+            SnhZK1h2ejhQUUNtbzFINUJmNGhiYVkKCMeBiPt80A8/ynEWy2e881y1tVnqANK+
+            wU9Bn+oRwoudPb1io9LAoTdu7+IQpLByt1phAju8m243nM48hAkipA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvb1ZtMjV5TjlhMVRwdWNU
-            ME93Y0xhVGlxdGxmeWtXQ09EN3lORlJpV3k0CkJxdE14YXpwcytjbnZuMWpHVzZ3
-            dVVBYVE0RW1naWVVQ0JRY0NoWG9LZTQKLS0tIG1udE1GbEtTQ2o3bGl0SW9NZmtF
-            OFNqTncyaHFUSzBNRzZiSTVBdkhFWVkK2v81N8c8cU1Ig9fQZOn0fltqO+Ej8Wtk
-            D0nMQv2fbWp6YlyE17VYPgmhdEY6+Zstve6PlBG86iQE3LTAfjG3Uw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhUmQzMU9hTlpQbHBQMm9R
+            Y0d5Z0lGTkFvYnc5MkRDbjNTMlUxWmI0U2t3CkdRQzdGTTNjbmprWEdYc0Nkckpr
+            Z2xqYkhlcHlQNG0rRFVvVTFLdFQxWVUKLS0tIFNPS1o2UVZobU5xN0U2QnI4dXA5
+            WWR1MWNGMVIyTGFBZXFyZlhwM09qakUK8Q26phHWY9zN5j6ZxB7+kmSgmcukfgiv
+            qAAzIGdgsvnUiFZCEJHD1D686C+ZxvakD4p9sA/zEIyeIBtKCq3lIA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSVdUWXRUa2tHVGczelhu
-            UWk5RFl6azRJTkdxZGxvbWlnSDc3K3NlNlgwCjBRZEVta3RuNW1DZmo4RXJyTTNk
-            cnpxTDRGL0kwQXJmc29LNE0wV01hUGsKLS0tIGgyTWZrOHVNTGExRWtYMzJ1aXhp
-            cURNZXBtbnp2OUZDZDZKeEMrZlN0TEEKznlmLKFHYDm/hv3EPcHjT0A8r06GL7if
-            tbuJei8aWWg+uuvCBTZjHqmPUyNR1ixt84vxy1HlwXVu3dYHcG0Wug==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHR05GcVViZTY1Q0NaR1RG
+            SWZzYjlxQUttS0tXc1ZDbDljbXczd1gxL25ZCkM3TVJ5NzlIdUx1dTc5d3R4U3BY
+            RVBLazRRZ2F0anJZRXl3bFdsbXJhdVkKLS0tIFVXN21DQmtqZ2hIRi9FM2dtTTlw
+            aHQvOUt5UGhhR2ZXMVFOOEtKMDRtZmcK0ZX5pF08o+HLztgL1/LocDGIcOGPKqXe
+            9bRBkUtr5QuIxQEYj6NenhkeIxRoPxK9Re/Vsqpphv4NqKpzyOujcw==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZYnlaTkd3LzFRbldWL3RZ
-            N2ZneVIzMnRpVVNHVWRMdXJLdjQwSWFKS2pFCmlQZUZMbG03VFVuUXcxZ3NRWjVH
-            SHVPYzk5NGpkeUVSU1BmQnNuaWZnZFUKLS0tIFdQZEU1YnhHZWRIajNYWTYxMEwr
-            UVBjaDFtSWs1b29DR0R2WS9pSGh3OEkKmG34ldBy4s9nj3ng/HQr+gN0LHJCOPJ8
-            EWhh7cTLSF9AmZKP0sBsj7I4hHhZlOn85bvTM9RDiRVOSz8VrObXHA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYcmxldjA2UllycEFyTnpW
+            c2dIa1NXYVJSU1lwb0EvckxQQ0J4ckhSeDFBCnBTZGRYUzdSK08xeWFmaUM3SEZ3
+            bXJSUG1OVEU1T0Z5VGRqYUloa3k0RmsKLS0tIHdRcXE3Q2lLZTRvL3ZCSnZtSk1K
+            TU5Iby9qamRIcEUwc2dTdERFVmNreTAKh55E4KbM6WeFhVx3KDI/pYq+1vCNwDj6
+            6zfXWJvyD9Icn2ZgqpK30wyJ/R/DzmpTDR8AtujXHT6/Uikn7M1fig==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-09-21T20:28:29Z"
    mac: ENC[AES256_GCM,data:e267Kxv1Pyun/VOcLepBDBEKN6uSf8/iuY8KQ8u4xK58wsWkMdSDVcDKvO/iKF/Tj9hj+lZapkaKmp5SdeX+gjpyWiZi6QmUuKsCs0jlkV2NydLtZZt9vkmY/LCguIBRMmhDgidrNcfoghTxDDK5lng5H+2MBs0r2zLID65pHUQ=,iv:tr4YFdBltnsD4uTt+0NCam7r1QzhOmdoEbfz5/+JGPI=,tag:R2dDWTC1qrwPI9ghaf1FEw==,type:str]
--- a/secrets/env.yaml
+++ b/secrets/env.yaml
@@ -21,38 +21,38 @@ sops:
        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjcWpKQ3RqSVdxcDllajc2
-            UzVtdmxBWmJ2QkI3SGhYRlRadGJYaDU3UVN3CkpQYkxhVm5ZQ2djbldYL2VmQWsv
-            SEJmam0zMzlJSFpHS3JZWVorUmh5ZDgKLS0tIFdWdU44VlRDZllCYXRTQzNyajRy
-            cDJqNzA3ektRWll6SkFsVnFMd1FBUEEK0j9X4lYcFaj4MnVh4jnNwrTg2Sl5TTdZ
-            uFvTdE4ZNtZsh3nKmj+v2J3JM8dDUtw2NSooqpoqEvCYdDqwK1kDXQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhV0xoZEhJYlZIUDdOSlVv
+            RGlOQmdSSDROaVY4L2xHSEt3cVVpc3MrRkg0CktGQ204UDNYcXN6NDJqTXFpdmxQ
+            RUYrWDNCZzlObWNyYStWQlRqQ0VJQzQKLS0tIEY4bG41R1k4NDlabGhoUEl4VitI
+            YmYvaDNWRzRlMkdUdVBxM2lwd0N1bXcKp1iUENgs/0RL6PN7b/mwbBdIPuDFfWM4
+            9gXuoW7FiS5MYGdUY5Ub8WlSfA6iUww+t6FB/rBhK9TDXOfIKRYmgg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGSXlITkpxcHZqR0kzMlFY
-            TStOVitPSm0zTURZcE92NkM2ak8xcVF6OVZBCkRRbkpBNW9yek9rWFlOa1pLSk0r
-            ViszS3pMNFhLQlcwdW83R1hhTUJLT0UKLS0tIG9NTm5tNzlidlJmejdoOUkvUE9X
-            RzV2MUFEMnlHVmp3UmgvNmJKSDFrWHcKQ7y2W0PFLs/I6Tb0J/M91+toDP8XmgWh
-            LYuNc9lkjTs+ylIWuMTwtXdceI+kK8hJlELT47FyKl755DzuB1ufAg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWNEtaUndrMGszbHpuYWtx
+            RTRCc29YcmQwYWFKeTFtaHBpM1NjR1R1dGxjCklsTFVXSmp0OUxVUzVYeFJnSWI5
+            M2hEM0pjTXowbGZsQ0tHdnJYdkxjTncKLS0tIG0zUEJ6ZnNOVmd5UWF1K013N1JT
+            dk1HeEJ3bkVUWnhIakt4eEdNUi9aSkkK6Ug6dwtSEpzMpgKvozR8BO0ir1YeRBQd
+            jDtkNhpc32P5uZtx/kv74vIXgOT7KCSb03b7mSIl13J2IeHQDZTPBg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzYXRodjgzR1hoR2VDNHd6
-            NGJ3SXpqRmJKVlY5aTI0R0hBLzFGQ0VSYmpVCi9BakFwRGlXd1ZPbWpHY2h6RUo0
-            VGl0T0d1LzdaZGNOZ0pDekZxVVBWUlEKLS0tIEdtVDZlN2FrcFhEU2pTMUdiZ3NH
-            d3ZSMGdkNzNaczBYOHFuZWJmcEM4MXMK6ayh37HUhOYPryv2Y2WlE1U0CX7qZF89
-            PzvHQZYcbZ2gsRW2f1uU2VoJp/6XnSipD7fCjma3iNovoPlu2+A0yw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWMm5NRmg5Y1NYNDA4MkpR
+            M2RPM2JLZ2NMQm9uNURNc0lSVnJaMHE1MG1JCi9CY3U5V1pnQjhPOXl5NlN0eTJW
+            d3dXQ3hMRGNjWlBQZDAzc0ZDWWUzNm8KLS0tIHMxQWdvY0F4Mk9zaElhMlhManFu
+            TXNGcFZRd1hPdW1wWFpPRklScGZqVXMKwHv5CDSdlaGlXqFKoK9motAWNVMzerXy
