emacs main repo parity

Reviewed-on: #5

.codex/config.toml

@@ -14,3 +14,8 @@ trust_level = "trusted"
 [mcp_servers.nixos-mcp]
 command = "nixos-mcp"
 cwd = "/home/jawz/Development/NixOS"
+
+[mcp_servers.nixos]
+command = "nix"
+args = ["run", "github:utensils/mcp-nixos", "--"]
+startup_timeout_sec = 300

.gitea/workflows/mcp-tests.yml

@@ -5,20 +5,30 @@ on:
     branches: [ main ]
     paths:
       - 'scripts/**'
-      - 'docs/**'
+      - 'scripts/mcp-server/**'
+      - 'parts/packages.nix'
+      - 'flake.nix'
+      - 'flake.lock'
       - '.gitea/workflows/mcp-tests.yml'
   pull_request:
     paths:
       - 'scripts/**'
-      - 'docs/**'
+      - 'scripts/mcp-server/**'
+      - 'parts/packages.nix'
+      - 'flake.nix'
+      - 'flake.lock'
       - '.gitea/workflows/mcp-tests.yml'
 
 jobs:
   mcp-tests:
     runs-on: nixos
+    defaults:
+      run:
+        working-directory: ${{ github.workspace }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Run MCP lint/format/tests via nix-shell
-        run: ./scripts/mcp-server/run-tests.sh
+        run: |
+          nix run .#mcp-tests

.sops.yaml

@@ -2,7 +2,7 @@ keys:
   - &devkey age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
   - &workstation age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
   - &server age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
-  - &vps age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+  - &vps age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
 creation_rules:
   - path_regex: secrets/secrets.yaml$
     key_groups:

AGENTS.md

@@ -7,7 +7,7 @@ Auto-generated from feature plans. Last updated: 2026-01-30
 - None (in-memory tool definitions; filesystem access for repo interactions) (002-mcp-server)
 - Nix (flakes; nixpkgs 25.11) + nixpkgs, flake-parts, sops-nix (003-vps-image-migration)
 - N/A (configuration repo) (003-vps-image-migration)
-- Nix (flakes; nixpkgs 25.11) + NixOS modules, sops-nix, nginx, wireguard, openssh, iptables (004-vps-migration)
+- Nix (flakes; nixpkgs 25.11) + NixOS modules, sops-nix, nginx, wireguard, openssh, nftables (004-vps-migration)
 - Files (configuration and secrets) (004-vps-migration)
 
 - Documentation set (AI-facing constitution and playbooks) in Markdown (001-ai-docs)

README.org

@@ -6,198 +6,72 @@
 
 * Overview
 
-This repository contains my personal NixOS configuration flake, managing
-multiple hosts with a modular approach. Designed the configuration for a
-self-hosted infrastructure with services and development environments.
+This repository is a NixOS configuration flake with a local MCP server
+(`nixos-mcp`) that helps Codex CLI work with the repo’s documentation and
+maintenance workflows. The README focuses on how to use the MCP server and
+how the repo is structured.
 
-* Architecture
+* MCP Server (nixos-mcp)
 
-** Hosts
-- =workstation= :: Main development machine with GNOME desktop
-- =server= :: Primary server with containerized services
-- =miniserver= :: Secondary server for additional services
-- =galaxy= :: Minimal configuration host
-- =emacs= :: Development VM for Emacs configuration
+** What it is
+Local-only MCP server that exposes repo documentation helpers over stdio so
+Codex CLI can read the constitution, playbooks, and reference map without
+manual navigation.
 
-** Key Features
-- Modular configuration system
-- SOPS-based secrets management
-- Container orchestration with Podman
-- Automated builds and caching
-- Multi-language development environments
-- Self-hosted service stack
+** Tool Catalog
+- =show-constitution= :: Open =docs/constitution.md=
+- =list-playbooks= :: List =docs/playbooks/=
+- =show-reference= :: Open =docs/reference/index.md=
+- =search-docs= :: Search the docs set
+- =list-mcp-tasks= :: Show MCP tasks from =specs/002-mcp-server/tasks.md=
+- =sync-docs= :: Check tool catalog vs. docs anchors
 
-* Quick Start
-
-** Prerequisites
-- NixOS 23.05 or later
-- SOPS configured with age keys
-- SSH keys for remote builds
-
-** Initial Setup
+** Quick Start (new users)
 #+BEGIN_SRC bash
-# Clone the repository git clone <repository-url> /home/jawz/Development/NixOS
-cd /home/jawz/Development/NixOS
+# Enter the MCP dev shell (includes codex + nixos-mcp)
+nix develop .#mcp
 
-# Install dependencies nix flake update
-
-# Build and switch to configuration sudo nixos-rebuild switch --flake
-.#<hostname>
+# Run the MCP server (stdio mode)
+nixos-mcp
 #+END_SRC
+Configure Codex CLI to use a local stdio MCP endpoint and allowlist
+=nixos-mcp= in =.codex/requirements.toml=. The dev shell sets
+=CODEX_HOME=.codex= for a repo-local Codex config.
 
-** Development Environment
-#+BEGIN_SRC bash
-# Enter development shell for specific language nix develop .#<language>
+** Reference
+Detailed invocation notes live in =docs/reference/mcp-server.md=.
 
-# Available languages: python, rust, go, haskell, javascript, julia, zig, sh,
-cc, nix
-#+END_SRC
+* Repository Structure
 
-* Configuration Structure
+** Docs and Guidance
+- =docs/constitution.md= :: AI constitution (authoritative rules)
+- =docs/reference/index.md= :: Reference map
+- =docs/reference/mcp-server.md= :: MCP server reference
+- =docs/playbooks/= :: Repeatable workflows
+- =specs/002-mcp-server/= :: MCP feature plan + tasks
 
-** Core Configuration
-- =config/base.nix= :: Common system configuration
-- =config/jawz.nix= :: User and SSH configuration
-- =config/stylix.nix= :: Theming configuration
-- =config/schemes.nix= :: Color scheme definitions
+** MCP Server
+- =scripts/mcp-server/= :: Python MCP server implementation, tests, and CLI
+- =modules/dev/mcp.nix= :: Dev shell and optional global install
 
-** Host Configurations
-- =hosts/<hostname>/configuration.nix= :: Host-specific settings
-- =hosts/<hostname>/hardware-configuration.nix= :: Hardware-specific config
-- =hosts/<hostname>/toggles.nix= :: Feature toggles
+** Flake Parts
+- =parts/core.nix= :: Shared library + base composition
+- =parts/hosts.nix= :: Host definitions
+- =parts/packages.nix= :: Package outputs
+- =parts/devshells.nix= :: Dev shells (including MCP)
 
-** Modules
-- =modules/apps/= :: Application packages and configurations
-- =modules/dev/= :: Development environment modules
-- =modules/servers/= :: Self-hosted service configurations
-- =modules/services/= :: System service configurations
-- =modules/scripts/= :: Custom scripts and utilities
-- =modules/shell/= :: Shell and terminal configurations
+* Flake Inputs (high level)
 
-* Services
-
-** Core Services
-- PostgreSQL 17 :: Database backend
-- Nginx :: Reverse proxy and web server
-- Podman :: Container runtime
-- Syncthing :: File synchronization
-- WireGuard :: VPN connectivity
-
-** Self-Hosted Applications
-- Nextcloud :: File sharing and collaboration
-- Gitea :: Git repository hosting
-- Jellyfin :: Media server
-- Plex :: Media streaming
-- Sonarr/Radarr/Lidarr :: Media management
-- Vaultwarden :: Password manager
-- Homepage :: Service dashboard
-- And more...
-
-* Development
-
-** Available Development Shells
-The configuration provides development shells for my favorite programming
-languages:
-
-#+BEGIN_SRC bash
-# Python development nix develop .#python
-
-# Rust development   nix develop .#rust
-
-# Go development nix develop .#go
-
-# JavaScript/Node.js development nix develop .#javascript
-
-# Haskell development nix develop .#haskell
-
-# Julia development nix develop .#julia
-
-# Zig development nix develop .#zig
-
-# Shell scripting nix develop .#sh
-
-# C/C++ development nix develop .#cc
-
-# Nix development nix develop .#nix
-#+END_SRC
-
-** Adding New Modules
-1. Create module file in appropriate directory under =modules/=
-2. Add module to =modules/modules.nix= if needed
-3. Enable module in host configuration or toggles
-
-** Adding New Hosts
-1. Create host directory under =hosts/<hostname>/
-2. Add =configuration.nix= and =hardware-configuration.nix=
-3. Add host to =flake.nix= outputs
-4. Create =toggles.nix= for feature management
-
-* Secrets Management
-
-** SOPS Configuration
-Manage secrets using SOPS with age encryption:
-
-- =secrets/secrets.yaml= :: Main secrets file
-- =secrets/keys.yaml= :: SSH and encryption keys
-- =secrets/env.yaml= :: Environment variables
-- =secrets/wireguard.yaml= :: VPN configuration
-- =secrets/certs.yaml= :: SSL certificates
-
-** Adding New Secrets
-#+BEGIN_SRC bash
-# Edit secrets file sops secrets/secrets.yaml
-
-# Add new secret sops -i -a 'new-secret: "value"' secrets/secrets.yaml
-#+END_SRC
-
-* CI/CD
-
-** GitHub Actions
-The repository includes automated workflows:
-
-- =weekly-build-cache.yml= :: Weekly builds and cache updates
-- =build-schemes.yml= :: Color scheme builds
-
-** Build Cache
-Builds are automatically cached using Atticd for faster rebuilds.
-
-
-* Customization
-
-** Theming
-The configuration uses Stylix for theming. Define color schemes in
-=config/schemes.nix= and can set them via the =config/stylix.nix= file.
-
-** Adding New Services
-1. Create service module in =modules/servers/=
-2. Add service configuration
-3. Enable service in host toggles
-4. Add to homepage if needed
-
-** Custom Scripts
-Scripts are in =modules/scripts/= and toggle them per host.
-
-* Troubleshooting
-
-** Common Issues
-
-*** Build Failures
-- Check flake inputs are up to date: =nix flake update=
-- Verify all required secrets are present
-- Check host-specific configuration
-
-*** Service Issues
-- Check service status: =systemctl status <service>=
-- View logs: =journalctl -u <service>=
-- Verify firewall rules
-
-*** Development Environment
-- Rebuild development shell: =nix develop .#<language>=
-- Check available packages: =nix search nixpkgs <package>=
-
-** Getting Help
-- Check NixOS documentation
-- Review module documentation
+** Core Inputs
+- =nixpkgs= (25.11) and =nixpkgs-small= (25.11-small)
+- =nixpkgs-unstable= (rolling)
+- =flake-parts= (structure)
+- =home-manager= (user configs)
+- =stylix= (theming)
+- =sops-nix= (secrets integration)
+- =nur=, =nix-gaming=, =hyprland= (extra packages)
+- Content inputs: =wallpapers=, =fonts=, =qbit_manage=
+- Repo inputs: =jawz-scripts=, =prem2resolve=, =lidarr-mb-gap=
 - Check service-specific documentation
 
 * Maintenance

caddy/Caddyfile

@@ -1,36 +0,0 @@
-# The Caddyfile is an easy way to configure your Caddy web server.
-#
-# https://caddyserver.com/docs/caddyfile
-
-
-# The configuration below serves a welcome page over HTTP on port 80.  To use
-# your own domain name with automatic HTTPS, ensure your A/AAAA DNS record is
-# pointing to this machine's public IP, then replace `http://` with your domain
-# name.  Refer to the documentation for full instructions on the address
-# specification.
-#
-# https://caddyserver.com/docs/caddyfile/concepts#addresses
-http:// {
-
-    # Set this path to your site's directory.
-    root * /usr/share/caddy
-
-    # Enable the static file server.
-    file_server
-
-    # Another common task is to set up a reverse proxy:
-    # reverse_proxy localhost:8080
-
-    # Or serve a PHP site through php-fpm:
-    # php_fastcgi localhost:9000
-
-    # Refer to the directive documentation for more options.
-    # https://caddyserver.com/docs/caddyfile/directives
-
-}
-
-
-# As an alternative to editing the above site block, you can add your own site
-# block files in the Caddyfile.d directory, and they will be included as long
-# as they use the .caddyfile extension.
-import Caddyfile.d/*.caddyfile

caddy/Caddyfile.d/10-nextcloud.caddyfile

@@ -1,20 +0,0 @@
-cloud.lebubu.org cloud.rotehaare.art {
-	redir /.well-known/carddav /remote.php/dav/ 301
-	redir /.well-known/caldav /remote.php/dav/ 301
-	reverse_proxy 10.77.0.2:8081 {
-		header_up Host {upstream_hostport}
-		header_up X-Real-IP {remote_host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-	}
-
-	header {
-		X-Frame-Options "SAMEORIGIN"
-		X-Content-Type-Options "nosniff"
-		X-Permitted-Cross-Domain-Policies "none"
-		X-XSS-Protection "1; mode=block"
-		Referrer-Policy "no-referrer-when-downgrade"
-		Strict-Transport-Security "max-age=15552000; includeSubDomains"
-		-Server
-	}
-}

caddy/Caddyfile.d/15-private.caddyfile

@@ -1,18 +0,0 @@
-(secure_mtls) {
-	tls {
-		client_auth {
-			mode require_and_verify
-			trusted_ca_cert_file /etc/caddy/client_ca.pem
-		}
-	}
-}
-
-home.lebubu.org, indexer.lebubu.org, xxx.lebubu.org {
-	import secure_mtls
-
-	@home host home.lebubu.org
-	@indexer host indexer.lebubu.org
-
-	reverse_proxy @home 10.77.0.2:8082
-	reverse_proxy @indexer 10.77.0.2:9696
-}