+            6K2KVn3tmlAiBzkwuEVVa4jafQjd0t3J6bPx047DP6fPZVNLMElctQ==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aUk0WVhTUTZXOVRqam9O
-            WkVNd1FKdDA1SWpwWndHbmVBRlNaSWI4aEVnCnJTTDNYTkRtNkR5cUl0SURVQWxh
-            d0c5cEhJVTZ2YXdLdHFQRk9KN04vcW8KLS0tIGF3Rmp2Z0pwM0x1WnpKaVBiUE5x
-            MVBONDBmQjI2enNIVFFQT1hyYm45YXMK2NXWvm8G+Yrvw1NAC6AiDaxA9UftuqYe
-            ZB7QpfkdCT3vS52lBgcEJrM1TbaVX2868trk5kB4gjqVMPVPYxcGHg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaTNnYlFsdFBJeGFwdUNl
+            MVc4OXorOVhJcDBTWDZaT3pQbTg0UFlGNkhrCnVST0IrTnliREpmS0dPMzVDZUJm
+            aUg4SnhtNlcydFYyTkp3N0xaSzVCREEKLS0tIE9tZmZLUERnSzY0aDdkTnY0SXJz
+            UDltYm4zalM2VmxmQjJRSVQ0YWpuM3cKsYQOOppHVJT2tbQQ/jXy4NcUX6aWjQxT
+            Y/I40tBrkwnzVFpVvf6COS+oC6/yRISwWJYYvia9xVfC5+kss9cFIw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-02-02T03:55:24Z"
    mac: ENC[AES256_GCM,data:+NN+RgkHAIox1IgUuC2ACHneRBzgn5FzsujpbPtmw1IecxeKMMXM7Wa1ZziSkWJSjjDCcBoanox57e+BoNWN5WhWuMdCed04AKcknfKlHAtHrKhoLCsi1sZnsQX7xBmTsA5qHD8788EWfIgPk4gToXkq5KkEfvEWLvalClRK7tY=,iv:kGyw9hk6vp5iu0iMHaCLgVqdcv1gNUBqBhZbRSCa4Ks=,tag:FdKL/5ZraejphDIE2ig8GQ==,type:str]
--- a/secrets/gallery.yaml
+++ b/secrets/gallery.yaml
@@ -5,38 +5,38 @@ sops:
        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4R05sUnl0UFd3T3pzRm1y
-            U3piNzlpTmpZeEhkeWJxRkMzRzBWRW9LQmtBCjRHTVg5ZlozUnpsVjhIK05xYjlz
-            c2dwbWVKWVNXWFhTWEtlUUFjVUw2RkkKLS0tIElaNXN2ZmROdHd4bWljM3FyMEh6
-            Szg3WTdrVlFmSUJ1S05xNXY5RlM1V1UK7YETep9hn49UqRUjbRv6oGFUT/8lRgXx
-            5O5eGB1X8kPCY8zXiGWSzfo6X8O5659vWIvqjoY8nZxekgvsISS/WA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNWNIek9yVUJIYlhSQmVZ
+            NENoS2dvRDVENit2bnVNQmJ3TVZGWTkwTFh3CnViekVsaTVFZ29iQXNXUTNPS2U0
+            Z2JsWWN4T2tUckVJU0tpNWFaYXpGVTAKLS0tIFowcE1tZDdPREY0ZGVzYS8xNFFp
+            elN4TnZjZUtGOGZ1c3FiU0h4YytLTmMK9wXfpIgMcPD4FpO5CNIXnJc0wJliB35g
+            v4wiDb4zU4VFfWzdimSXjgZrI/ZIqB4Bx/PPi6SPhuT4oQ6LSH5sKw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpT1oraHpJb0NUQndMZW9l
-            YWZrOVBqOG1KME5PYS9YVE4zd2VQb0hRN1dJCmVqSzhkbU5DVmc4MFVnSnVYTi9V
-            RUR2UDNEK3JGOEFUWVoraGtqQVFFWkUKLS0tIDVRdU8rV3diVXNUQSsrKzlBdmFN
-            Q0x5QXdaOXRMc211TUhqTndQOXR6ODAKtJYiAeVTYPOpS+GykBDOLx1g3VloFo2P
-            fDIkOCrINnAU4y07KPhGBxCV3/2cvOPhIgsd02XqxfZPCEU/cYdCgQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtSmsyR0N6SWMvQVl2RzRZ
+            TUpXbm9oTmswdXViczVBOFBLL0lhUmV4WXhvCkdqRG5pcStUVDE4S3FSL0R2TTlG
+            Sm1aZTcrejRHdzU2dFozSUZucHFtUHcKLS0tIDJTSmU1dVhSeUxMSnd1NGlkR1RC
+            cVVIcy9QRFArUkdIM05neG5aM2EyM0UKSCIv0iU/X9bVoQCRxcQXwMbr0GE7MGkb
+            pn420gXMiLFBE8OOhkHg7EEjuR3n9iB3f+pTgN5v6UkxZBmZ2Xr4yg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4dTIzeCttSGNVNmhPejdW
-            ZFkySng2T2ZYdkRrRGRXQVpER1NJMW5XN2xVCkc0VTdsbXdLUkg5d29zZ3VmY0hH
-            U1cybHNob3VkdzRWbGt1bFhNeW9XN0EKLS0tIDdoc2cyaEIybjBHOU5tdVRsTWFZ
-            TmdZTGNDOFovMDVPakF0WTdHaUpHeFUKl0ub1OOylE2JGJNpeReebiOaVdxbd0wv
-            nvJD7tYYXI666Pi31OHttWhsHR+xkL8TU9Dd6uDs4QxIRQfwy/VxcA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlL3picmtSZE8vS0Jod1RV
+            aGNlK2t6b3RTZWRPUmNCZXN0KytSRnRuMHdNCkd1VjU3NEhBOE9jN3gvblM2NnZF
+            TDRhVGh1Y21YM2J4WTZtenFHSDBBNncKLS0tIHZqcnpRbldWN2cxT1I0Qzgva3R5
+            a2lsbG5SUFgvZXlHWUhOc0xQS1dxaHMKDMGQujRa0s4kjrQod11mn0otxO2Zl/bv
+            kHG8ufANpJS5RfKNLMhAK4piUtr1o97471MSGA0ebZAUSK01fQBNfA==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUldWbldqTTEwMGF5RVFV
-            ZkZ0Y24ycU1hVDlaTnpGQW1SeFlzaXc2a1FrCmtrUkxLcjNsVHNXemd1cWJJdXI5
-            bDFxUThzSFptNWtXMlNqM09aeklUMTgKLS0tIHR5KzE3dStMTXlhUWhtUWUwSkY0
-            ZldyVmtRVGppQ0d0SnN5Tld4cEtmQ28K1Yij+7OxQUpEsPt/GTnP+dhEErBH1HuL
-            pBFXqHLAwpqiEiiNhYnb0KVWeQnIqDo9WUnrbPavcWSrSkmCsszgxQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4WlgxL2xMR1p4eG1Ca3FM
+            c1JOcDBhaHNlUjRNZjFhVm9CdkN6NEdqdGtnCnUwUFBtLzYvM1kvd1NVREdwL3B5
+            MVc1UEdaSTlhWXFadSsvbHNTaUZKcDgKLS0tIDc3RDg3ZUkvRVFvRWhBWDFHZjV1
+            NGlweEtoVGdqT2J3UzNGaGt2RFM5eE0KUCFvcv39dFM0Vm6uDuntsnZyMq+LHfJW
+            Sts7AJwVIGTmOolImqoVTeKFYJZu5oeKZZNsEG+gvIZptxaR0jPtow==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-10-10T05:09:54Z"
    mac: ENC[AES256_GCM,data:N/BwfrwWcnot36Kn6RFZjjpUIluzq5Upy5iVVV4XSs+/0PYdlZGytjoAB+E3gXyPsLZ93UqI0A9/5KbfXBuR2oY2F7iKsu5puzgyYWa0Gl2z9YcPnyDnk1dj7Ne77xJlqR9YquGzFKF8QdqFXFA9cdE3b/1usTFhP26oxofMXs0=,iv:Iz/LzS8yeKQgDiGchYdKNymBeekhopJtBWaQGOwRZlE=,tag:hMRwxJlKR21W7otW01GmGw==,type:str]
--- a/secrets/homepage.yaml
+++ b/secrets/homepage.yaml
@@ -4,38 +4,38 @@ sops:
        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDa3NpNG5tenhqWVQ5RFAv
-            bjhhRWJWK0NFQVk0cGVpcVJGS3BFeWlSQWc0Ci9IT05mQTVWbmk3SFFpWE9KUnh6
-            bHhCSktlbzVUQm1lOHp3cVpiSHU3MDgKLS0tIGg1UU4vVVo0SXRwMjJsVUZEZkFC
-            TC9Eb2JaVUFDSWRMYm5jR1BBa2lEamMK4V77WUVbMXcsw83FFdL2Rk30oR4cAkqQ
-            kc8Z0+5kNJFUFilFb54dnWTOh27K7KZvU1qIdhG3X9fuMIHSuPnyTw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWaEZKVnhKR3ZnalQ1dWZy
+            THJ1Qi9EK2NHQXUxYlg1NWZqd1VuRUY0a1FNCkg0UmphaktuWklNVE85c1RuT3FV
+            bUwrVzIxQ2JhZmNqdnR2SUlIcGNiazgKLS0tIEVDZk4rV2tTT0pLd3I2RXVIZ0pC
+            RWJCbkxHMm1DRFJKZkRhRldiRFVFd2cKQvohCMbXDJzOKzfAN72/1S4CXj5d0bbK
+            Ge+V8Ew9S4+UR39iLtQzs7lNYYCtDxNnayEm0V8LlVkgeEj2HnS0bA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDRVdYVTY3QzR2MFJPVW9j
-            SUtmTldMRCs0dTlJcGFoMDVnaWMyNlF4OHlnCjg0OFFrOERKRFZVMm9NREhBOGRs
-            dTEwc0NZUk9hOEtvNVJDRXl0TDhCaTQKLS0tIE5OWm5CNzc5SW9IdGFud1N6Vm1D
-            djhzM29HK0FIdXIvaGIrRXlOMisxaTgKVCAiniAmfqJuwwiUpcGAvoyqnUEZ9gOS
-            SyhXMzv2cbomuOb0NiALRkd2up/uX0TVuz9wuBQvYYjJhqpFuSnbRg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBheTV2MllUaFMzTWpiRnFw
+            a3hHeFhyNHZGek9tWVhySnVLUzNDVzV2VUIwCitWLzJ1ZG4rVHRwZElOdTdXMmdX
+            ZG9RVktFQ0VvdDViSi92YzRIZXJYOHMKLS0tIDZkRHYrMmtyZUh6bE5KaldvMDY2
+            MitQdXpDTkNxME1pV1BML1ZRRG1NaWsKUBHmQa1io7qNp+xkEmYsn7Q6XSpQ/566
+            KYVB7GMSyp5YYsJv1vA8tLHnavLDam4zMZ1t24dgk8pWOZpJ4T6T4g==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1UlM2MC90SEM5elBtNmpm
-            cnpTQVF0VEpLUDJPZkEyeGNuYnl0cEY4M0U0CjhOY25BcERjOThkbkVhNnJtaVpv
-            N00zOUZPWnNYaEtYMzlXZk56dGVPeGsKLS0tIDVDcGY5cG1ETHk4eXRFN1hVOXhV
-            Y2xncFJuNUs5ZkhLSjJyc2pzdDZxbEkKn/8BtUXPQ0OdR35ZwiHWFB0AqaDtAlG7
-            N4Z7iztqiscuxn8G8VVVFdkQLBY3JcrXhxPYWK4xtJeEtpIMhegxeQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkanhPTzY4WEhVLzFvbjhR
+            emVmVmZIRmVDelpONmM1SUhuT2Zadi84aW5ZClRaVGwrbjlGYkZiOVR0V2RuVWR3
+            UVBlNG9RUlpUZlJ6VFhKRHQ3T1VMRVkKLS0tIGpUTzM5MVA1LzdsNW5IMGlZcitR
+            aG9pR0RRd1NBalhweEdGNnNCVHFvb0UKIiFruo9rV/VD6XykanHIpbI6G6D3cGG/
+            ZGSxH1HD9qIVYDQ5LpBfUy/dZxRnpTiBJ7Veg/Siemz7kmChlmVDQA==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzd1VYanVSZTd5elNlZ2NC
-            bnd0V0VZVmtrVDhBbW5KUHJDMUkrekVZeldRCjBNY3g1SkVKUzhRL2xsbjloUERi
-            UXM4T1A0a1V2eEFlQWlTQ2tDdFdaZ1kKLS0tIFFtNDZzbzYyaE5UT3R4eDJzNnU1
-            RG9UbWM4YTVHcFpKblQwemNScDVteVEKA6fibq6Ozwrz/tg9Hrx4bH9LCadmW5fR
-            IkFalgD7nqew8KwS0keyKFk93i2p6sTDZPy2/t+WryMXBIc/y0iQ5Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UWRTR2x6aWJEZ1p4aE1O
+            RGpSM0xVRVJpTDhVa0dhTWwwTVp1Z0NkTW1RCkxRVUhkMklZUVhDSEE0bkZHaFlu
+            UGRvYURuMWwzOUtoTzV2V05kblRpNnMKLS0tIEgrYXBpYysvenRGMENNcTY5L0dk
+            a1pWRTkzSkZGaTVtbVc4VjdHdkpneGMKq+3Pd2dOJAnC/PKEYijWbk1vQSes3ykt
+            1A88VIO2o/isCLr9643SVkZQ4WbISA4xvInG+peEdbja0oZNRQNU3w==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-02-01T22:31:04Z"
    mac: ENC[AES256_GCM,data:gtTuLmgVd5t1Eic+ld6x3pmAlv2+SVf4OgUICu78DJ9L1YCtmJ+LsqIoHFueMdQAmubPA8c4xYsHWCDu2dbrUDUs/79BF2u4P9lbNkJx5cco8bnPdy2tmkhcLwb0HwRduVIbgcm0wzYKUMd76Y0ChxdCddkrkk+PjXkUE7OBNg8=,iv:Eqhoc6GjB1NOnIIeRIdVoQNQm51DguH3vEX4zRUgeBE=,tag:V25oIemZpdJDMRFcZkH4bA==,type:str]
--- a/secrets/keys.yaml
+++ b/secrets/keys.yaml
@@ -51,38 +51,38 @@ sops:
        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRGVscDJsU0ErZ1VBRzVq
-            dE5aNUZvcmhVRHVjYUJFT09hdDd0UzhIS3hNCkRFRlphRXBTd3VFTE81RjJRaE5w
-            bzJSaCtsT0QwMkx2WDVyZ0FzeFphWk0KLS0tIGN5M0QyWmQ4Y3lCU0FXaU9vL0hv
-            MEp1ekxTdWp2b2g4dFd3OVNkUlZBMGMKzNGSzYgQsNW6HEvzTWmo73GShAAv/g8+
-            h3/6n/ObqlKsjDyVFgiOYop3LWfwPMzmOhx4S0wsOHit0UxdyoJwWA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnVVQ3NG9lM0l0MzlYaVA4
+            dEpOajlJeUxYTmJlMXJJMlN3UnRwZHEyaHlVCmYya09LMU5UQ29pQ3JCeWJnRkI4
+            ZEpzRk93WUhXR25QK2c0UjRlTnZld0UKLS0tIHZPUGthU0tBTVNzRmFmVUxnSkda
+            RUVNLzM0QUZLRFRCOFpjTXY4eHprUWcKK0+r6kWEw+gC8P+afVvw31SY63PTKb1C
+            D1KCOugRHnNT+xOELiVg9jjFW5lTJc4U2OBe/IpsGBujleXrWKwpvQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLUGFaaHFtVWl1cG1XdlRT
-            TUh0MHZTa0JhdDFSTVJZOWJBd0F0SWI0N2tNCkdnaG5DcXdDT3dqRVJDcjlsZ3Fz
-            ZFFaeTB4UTBQRVYzcldndm1RSjhCTzQKLS0tIDJySFIvbGpBd0l4RzYwVUd1MWpF
-            ZHhxdERrd3VNUGpTTlZUM25RYzJwSjAKG2DZUyomWm8Nxn6mPDKbBh1YsEUr642a
-            nGYxmuRVBVINbOB3gBPwgLeD+S2Vlm4vrC/u2761fTgm8KFLC+txpQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZY0JpODFjNkhQbnFHNlJU
+            V0s0YWZSTC9OTWdXR2h3S0FkM21CN3NocURVCjM5TWNNYzhkUW5jcHVuSW40ejJs
+            MkgydVlpejhzWFlMZHNGMzdqaEpPcFEKLS0tIHdzQ3UySDFpeWhVMDk0dmswTW9N
+            U1M3aXlqSHQwaG1DZysza25KZVRDU2sKp6kZa/6/Or9zdLTfFf/lKWcoHDz4v6p7
+            UEAA3twa1VXAk7dqmDmp0Szngu8y7iF9BE5fS1nb5n+rUa9DrwWvng==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXTnc0N3JWUGk3cWV0QXNK
-            L0ZWM0I0NVlVbTdsZmdRall2V3FUTllidlJnCjQwbFJ1TjVNQjl3NURQenBDZVhy
-            QXEybkIvc0RnV1dNL1Rhem9GajhzY2cKLS0tIFk0Nm9JK2ZvenJsYVF2RUJLVzVL
-            bzFWRnFjd01wbDVrQnhlb3NYampEVEkKWl3/oymEX/TdMHyxE8mOopIwu4Kots27
-            teyBmo6aVTAQ1zSxGDszI6kgK6PC3Z/WqaMaoJilGI6k8vCkOT3oMw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrU2Y1RC9aczBVWjZoS1Vp
+            VFp4VmtkME0vNVpnZXRYQmxmdHhZb01MelY4CjhHcnpVenVFd0YxOGJmT3pOOEF0
+            a1VBNGpSNSttblF3b3ljRDI2NjAwbzgKLS0tIEdiYWpucEY5N0JVN215ZWNDZmkr