caddy/Caddyfile.d/15-private.caddyfile__

@@ -1,29 +0,0 @@
-(oauth2_common) {
-	@oauth2path path /oauth2/*
-	handle @oauth2path {
-		reverse_proxy 10.77.0.2:4180
-	}
-
-	handle {
-		forward_auth 10.77.0.2:4180 {
-			uri /oauth2/auth
-			copy_headers X-Auth-Request-User X-Auth-Request-Email
-		}
-	}
-}
-
-auth-proxy.lebubu.org {
-	reverse_proxy 10.77.0.2:4180
-}
-
-home.lebubu.org, indexer.lebubu.org, xxx.lebubu.org {
-	import oauth2_common
-	@home host home.lebubu.org
-	@indexer host indexer.lebubu.org
-	@xxx host xxx.lebubu.org
-	handle {
-		reverse_proxy @home 10.77.0.2:8082
-		reverse_proxy @indexer 10.77.0.2:9696
-		reverse_proxy @xxx 10.77.0.2:9999
-	}
-}

caddy/Caddyfile.d/20-servers.caddyfile

@@ -1,79 +0,0 @@
-analytics.lebubu.org {
-	reverse_proxy 10.77.0.2:8439
-}
-
-cache.lebubu.org {
-	reverse_proxy 10.77.0.2:2343
-}
-
-audiobooks.lebubu.org {
-	reverse_proxy 10.77.0.2:5687
-}
-
-mealie.lebubu.org {
-	reverse_proxy 10.77.0.2:9925
-}
-
-git.lebubu.org {
-	reverse_proxy 10.77.0.2:9083
-}
-
-subs.lebubu.org {
-	reverse_proxy 10.77.0.2:6767
-}
-
-collabora.lebubu.org {
-	reverse_proxy 10.77.0.2:9980
-}
-
-library.lebubu.org {
-	reverse_proxy 10.77.0.2:5000
-}
-
-music.lebubu.org {
-	reverse_proxy 10.77.0.2:8686
-}
-
-maloja.lebubu.org {
-	reverse_proxy 10.77.0.2:42010
-}
-
-copy.lebubu.org {
-	reverse_proxy 10.77.0.2:8086
-}
-
-scrobble.lebubu.org {
-	reverse_proxy 10.77.0.2:9078
-}
-
-plex.lebubu.org plex.rotehaare.art {
-	reverse_proxy 10.77.0.2:32400
-}
-
-movies.lebubu.org {
-	reverse_proxy 10.77.0.2:7878
-}
-
-laters.lebubu.org {
-	reverse_proxy 10.77.0.2:9546
-}
-
-links.lebubu.org {
-	reverse_proxy 10.77.0.2:3000
-}
-
-tracker.lebubu.org {
-	reverse_proxy 10.77.0.2:8765
-}
-
-series.lebubu.org {
-	reverse_proxy 10.77.0.2:8989
-}
-
-vault.lebubu.org {
-	reverse_proxy 10.77.0.2:8222
-}
-
-bajameesta.lebubu.org {
-	reverse_proxy 10.77.0.2:8881
-}

caddy/Caddyfile.d/25-static.caddyfile

@@ -1,98 +0,0 @@
-(hugo_common) {
-	encode zstd gzip
-
-	header {
-		X-Frame-Options "SAMEORIGIN"
-		X-Content-Type-Options "nosniff"
-		X-XSS-Protection "1; mode=block"
-		Referrer-Policy "strict-origin-when-cross-origin"
-		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-	}
-
-	@static {
-		path *.jpg *.jpeg *.png *.gif *.ico *.css *.js *.svg *.woff *.woff2 *.ttf *.xml
-	}
-
-	handle @static {
-		file_server
-		header {
-			Cache-Control "public, max-age=31536000, immutable"
-		}
-	}
-	@html {
-		path *.html
-	}
-	handle @html {
-		file_server
-		try_files {path} {path}/ /index.html
-	}
-
-	handle {
-		file_server
-		try_files {path} {path}/ /index.html
-	}
-
-	@hidden {
-		path_regexp ^.*/\..*$
-	}
-	respond @hidden 404
-
-	handle /js/script.js {
-		rewrite * /js/script.file-downloads.hash.outbound-links.js
-		reverse_proxy https://analytics.lebubu.org {
-			header_up Host analytics.lebubu.org
-		}
-	}
-
-	handle /api/event {
-		reverse_proxy https://analytics.lebubu.org {
-			header_up Host analytics.lebubu.org
-		}
-	}
-}
-
-www.danilo-reyes.com {
-	redir https://danilo-reyes.com{uri}
-}
-
-www.blog.danilo-reyes.com {
-	redir https://blog.danilo-reyes.com{uri}
-}
-
-danilo-reyes.com {
-	root * /var/www/html/portfolio
-	import hugo_common
-}
-
-blog.danilo-reyes.com {
-	route {
-		handle_path /isso* {
-			reverse_proxy 10.77.0.2:8180
-		}
-		root * /var/www/html/blog
-		import hugo_common
-	}
-}
-
-mb-report.lebubu.org {
-	root * /var/www/html/lidarr-mb-gap
-	file_server
-	encode gzip zstd
-
-	try_files {path} /missing_albums.html
-
-	@html {
-		path *.html
-	}
-	header @html Content-Type "text/html; charset=utf-8"
-
-	@json {
-		path *.json
-	}
-	header @json Content-Type "application/json"
-
-	header {
-		X-Content-Type-Options "nosniff"
-		X-Frame-Options "SAMEORIGIN"
-	}
-}

caddy/Caddyfile.d/40-jellyfin.caddyfile

@@ -1,13 +0,0 @@
-flix.lebubu.org {
-	reverse_proxy 10.77.0.2:8096 {
-		header_up Host {host}
-		header_up X-Real-IP {remote_host}
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Proto {scheme}
-		header_up X-Forwarded-Host {host}
-
-		# WebSocket support (automatic in Caddy, but explicit is fine)
-		header_up Connection {>Connection}
-		header_up Upgrade {>Upgrade}
-	}
-}

caddy/Caddyfile.d/5-keycloak.caddyfile

@@ -1,9 +0,0 @@
-auth.lebubu.org {
-	tls internal
-	reverse_proxy 10.77.0.2:8090 {
-		header_up X-Forwarded-Proto https
-		header_up X-Forwarded-For {remote_host}
-		header_up X-Forwarded-Host {host}
-		header_up Host {host}
-	}
-}

caddy/Caddyfile.d/75-qbittorrent.caddyfile

@@ -1,4 +0,0 @@
-torrent.lebubu.org {
-  reverse_proxy 127.0.0.1:9345
-}
-

caddy/client_ca.pem

@@ -1,33 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFmzCCA4OgAwIBAgIUPBgrOAnSgT+y9+zaFaCuVkwi/M4wDQYJKoZIhvcNAQEL
-BQAwXTELMAkGA1UEBhMCTVgxEjAQBgNVBAgMCVNvbWVTdGF0ZTERMA8GA1UEBwwI
-U29tZUNpdHkxEDAOBgNVBAoMB0phd1pEZXYxFTATBgNVBAMMDEphd1ogUm9vdCBD
-QTAeFw0yNTA3MTYxOTMxMTBaFw0zNTA3MTQxOTMxMTBaMF0xCzAJBgNVBAYTAk1Y
-MRIwEAYDVQQIDAlTb21lU3RhdGUxETAPBgNVBAcMCFNvbWVDaXR5MRAwDgYDVQQK
-DAdKYXdaRGV2MRUwEwYDVQQDDAxKYXdaIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEB
-AQUAA4ICDwAwggIKAoICAQDwcWfnMDBzdukPZUa0pbY3tHG2ONEZMDUsxo5T5veq
-KrMfsu7U9tE8AY+AVl0Qz9hpBHN+GmktXQlimPkm4tSVKJMjk0iWYgZn8tTMB+AL
-i3gl/bt7qP+59U7gQbojkp6B0xCMCynPlsgcMiIcZWFmNVrG6ehh4B+wuG52gWVw
-TrwhDjHhxsrc66DkgC/59Pm60JqHlBhuhv9HB/q9JM3HLQ63XUwhvTVJ29tSiJZl
-WpKFr5s8nfE2FIXIHzi+o+Lo3n9wvdCzNfaRUStLWbROzF97jY4VIxIDk/loQH4T
-6oXBGlRe8M+G1XL/waRDySxL26jRVG8bUEv4mh/Hd9Rs0JcUOl6lFiGndJMjMyom
-ZgAlhi2Id2AzkT28utdYQqKUuaTy1SwLkrcOu9k2/dw7Uf7aK5WCraOth5ys+lw+
-mzga4gNGc3Am9soFHjI56Qxvhf+Aa5tlASwpzrjsc7PJEZJXorE40uZsB/q1PafP
-AIqVsSoT+Q6h6bld0EuQ5W4i1LTipZEPUaF673tGCXuI40AeTI44SFKcGm9XG1ic
-I25OxuIKyl5sCANkryOHjNKY4SkzXKSpML3PYbfSKK7xDpeFofIYKnRfJm4qmBNd
-lKT+ti4Hnvr8NZDRWyxC5SIDF1fdkslNu/HoAoL8JdXPYnitlTL7A5mF5PVPHom7
-XwIDAQABo1MwUTAdBgNVHQ4EFgQUhquhsVpNS4shC+7DMxOK4/wYYEswHwYDVR0j
-BBgwFoAUhquhsVpNS4shC+7DMxOK4/wYYEswDwYDVR0TAQH/BAUwAwEB/zANBgkq
-hkiG9w0BAQsFAAOCAgEAU8nSV6DqCZSDxWpa8JSBmZFnO2oZIRF9Nw/1QcpMOGUR
-pnWyQ03QtEgXYMwvxN/FOcGvYwg0LyYy07rzlpe5n2wRBaTrPCZ928f5j0nhADjC
-GYutxhbO4WYvBKUY88qYCrJRa1Aw1B/CsGCmH5f+aND6fyxZ6Lx9CQ8O43f+QCOE
-ltkbHRvjxYyVpDkgccDwetMDURKKrzkibUskeCPt0TjZbLKUq/cDspdAjSJgIJrz
-a50JbniKUG5Qcav3P2aA6NluOKFJfYh+146uafC6WofUtx2Vv5lViYMlIDnqN4L0
-xUzN5hB1kwF+4v1PO9/olafKqmgZ8FD/ipMYq2aYX4u9RJHLD6hMPUJpgKPRhGfi
-ul9rYv6rC+pQNIn4s287sAPru5IgIzPBBCbqXSkoue7V/mpqRuZZRX84V6CzlYDc
-0knoG2TL6aEWO+vj1mROgOuagyqyb3NZvgySE7GieW4tdvZhdYJJxdXh/tBQCg9E
-iVcQH0rNJ+0jsybFWPqdOIZ6sH78SvY+J4KhqZ3Il/WCxCTs/Ccb/RMkhRm+bfSX
-1FxoKF20b3RJ6g9N1oOj+12oK8jwMpUbaG/oAZh0TgZf1FUKic2f6jhMZLus8fGe
-nyHza9mHbN1M8d9hX7U3gkepY8RVhSNL5erNp1zsBtZ4UNmouGm53wgjYZPYkrc=
------END CERTIFICATE-----
-

config/jawz.nix

@@ -79,7 +79,6 @@ in
       "galaxy"
       "phone"
       "vps"
-      "windows_vm"
     ];
   };
 }

config/schemes.nix

@@ -116,5 +116,28 @@ in
         base0F = "#dc143c"; # crimson
       };
     };
+    punk = mkScheme {
+      color = "red";
+      polarity = "light";
+      image = "${wallpapers}/punk.jpeg";
+      base16Scheme = {
+        base00 = "#f7f3ee";
+        base01 = "#efe6dc";
+        base02 = "#e1d3c6";
+        base03 = "#c8b2a0";
+        base04 = "#a18673";
+        base05 = "#6e5646";
+        base06 = "#3f2f28";
+        base07 = "#1a1512";
+        base08 = "#c7423a";
+        base09 = "#d28b61";
+        base0A = "#c9a24c";
+        base0B = "#7d8b6a";
+        base0C = "#5f8f8a";
+        base0D = "#4f6a86";
+        base0E = "#8a5b6a";
+        base0F = "#8b5a3c";
+      };
+    };
   };
 }

config/stylix.nix

@@ -9,7 +9,7 @@ let
   schemesFile = import ./schemes.nix {
     inherit pkgs inputs;
   };
-  scheme = schemesFile.schemes.space;
+  scheme = schemesFile.schemes.punk;
   cfg = config.my.stylix;
   gnomeEnabled = config.services.desktopManager.gnome.enable;
 in