+            SlJJaUFzaGdwdjhwdjJUWG1TdnZIWHMKGvQWCQNr83Z0CP5jGHc2wvqOIUdGC7+2
+            8buS4XK22o7EotL4bbKsEw5dgWQIBRXH+9XCq56RIUYR0T/T9UW0ew==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtaG1Ea0ZyZ1IrRGxEaUdw
-            TzlMRE84ZDBXRTNFWHcwNE81MDZlYStTZWdFCmxLbUxORFNVVHRGYXV4bDRvV1Ra
-            Rzg0YnpkaDJ3alhxalFFck10MjF4MG8KLS0tIDgwSEhReERtZHZ3U2RWcnFaaHlI
-            UmQzNEJVVTVPRHFqVlAraTR2bHNOdmsKKCVCzZ10sEA7rGRCUxbpYlaR6Y2jZvho
-            THbZe5MHY1a44L2XQSZe3I+1qOVBWVSL10KYTjJIBTxoeBtjlQJAVQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnblN2TkRudTZCN2Vvcldr
+            UDdBNXYyaUJVdkRDL1Zlb21vK1NlTnJyV1MwClFRMWpQYmo5amRWMTRCTlYySTRY
+            YStldXhHdnR4RUcvNFpVbUZPMGpFQU0KLS0tIEV4MGZ3YUJjOVdLNDF6RFhIOGs1
+            bmtmNDJ5OFlQYlZTWmQ5S2FmdEZ3clEKYRQ7nuP3G63vwyhW0wLQISrkiY98F3jx
+            7c9qMd2eGVvrOQr5M2OEPcjKexBa9Qt6O5t+dABrTmXCa42B251zWg==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-02-03T21:56:09Z"
    mac: ENC[AES256_GCM,data:Bnjo3TFYoGbtB8HF1i+ZQLlfeBMOjq14lu8oLRqcZ6Fx5Am0uuh+/PHClWZ/JX5suC0Kb81+aBHg2QTsLoB6zdUrRpaqa0CUxTDoGw8tpo8m6zLWvSggpYLAuRgTYqBZ0lVK1QxAi9+qVJQ5AIhYwSPrf2oq/Mpq4tFGUoG/tzM=,iv:8JqAeBVYnZM8A+CPAlKN+6SDty0XQ4AKEBJLGV8Q738=,tag:CQXE5QsfJMiI7UQoCfE3dQ==,type:str]
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -19,38 +19,38 @@ sops:
        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQTUEycms3ZkdMd3hpcXJz
-            R2pZZEc5STZ3dUdYbUdsSGJaRWI5TWNMK1RRCjVxR1pzY0ZVUmcwSjJFYktteWoz
-            YmlaVkFPRnZha3h5ckV1TVQyVWZKdGMKLS0tIFgvdWF5VEJwTTcwdXZ6SDRMU3BL
-            V2x6NlhyY0pmUVBsYmZITjArdjJRbEkKvzsJxs5EHR0uumwhZ36MhKuMS+WkogXU
-            nSVRQoc5TClzYwShY1ltHK+LCl0DlB4xFoMiO4GWwH1TySKe/ywpUQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCWm1RTldOekErU3pxcEpP
+            dWducG4vTGpuYkhlZDY2a1lLemRFaW9uNFRNCnNtRExLbVBXUVBXRjhhMW1NcjR2
+            dkR1MFBPdDhPMldaYzk2V2pYQjZWeHMKLS0tIFc3RDhLVXdtaC82RUpPWnVGdjc3
+            d2JyM043WFJSL0grR0FheldHdWFSTXMKxf4LZ1sKH+HKKCT4w8AmKk+DtVoSobtn
+            20acQeJsbuAng+/DIQccPSp//3+3YkfsBRfSGg90vQPNKzxxNmrY1Q==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnQytNaUs1M0hiYi8vdDUx
-            V1NtZ3VGNFVjRHRWUzliR3M3Q2Z6K3RWSHo4ClQ1RE1PeHJ4REpubVJHb0lJcGJ2
-            SEFvT2YvNWhMc2lneWR5NmRYc2pzVE0KLS0tIGxkRWRRRTNtVDUzVXh2L0lEa3RK
-            YjFSUDJHUjFUeVBFbUlKOS8ya1ZhMW8KssRH3/XT1iCVgV+6Sh25Axp0c96aHtVX
-            /HXN3AwTm0GJZCQnZsVIIPtoCzhUZSza+bzGZIZODYtgtCIxtdzVSw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmSTA4Yk5TbmIyVzJWb3h1
+            bEFsb0l0Uk5jVDdvL0hMdlBFUzBJdTA3bEZvCmRMRmdyM3lieDVGVDZ0bjRpSngz
+            c0FqNjRWN29zdzFsRnhtcEhUeEtwb1EKLS0tIEkwcVdpWmhKZEVZM052WU16aXZi
+            UjFxUlExazVhc1hkcmZuT0ZadG1pTmcKADLIwbz9KlPgTrs3kxeWEgKsfh9K9Qyp
+            +PSLBc8OjORDBBqqRcFJ3D9paiqppegGAPKaZ9INCXVoWke+wEOL3g==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbkZpZFJCY21IRkJjNkRB
-            UEdEVlZhRWhRb1ZDMjJtMmpkUmpnY3ZvMGlFCnBLcHlkMWNyMy8wenYwT2pmRTZL
-            dWtiWFlaR1FrL21HQTFZM2N3a3BHYW8KLS0tIFlYZWVHb0VEeDU5NnRjbDk5M2po
-            K0xRRFhua09DRE04WUd6NlZuQldFbEEK2OgiawCbCtbrk8l45QdjVu8+VNWbrl4i
-            3U9iwek30JkQSZaWBXaCZlWLvbKNjIMpwTtxDOhxmu4DUh3Hx6In/g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSM2h6Rkp3T1c3UTJXVGEw
+            ZHJJNndrUGdtVnZNOWJobzZFb2U5d09LekJzCm5mSUd6V05BUUZpMm9US2JhRUNP
+            YnZ4U1RBSUdMaHJnd2ZGNVFyT2hKeWMKLS0tIGpzUHlVU0JMbitmSzNjOWdaRFFI
+            YlJoZUVoQWFHMEg4Umo3WDZHUVppQncKL8HtEF3+uI/qm8K/u7V7IlEv8Lt0QwQv
+            SPzuq89L/aT7hK3LyB88B2pvAKE2Z1Kj/3Z3depQfujIQsulpIg1lA==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySjBmaC9rREpUQ3BvWWNU
-            MWEvM3ZGb2RXZ0dMdWxLRTJCR2VSdyt5VUhBCjBvL3MxZ3pTaFQ4aGdZVnAxUmd3
-            YUtoZkhEV01TU0drRUdDaFZ5M2tZLzAKLS0tIHpBL3NwV2NhN0QwcHdwbFpQWlZn
-            eUNjc2RPOUxLTGowTlRqN3lEdjRLU2cKTTEXmHyhnL/hZGDr8ONrmzdU6Or5xkKY
-            GHADDt+LCg8njcZom39Aj4kpCx+f7HlV65glKwr37vZ0sL9KE+O9+w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNWFNMXVsdWJKYXJaMCtM
+            NHRVeVV0d0dXQjhwTk9ZbkpINUxUTkNISXpzCjI3blp0bkZiM1pVcDBYaVkwaUVQ
+            ZTRicDhmdXpybzI1SjZSdDAyYmR1eEUKLS0tIDdUTGdvQzFXMDBMemJUMTc3MURD
+            S3FxRUI2eEg3bGs3Rjh2YXhiMnQ5eGcKAHlMDXwb1uULH+lLuWW4dMxofXSbKRMt
+            Ce/mfgDwqERw8h2yotOoSkNSFBQ2kPLu3/NeTsVAfbdSMyp/T3aJ5A==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-01-16T15:38:39Z"
    mac: ENC[AES256_GCM,data:4xaoGvLq1UIdozNqQ7v+pORVPDCk+FZRsCRvZ3C5AZOwSaM+UfDYZcI32AI0K80yFyhVIrrjqylykvXghbpQGAju3mv7+7Tbn5p2gqXrB/m1FuyVe/ftw7SSn8FTGL14cdHuPPkQTvV/u7z1IfX4YAOEGqtWiEfOe4YoWT3xc3A=,iv:dygbKjQ0ljgBPyk2aEIa/Mpbs/At+UzuhYy8Sndx/nk=,tag:jYbROlRxeDxqF1YqrBGL8A==,type:str]
--- a/secrets/wireguard.yaml
+++ b/secrets/wireguard.yaml
@@ -14,38 +14,38 @@ sops:
        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlemJmbnAwUHZHT3ozdWxH
-            Njh1ZFUvVW8zcVV6SGxrVW1IWW9ZUFBaTEh3CnJsMnFnM0d5YnBKWE5CT2Flang0
-            TkNZb0xCY2c4Qk1kdXRkRXcvOU1TSW8KLS0tIE1VdGEraW03bnV4VEc5c0ZheFJ0