docs/constitution.md

@@ -7,7 +7,7 @@
 
 ## Repository Overview
 - Architecture: Flake-based repo using `flake-parts` with inputs for pkgs (stable/unstable), stylix, home-manager, sops-nix, and service overlays. Common modules are composed through `parts/core.nix` and `parts/hosts.nix`.
-- Module auto-import: `modules/modules.nix` auto-imports `.nix` files under `modules/apps`, `modules/dev`, `modules/scripts`, `modules/servers`, `modules/services`, `modules/shell`, and `modules/network`, excluding `librewolf.nix`. Factories live in `modules/factories/` (`mkserver`, `mkscript`), and shared options are in `modules/nix` and `modules/users`.
+- Module auto-import: `modules/modules.nix` auto-imports `.nix` files under `modules/apps`, `modules/dev`, `modules/scripts`, `modules/servers`, `modules/services`, `modules/shell`, `modules/websites`, and `modules/network`, excluding `librewolf.nix`. Factories live in `modules/factories/` (`mkserver`, `mkscript`), and shared options are in `modules/nix` and `modules/users`.
 - Hosts and toggles: Host definitions live in `hosts/<name>/configuration.nix` with host-specific toggles in `hosts/<name>/toggles.nix`. The `my` namespace carries toggles for apps/dev/scripts/services/shell, feature flags like `enableProxy` and `enableContainers`, and per-host `interfaces` and `ips` maps.
 - Main server and proxies: `my.mainServer` selects the host that should serve traffic by default (default `vps`). Reverse proxies use helpers in `parts/core.nix` (`proxy`, `proxyReverse`, `proxyReverseFix`, `proxyReversePrivate`) and pick IPs from `my.ips` plus the hostName/ip set by `mkserver` options. Nginx defaults to `proxyReverse` for any server with `enableProxy = true` unless `useDefaultProxy = false` or the server is listed in the Fix/Private proxy lists.
 - Secure hosts and secrets: `my.secureHost` gates SOPS secrets. Secure hosts load secrets from `secrets/*.yaml` and wireguard definitions; non-secure hosts (e.g., `hosts/emacs`) skip secret-dependent services. Default SOPS file is `secrets/secrets.yaml` via `config/base.nix`. Proxy-only services that need private certificates must still define their cert secrets when `enableProxy = true`.
@@ -34,6 +34,7 @@ config.services = {
 - Options: Settings under the `my` namespace (e.g., `my.services.<service>`, `my.scripts.<script>`).
 - Toggles: Enablement maps in `hosts/<name>/toggles.nix` controlling categories (apps/dev/shell/scripts/services/servers/units) and features (`enableProxy`, `enableContainers`).
 - Servers: Reverse-proxied services under `modules/servers/`, normally created with `mkserver` options (including `useDefaultProxy` to opt out of default proxyReverse).
+- Websites: Static nginx vhosts under `modules/websites/` (portfolio/blog, mb-report), gated by `my.websites.*.enableProxy`.
 - Scripts: Units defined via `mkscript` with `enable`, `install`, `service`, `users`, `timer`, and `package` fields.
 - Playbooks: Workflow guides under `docs/playbooks/` for repeatable tasks.
 - Reference map: Navigation index under `docs/reference/index.md` for paths and responsibilities.
@@ -45,8 +46,8 @@ config.services = {
 - VPS enrollment flow: The vps host generates its own key on first boot, then operators enroll the public key, re-encrypt secrets, and redeploy. Follow `docs/playbooks/enroll-vps.md`.
 
 ## Module Categories and Active Hosts
-- Module categories: apps, dev, scripts, servers, services, shell, network, users, nix, patches. Factories sit in `modules/factories/` and are imported explicitly.
-- Active hosts: `workstation`, `server`, `miniserver`, `galaxy`, `emacs`. Host roles and secure status are defined in `hosts/<name>/configuration.nix` and toggles in `hosts/<name>/toggles.nix`.
+- Module categories: apps, dev, scripts, servers, services, shell, websites, network, users, nix. Factories sit in `modules/factories/` and are imported explicitly; patch artifacts live at the repo root in `patches/`.
+- Active hosts: `workstation`, `server`, `miniserver`, `galaxy`, `emacs`, `vps`. Host roles and secure status are defined in `hosts/<name>/configuration.nix` and toggles in `hosts/<name>/toggles.nix`.
 
 ## Precedence and Conflict Resolution
 - Precedence: This constitution is authoritative for AI. Human docs must be updated to match. If conflicts are found, align human docs to the constitution and log the resolution in `specs/001-ai-docs/research.md`.

docs/playbooks/add-wireguard-peer.md

@@ -0,0 +1,25 @@
+# Playbook: Add WireGuard Peer (Friend or Guest)
+
+## When to use
+- Adding a new WireGuard peer in the friends (10.8.0.0/24) or guests (10.9.0.0/24) subnet.
+- Updating firewall rules to allow access to specific ports for that peer.
+
+## Inputs
+- Peer name (e.g., `friend5`, `guest2`)
+- Peer public key (WireGuard)
+- Peer IP address (e.g., `10.8.0.6` or `10.9.0.3`)
+- Access scope (ports/services the peer should reach)
+
+## Steps
+1. Add the peer IP to `my.ips` in `modules/modules.nix`.
+2. Add the peer to the VPS WireGuard peers list in `modules/services/wireguard.nix`.
+3. If the peer is a guest/friend, ensure `allowedIPs` includes the relevant subnets in `hosts/server/configuration.nix`.
+4. Add or adjust VPS firewall rules in `hosts/vps/configuration.nix` (`networking.firewall.extraForwardRules`) to allow the requested ports.
+5. Rebuild both hosts:
+   - `nixos-rebuild switch --flake .#vps`
+   - `nixos-rebuild switch --flake .#server`
+
+## Verification
+- On VPS: `sudo wg show`
+- On VPS: `sudo nft list ruleset | rg -n "<peer ip>|<port>"`
+- From peer: confirm access to allowed endpoints (HTTP/TCP/ICMP as defined).

docs/reference/index.md

@@ -7,16 +7,18 @@
 - servers → `modules/servers/` (reverse-proxied services built via `mkserver`)
 - services → `modules/services/` (supporting services like syncthing, wireguard)
 - shell → `modules/shell/` (shell customizations and CLI tooling)
+- websites → `modules/websites/` (static nginx vhosts for portfolio/blog and reports)
 - network → `modules/network/` (networking rules, firewall helpers)
 - users → `modules/users/` (user-related options)
 - nix → `modules/nix/` (Nix configuration and helpers)
-- patches → `patches/` (patch artifacts referenced by modules)
 - factories → `modules/factories/` (`mkserver.nix`, `mkscript.nix` shared helpers)
+## Root Directories
+- patches → `patches/` (patch artifacts referenced by modules)
 
 ## Auto-Import Rules
 - Source: `modules/modules.nix` uses `inputs.self.lib.autoImport` to load `.nix` files from module directories.
 - Filter: Excludes `librewolf.nix`; all other `.nix` files in target dirs are loaded automatically.
-- Implication: Place new modules in the correct category directory with a `.nix` filename; no manual import wiring required unless adding a new factory.
+- Implication: Place new modules in the correct category directory with a `.nix` filename; no manual import wiring required unless adding a new factory. Patch artifacts under `patches/` are not auto-imported.
 
 ## Hosts and Roles
 - Configs: `hosts/<name>/configuration.nix` with toggles in `hosts/<name>/toggles.nix`.
@@ -60,7 +62,7 @@
 - MCP server reference: `docs/reference/mcp-server.md` (tool catalog, `nixos-mcp` wrapper, invocation, sync-docs)
 
 ## Quick Audit Checklist
-- Module coverage: All categories (apps, dev, scripts, servers, services, shell, network, users, nix, patches) have corresponding entries and auto-import rules.
+- Module coverage: All categories (apps, dev, scripts, servers, services, shell, websites, network, users, nix) have corresponding entries and auto-import rules; `patches/` is documented as a root directory.
 - Host coverage: Active hosts listed with roles and secureHost status; `mainServer` noted.
 - Proxy rules: `enableProxy` usage, proxy helper selection, and `my.ips` mappings documented.
 - Secrets map: Every secrets file and secureHost gating captured; new secret types aligned to file purposes.

dotfiles/doom/init.el

@@ -43,6 +43,7 @@
        ;;neotree           ; a project drawer, like NERDTree for vim
        ophints           ; highlight the region an operation acts on
        (popup +defaults)   ; tame sudden yet inevitable temporary windows
+       (smooth-scroll +interpolate)     ; So smooth you won't believe it's not butter
        ;;tabs              ; a tab bar for Emacs
        (treemacs +lsp)         ; a project drawer, like neotree but cooler
        ;;unicode           ; extended unicode support for various languages
@@ -64,6 +65,7 @@
        ;;parinfer          ; turn lisp into python, sort of
        rotate-text       ; cycle region at point between text candidates
        snippets          ; my elves. They type so I don't have to
+       (whitespace +guess +trim)  ; a butler for your whitespace
        ;;word-wrap         ; soft wrapping with language-aware indent
 
        :emacs
@@ -71,6 +73,7 @@
        electric          ; smarter, keyword-based electric-indent
        eww ; the internet is gross
        ibuffer         ; interactive buffer management
+       tramp             ; remote files at your arthritic fingertips
        (undo +tree)              ; persistent, smarter undo for your inevitable mistakes
        vc                ; version-control and Emacs, sitting in a tree
 
@@ -96,21 +99,24 @@
        ;;ein               ; tame Jupyter notebooks with emacs
        (eval +overlay)     ; run code, run (also, repls)
        (lookup +dictionary + offline)              ; navigate your code and its documentation
+       llm               ; when I said you needed friends, I didn't mean...
        (lsp +peek)               ; M-x vscode
        magit             ; a git porcelain for Emacs
        ;;make              ; run make tasks from Emacs
        ;;pass              ; password manager for nerds
        ;;pdf               ; pdf enhancements
        ;;prodigy           ; FIXME managing external services & code builders
-       ;;terraform         ; infrastructure as code
+       (terraform +lsp)        ; infrastructure as code
        tmux              ; an API for interacting with tmux
        ;; tree-sitter       ; syntax and parsing, sitting in a tree...
        upload            ; map local to remote projects via ssh/ftp
 
        :os
        ;;(:if (featurep :system 'macos) macos) ; improve compatibility with macOS       tty               ; improve the terminal Emacs experience
+       tty               ; improve the terminal Emacs experience
 
        :lang
+       ;;ada               ; In strong typing we (blindly) trust
        ;;agda              ; types of types of types of types...
        ;;beancount         ; mind the GAAP
        (cc +lsp)         ; C > C++ == 1
@@ -139,6 +145,7 @@
        ;;hy                ; readability of scheme w/ speed of python
        ;;idris             ; a language you can depend on
        (json +lsp)              ; At least it ain't XML
+       ;;janet             ; Fun fact: Janet is me!
        ;;(java +lsp)       ; the poster child for carpal tunnel syndrome
        (javascript +lsp)       ; all(hope(abandon(ye(who(enter(here))))))
        (julia +lsp)            ; a better, faster MATLAB

dotfiles/doom/packages.el

@@ -49,15 +49,9 @@
 ;; ...Or *all* packages (NOT RECOMMENDED; will likely break things)
                                         ;(unpin! t)
 
-;; (package! nixos-options) ;; enable when migrating to nixos
-;; (package! quick-preview) ;; preview files with sushi
-
-
-;; (package! codeium :recipe (:host github :repo "Exafunction/codeium.el"))
-(package! config-general-mode)
 (package! dired-open)
 (package! dired-subtree)
-;; (package! doom-modeline-now-playing)
+(package! expand-region)
 (package! ini-mode)
 (package! insert-esv) ;; bible passages
 (package! olivetti) ;; writing mode centering text, looks like word
@@ -68,11 +62,14 @@
 (package! peep-dired) ;; kind of cool but never could make it work
 (package! php-cs-fixer)
 (package! systemd)
+;;   :recipe (:host github :repo "tecosaur/ox-chameleon"))
 ;; (package! 2048-game)
 ;; (package! academic-phrases)
 ;; (package! caddyfile-mode)
 ;; (package! clippy)
+;; (package! codeium :recipe (:host github :repo "Exafunction/codeium.el"))
 ;; (package! crontab-mode) ;; crontab colors
+;; (package! doom-modeline-now-playing)
 ;; (package! evil-tutor) ;; vim tutorial
 ;; (package! ewal) ;; theme colors based on pywal
 ;; (package! ewal-doom-themes)
@@ -81,16 +78,14 @@
 ;; (package! flycheck-aspell)
 ;; (package! ivy-posframe)
 ;; (package! mw-thesaurus)
+;; (package! nixos-options) ;; enable when migrating to nixos
 ;; (package! org-appear) ;; couldn't get it to work
 ;; (package! org-recur) ;; works but I want to keep org vanilla
 ;; (package! ox-chameleon
-;;   :recipe (:host github :repo "tecosaur/ox-chameleon"))
+;; (package! quick-preview) ;; preview files with sushi
 ;; (package! renpy)
 ;; (package! resize-window)
 ;; (package! tldr)
 ;; (package! typit) ;; type speed test
 ;; (package! vimgolf) ;; vim puzzles
 ;; (package! wc-mode) ;; displays character count of buffer
-
-(package! expand-region)
-(package! gptel :recipe (:nonrecursive t))

flake.lock

@@ -422,11 +422,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769580047,
-        "narHash": "sha256-tNqCP/+2+peAXXQ2V8RwsBkenlfWMERb+Uy6xmevyhM=",
+        "lastModified": 1770260404,
+        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "366d78c2856de6ab3411c15c1cb4fb4c2bf5c826",
+        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
         "type": "github"
       },
       "original": {
@@ -513,11 +513,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1769965155,
-        "narHash": "sha256-KAgGtueNnwLtekIh9tnmLAUDFbRxSff0OZwQwSi05Nk=",
+        "lastModified": 1770330959,
+        "narHash": "sha256-OPmJ6dBL615GGX7ENJXtJm4zeMv5uXDjmO8WB1MI5wM=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "a0ec2e4daf8e508761f6bc53fc163fbb92ac7aa1",
+        "rev": "562171ab668e7ee98a9d2bbb62a9477ad2b1e24e",
         "type": "github"
       },
       "original": {
@@ -806,11 +806,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769914377,
-        "narHash": "sha256-8wH3ZYNs36V0A3f/ikraqdoVE++BfnXg9Ql8nAuUkHw=",
+        "lastModified": 1770345361,
+        "narHash": "sha256-/kldWxogKCw1ykliO6lLwLE4aqUQ+yZOS9fHiFdI7u0=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "f7d17740ed90663b11ae907d33b3fed9fc9e15a9",
+        "rev": "2b6e7914c9ba6ad7effd53fab40d7acf34873069",
         "type": "github"
       },
       "original": {
@@ -885,11 +885,11 @@
     },
     "nixpkgs-small": {
       "locked": {
-        "lastModified": 1769983561,
-        "narHash": "sha256-Hv7yml1x0gU14H1zxGATCXb+ueeBH7DFBUTIMkLWD4A=",
+        "lastModified": 1770235692,
+        "narHash": "sha256-VvqTQ2RYZE4PUWiefJKAPKW3H4fahCbp3L8yv4c7B8s=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8dcf33716a525a7a0b6815cd8d0f4fa9b13abb1b",
+        "rev": "39dfe6111bc5b19a710bcf409a9b179688f381eb",
         "type": "github"
       },
       "original": {
@@ -901,11 +901,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1769789167,
-        "narHash": "sha256-kKB3bqYJU5nzYeIROI82Ef9VtTbu4uA3YydSk/Bioa8=",
+        "lastModified": 1770197578,
+        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "62c8382960464ceb98ea593cb8321a2cf8f9e3e5",
+        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
         "type": "github"
       },
       "original": {
@@ -917,11 +917,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1769900590,
-        "narHash": "sha256-I7Lmgj3owOTBGuauy9FL6qdpeK2umDoe07lM4V+PnyA=",
+        "lastModified": 1770136044,
+        "narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "41e216c0ca66c83b12ab7a98cc326b5db01db646",
+        "rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
         "type": "github"
       },
       "original": {
@@ -960,11 +960,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770024533,
-        "narHash": "sha256-EXQWqlbhkkune23d6xq/0bz3iyJzkVklvDsSlYE3n3Y=",
+        "lastModified": 1770368476,
+        "narHash": "sha256-myWSpD+v5TmQ47grn+gbLou1dNy5hCXvfvc6VGF72kk=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "cdb7c463555d7c6de5ba7251f9b4940249b651e8",
+        "rev": "2959831b0338e196f2d864fb5e6bb309fa1c99c1",
         "type": "github"
       },
       "original": {
@@ -1088,11 +1088,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769921679,
-        "narHash": "sha256-twBMKGQvaztZQxFxbZnkg7y/50BW9yjtCBWwdjtOZew=",
+        "lastModified": 1770145881,
+        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "1e89149dcfc229e7e2ae24a8030f124a31e4f24f",
+        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
         "type": "github"
       },
       "original": {
@@ -1122,11 +1122,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1769885983,
-        "narHash": "sha256-jLS7410B58f+3WfZ4PQ28aaaTONnmxlfAbDPdNuciLc=",
+        "lastModified": 1770308890,
+        "narHash": "sha256-7bx8Bn9B2g/loBaz+uLwdKI2rUW+RhDPyP/MqAgvrxU=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "fe06391a1e1905fc7e6c13443ea439a89695ca69",
+        "rev": "7e7fa955abac04a8e118b1cedf930a8fd41c34a6",
         "type": "github"
       },
       "original": {
@@ -1331,11 +1331,11 @@
     "wallpapers": {
       "flake": false,
       "locked": {
-        "lastModified": 1759463031,
-        "narHash": "sha256-9goyp+g9N4+9PA9V2QerTsxlVy9MA4LXufJaruj2MMs=",
+        "lastModified": 1770517108,
+        "narHash": "sha256-QYvx6j7r1ItxaaKN/wI0nGB6r5aWG46zfcoXCTOgK18=",
         "ref": "refs/heads/main",
-        "rev": "0212af5b70347f0721cfe88c25e1efb77b645a2d",
-        "revCount": 2,
+        "rev": "dcb86c4c592b8cf838a0fd6d139254619cbbd869",
+        "revCount": 3,
         "type": "git",
         "url": "https://git.lebubu.org/jawz/wallpapers.git"
       },

hosts/server/configuration.nix

@@ -67,7 +67,7 @@ in
     hostName = "server";
     firewall = {
       allowedUDPPorts = config.networking.firewall.allowedTCPPorts;
-      interfaces.wg0.allowedTCPPorts = [ 8081 ];
+      interfaces.wg0.allowedTCPPorts = [ config.my.servers.nextcloud.port ];
     };
     wireguard.interfaces.wg0 = lib.mkIf config.my.secureHost {
       ips = [ "${config.my.ips.wg-server}/32" ];
@@ -78,7 +78,9 @@ in
           endpoint = "${config.my.ips.vps}:51820";
           allowedIPs = [
             "${config.my.ips.wg-vps}/32"
-            "${config.my.ips.wg-friends}/24" # all friends
+            config.my.subnets.wg-homelab
+            config.my.subnets.wg-friends
+            config.my.subnets.wg-guests
           ];
           persistentKeepalive = 25;
         }
@@ -116,8 +118,11 @@ in
       sshKeyFile = config.sops.secrets."private_keys/lidarr-mb-gap".path;
       sshKnownHosts = {
         vps = {
-          hostNames = [ config.my.ips.vps ];
-          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMvtTURGBtAFXxxfzMJVoNJrtWLykOloJ5XYjxGh1OUx";
+          hostNames = [
+            config.my.ips.vps
+            "[${config.my.ips.vps}]:3456"
+          ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPp0wAuZXk96OyA/+2YpQalokS9lZdacjJqY9zN8IScP";
         };
       };
     };

hosts/server/toggles.nix

@@ -67,10 +67,8 @@ in
     "maloja"
     "mealie"
     "metube"
-    "microbin"
     "multi-scrobbler"
     "paperless"
-    "plausible"
     "plex"
     "postgres"
     "prowlarr"
@@ -86,10 +84,10 @@ in
   ]
   // enableList mkEnabledIp [
     "audiobookshelf"
-    "isso"
     "keycloak"
     "linkwarden"
     "oauth2-proxy"
+    "plausible"
     "vaultwarden"
   ];
 }

hosts/vps/configuration.nix

@@ -1,41 +1,132 @@
 {
   config,
   lib,
-  inputs,
   pkgs,
+  inputs,
   ...
 }:
+let
+  externalInterface = config.my.interfaces.${config.networking.hostName};
+  wgInterface = "wg0";
+  ips = {
+    homeServer = config.my.ips.wg-server;
+    wgFriend1 = config.my.ips.wg-friend1;
+    wgGuest1 = config.my.ips.wg-guest1;
+    wgGuest2 = config.my.ips.wg-guest2;
+  };
+  subnets = {
+    wgFriends = config.my.subnets.wg-friends;
+    wgGuests = config.my.subnets.wg-guests;
+    wgHomelab = config.my.subnets.wg-homelab;
+  };
+  ports = {
+    giteaSsh = 22;
+    ssh = 3456;
+    web = [
+      80
+      443
+    ];
+    wg = 51820;
+    syncthing = 22000;
+    synapseFederation = 8448;
+  };
+  portsStr = {
+    giteaSsh = toString ports.giteaSsh;
+    syncthing = toString ports.syncthing;
+    synapseFederation = toString ports.synapseFederation;
+    synapseClient = toString config.my.servers.synapse.port;
+    syncplay = toString config.my.servers.syncplay.port;
+    stash = toString config.my.servers.stash.port;
+    jellyfin = toString config.my.servers.jellyfin.port;
+    audiobookshelf = toString config.my.servers.audiobookshelf.port;
+    kavita = toString config.my.servers.kavita.port;
+  };
+in
 {
   imports = [
     ./hardware-configuration.nix
+    ./nginx-nextcloud.nix
     ../../config/base.nix
   ];
-  my = import ./toggles.nix { inherit config inputs; } // {
-    secureHost = true;
-    users.nixremote = {
-      enable = true;
-      authorizedKeys = inputs.self.lib.getSshKeys [
-        "nixworkstation"
-        "nixserver"
-        "nixminiserver"
-      ];
-    };
-  };
-  environment.etc."iptables.rules".source = ../../iptables;
-  networking.firewall.enable = lib.mkForce false;
-  networking.nftables.enable = false;
-  systemd.services.iptables-restore = {
-    description = "Apply iptables ruleset";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network-pre.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = "${pkgs.iptables}/bin/iptables-restore --wait /etc/iptables.rules";
+  my =
+    import ./toggles.nix {
+      inherit config inputs lib;
+    }
+    // {
+      secureHost = true;
+      users.nixremote = {
+        enable = true;
+        authorizedKeys = inputs.self.lib.getSshKeys [
+          "nixworkstation"
+          "nixserver"
+          "nixminiserver"
+        ];
+      };
     };
+  sops.age = {
+    generateKey = true;
+    keyFile = "/var/lib/sops-nix/key.txt";
+    sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   };
   image.modules.linode = { };
-  networking.hostName = "vps";
+  environment.systemPackages = [ ];
+  networking = {
+    hostName = "vps";
+    nat = {
+      inherit externalInterface;
+      enable = true;
+      internalInterfaces = [ "wg0" ];
+      forwardPorts = [
+        {
+          sourcePort = ports.giteaSsh;
+          proto = "tcp";
+          destination = "${ips.homeServer}:${portsStr.giteaSsh}";
+        }
+      ];
+    };
+    nftables = {
+      enable = true;
+      tables.vps-snat = {
+        family = "ip";
+        content = ''
+          chain postrouting {
+            type nat hook postrouting priority srcnat;
+            iifname "${externalInterface}" oifname "${wgInterface}" ip daddr ${ips.homeServer}/32 tcp dport ${portsStr.giteaSsh} masquerade comment "snat ssh forward"
+          }
+        '';
+      };
+    };
+    firewall = {
+      enable = true;
+      filterForward = true;
+      checkReversePath = "loose";
+      allowedTCPPorts = [ ports.ssh ] ++ ports.web;
+      allowedUDPPorts = [ ports.wg ];
+      extraForwardRules = ''
+        iifname "${wgInterface}" ip saddr ${subnets.wgFriends} ip daddr ${ips.homeServer}/32 tcp dport ${portsStr.syncthing} accept
+        iifname "${wgInterface}" ip saddr ${ips.homeServer}/32 ip daddr ${subnets.wgFriends} tcp dport ${portsStr.syncthing} accept
+
+        iifname "${wgInterface}" ip saddr ${subnets.wgFriends} ip daddr ${ips.homeServer}/32 tcp dport { ${portsStr.synapseClient}, ${portsStr.synapseFederation}, ${portsStr.syncplay} } accept
+
+        iifname "${wgInterface}" ip saddr ${subnets.wgFriends} ip daddr ${ips.homeServer}/32 icmp type echo-request accept
+        iifname "${wgInterface}" ip saddr ${ips.wgFriend1}/32 ip daddr ${ips.homeServer}/32 tcp dport ${portsStr.stash} accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgGuests} ip daddr ${ips.homeServer}/32 tcp dport { ${portsStr.stash}, ${portsStr.jellyfin}, ${portsStr.audiobookshelf}, ${portsStr.kavita} } accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgGuests} ip daddr ${ips.homeServer}/32 icmp type echo-request accept
+
+        iifname "${wgInterface}" ip saddr ${subnets.wgHomelab} ip daddr ${ips.homeServer}/32 accept
+
+        iifname "${wgInterface}" ip saddr ${subnets.wgFriends} oifname "${externalInterface}" accept
+        iifname "${wgInterface}" ip saddr ${subnets.wgGuests} oifname "${externalInterface}" accept
+
+        ip saddr ${subnets.wgFriends} ip daddr ${subnets.wgHomelab} drop
+        ip saddr ${subnets.wgHomelab} ip daddr ${subnets.wgFriends} drop
+        ip saddr ${subnets.wgGuests} ip daddr ${subnets.wgHomelab} drop
+        ip saddr ${subnets.wgHomelab} ip daddr ${subnets.wgGuests} drop
+        ip saddr ${subnets.wgGuests} ip daddr ${subnets.wgFriends} drop
+        ip saddr ${subnets.wgFriends} ip daddr ${subnets.wgGuests} drop
+      '';
+    };
+  };
   security.sudo-rs.extraRules = [
     {
       users = [ "nixremote" ];
@@ -47,29 +138,46 @@
       ];
     }
   ];
-  services.openssh.ports = [ 3456 ];
-  sops.age = {
-    generateKey = true;
-    keyFile = "/var/lib/sops-nix/key.txt";
-    sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  systemd.tmpfiles.rules = [
+    "d /var/www/html 2775 deploy www-data -"
+    "d /var/www/html/portfolio 2775 deploy www-data -"
+    "d /var/www/html/blog 2775 deploy www-data -"
+    "d /var/www/html/lidarr-mb-gap 2775 lidarr-reports lidarr-reports -"
+  ];
+  services = {
+    smartd.enable = lib.mkForce false;
+    openssh.ports = [ ports.ssh ];
   };
   users = {
     groups = {
       deploy = { };
       lidarr-reports = { };
+      www-data = { };
     };
     users = {
+      nginx = lib.mkIf config.my.secureHost {
+        extraGroups = [
+          "www-data"
+          "lidarr-reports"
+        ];
+      };
       deploy = {
         isSystemUser = true;
         group = "deploy";
+        home = "/var/lib/deploy";
+        createHome = true;
+        shell = pkgs.bashInteractive;
+        extraGroups = [ "www-data" ];
         openssh.authorizedKeys.keyFiles = [ ../../secrets/ssh/ed25519_deploy.pub ];
       };
       lidarr-reports = {
         isSystemUser = true;
         group = "lidarr-reports";
+        home = "/var/lib/lidarr-reports";
+        createHome = true;
+        shell = pkgs.bashInteractive;
         openssh.authorizedKeys.keyFiles = [ ../../secrets/ssh/ed25519_lidarr-reports.pub ];
       };
     };
   };
-  environment.systemPackages = [ ];
 }

hosts/vps/hardware-configuration.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  config,
   modulesPath,
   ...
 }:
@@ -9,7 +10,10 @@
     kernelModules = [ ];
     extraModulePackages = [ ];
     kernelParams = [ "console=ttyS0,19200n8" ];
-    kernel.sysctl."net.ipv4.conf.wg0.rp_filter" = 0;
+    kernel.sysctl = {
+      "net.ipv4.ip_forward" = 1;
+      "net.ipv4.conf.wg0.rp_filter" = 0;
+    };
     initrd.availableKernelModules = [
       "virtio_pci"
       "virtio_scsi"
@@ -30,13 +34,17 @@
     };
   };
   fileSystems."/" = {
-    device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
+    device = lib.mkForce (
+      if config.my.build.baseImage then
+        "/dev/sda"
+      else
+        "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f"
+    );
     fsType = "ext4";
   };
-  swapDevices = [
-    {
-      device = "/dev/disk/by-uuid/f1408ea6-59a0-11ed-bc9d-525400000001";
-    }
+  swapDevices = lib.mkMerge [
+    [ { device = "/dev/disk/by-uuid/f1408ea6-59a0-11ed-bc9d-525400000001"; } ]
+    (lib.mkIf config.my.build.baseImage [ { device = "/dev/sdb"; } ])
   ];
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/vps/nginx-nextcloud.nix