-            MFJpVTlvTGJ0YXBKSnFFbXhEUEwwSmMKxOtHLbRw5e6dRW4jvqFLsl6UzKZ+mvfR
-            hwKJ4KEbXuCqwtPQEWk/pF0i4vzrgUP1Cp1Y7BxGGyK9ufyV/CCQIg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXN25MZVQzTmora3o3YjJs
+            aUptdGxJY2YxZU5XSjBjczFnTFVVdHVsRkM0CkNFN2JoelQva1ZucUxNNUJsVk9z
+            cVZVU0MxL2Y3b2dNRnhJSzZrSVlaRWcKLS0tIG1vTHB1dHNWa0RLR1BRV0hFUVdx
+            blY1QTNhUGpKZ3EzRHNadStxaCtLb1kKtyXKpZGLtrUo1HE26IWhv8245Bjcwcqe
+            IR2WGv7qtnpWZoaFv76LNN7YY1JViy2k2AY+TdLmFQr0Vh2n5+tH1A==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5cnE5VENCMUxxOVZUdC9X
-            QWFMRytGamhaWENZY1Q4STR5L0Jsdk90SlUwCis4ekFWYmMwN2dESXMrVFNIamFG
-            RzhET2ZGdGN6b1V1ZHkyOCtDNzBWVjQKLS0tIEF1NGdoU2lqYVdIN3hwRk13SFpP
-            RHNOeDBlSHFpays2VkRuR2RxaGpYZ1EKwxZfRZthZHVuJe3D5pamCSxYo3hyaaVc
-            I0UvMDMgcDRZuEzV9g1ZEYnaVXg5InyOO0dDZuCYX/HZqTLPiaOIxg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZbHVXV2hVTWZlemdCQmI0
+            SGwwK0hDYjNkWGJMMTVuWnNMVW1Ebldsd0RRCmNoN2dZN2JiSEpzUzNwcjU3eFVv
+            QmNnWERpQVByYlRqUDQrWEF4bkRPQm8KLS0tIHNOaDhQZExuOVJIVXZGQVdFeGhQ
+            QXRJRFlZWXJUVW9nVDhOaUFacjFlSzgKYSs6Woc/lAr2ECcrqoMCAwvIbXTpbtTr
+            J4ljY3BRCdSzHEMS9IFV2j9nGu8sUrHRsO7V/Kc8i+XmTGZP76LRJA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaUhOcHV2TkYrZWxnOCtI
-            TzF1RVpFY3pSa1Y2MmJjVlpKcWZnWGtOOTJ3CmRnTUpyRms2aUtvS1ZvVXFsb0ZQ
-            U0RiYXM3S0RKQjVwL2hqYllhZENUdmsKLS0tIDNTRHR2ZU1VTzdNNXRDU0xkcTRM
-            ckowd2p5bitGYVhMNU9Qc0NUeFFJV3MKPKT1/06/fKpWPOMsRaU/fpyVUf7onWGB
-            0P22NBzP1i5caqSrFnVVeyuhgYxabC4oUKVmjU5QIj1R8Rqh7gworw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlRGwzbm9rY3hXeHZReWZW
+            VngyN3ZlZDJWekExNkNBdCtLT1J6d0ZYU0hrCi9RRWNYUyt3OGh1ZVNCNWI1U3Vn
+            dnByZnVpYmV1RndKQUxHbUtrS0F5L3cKLS0tIDJONlcvMllKOWRxdE5ZWUZmaFEx
+            S1JCM2x1WDF0Z3c0ODZNb3FKOGNhMlUKGP8P/PUcMM1c4VzXLjLNp/zThu8JCiyQ
+            iHdz0LBSAha/m23b316z72yg3YD5q+/qDP8KczAv1SG+VvgHDKxpCg==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3SHdHTDhKQzFUQVdqM0hW
-            Tm9QdVozaHViQVRuTExhV1BpdWYvY012enk0CmhjODlUN0FkNldGRG94bVFSTVBv
-            QUNWZmszRStZN24vZWhnajhIcWdXVDgKLS0tIG9ueVZsT29KRE1iM2oreWtGWGVC
-            SG40OS8wMHlKNmxQa0VScHQrU2NmT2sKt9xw/8jsgnV1cZndqYNiHvIf8VdEJYCl
-            UUJ1KPz9mvUx3ny+rK50FSD61U8PHEZm2UC0w+/qkZwRtCx21Ku6dw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5Z3hyOGFJTlpxOWFQaWsx
+            WE9oYmJaaWxURjdmRlVJMUcxaUZKWDZCS1VJCmxWV01DRloyM3lLemJYc2FxcUdH
+            M1NZRGxjVUVEUExTWjFaazhRaDdCUXcKLS0tIFF6NW4vSGJSWjN3NHFlOXRUYXhM
+            NXZzQmlneDNEb1UvR2NGK0kyY1lsa1kK7IQmyuVxa2hmic4yTeiAcxN41RvMcIDV
+            Pofrhu7q8VvB/Cxb7FjVs3Ed5Hdz9xQ60mXUKsnJV/rIssm9wx4cfg==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-02-04T18:37:11Z"
    mac: ENC[AES256_GCM,data:AlrMK34dWDm5hfVwnQnzk3l8NIRbiVV6KHa6io9S9l07WvC3TYLTOJS6xOi4pkEz6sqQ7IpZU7RRdosxuQp50NmMEt2QYawTHFZIgzFYeKRbl5N5LCu9afC6yTtvG/sT7uenTMhh2qT1JBwebJiUdM9zNVUzWlW5d1SdxrHgIbs=,iv:dvqsDaC+trhY1kheYUEOEwHfCDz0Mu7N0LpfjnKko5g=,tag:tuqyK8vuwSrk1kf+Vi7MKg==,type:str]
--- a/specs/001-ai-docs/data-model.md
+++ b/specs/001-ai-docs/data-model.md
@@ -14,7 +14,7 @@

 ### Reference Map
 - **Role**: Index mapping core concerns to repo paths for navigation and validation.
- **Key Fields**: category (apps, dev, scripts, servers, services, shell, network, users, nix, patches), hosts list (emacs, server, workstation, miniserver, galaxy), secrets files, proxy rules, auto-import rules, stylix/schemes, audit checklist entries, navigation links to constitution/playbooks.
+- **Key Fields**: category (apps, dev, scripts, servers, services, shell, network, users, nix), root paths (patches), hosts list (emacs, server, workstation, miniserver, galaxy, vps), secrets files, proxy rules, auto-import rules, stylix/schemes, audit checklist entries, navigation links to constitution/playbooks.
 - **Relationships**: Anchors citations used by Constitution and Playbooks.

 ## Constraints and States
--- a/specs/001-ai-docs/research.md
+++ b/specs/001-ai-docs/research.md
@@ -29,3 +29,8 @@
 - **Decision**: Gate SOPS configuration behind `config.my.secureHost` so non-secure hosts skip secret loading.
 - **Rationale**: Aligns `config/base.nix` behavior with the constitution’s secureHost rules and avoids secret dependency on non-secure hosts.
 - **Alternatives considered**: (a) Leave SOPS enabled on all hosts (rejected: violates secureHost contract); (b) Duplicate SOPS logic per host (rejected: increases drift risk).
+
+## Decision 7 (2026-02-07): Module categories and patches location; active hosts update
+- **Decision**: Treat `patches/` as a root-level directory (not a module category) and update active hosts to include `vps`.
+- **Rationale**: Repo structure places patches at the root and hosts include `vps`; documentation must reflect actual paths and host inventory.
+- **Alternatives considered**: (a) Move `patches/` under `modules/` (rejected: would change repo layout); (b) Keep `vps` undocumented (rejected: causes host list drift).
--- a/specs/001-ai-docs/spec.md
+++ b/specs/001-ai-docs/spec.md
@@ -89,6 +89,6 @@ An AI or contributor can update the constitution and use-case docs when repo rul
 ### Measurable Outcomes

 - **SC-001**: An AI with only these docs can describe the correct steps and file locations to add a new server module in under 2 minutes of reading time, matching existing patterns.
- **SC-002**: The constitution explicitly enumerates 100% of current module categories (apps, dev, scripts, servers, services, shell, network, users, nix, patches) and active hosts (emacs, server, workstation) with their roles.
+- **SC-002**: The constitution explicitly enumerates 100% of current module categories (apps, dev, scripts, servers, services, shell, network, users, nix), documents the root `patches/` directory, and lists active hosts (emacs, server, workstation, miniserver, galaxy, vps) with their roles.
 - **SC-003**: Guidance includes the full secrets file map (certs/env/gallery/homepage/keys/wireguard/secrets) and secureHost behavior with no omissions when audited against the repository.
 - **SC-004**: Playbook locations and required fields are discoverable via the documented index in ≤2 navigation steps from the top of the spec.
--- a/specs/004-vps-migration/contracts/openapi.yaml
+++ b/specs/004-vps-migration/contracts/openapi.yaml
@@ -14,7 +14,7 @@ paths:
          description: Proxy mappings resolve to services on host server
  /verify/firewall:
    get:
-      summary: Verify iptables ruleset parity
+      summary: Verify nftables parity against the iptables reference
      responses:
        "200":
          description: Firewall flows match expected allow/deny behavior
--- a/specs/004-vps-migration/data-model.md
+++ b/specs/004-vps-migration/data-model.md
@@ -17,7 +17,7 @@

 ## FirewallRuleSet

- **Fields**: sourceFile (iptables), rules[], appliedHost
+- **Fields**: sourceFile (iptables reference), rules[], appliedHost
 - **Rules**: Ruleset must be applied as-is; no translation allowed.

 ## VPNPeer
--- a/specs/004-vps-migration/plan.md
+++ b/specs/004-vps-migration/plan.md
@@ -5,18 +5,18 @@

 ## Summary

-Migrate VPS responsibilities to the new NixOS host by making it the primary reverse-proxy host (nginx only), mirroring the existing iptables ruleset, enabling wireguard with secret-managed keys, and restoring SSH/service-user access, while keeping all services running on the host server. Provide validation steps, review historical configs for gaps, and document analytics data migration.
+Migrate VPS responsibilities to the new NixOS host by making it the primary reverse-proxy host (nginx only), mirroring the existing iptables ruleset via nftables/NixOS equivalents, enabling wireguard with secret-managed keys, and restoring SSH/service-user access, while keeping all services running on the host server. Provide validation steps, review historical configs for gaps, and document analytics data migration.

 ## Technical Context

 **Language/Version**: Nix (flakes; nixpkgs 25.11)  
-**Primary Dependencies**: NixOS modules, sops-nix, nginx, wireguard, openssh, iptables  
+**Primary Dependencies**: NixOS modules, sops-nix, nginx, wireguard, openssh, nftables (iptables reference)  
 **Storage**: Files (configuration and secrets)  
 **Testing**: Manual validation steps (no automated test harness)  
 **Target Platform**: Linux server (NixOS)  
 **Project Type**: configuration repo  
 **Performance Goals**: N/A (configuration change)  
-**Constraints**: Services remain on host server; VPS only terminates proxy and exposes wireguard port; iptables parity required  
+**Constraints**: Services remain on host server; VPS only terminates proxy and exposes wireguard port; nftables parity required  
 **Scale/Scope**: Single VPS + host server, small set of VPN peers and admin SSH principals

 ## Constitution Check
@@ -45,8 +45,8 @@ specs/004-vps-migration/
 hosts/
 modules/
 secrets/
-iptables
+iptables (reference ruleset)
 scripts/
 ```

-**Structure Decision**: Use the existing NixOS configuration layout (`hosts/`, `modules/`, `secrets/`) and the root `iptables` ruleset file.
+**Structure Decision**: Use the existing NixOS configuration layout (`hosts/`, `modules/`, `secrets/`) and the root `iptables` ruleset file as the reference for nftables parity.
--- a/specs/004-vps-migration/quickstart.md
+++ b/specs/004-vps-migration/quickstart.md
@@ -3,7 +3,7 @@
 ## Prerequisites

 - Access to this repo and the new VPS host configuration
- Existing iptables ruleset file available at repo root: `iptables`
+- Existing iptables ruleset file available at repo root (reference for nftables parity): `iptables`
 - VPN keys present in the secrets system
 - SSH public keys present in `secrets/ssh/`

@@ -19,10 +19,10 @@
 3. Update host configuration:
   - Set new VPS as primary reverse proxy host
   - Enable proxying for all enabled services (services remain on host server)
-   - Apply iptables ruleset as-is
+   - Apply nftables/NixOS firewall rules derived from the iptables reference
   - Enable wireguard on VPS and expose port
   - Add service users and admin SSH keys
-   - Update VPS public IP to `45.33.0.228` in SSH configuration
+   - Update VPS public IP to `45.79.25.87` in SSH configuration
   - Update host server VPN client to target the new VPS

 4. Provide and review legacy proxy config snapshot:
@@ -82,13 +82,13 @@
 - **T002**: verify this section exists in `/home/jawz/Development/NixOS/specs/004-vps-migration/quickstart.md`
 - **T003**: `rg -n "mainServer|enableProxy" hosts/server/toggles.nix modules/modules.nix`
 - **T004**: `rg -n "wireguard|wg0|services.wireguard" modules/services/wireguard.nix hosts/vps/configuration.nix`
- **T005**: `rg -n "vps|45.33.0.228|programs.ssh" config/jawz.nix modules/modules.nix`
+- **T005**: `rg -n "vps|45.79.25.87|programs.ssh" config/jawz.nix modules/modules.nix`
 - **T006**: `rg -n "/etc/caddy/Caddyfile.d" sudo_hist jawz_hist`
 - **T007**: `rg -n 'mainServer = "vps"' hosts/server/toggles.nix modules/modules.nix`
 - **T008**: `rg -n "enableProxy = true" hosts/vps/toggles.nix hosts/vps/configuration.nix hosts/server/toggles.nix`
 - **T009**: ensure Caddy vs Nix comparison section remains in this file
 - **T010**: `rg -n "iqQCY4iAWO-ca/pem|certPath|proxyReversePrivate" modules/network/nginx.nix modules/servers`
- **T011**: `rg -n "iptables.rules|iptables-restore|networking.firewall.enable = false" hosts/vps/configuration.nix`
+- **T011**: `rg -n "nftables|forwardPorts|vps-snat" hosts/vps/configuration.nix`
 - **T012**: `rg -n "services.wireguard.enable = true" hosts/vps/configuration.nix`
 - **T013**: confirm `wireguard/private` exists in `secrets/wireguard.yaml`
 - **T014**: `rg -n "10.77.0.1/24|10.8.0.1/24|10.9.0.1/24|AllowedIPs|allowedIPs" modules/services/wireguard.nix`
@@ -104,3 +104,4 @@
 - **T024**: verify each task from T001-T026 has a corresponding verification line in this section
 - **T025**: `rg -n "caddy|Caddy" README.org docs || true` and confirm no active-proxy references remain outside legacy migration notes
 - **T026**: `rg -n "T0[0-2][0-9]" /home/jawz/Development/NixOS/specs/004-vps-migration/tasks.md` and confirm each task mentions at least one concrete path
+- **T027**: `rg -n "modules/websites|danilo-reyes.com|blog.danilo-reyes.com|mb-report.lebubu.org" modules/websites hosts/vps/toggles.nix`
--- a/specs/004-vps-migration/research.md
+++ b/specs/004-vps-migration/research.md
@@ -8,7 +8,7 @@

 ## Decision 2: Firewall parity

- **Decision**: Apply the existing iptables ruleset as-is on the new VPS.
+- **Decision**: Use the existing iptables ruleset as the source of truth and implement equivalent nftables/NixOS rules on the new VPS.
 - **Rationale**: Ensures exact behavioral parity for complex routing and hot-swap behavior.
 - **Alternatives considered**: Translating to another firewall system; partial translation with mixed rules.