@@ -0,0 +1,116 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.servers.nextcloud;
+in
+{
+  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy && config.my.secureHost) {
+    services.nginx.virtualHosts.${cfg.host} = {
+      forceSSL = true;
+      enableACME = true;
+      http2 = true;
+      default = true;
+      serverAliases = [ "cloud.rotehaare.art" ];
+      extraConfig = ''
+        index index.php index.html /index.php$request_uri;
+        add_header X-Content-Type-Options nosniff always;
+        add_header X-Robots-Tag "noindex, nofollow" always;
+        add_header X-Permitted-Cross-Domain-Policies none always;
+        add_header X-Frame-Options SAMEORIGIN always;
+        add_header Referrer-Policy no-referrer always;
+        add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+      '';
+      locations = {
+        "= /robots.txt" = {
+          priority = 100;
+          extraConfig = ''
+            allow all;
+            access_log off;
+          '';
+        };
+        "= /" = {
+          priority = 100;
+          proxyPass = cfg.local;
+          proxyWebsockets = true;
+          extraConfig = ''
+            if ( $http_user_agent ~ ^DavClnt ) {
+              return 302 /remote.php/webdav/$is_args$args;
+            }
+          '';
+        };
+        "= /.well-known/carddav" = {
+          priority = 210;
+          extraConfig = ''
+            return 301 /remote.php/dav/;
+          '';
+        };
+        "= /.well-known/caldav" = {
+          priority = 210;
+          extraConfig = ''
+            return 301 /remote.php/dav/;
+          '';
+        };
+        "~ ^/\\.well-known/(?!acme-challenge|pki-validation)" = {
+          priority = 210;
+          extraConfig = ''
+            return 301 /index.php$request_uri;
+          '';
+        };
+        "^~ /.well-known" = {
+          priority = 210;
+          extraConfig = ''
+            try_files $uri $uri/ =404;
+          '';
+        };
+        "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)" = {
+          priority = 450;
+          extraConfig = ''
+            return 404;
+          '';
+        };
+        "~ ^/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
+          priority = 450;
+          extraConfig = ''
+            return 404;
+          '';
+        };
+        "~ \\.php(?:$|/)" = {
+          priority = 500;
+          proxyPass = cfg.local;
+          proxyWebsockets = true;
+          extraConfig = ''
+            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
+          '';
+        };
+        "~ \\.(?:css|js|mjs|svg|gif|ico|jpg|jpeg|png|webp|wasm|tflite|map|html|ttf|bcmap|mp4|webm|ogg|flac)$" =
+          {
+            proxyPass = cfg.local;
+            extraConfig = ''
+              expires 6M;
+              access_log off;
+            '';
+          };
+        "~ ^\\/(?:updater|ocs-provider)(?:$|\\/)" = {
+          proxyPass = cfg.local;
+          extraConfig = ''
+            try_files $uri/ =404;
+            index index.php;
+          '';
+        };
+        "/remote" = {
+          priority = 1500;
+          extraConfig = ''
+            return 301 /remote.php$request_uri;
+          '';
+        };
+        "/" = {
+          priority = 1600;
+          proxyPass = cfg.local;
+          proxyWebsockets = true;
+          extraConfig = ''
+            try_files $uri $uri/ /index.php$request_uri;
+          '';
+        };
+      };
+    };
+  };
+}

hosts/vps/toggles.nix

@@ -1,61 +1,86 @@
-{ config, inputs }:
+{
+  config,
+  inputs,
+  lib,
+}:
 let
   inherit (inputs.self.lib)
     enableList
     mkEnabled
+    mkEnabledWithProxy
     mkEnabledWithUsers
     ;
   wgServerIp = config.my.ips.wg-server;
   mkEnabledProxyIp = inputs.self.lib.mkEnabledProxyIp wgServerIp;
-in
-{
-  enableProxy = true;
-  enableContainers = true;
-  apps.dictionaries.enable = true;
-  apps.dictionaries.users = "jawz";
-  services = enableList mkEnabled [
-    "network"
-    "wireguard"
-  ];
-  shell = enableList mkEnabledWithUsers [
-    "multimedia"
-    "tools"
-  ];
-  dev = enableList mkEnabledWithUsers [
-    "nix"
-    "sh"
-  ];
-  servers = {
-    nextcloud = {
+  mkEnabledProxySocketIp = name: {
+    inherit name;
+    value = {
       enableProxy = true;
+      enableSocket = true;
       ip = wgServerIp;
-      port = 8081;
     };
-  }
-  // enableList mkEnabledProxyIp [
-    "audiobookshelf"
-    "bazarr"
-    "collabora"
-    "gitea"
-    "homepage"
-    "isso"
-    "jellyfin"
-    "kavita"
-    "keycloak"
-    "lidarr"
-    "linkwarden"
-    "maloja"
-    "mealie"
-    "metube"
-    "microbin"
-    "multi-scrobbler"
-    "oauth2-proxy"
-    "plausible"
-    "plex"
-    "prowlarr"
-    "radarr"
-    "sonarr"
-    "vaultwarden"
-    "yamtrack"
-  ];
-}
+  };
+  baseToggles = {
+    services = enableList mkEnabled [
+      "network"
+      "wireguard"
+    ];
+    shell = enableList mkEnabledWithUsers [
+      "multimedia"
+      "tools"
+    ];
+    dev = enableList mkEnabledWithUsers [
+      "nix"
+      "sh"
+    ];
+    apps.dictionaries = {
+      enable = true;
+      users = "jawz";
+    };
+  };
+  secureToggles = {
+    enableProxy = true;
+    enableContainers = true;
+    websites = {
+      portfolio.enableProxy = true;
+      lidarrMbReport.enableProxy = true;
+    };
+    servers =
+      enableList mkEnabledWithProxy [
+        "isso"
+        "microbin"
+      ]
+      // enableList mkEnabledProxySocketIp [
+        "audiobookshelf"
+        "collabora"
+        "jellyfin"
+        "nextcloud"
+        "plausible"
+        "plex"
+      ]
+      // enableList mkEnabledProxyIp [
+        "atticd"
+        "bazarr"
+        "gitea"
+        "homepage"
+        "kavita"
+        "keycloak"
+        "lidarr"
+        "linkwarden"
+        "maloja"
+        "mealie"
+        "metube"
+        "multi-scrobbler"
+        "oauth2-proxy"
+        "prowlarr"
+        "radarr"
+        "sonarr"
+        "vaultwarden"
+        "yamtrack"
+      ];
+  };
+in
+lib.mkMerge [
+  baseToggles
+  (lib.mkIf config.my.secureHost secureToggles)
+]

iptables

@@ -1,126 +0,0 @@
-# Generated by iptables-save v1.8.11 (nf_tables) on Fri Jan  2 03:44:23 2026
-*mangle
-:PREROUTING ACCEPT [95853893:179831236298]
-:INPUT ACCEPT [94316554:179510512585]
-:FORWARD ACCEPT [1536524:320567864]
-:OUTPUT ACCEPT [49857522:93072472240]
-:POSTROUTING ACCEPT [51393797:93393029789]
-COMMIT
-# Completed on Fri Jan  2 03:44:23 2026
-# Generated by iptables-save v1.8.11 (nf_tables) on Fri Jan  2 03:44:23 2026
-*raw
-:PREROUTING ACCEPT [95853893:179831236298]
-:OUTPUT ACCEPT [49857522:93072472240]
-COMMIT
-# Completed on Fri Jan  2 03:44:23 2026
-# Generated by iptables-save v1.8.11 (nf_tables) on Fri Jan  2 03:44:23 2026
-*filter
-:INPUT ACCEPT [94315678:179510353216]
-:FORWARD ACCEPT [46534:2774394]
-:OUTPUT ACCEPT [49857520:93072471971]
-
-
-# --- Incoming (INPUT) rules for VPS itself ---
-# Accept SSH on port 3456 (new SSH port)
-# allow SSH to VPS
--A INPUT -p tcp --dport 3456 -m conntrack --ctstate NEW -j ACCEPT
-
-# allow established connections (responses)
--A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-
-# (Optionally, add other INPUT rules for any services the VPS itself runs, if any, like HTTP/HTTPS if needed)
-
-# If a default DROP policy is desired on INPUT, or an explicit drop rule:
-# -A INPUT -j DROP   # (optional: lock down any other input)
-
-# --- Forwarding (FORWARD) rules for VPN traffic ---
-# allow return traffic for established sessions
--A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-
-# Syncthing between 10.8.0.2 and home server
-# 10.8.0.2 -> 10.77.0.0 Syncthing
--A FORWARD -s 10.8.0.2/32 -d 10.77.0.2/32 -p tcp --dport 22000 -j ACCEPT
--A FORWARD -s 10.8.0.3/32 -d 10.77.0.2/32 -p tcp --dport 22000 -j ACCEPT
--A FORWARD -s 10.8.0.4/32 -d 10.77.0.2/32 -p tcp --dport 22000 -j ACCEPT
--A FORWARD -s 10.8.0.5/32 -d 10.77.0.2/32 -p tcp --dport 22000 -j ACCEPT
-# home -> 10.8.0.0 Syncthing
--A FORWARD -s 10.77.0.2/32 -d 10.8.0.2/32 -p tcp --dport 22000 -j ACCEPT
--A FORWARD -s 10.77.0.2/32 -d 10.8.0.3/32 -p tcp --dport 22000 -j ACCEPT
--A FORWARD -s 10.77.0.2/32 -d 10.8.0.4/32 -p tcp --dport 22000 -j ACCEPT
--A FORWARD -s 10.77.0.2/32 -d 10.8.0.5/32 -p tcp --dport 22000 -j ACCEPT
-
-# Matrix/Synapse access from 10.8 subnet to home server
-# allow Matrix client port
--A FORWARD -s 10.8.0.0/24 -d 10.77.0.2/32 -p tcp --dport 8008 -j ACCEPT
-# allow Matrix federation port
--A FORWARD -s 10.8.0.0/24 -d 10.77.0.2/32 -p tcp --dport 8448 -j ACCEPT
-# allow TURN/other (if used)
--A FORWARD -s 10.8.0.0/24 -d 10.77.0.2/32 -p tcp --dport 8999 -j ACCEPT
-
-# ICMP between 10.8 subnet and home
-# ping home from 10.8 clients
--A FORWARD -s 10.8.0.0/24 -d 10.77.0.2/32 -p icmp -j ACCEPT
-# ping 10.8 clients from home
--A FORWARD -s 10.77.0.2/32 -d 10.8.0.0/24 -p icmp -j ACCEPT
-
-# New Friend's subnet (10.9) access rule
-# allow new subnet to access port 9999 on home
--A FORWARD -s 10.9.0.2/24 -d 10.77.0.2/32 -p tcp --dport 9999 -j ACCEPT
-# allow ping to home
--A FORWARD -s 10.9.0.2/24 -d 10.77.0.2/32 -p icmp -j ACCEPT
-# allow ping reply from home
--A FORWARD -s 10.77.0.2/32 -d 10.9.0.2/24 -p icmp -j ACCEPT
-
-# Allow VPN subnets to reach Internet (MASQUERADE will SNAT them)
-# 10.8 clients to internet
--A FORWARD -s 10.8.0.0/24 -o eth0 -j ACCEPT
-# 10.9 clients to internet
--A FORWARD -s 10.9.0.2/24 -o eth0 -j ACCEPT
-
-# Drop all other traffic between these subnets and home or between subnets (isolation)
-# drop any 10.8 -> home not allowed
--A FORWARD -s 10.8.0.0/24 -d 10.77.0.0/24 -j DROP
-# drop any home -> 10.8 not allowed
--A FORWARD -s 10.77.0.0/24 -d 10.8.0.0/24 -j DROP
-
-# drop any 10.9 -> home not allowed (except 9999/ping above)
--A FORWARD -s 10.9.0.0/24 -d 10.77.0.0/24 -j DROP
-# drop any home -> 10.9 not allowed
--A FORWARD -s 10.77.0.0/24 -d 10.9.0.0/24 -j DROP
-
-# drop 10.9 -> 10.8 (no client-to-client)
--A FORWARD -s 10.9.0.0/24 -d 10.8.0.0/24 -j DROP
-# drop 10.8 -> 10.9
--A FORWARD -s 10.8.0.0/24 -d 10.9.0.0/24 -j DROP
-
-COMMIT
-
-*nat
-:PREROUTING ACCEPT [3368888:178175988]
-:INPUT ACCEPT [3348703:174454011]
-:OUTPUT ACCEPT [30120:1902454]
-:POSTROUTING ACCEPT [32339:2018208]
-# Port forwarding (DNAT) rules:
-# forward SSH (port 22) to home server
--A PREROUTING -p tcp --dport 22 -j DNAT --to-destination 10.77.0.2:22
-# forward port 51412 to home (TCP)
--A PREROUTING -p tcp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-# forward port 51412 to home (UDP)
--A PREROUTING -p udp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-# (Remove the above 51412 rules if not used; keep 22 as it’s for Gitea’s SSH access)
-
-# Masquerade (SNAT) rules:
-# masquerade replies from home for SSH
--A POSTROUTING -d 10.77.0.2/32 -p tcp --dport 22 -j MASQUERADE
-# masquerade replies for 51412 (TCP)
--A POSTROUTING -d 10.77.0.2/32 -p tcp --dport 51412 -j MASQUERADE
-#masquerade replies for 51412 (UDP)
--A POSTROUTING -d 10.77.0.2/32 -p udp --dport 51412 -j MASQUERADE
-# (If 51412 rules removed above, remove their masquerade lines too)
-
-# NAT for 10.8.0.x clients to internet
--A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-# NAT for 10.9.0.x clients to internet
--A POSTROUTING -s 10.9.0.0/24 -o eth0 -j MASQUERADE
-
-COMMIT

jawz_hist

@@ -1,634 +0,0 @@
-exit
-cd
-ls
-ls .ssh
-ls ~/.ssh/
-ls -lag
-ls -la
-sudo chown -R jawz:jawz ./
-ls -lag
-ls -la
-ls .ssh/
-ls .ssh/ -la
-sudo systemctl enable  --now wg-quick@wg0
-sudo nano /etc/sysctl.d/99-ipforward.conf
-ls
-sudo -i
-sudo systemctl status sshd.service 
-sudo systemctl restart sshd.service 
-journalctl -xeu sshd
-sudo -i
-sudo systemctl status sshd
-sudo ss -ltnp | grep ssh
-sudo semanage port -l | grep ssh_port_t
-sudo ss -ltnp | grep 3456 || sudo ss -ltnp | grep sshd
-ping google.com
-sudo systemctl stop wg-quick@wg0.service 
-ping google.com
-sudo systemctl disable wg-quick@wg0.service
-exi
-exit
-sudo rmdir /etc/caddy/Caddyfile.d/
-sudo -i
-exit
-ls
-rm histfile 
-rm iptables*
-ls
-rm sudo_histfile 
-cat syncthingblocked 
-rm syncthingblocked 
-ls
-exit
-sudoedit /etc/wireguard/wg0.conf
-export TERM=xterm-256color
-sudoedit /etc/wireguard/wg0.conf
-sudo systemctl restart wg-quick
-sudo systemctl restart wg-quick@wg0.service 
-sudoedit /etc/wireguard/wg0.conf
-sudo -i
-sudo tcpdump
-sudo dnf install tcpdump
-sudo tcpdump -i wg0 host 10.77.0.2 -n -v
-sudoedit /etc/sysconfig/iptables
-export TERM=xterm-256color
-sudoedit /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-ping google.com
-sudo ss -ltnp | grep 3456 || sudo ss -ltnp | grep sshd
-sudo sed -n '1,200p' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf 2>/dev/null | egrep -n '^(Port|ListenAddress)'
-sudo iptables -S
-cat /etc/sysconfig/iptables
-sudo cat /etc/sysconfig/iptables
-sudo systemctl enable --now iptables
-sudo systemctl start iptables
-sudo systemctl restart iptables
-sudo iptables -S
-sudo systemctl enable wg-quick@wg0
-sudo systemctl start wg-quick@wg0
-ping google.com
-sudo -i
-sudo wg sow
-sudo wg show
-ls
-cd /etc/caddy/Caddyfile.d/
-ls
-cat fun.caddyfile__ 
-ls
-clear
-mv portfolio.caddyfile_bkp portfolio.caddyfile
-sudo mv portfolio.caddyfile_bkp portfolio.caddyfile
-sudo systemctl restart caddy
-clear
-export TERM=xterm-256color
-iptables-s
-sudo iptables -S
-sudo iptables -s
-sudo iptables -S
-clear
-cat /etc/sysconfig/iptables
-sudo cat /etc/sysconfig/iptables
-sudo -i
-sudo reboot
-exit
-ping google.com
-sudo systemctl restart iptables
-sudo systemctl enable iptables
-exit
-sudo -i
-exit
-sudo iptables -vnL FORWARD | grep 22000
-sudo -i
-sudo iptables -L FORWARD -n -v --line-numbers
-cat /etc/sysconfig/iptables
-sudo cat /etc/sysconfig/iptables
-sudoedit /etc/sysconfig/iptables
-export TERM=xterm-256color
-sudoedit /etc/sysconfig/iptables
-clear
-sudo cat /etc/sysconfig/iptables
-sudoedit /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-sudoedit /etc/sysconfig/iptables
-wg show 
-sudo wg show 
-ping -c 3 10.8.0.2
-nc -zv 10.77.0.2 22000
-sudo -i
-exit
-sudo -i
-exit
-sudo systemctl disable iptables
-sudo systemctl enable iptables
-sudo systemctl status iptables
-sudo systemctl start iptables
-sudo -i
-exit
-sudo dnf install starship
-sudo dnf copr enable atim/starship 
-sudo dnf install starship
-nano .bashrc 
-export TERM=xterm-256color
-nano .bashrc 
-bash
-exit
-nano /etc/hostname 
-export TERM=xterm-256color
-nano /etc/hostname 
-sudoedit /etc/hostname 
-exit
-sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-export TERM=xterm-256color
-sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-export EDITOR=neovim
-sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-EDITOR=neovim sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-EDITOR=nvim sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo -i
-exit
-sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-exit
-sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo -i
-exit
-export TERM=xterm-256color
-sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy
-export TERM=xterm-256color
-sudoedit /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy
-sudo -i
-exit
-sudo mkdir -p /var/www/html
-sudo mkdir -p /var/www/html/lidarr-mb-gap
-sudo useradd -m -s /bin/bash lidarr-reports
-sudo chown -R lidarr-reports:lidarr-reports /var/www/html/lidarr-mb-gap/
-exit
-sudo -u lidarr-reports bash
-exit
-sudo -u lidarr-reports 
-sudo -u lidarr-reports  bash
-sudo -i
-exit
-sudo -u lidarr-mb-gap cat /var/lib/lidarr-mb-gap/.ssh/id_ed25519.pub
-exit
-sudo -u lidarr-reports
-sudo -u lidarr-reports bash
-exit
-sudo -u lidarr-reports ssh-keygen -l -f /home/lidarr-reports/.ssh/ed25519_lidarr-mb-gap.pub
-exit
-sudo -u lidarr-reports -u bash
-sudo -u lidarr-reports bash
-exit
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-exit
-sudo dnf install rsync
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile
-sudo systemctl restart caddy.service 
-ls
-cd /var/www/html/lidarr-mb-gap/
-ls
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile
-sudo systemctl restart caddy.service 
-nc -zv 10.77.0.2 8999
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/5-keycloak.caddyfile
-sudo nvim /etc/caddy/Caddyfile.d/10-nextcloud.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/5-keycloak.caddyfile
-sudo systemctl restart caddy
-ls
-cd /etc/wireguard/
-sudo -i
-exit
-cd /etc/caddy/Caddyfile.d/
-ls
-nvim 15-private.caddyfile 
-mv 15-private.caddyfile 15-private.caddyfile_
-sudo mv 15-private.caddyfile 15-private.caddyfile_
-nvim 15-private.caddyfile 
-sudo nvim 15-private.caddyfile 
-sudo systemctl restart caddy
-exit
-cd /etc/caddy/Caddyfile.d/
-sudo nvim 15-private.caddyfile 
-sudo systemctl restart caddy
-exit
-cd /etc/caddy/Caddyfile.d/
-sudo nvim 15-private.caddyfile 
-sudo systemctl restart caddy
-sudo nvim 15-private.caddyfile 
-sudo systemctl restart caddy
-exit
-sudo nvim /etc/caddy/Caddyfile.d/5-keycloak.caddyfile
-sudo nvim /etc/caddy/Caddyfile.d/10-nextcloud.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/5-keycloak.caddyfile 
-sudo systemctl restart caddy
-sudo nvim 15-private.caddyfile 
-cd /etc/caddy/Caddyfile.d/
-sudo nvim 15-private.caddyfile 
-sudo systemctl restart caddy
-sudo nvim 15-private.caddyfile 
-cat 15-private.caddyfile
-sudo nvim 15-private.caddyfile 
-sudo systemctl restart caddy
-sudo nvim 15-private.caddyfile 
-sudo nvim 15-private.caddyfile_
-sudo nvim 15-private.caddyfile 
-sudo systemctl restart caddy
-exit
-sudo systemctl restart caddy
-sudo nvim 
-cd /etc/caddy/Caddyfile.d/
-sudo nvim 15-private.caddyfile 
-cat 15-private.caddyfile_ 
-sudo nvim 15-private.caddyfile 
-cat 15-private.caddyfile
-sudo nvim 15-private.caddyfile 
-sudo systemctl restart caddy
-sudo nvim 15-private.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/15-private.caddyfile 
-sudo systemctl restart caddy
-systemctl status caddy
-sudo nvim /etc/caddy/Caddyfile.d/15-private.caddyfile 
-sudo systemctl restart caddy
-cd /etc/caddy/Caddyfile.d/
-ls
-sudo nvim 20-servers.caddyfile 
-sudo nvim 40-jellyfin.caddyfile
-sudo systemctl restart jel
-sudo systemctl restart caddy
-cd /etc/caddy/Caddyfile.d/
-ls
-mv 15-private.caddyfile 15-private.caddyfile__
-sudo mv 15-private.caddyfile 15-private.caddyfile__
-sudo mv 15-private.caddyfile_ 15-private.caddyfile
-sudo systemctl restart caddy
-exit
-dig servidos.lat A
-sudo dnf install dig
-dig servidos.lat A
-exit
-curl servidos.lat
-exit
-curl servidos.lat
-dig servidos.lat A
-curl -v 130.211.27.102
-curl -v 130.211.27.102:443
-curl -v https://130.211.27.102
-curl servidos.lat
-curl https://servidos.lat
-curl-v https://servidos.lat
-curl -v https://servidos.lat
-dig servidos.lat A
-exit
-dig servidos.lat A
-exit
-dig servidos.lat A
-exit
-dig servidos.lat A
-exit
-dig servidos.lat A
-exit
-dig servidos.lat A
-curl -v https://servidos.lat
-exit
-sudo useradd -m -s /bin/bash deploy
-sudo groupadd -f www-data
-sudo usermod -aG www-data deploy
-ls -lag /var/www/html/
-sudo mkdir /var/www/html/portfolio
-sudo chown -R root:www-data /var/www/html/portfolio/
-sudo chmod -R 775 /var/www/html/portfolio/
-ssh-keygen -t ed25519 -C "deploy@portfolio" -f ~/.ssh/portfolio_deploy
-cat ~/.ssh/portfolio_deploy.pub 
-sudo -u deploy
-sudo -u deploy bash
-ls
-ls -lag
-cat ~/.ssh/portfolio_deploy
-exit
-su
-sudo -u
-sudo -i
-cat ~/.ssh/portfolio_deploy
-exit
-sudo systemctl restart iptables
-exit
-ls
-ls ~/.ssh/authorized_keys 
-cat ~/.ssh/authorized_keys 
-sudo systemctl restart iptables.service 
-sudo systemctl status iptables.service 
-cat /etc/sysconfig/iptables
-sudo cat /etc/sysconfig/iptables
-exit
-ls
-exit
-cd /var/www/html/portfolio/
-ls -lag
-ls
-sudo -u deploy bash
-ls
-exit
-sudo systemctl restart caddy
-cd /var/www/html/portfolio/
-ls
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-sudo chown -R deploy:www-data /var/www/html/portfo 
-sudo chown -R deploy:www-data /var/www/html/portfolio/
-exit
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo mkdir /var/www/html/blog
-sudo chown deploy:www-data /var/www/html/blog/ -R
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-sudo chmod -R 775 /var/www/html/portfolio
-ls -la /var/www/html/portfolio/
-sudo chown -$ deploy:www-data /var/www/html/portfolio/
-sudo chown -R deploy:www-data /var/www/html/portfolio/
-sudo -i
-ls -la /var/www/html/portfolio/friends/ | grep "001_chicken_hu"
-sudo cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-df -h
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy && exit
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy && exit
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-journalctl -xeu caddy.service
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-journalctl -xeu caddy.service
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy && exit
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-curl -sI "https://danilo-reyes.com/isso/js/embed.min.js" 
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy && exit
-curl -sI "https://danilo-reyes.com/isso/js/embed.min.js" 
-curl -vkI https://blog.danilo-reyes.com/isso/js/embed.min.js
-sudo cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-sudo cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-curl -vkI https://blog.danilo-reyes.com/isso/
-curl -vkI https://blog.danilo-reyes.com/isso/js/embed.min.js
-curl -vkI http://10.77.0.2:8180/
-curl -vkI http://10.77.0.2:8180/js/embed.min.js
-curl -vkI http://10.77.0.2:8180/
-curl -vkI http://10.77.0.2:8180/js/embed.min.js
-curl -vkI https://blog.danilo-reyes.com/isso/js/embed.min.js
-curl -vkI https://blog.danilo-reyes.com/isso/
-curl -vkI https://blog.danilo-reyes.com/isso
-9;6u
-timedatectl status
-date-u
-date -u
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-exit
-sudo cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-exit
-sudo cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo cat /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo dnf search opentracker
-sudo dnf install -y git gcc make libowfat-devel
-git clone https://erdgeist.org/gitweb/opentracker
-cd opentracker/
-make
-sudo dnf install -y libowfat-devel
-make clean
-make CFLAGS="-I/usr/include/libowfat"
-sudo dnf install -y zlib-devel
-make CFLAGS="-I/usr/include/libowfat"
-git submodule update --init
-make clean
-make
-ls
-cd ..
-git clone git@github.com:masroore/libowfat.git
-sudo dnf install libowfat
-git clone git@github.com:masroore/libowfat.git
-podman
-docker
-exit
-sudo dnf copr enable dlk/rpms
-sudo dnf install opentracker
-rm opentracker/
-rm opentracker/ -rf
-sudo systemctl enable --now opentracker
-sudo systemctl status opentracker
-sudo cat /etc/opentracker.conf 
-sudo nvim /etc/opentracker.conf 
-sudo nvim /etc/caddy/Caddyfile.d/15-private.caddyfile
-sudo grep -r 6969 /etc/caddy/Caddyfile.d/
-sudo nvim /etc/opentracker.conf 
-sudo systemctl restart opentracker.service 
-sudo systemctl status opentracker
-sudo nvim /etc/opentracker.conf 
-sudo systemctl restart opentracker.service 
-sudo systemctl status opentracker
-sudo install -d -m 0750 /var/lib/opentracker
-sudo install -m 0640 /dev/null /var/lib/opentracker/whitelist
-sudo install -m 0640 /dev/null /var/lib/opentracker/blacklist
-sudo systemctl restart opentracker.service 
-sudo systemctl status opentracker
-ls -lag /var/lib/opentracker/
-sudo ls -lag /var/lib/opentracker/
-sudo nvim /etc/opentracker.conf 
-sudo systemctl restart opentracker.service 
-sudo systemctl status opentracker
-sudo chmod 666 /var/lib/opentracker/blacklist
-sudo systemctl restart opentracker.service 
-sudo systemctl status opentracker
-sudo iptables -A INPUT -p tcp --dport 6969 -j ACCEPT
-sudo iptables -A INPUT -p udp --dport 6969 -j ACCEPT
-sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-sudo iptables -L INPUT -n -v --line-numbers | grep 6969
-sudo service iptables save
-exit
-ls /etc/wireguard/
-sudo ls /etc/wireguard/
-sudo cat /etc/wireguard/wg0.conf
-cat /etc/sysctl.d/99-forward.conf
-sudo ls /etc/sysctl.d
-cat /etc/sysctl.d/99-ipforward.conf 
-sudo sysctl net.ipv4.ip_forward
-sudo -i
-sudo systemctl status opentracker
-journalctl -xefu opentracker
-ss -tnp | grep 6969
-sudo sysctl -w net.ipv4.conf.all.rp_filter=0
-sudo sysctl -w net.ipv4.conf.eth0.rp_filter=0
-sudo sysctl -w net.ipv4.conf.wg0.rp_filter=0
-journalctl -xefu opentracker
-sudo cat /etc/sysconfig/iptables
-sysctl -w net.ipv4.ip_forward=1
-# ---- NAT (insert at top) ----
-iptables -t nat -I PREROUTING 1 -i eth0 -p tcp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -t nat -I PREROUTING 2 -i eth0 -p udp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -t nat -I POSTROUTING 1 -s 10.77.0.0/24 -o eth0 -j MASQUERADE
-# ---- FORWARD ----
-iptables -I FORWARD 1 -i eth0 -o wg0 -p tcp -d 10.77.0.2 --dport 51412 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
-iptables -I FORWARD 2 -i eth0 -o wg0 -p udp -d 10.77.0.2 --dport 51412 -j ACCEPT
-iptables -I FORWARD 3 -i wg0 -o eth0 -s 10.77.0.2 -p tcp --sport 51412 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -I FORWARD 4 -i wg0 -o eth0 -s 10.77.0.2 -p udp --sport 51412 -j ACCEPT
-iptables -I FORWARD 5 -i wg0 -o eth0 -j ACCEPT
-iptables -I FORWARD 6 -i eth0 -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-net.ipv4.ip_forward = 1
-sudo -i
-mkfs.ext4 "/dev/disk/by-id/scsi-0Linode_Volume_box"
-sudo -i
-mkdir /mnt/box/downloads
-sudo mkdir /mnt/box/downloads
-sudo chown jawz:users /mnt/box/downloads/
-ls -la
-sudo chown jawz:jawz /mnt/box/downloads/
-qbittorrent-nox 
-sudo useradd --system --create-home --home-dir /var/lib/qbittorrent --shell /sbin/nologin qbittorrent
-sudo mkdir -p /srv/torrents/{downloads,incomplete,watch}
-sudo chown -R qbittorrent:qbittorrent /srv/torrents /var/lib/qbittorrent
-sudo tee /etc/systemd/system/qbittorrent-nox.service >/dev/null <<'EOF'
-[Unit]
-Description=qBittorrent (nox)
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=qbittorrent
-Group=qbittorrent
-UMask=0027
-WorkingDirectory=/var/lib/qbittorrent
-ExecStart=/usr/bin/qbittorrent-nox --profile=/var/lib/qbittorrent
-Restart=on-failure
-RestartSec=3
-LimitNOFILE=65536
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-sudo systemctl daemon-reload
-sudo systemctl enable --now qbittorrent-nox
-sudo systemctl status qbittorrent-nox --no-pager
-sudo -u qbittorrent nano /var/lib/qbittorrent/qBittorrent/config/qBittorrent.conf
-sudo systemctl restart qbittorrent-nox
-sudo nvim /etc/caddy/Caddyfile.d/75-qbittorrent.caddyfile
-sudo -u qbittorrent nano /var/lib/qbittorrent/qBittorrent/config/qBittorrent.conf
-sudo systemctl stop qbittorrent-nox
-sudo -u qbittorrent nano /var/lib/qbittorrent/qBittorrent/config/qBittorrent.conf
-sudo systemctl start qbittorrent-nox
-sudo -u qbittorrent nano /var/lib/qbittorrent/qBittorrent/config/qBittorrent.conf
-sudo nvim /etc/caddy/Caddyfile.d/75-qbittorrent.caddyfile
-sudo systemctl restart caddy
-sudo systemctl status qbittorrent-nox --no-pager
-ls
-cat /etc/sysconfig/iptables
-sudo cat /etc/sysconfig/iptables
-ls /mnt/
-ls /mnt/box/
-rm /mnt/box/downloads/
-rmdir /mnt/box/downloads/
-sudo rmdir /mnt/box/downloads/
-sudo mv /srv/torrents/* /mnt/box/
-sudo umount /mnt/box 
-sudo nvim /etc/fstab 
-sudo mount -a
-sudo systemctl daemon-reload
-sudo mount -a
-ls -lag /srv/torrents/
-sudo -u qbittorrent nano /var/lib/qbittorrent/qBittorrent/config/qBittorrent.conf
-cd /var/lib/qbittorrent/
-sudo -i
-exit
-sudo -i
-ssh server 
-exitr
-exit
-ls /srv/torrents/
-sudo mkdir /srv/torrents/tits
-sudo chown jawz:jawz /srv/torrents/tits/
-ls /srv/torrents/tits/
-sudo -i
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy
-exit
-ls
-df -h
-ssh server
-exit
-clear
-sudoedit /etc/sysconfig/iptables
-exit
-sudo grep 6060 /etc/
-sudo grep 6060 /etc/ -r
-sudo grep -r 6969 /etc/
-sudo cat /etc/ssh/sshd_config
-ls
-clear
-exit
-cat /etc/sysconfig/iptables
-sudo cat /etc/sysconfig/iptables
-sudo ls /etc/wireguard/
-sudo cat /etc/wireguard/wg0.conf
-sudo -i
-exit
-sudo -i
-sudo -i
-sudo -i
-iptables -S
-sudo iptables -S
-sudo nvim /etc/wireguard/wg0.conf
-exit
-curl # Test paperless (should fail)
-curl -v --connect-timeout 5 http://192.168.100.15:8000
-# Test sabnzbd (should fail)  
-curl -v --connect-timeout 5 http://192.168.100.15:3399
-curl -v --connect-timeout 5 http://192.168.100.15:8686
-sudo wg show
-exit
-sudo systemctl restart wg-quick@wg0.service 
-exit
-sudo nvim /etc/wireguard/wg0.conf
-sudo systemctl restart wg-quick@wg0.service 
-sudo nvim /etc/wireguard/wg0.conf
-exit
-sudo wg show
-exit
-sudo nvim /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-exit
-sudo systemctl restart wg-quick@wg0.service 
-sudo nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-sudo systemctl restart caddy
-z nixos
-exit
-cat .ssh/id_ed25519.pub 
-cat .ssh/id_ed25519
-exit
-cat /etc/sysconfig/iptables
-sudo cat /etc/sysconfig/iptables
-exit
-sudo -i
-ls
-cat vps_public.key 
-ls .ssh/authorized_keys 
-cat .ssh/authorized_keys 
-exit