--- a/specs/004-vps-migration/spec.md
+++ b/specs/004-vps-migration/spec.md
@@ -3,7 +3,7 @@
 **Feature Branch**: `004-vps-migration`  
 **Created**: 2026-02-04  
 **Status**: Draft  
-**Input**: User description: "start feature branch 004, the git fetch command will fail, so force 004. Feature 003 added a new hosts vps, as a linode host, I want to now fully migrate my existing fedora vps to this new nixos vps. to do so I want to bring in the configurations fedora vps has. 1. right now the nginx logic of my servers is disabled, because I let the fedora vps handle the reverse proxy through caddy. But I dont want that caddy logic, on nixos I want to let nginx take care of the reverse proxies, plus the logic is already backed in, there is a isLocal logic to the factory, and I dont remember exactly the name of the code. but there is some flag under the my. options that specifies the mainHost, the constitution mentions that mainHost is the host handling nginx and because the vps will be it, then main host needs to become vps, I think before it was miniserver. This change means, that all the currently enabled servers on the toggles.nix from the host server, should have the enableProxy flag on vps (double check the logic) this should make it so, that nginx runs on vps, and the servers run on server. 2. Add a step to ask me for the caddy files, just to check that the subdomains caddy handles for each server match the subdomains on the servers/.*nix files. 3. I use iptables on the fedora vps, and the nixos vps, well I dont mind you using another firewall but there are some complex firewall rules that I need them to work 100% as the original vps, the rules will be on a file named iptables, this is perhaps the most important step, otherwise the complex network configuration this vps has wont be able to hot swap and serve my servers to the world.
+**Input**: User description: "start feature branch 004, the git fetch command will fail, so force 004. Feature 003 added a new hosts vps, as a linode host, I want to now fully migrate my existing fedora vps to this new nixos vps. to do so I want to bring in the configurations fedora vps has. 1. right now the nginx logic of my servers is disabled, because I let the fedora vps handle the reverse proxy through caddy. But I dont want that caddy logic, on nixos I want to let nginx take care of the reverse proxies, plus the logic is already backed in, there is a isLocal logic to the factory, and I dont remember exactly the name of the code. but there is some flag under the my. options that specifies the mainHost, the constitution mentions that mainHost is the host handling nginx and because the vps will be it, then main host needs to become vps, I think before it was miniserver. This change means, that all the currently enabled servers on the toggles.nix from the host server, should have the enableProxy flag on vps (double check the logic) this should make it so, that nginx runs on vps, and the servers run on server. 2. Add a step to ask me for the caddy files, just to check that the subdomains caddy handles for each server match the subdomains on the servers/.*nix files. 3. I use iptables on the fedora vps, and the nixos vps, well I dont mind you using another firewall but there are some complex firewall rules that I need them to work 100% as the original vps, the rules will be on a file named iptables (treat this as the reference ruleset for nftables parity), this is perhaps the most important step, otherwise the complex network configuration this vps has wont be able to hot swap and serve my servers to the world.

 4. modify the existing wireguard.nix module, doublecheck that isnt toggled anywhere, toggle it on vps and add this configuration to it
 [Interface]
@@ -46,7 +46,7 @@ I need you to create the service users and groups for deploy and lidarr-reports.
 in those, I need you to add ./secrets/ssh/ed25519_deploy.pub to authorized_keys for the user deploy
 and for lidarr-reports ed25519_lidarr-reports.pub

-6. similar to every other host, add ssh login authorized_keys for workstation, server, deacero, galaxy and check if Im missing one. Because this will replace the ssh vps on the ssh config, you need to replace the existing vps ip with 45.33.0.228. 7. change the configuration on the host server, so that its wireguard session, connects to this server (i think will ve done automagically when the ip changes right?) 8. Ive added sudo_hist and jawz_hist, which are a dump of the histfile of this server, just check if there is a configuration that Im missing, something I did on there that I missed, and add it to the clarification list, so when I run clarify I tell you if I want that or not, granted lots of those commands are trial and error, so I think I have everything. 9. I have setup a plausible server, write the steps necesary to migrate it, I dont know.
+6. similar to every other host, add ssh login authorized_keys for workstation, server, deacero, galaxy and check if Im missing one. Because this will replace the ssh vps on the ssh config, you need to replace the existing vps ip with 45.79.25.87. 7. change the configuration on the host server, so that its wireguard session, connects to this server (i think will ve done automagically when the ip changes right?) 8. Ive added sudo_hist and jawz_hist, which are a dump of the histfile of this server, just check if there is a configuration that Im missing, something I did on there that I missed, and add it to the clarification list, so when I run clarify I tell you if I want that or not, granted lots of those commands are trial and error, so I think I have everything. 9. I have setup a plausible server, write the steps necesary to migrate it, I dont know.

 10. add verification steps for every task we did, when youre done and"

@@ -56,7 +56,7 @@ and for lidarr-reports ed25519_lidarr-reports.pub

 - Q: Are any services being migrated to the new VPS, and what does enableProxy do? → A: No services are migrated; enableProxy only configures nginx on the VPS, wireguard exposes the port, and services continue running on the host server.
 - Q: How should the analytics service be migrated? → A: Migrate existing analytics data to the new server.
- Q: How should firewall parity be achieved on the new VPS? → A: Use the existing iptables ruleset as-is.
+- Q: How should firewall parity be achieved on the new VPS? → A: Use the existing iptables ruleset as the source of truth and implement equivalent nftables/NixOS firewall rules; document any intentional deviations.
 - Q: Where should VPN keys be stored? → A: Preserve keys only in the existing secrets system.
 - Q: Which admin hosts should receive SSH authorized_keys entries? → A: Only the listed hosts (workstation, server, deacero, galaxy).

@@ -134,7 +134,7 @@ As an operator, I want a checklist of potential missing configuration from exist
 - **FR-001**: The system MUST designate the new VPS as the primary host for reverse proxying and ensure all enabled services are routed through it without relocating the services.
 - **FR-002**: The system MUST ensure proxy configuration is enabled for all services currently enabled on the host server so traffic flows through the new VPS while services remain on the host server.
 - **FR-003**: The system MUST request existing proxy configuration files for verification and flag any subdomain mismatches against current service definitions.
- **FR-004**: The system MUST apply the existing iptables ruleset as-is on the new VPS to match the existing VPS behavior for all documented inbound and outbound flows.
+- **FR-004**: The system MUST mirror the existing iptables behavior on the new VPS using nftables/NixOS firewall rules and document any intentional deviations from the source ruleset.
 - **FR-005**: The system MUST enable the VPN configuration on the new VPS with the specified peer addresses and ensure each peer is uniquely identified.
 - **FR-006**: The system MUST support encrypting sensitive VPN keys and pause for user-provided secret material when required.
 - **FR-015**: The system MUST store VPN keys only in the existing secrets system and must not place them in plaintext configuration.
@@ -172,6 +172,6 @@ As an operator, I want a checklist of potential missing configuration from exist
 ## Assumptions

 - The existing proxy configuration files will be provided by the user for comparison.
- The firewall rules from the existing VPS are authoritative and should be mirrored on the new VPS.
+- The firewall rules from the existing VPS are authoritative and should be mirrored on the new VPS, even if implemented via nftables equivalents.
 - The list of standard admin hosts for SSH access is complete unless the review identifies an omission.
 - The analytics service migration steps are documentation-only and do not require immediate cutover.
--- a/specs/004-vps-migration/tasks.md
+++ b/specs/004-vps-migration/tasks.md
@@ -11,7 +11,7 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host

 ## Phase 1: Setup

- [x] T001 Confirm baseline files exist: iptables, secrets/ssh/ed25519_deploy.pub, secrets/ssh/ed25519_lidarr-reports.pub, secrets system entries for VPN keys
+- [x] T001 Confirm baseline files exist: iptables (reference ruleset), secrets/ssh/ed25519_deploy.pub, secrets/ssh/ed25519_lidarr-reports.pub, secrets system entries for VPN keys
 - [x] T002 Create working checklist placeholder for verification steps in /home/jawz/Development/NixOS/specs/004-vps-migration/tasks.md (this file)

 ## Phase 2: Foundational
@@ -34,11 +34,11 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host

 ## Phase 4: User Story 2 (P1) - Firewall parity

-**Story goal**: Firewall behavior on new VPS matches old VPS by applying iptables ruleset as-is.
+**Story goal**: Firewall behavior on new VPS matches old VPS by implementing nftables/NixOS rules derived from the iptables reference.

 **Independent test criteria**: Known inbound/outbound flows match existing VPS behavior.

- [x] T011 [US2] Apply iptables ruleset as-is to VPS configuration in hosts/vps/configuration.nix using the repo root iptables file
+- [x] T011 [US2] Apply firewall parity to VPS configuration using nftables/NixOS rules derived from the repo root iptables reference and document any intentional deviations

 ## Phase 5: User Story 3 (P2) - Secure access and VPN peers

@@ -54,7 +54,7 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host
 - [x] T017 [US3] Configure sshd port and auth settings in hosts/vps/configuration.nix to match: Port 3456, PermitRootLogin no, PasswordAuthentication no
 - [x] T018 [US3] Harden remote rebuild access by switching to a non-root SSH user for rebuilds (nixremote) and requiring sudo for nixos-rebuild in hosts/vps/configuration.nix and modules/users/nixremote.nix
 - [x] T019 [US3] Restrict SSH access for remote rebuilds by limiting allowed users/keys for nixremote (update inputs.self.lib.getSshKeys list in hosts/vps/configuration.nix)
- [x] T020 [US3] Update VPS IP to 45.33.0.228 in modules/modules.nix and config/jawz.nix SSH host entry
+- [x] T020 [US3] Update VPS IP to 45.79.25.87 in modules/modules.nix and config/jawz.nix SSH host entry
 - [x] T021 [US3] Update host server wireguard client configuration in hosts/server/configuration.nix to target the new VPS endpoint

 ## Phase 6: User Story 4 (P3) - Migration gaps and verification
@@ -71,6 +71,7 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host

 - [x] T025 [P] Update references to old VPS proxy logic (caddy) to ensure nginx is the only runtime proxy in README.org and docs/*.md
 - [x] T026 [P] Validate all task descriptions include explicit file paths in specs/004-vps-migration/tasks.md and update mismatches
+- [x] T027 [P] Move static site vhosts (portfolio/blog and mb-report) into modules/websites and enable them via host toggles

 ## Dependencies

@@ -79,7 +80,7 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host
 ## Parallel Execution Examples

 - US1: T007, T008, T009 can proceed once T003 and T006 are reviewed.
- US2: T011 can proceed once iptables application location is identified.
+- US2: T011 can proceed once the iptables reference ruleset location is identified.
 - US3: T012, T016, T017, T018, and T020 can proceed after T004 and T005 review; T013 depends on user-provided secrets.
 - US4: T022, T023, T024 can proceed independently once logs are reviewed and quickstart.md is open.
Author	SHA1	Message	Date
Danilo Reyes	2910dcb3ef	emacs main repo parity Some checks are pending Weekly NixOS Build & Cache / build-and-cache (push) Has started running Details	2026-02-09 18:47:49 -06:00
Danilo Reyes	8d62cffc8e	linode builds both image and host Some checks failed MCP Tests / mcp-tests (push) Successful in 23s Details Weekly NixOS Build & Cache / build-and-cache (push) Failing after 9m18s Details	2026-02-09 00:13:59 -06:00
Danilo Reyes	7670f2fa94	time for mcp to build	2026-02-08 23:33:15 -06:00
Danilo Reyes	b5c7024ea4	test....... All checks were successful MCP Tests / mcp-tests (push) Successful in 15s Details	2026-02-08 15:15:02 -06:00
Danilo Reyes	6d29835303	...5 Some checks failed MCP Tests / mcp-tests (push) Failing after 13s Details	2026-02-08 15:11:59 -06:00
Danilo Reyes	67119653b5	...4 Some checks failed MCP Tests / mcp-tests (push) Failing after 10s Details	2026-02-08 15:09:34 -06:00
Danilo Reyes	f95cf4a546	...3 Some checks failed MCP Tests / mcp-tests (push) Failing after 9s Details	2026-02-08 15:08:11 -06:00
Danilo Reyes	dc94b8fc44	...2 Some checks failed MCP Tests / mcp-tests (push) Failing after 10s Details	2026-02-08 15:07:22 -06:00
Danilo Reyes	b46e2a6269	... Some checks failed MCP Tests / mcp-tests (push) Failing after 4s Details	2026-02-08 15:06:13 -06:00
Danilo Reyes	fc62d7ab32	paths monitored Some checks failed MCP Tests / mcp-tests (push) Failing after 12s Details	2026-02-08 15:04:47 -06:00
Danilo Reyes	e0aa2b337e	cicd fix	2026-02-08 15:00:30 -06:00
Danilo Reyes	4fb24672bf	test temp dir Some checks failed MCP Tests / mcp-tests (push) Failing after 6s Details	2026-02-08 14:59:03 -06:00
Danilo Reyes	81318b3fb1	mcp test Some checks failed MCP Tests / mcp-tests (push) Failing after 16s Details	2026-02-08 14:54:30 -06:00
Danilo Reyes	ae1f68b105	atticd nginx	2026-02-08 14:44:21 -06:00
Danilo Reyes	b7a38d7634	fixing emacs daemon	2026-02-07 22:04:33 -06:00
Danilo Reyes	6cd22f0448	punk theme All checks were successful Build All Color Schemes / build-schemes (push) Successful in 1h1m21s Details	2026-02-07 20:44:51 -06:00
Danilo Reyes	9c73be46ac	discord upgrades	2026-02-07 13:26:02 -06:00
Danilo Reyes	293f0a3096	ipv6 crashes synapse	2026-02-07 04:25:43 -06:00
Danilo Reyes	d8606ad2ed	isso didnt need ip override Some checks failed MCP Tests / mcp-tests (push) Failing after 7s Details	2026-02-06 23:03:31 -06:00
Danilo Reyes	7671ec686f	documentation audit	2026-02-06 22:58:20 -06:00
Danilo Reyes	5ed2ece05c	isso and microbin migrated	2026-02-06 22:51:54 -06:00
Danilo Reyes	2b1424cfd2	piracy ports for vpn	2026-02-06 22:33:03 -06:00
Danilo Reyes	661629924e	nextcloud nginx fixes	2026-02-06 22:23:16 -06:00
Danilo Reyes	d7191f7a02	websockets	2026-02-06 21:38:25 -06:00
Danilo Reyes	480c9a2a07	new readme	2026-02-06 20:09:52 -06:00
Danilo Reyes	5e2e2ab29b	ill kick a baby	2026-02-06 20:04:34 -06:00
Danilo Reyes	b36c452c3a	it works!	2026-02-06 19:51:04 -06:00
Danilo Reyes	95c6cefd24	new wireguard connections Some checks failed MCP Tests / mcp-tests (push) Failing after 5s Details	2026-02-06 19:22:36 -06:00
Danilo Reyes	a8dda9d32d	playbook	2026-02-06 19:18:37 -06:00
Danilo Reyes	7a5f577806	dnscrypt listening subnets	2026-02-06 18:40:31 -06:00
Danilo Reyes	a7482ee146	fix	2026-02-06 12:19:38 -06:00
Danilo Reyes	5382bf7251	vps known_host for lidarr_mb_gap	2026-02-06 11:49:43 -06:00
Danilo Reyes	ead7e5a379	re-encrypted sops	2026-02-06 11:07:42 -06:00
Danilo Reyes	416e8a4edc	new disk uuids for vps	2026-02-06 11:00:24 -06:00
Danilo Reyes	2da1278b37	production ip	2026-02-06 09:24:14 -06:00
Danilo Reyes	60ccc776de	redundant port assignation	2026-02-06 09:22:09 -06:00
Danilo Reyes	f7bef14c19	Merge pull request '004-vps-migration' (#5 ) from 004-vps-migration into main Some checks failed MCP Tests / mcp-tests (push) Failing after 2s Details Reviewed-on: #5	2026-02-06 09:20:18 -06:00
Danilo Reyes	ed85b66017	Merge branch 'main' into 004-vps-migration Some checks failed MCP Tests / mcp-tests (pull_request) Failing after 2s Details	2026-02-06 09:20:02 -06:00
Danilo Reyes	a2cb88c970	knownhosts for lidarr-mb-gap Some checks failed MCP Tests / mcp-tests (pull_request) Failing after 2s Details	2026-02-06 09:11:21 -06:00
Danilo Reyes	b7ce1866d0	tmp files and lidarr-mb-gap	2026-02-06 08:59:44 -06:00
Danilo Reyes	6d5422f447	nginx fixes	2026-02-06 08:27:58 -06:00
Danilo Reyes	41298f0980	oops	2026-02-06 08:24:40 -06:00
Danilo Reyes	b7c4e38148	doc remediation	2026-02-06 08:22:40 -06:00
Danilo Reyes	005addff1b	create www-data	2026-02-06 08:21:24 -06:00
Danilo Reyes	17cd7ba593	websites init + docu revision	2026-02-06 08:13:37 -06:00
Danilo Reyes	893bb199b1	temp disable lidarr-mb-gap	2026-02-06 07:50:46 -06:00
Danilo Reyes	44e39fda6c	plausible ip	2026-02-06 07:44:31 -06:00
Danilo Reyes	229b989902	format document	2026-02-06 07:26:26 -06:00
Danilo Reyes	00a43a5a48	subnet parameters	2026-02-06 07:16:22 -06:00
Danilo Reyes	788ea5ad26	rules fixup	2026-02-06 06:59:59 -06:00
NixOS Builder Bot	ef9a11d76b	Weekly flake update: 2026-02-06 11:02 UTC	2026-02-06 05:02:07 -06:00
Danilo Reyes	542fd2485c	further declare nextcloud port All checks were successful Weekly NixOS Build & Cache / build-and-cache (push) Successful in 1h31m31s Details	2026-02-05 04:59:23 -06:00
Danilo Reyes	b8ab2171dc	nextcloud declarativedly set port	2026-02-05 03:51:16 -06:00