modules/modules.nix

@@ -15,6 +15,7 @@ in
     ++ inputs.self.lib.autoImport ./servers filterNames
     ++ inputs.self.lib.autoImport ./services filterNames
     ++ inputs.self.lib.autoImport ./shell filterNames
+    ++ inputs.self.lib.autoImport ./websites filterNames
     ++ inputs.self.lib.autoImport ./network filterNames
     ++ [
       ./factories/mkscript.nix
@@ -29,7 +30,7 @@ in
     };
     localhost6 = lib.mkOption {
       type = lib.types.str;
-      default = "::1";
+      default = "[::1]";
       description = "The localhost ipv6 address.";
     };
     secureHost = lib.mkOption {
@@ -49,19 +50,39 @@ in
         server = "192.168.100.15";
         miniserver = "192.168.1.100";
         workstation = "192.168.100.18";
-        vps = "45.33.0.228";
+        vps = "45.79.25.87";
         wg-vps = "10.77.0.1";
         wg-server = "10.77.0.2";
-        wg-g1 = "10.9.0.2";
-        wg-gs = "10.9.0.0";
+        wg-galaxy = "10.77.0.3";
+        wg-phone = "10.77.0.4";
+        wg-guest1 = "10.9.0.2";
+        wg-guest2 = "10.9.0.3";
         wg-friend1 = "10.8.0.2";
         wg-friend2 = "10.8.0.3";
         wg-friend3 = "10.8.0.4";
         wg-friend4 = "10.8.0.5";
-        wg-friends = "10.8.0.0";
+        wg-friend5 = "10.8.0.6";
       };
       description = "Set of IP's for all my computers.";
     };
+    subnets = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        wg-homelab = "10.77.0.0/24";
+        wg-friends = "10.8.0.0/24";
+        wg-guests = "10.9.0.0/24";
+      };
+      description = "Set of subnets for WireGuard networks.";
+    };
+    wgInterfaces = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        wg-homelab = "10.77.0.1/24";
+        wg-friends = "10.8.0.1/24";
+        wg-guests = "10.9.0.1/24";
+      };
+      description = "WireGuard interface IPs for the VPS.";
+    };
     interfaces = lib.mkOption {
       type = lib.types.attrsOf lib.types.str;
       default = {
@@ -109,6 +130,11 @@ in
     };
     enableContainers = lib.mkEnableOption "container services (Docker/Podman)";
     enableProxy = lib.mkEnableOption "nginx reverse proxy for services";
+    build.baseImage = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to enable base image settings for this host build.";
+    };
     toggleUsers = lib.mkOption {
       type = lib.types.attrsOf (lib.types.either lib.types.str (lib.types.listOf lib.types.str));
       default = {
@@ -196,7 +222,6 @@ in
               config.my.servers.go-vod.enable
               config.my.servers.tranga.enable
               config.my.servers.drpp.enable
-              config.my.servers.plex-discord-bot.enable
             ]);
           message = "Container services are enabled but enableContainers is false";
         }

modules/network/firewall.nix

@@ -16,7 +16,6 @@ let
     "drpp"
     "metube"
     "multi-scrobbler"
-    "plex-discord-bot"
   ];
   nativeServicesWithOpenFirewall = inputs.self.lib.getServicesWithNativeFirewall config firewallBlacklist;
   servicesConfig = lib.listToAttrs (

modules/servers/flame.nix

@@ -21,7 +21,7 @@ in
     virtualisation.oci-containers.containers = lib.mkIf enable {
       flame = lib.mkIf cfg.enable {
         autoStart = true;
-        image = "pawelmalak/flame";
+        image = "pawelmalak/flame:latest";
         ports = [ "${toString cfg.port}:${toString cfg.port}" ];
         volumes = [
           "${config.my.containerData}/flame:/app/data"
@@ -36,7 +36,7 @@ in
       };
       flame-nsfw = lib.mkIf cfgS.enable {
         autoStart = true;
-        image = "pawelmalak/flame";
+        image = "pawelmalak/flame:latest";
         ports = [ "${toString cfgS.port}:${toString cfg.port}" ];
         volumes = [ "${config.my.containerData}/flame-nsfw:/app/data" ];
         environmentFiles = [ config.sops.secrets.flame.path ];

modules/servers/homepage/service-widgets.nix

@@ -209,7 +209,7 @@
       icon = "${cfg.name}.png";
       href = cfg.url;
       widget = {
-        url = "http://${config.my.ips.wg-server}:8081";
+        url = "http://${config.my.ips.wg-server}:${toString cfg.port}";
         type = cfg.name;
         username = "{{HOMEPAGE_VAR_NEXTCLOUD_USERNAME}}";
         password = "{{HOMEPAGE_VAR_NEXTCLOUD_PASSWORD}}";

modules/servers/lidarr.nix

@@ -11,7 +11,7 @@ in
   options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;
   config.virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
     autoStart = true;
-    image = "linuxserver/lidarr:version-3.0.1.4866";
+    image = "linuxserver/lidarr:latest";
     ports = [ "${toString cfg.port}:${toString cfg.port}" ];
     environment = {
       TZ = config.my.timeZone;

modules/servers/maloja.nix

@@ -12,7 +12,7 @@ in
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.maloja.sopsFile = ../../secrets/env.yaml;
     virtualisation.oci-containers.containers.maloja = {
-      image = "krateng/maloja:3.2.4";
+      image = "krateng/maloja:latest";
       ports = [ "${toString cfg.port}:${toString cfg.port}" ];
       environmentFiles = [ config.sops.secrets.maloja.path ];
       environment = {

modules/servers/metube.nix

@@ -10,7 +10,7 @@ in
 {
   options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;
   config.virtualisation.oci-containers.containers.metube = lib.mkIf cfg.enable {
-    image = "ghcr.io/alexta69/metube:2026.01.02";
+    image = "ghcr.io/alexta69/metube:latest";
     ports = [ "${toString cfg.port}:8081" ];
     volumes = [
       "${config.my.containerData}/metube:/downloads"

modules/servers/multi-scrobbler.nix

@@ -12,7 +12,7 @@ in
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.multi-scrobbler.sopsFile = ../../secrets/env.yaml;
     virtualisation.oci-containers.containers.multi-scrobbler = {
-      image = "foxxmd/multi-scrobbler:0.10.0";
+      image = "foxxmd/multi-scrobbler:latest";
       ports = [ "${toString cfg.port}:${toString cfg.port}" ];
       environmentFiles = [ config.sops.secrets.multi-scrobbler.path ];
       environment = {

modules/servers/nextcloud.nix

@@ -176,11 +176,11 @@ in
           listen = [
             {
               addr = config.my.ips.wg-server;
-              port = 8081;
+              inherit (cfg) port;
             }
             {
               addr = config.my.localhost;
-              port = 8081;
+              inherit (cfg) port;
             }
           ];
         };
@@ -188,7 +188,7 @@ in
       virtualisation.oci-containers.containers = {
         go-vod = lib.mkIf config.my.servers.go-vod.enable {
           autoStart = true;
-          image = "radialapps/go-vod";
+          image = "radialapps/go-vod:latest";
           environment = {
             TZ = config.my.timeZone;
             NEXTCLOUD_HOST = "https://${config.services.nextcloud.hostName}";
@@ -256,78 +256,51 @@ in
         };
       };
     })
-    (lib.mkIf (cfg.enableProxy && config.my.enableProxy && config.networking.hostName == "vps") {
-      services.nginx.virtualHosts = {
-        "${cfg.host}" = {
-          forceSSL = true;
-          enableACME = true;
-          http2 = true;
-          default = true;
-          serverAliases = [ "cloud.rotehaare.art" ];
-          extraConfig = ''
-            add_header X-XSS-Protection "1; mode=block" always;
-            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-            add_header X-Content-Type-Options "nosniff" always;
-            add_header X-Frame-Options "SAMEORIGIN" always;
-            add_header Referrer-Policy "no-referrer-when-downgrade" always;
-            add_header X-Permitted-Cross-Domain-Policies "none" always;
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Host $host;
-          '';
-          locations = {
-            "/" = {
-              proxyPass = cfg.local;
-              proxyWebsockets = true;
-            };
+    (lib.mkIf (cfgC.enableProxy && config.my.enableProxy) {
+      services.nginx.virtualHosts.${cfgC.host} = {
+        forceSSL = true;
+        enableACME = true;
+        http2 = true;
+        locations = {
+          # static files
+          "^~ /browser" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonProxyConfig;
           };
-        };
-        "${cfgC.host}" = lib.mkIf cfgC.enableProxy {
-          forceSSL = true;
-          enableACME = true;
-          http2 = true;
-          locations = {
-            # static files
-            "^~ /browser" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # Legacy static files (for compatibility)
-            "^~ /loleaflet" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # WOPI discovery URL
-            "^~ /hosting/discovery" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # Capabilities
-            "^~ /hosting/capabilities" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # download, presentation, image upload and websocket
-            "~ ^/cool" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
-            # Legacy websocket (for compatibility)
-            "~ ^/lool" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
-            # Admin Console websocket
-            "^~ /cool/adminws" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
-            # Legacy Admin Console websocket (for compatibility)
-            "^~ /lool/adminws" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
+          # Legacy static files (for compatibility)
+          "^~ /loleaflet" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonProxyConfig;
+          };
+          # WOPI discovery URL
+          "^~ /hosting/discovery" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonProxyConfig;
+          };
+          # Capabilities
+          "^~ /hosting/capabilities" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonProxyConfig;
+          };
+          # download, presentation, image upload and websocket
+          "~ ^/cool" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonWebsocketConfig;
+          };
+          # Legacy websocket (for compatibility)
+          "~ ^/lool" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonWebsocketConfig;
+          };
+          # Admin Console websocket
+          "^~ /cool/adminws" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonWebsocketConfig;
+          };
+          # Legacy Admin Console websocket (for compatibility)
+          "^~ /lool/adminws" = {
+            proxyPass = cfgC.local;
+            extraConfig = commonWebsocketConfig;
           };
         };
       };

modules/servers/plex-discord-bot.nix

@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
-  cfg = config.my.servers.plex-discord-bot;
-  name = "plex-discord-bot";
-in
-{
-  options.my.servers.plex-discord-bot = setup.mkOptions name name 0;
-  config.virtualisation.oci-containers.containers.plex-discord-bot = lib.mkIf cfg.enable {
-    image = "ghcr.io/phin05/discord-rich-presence-plex:latest";
-    environment = {
-      DRPP_UID = toString config.users.users.jawz.uid;
-      DRPP_GID = toString config.users.groups.users.gid;
-    };
-    volumes = [
-      "${config.my.containerData}/drpp:/app/data"
-      "/run/user/${toString config.users.users.jawz.uid}:/run/app"
-    ];
-  };
-}

modules/servers/portfolio.nix

@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
-  cfg = config.my.websites.portfolio;
-in
-{
-  options.my.websites.portfolio = setup.mkOptions "portfolio" "portfolio" 0;
-  config.services.nginx.virtualHosts."danilo-reyes.com" = lib.mkIf cfg.enableProxy {
-    forceSSL = true;
-    enableACME = true;
-    http2 = true;
-    root = "/srv/www/danilo-reyes.com";
-    # index = "index.html";
-    locations."/".extraConfig = ''
-      try_files $uri $uri/ =404;
-    '';
-  };
-}

modules/servers/synapse.nix

@@ -75,7 +75,6 @@ in
               inherit (cfg) port;
               bind_addresses = [
                 config.my.localhost
-                config.my.localhost6
                 config.my.ips.server
                 config.my.ips.wg-server
               ];

modules/servers/yamtrack.nix

@@ -12,9 +12,9 @@ in
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
     sops.secrets.yamtrack.sopsFile = ../../secrets/env.yaml;
     virtualisation.oci-containers.containers = {
-      yamtrack-redis.image = "redis:7-alpine";
+      yamtrack-redis.image = "redis:latest";
       yamtrack = {
-        image = "ghcr.io/fuzzygrim/yamtrack";
+        image = "ghcr.io/fuzzygrim/yamtrack:latest";
         ports = [ "${toString cfg.port}:8000" ];
         dependsOn = [ "yamtrack-redis" ];
         environmentFiles = [ config.sops.secrets.yamtrack.path ];

modules/services/network.nix

@@ -1,10 +1,23 @@
 { config, lib, ... }:
+let
+  stripCidr = cidr: cidr |> lib.splitString "/" |> builtins.head;
+  wgListenIps = config.my.wgInterfaces |> builtins.attrValues;
+  wgListenAddrs = wgListenIps |> builtins.map (ip: "${stripCidr ip}:53");
+in
 {
   options.my.services.network.enable = lib.mkEnableOption "network configuration and services";
   config = lib.mkIf config.my.services.network.enable {
     networking = {
       enableIPv6 = true;
-      firewall.enable = true;
+      firewall = {
+        enable = true;
+        interfaces = lib.mkIf config.my.services.wireguard.enable {
+          wg0 = {
+            allowedTCPPorts = [ 53 ];
+            allowedUDPPorts = [ 53 ];
+          };
+        };
+      };
       dhcpcd.extraConfig = "nohook resolv.conf";
       networkmanager = {
         enable = true;
@@ -19,6 +32,16 @@
       settings = {
         ipv6_servers = true;
         require_dnssec = true;
+        log_level = 4;
+        listen_addresses = [
+          "${config.my.localhost}:53"
+          "${config.my.localhost6}:53"
+        ]
+        ++ lib.optionals config.my.services.wireguard.enable wgListenAddrs;
+        query_log = {
+          file = "/var/lib/dnscrypt-proxy/query.log";
+          format = "tsv";
+        };
         sources.public-resolvers = {
           urls = [
             "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"

modules/services/wireguard.nix

@@ -5,7 +5,6 @@
 }:
 let
   port = 51820;
-  interface = config.my.interfaces.${config.networking.hostName};
 in
 {
   options.my.services.wireguard.enable = lib.mkEnableOption "WireGuard VPN configuration";
@@ -13,16 +12,11 @@ in
     sops.secrets."vps/server/private".sopsFile = ../../secrets/wireguard.yaml;
     networking = {
       firewall.allowedUDPPorts = [ port ];
-      nat = {
-        enable = true;
-        externalInterface = interface;
-        internalInterfaces = [ "wg0" ];
-      };
       wireguard.interfaces.wg0 = {
         ips = [
-          "${config.my.ips.wg-vps}/24"
-          "10.8.0.1/24"
-          "10.9.0.1/24"
+          config.my.wgInterfaces.wg-homelab
+          config.my.wgInterfaces.wg-friends
+          config.my.wgInterfaces.wg-guests
         ];
         listenPort = port;
         postSetup = "";
@@ -33,6 +27,14 @@ in
             publicKey = "OUiqluRaS4hmGvLJ3csQrnIM3Zzet50gsqtTABaUkH4=";
             allowedIPs = [ "${config.my.ips.wg-server}/32" ];
           }
+          {
+            publicKey = "BwN4uCkMd6eAS5Ugld0oXnA16IhgEEQF8mOJ3+vHliA=";
+            allowedIPs = [ "${config.my.ips.wg-galaxy}/32" ];
+          }
+          {
+            publicKey = "R1xUFOuboQf/yy8ShiXqoCPaPcH3Cn0n4PAWB2rgHTs=";
+            allowedIPs = [ "${config.my.ips.wg-phone}/32" ];
+          }
           {
             publicKey = "rFgT6TXzRazK6GMazMNGjtOvzAAPST0LvCfN7QXsLho=";
             allowedIPs = [ "${config.my.ips.wg-friend1}/32" ];
@@ -49,6 +51,18 @@ in
             publicKey = "yg+2miZCrx89znFaUlU/le/7UIPgEAMY74fZfEwz8g4=";
             allowedIPs = [ "${config.my.ips.wg-friend4}/32" ];
           }
+          {
+            publicKey = "u4/6ZYO7lUJZ9QmSlFPUaadq25gwDljjhsfgs/p2amc=";
+            allowedIPs = [ "${config.my.ips.wg-friend5}/32" ];
+          }
+          {
+            publicKey = "GawtOvsZ75avelIri5CjGoPXd8AFpi9qlZ6dSsqUISE=";
+            allowedIPs = [ "${config.my.ips.wg-guest1}/32" ];
+          }
+          {
+            publicKey = "NvhUnErIb0/hi+Hui/o5l5Pq4ZysFVIn1VBPsjoTeCk=";
+            allowedIPs = [ "${config.my.ips.wg-guest2}/32" ];
+          }
         ];
       };
     };

modules/websites/lidarr-mb-report.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.websites.lidarrMbReport;
+  mbSecurityHeaders = ''
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+  '';
+in
+{
+  options.my.websites.lidarrMbReport = {
+    enableProxy = lib.mkEnableOption "lidarr mb report static site";
+  };
+  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+    services.nginx.virtualHosts."mb-report.lebubu.org" = {
+      forceSSL = true;
+      enableACME = true;
+      root = "/var/www/html/lidarr-mb-gap";
+      locations = {
+        "/" = {
+          extraConfig = ''
+            try_files $uri /missing_albums.html;
+            ${mbSecurityHeaders}
+          '';
+        };
+        "~* \\.html$" = {
+          extraConfig = ''
+            add_header Content-Type "text/html; charset=utf-8";
+            ${mbSecurityHeaders}
+          '';
+        };
+        "~* \\.json$" = {
+          extraConfig = ''
+            add_header Content-Type "application/json";
+            ${mbSecurityHeaders}
+          '';
+        };
+      };
+    };
+  };
+}

modules/websites/portfolio.nix

@@ -0,0 +1,98 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.websites.portfolio;
+  issoCfg = config.my.servers.isso;
+  hugoSecurityHeaders = ''
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  '';
+  hugoLocations = {
+    "/" = {
+      extraConfig = ''
+        try_files $uri $uri/ /index.html;
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "~* \\.html$" = {
+      extraConfig = ''
+        try_files $uri $uri/ /index.html;
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "~* \\.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|xml)$" = {
+      extraConfig = ''
+        expires 1y;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "~ /\\.(?!well-known).*" = {
+      extraConfig = ''
+        return 404;
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "= /js/script.js" = {
+      proxyPass = "https://analytics.lebubu.org";
+      extraConfig = ''
+        proxy_set_header Host analytics.lebubu.org;
+        rewrite ^ /js/script.file-downloads.hash.outbound-links.js break;
+        ${hugoSecurityHeaders}
+      '';
+    };
+    "= /api/event" = {
+      proxyPass = "https://analytics.lebubu.org";
+      extraConfig = ''
+        proxy_set_header Host analytics.lebubu.org;
+        ${hugoSecurityHeaders}
+      '';
+    };
+  };
+in
+{
+  options.my.websites.portfolio = {
+    enableProxy = lib.mkEnableOption "portfolio and blog static sites";
+  };
+  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+    services.nginx.virtualHosts = {
+      "www.danilo-reyes.com" = {
+        forceSSL = true;
+        enableACME = true;
+        globalRedirect = "danilo-reyes.com";
+      };
+      "www.blog.danilo-reyes.com" = {
+        forceSSL = true;
+        enableACME = true;
+        globalRedirect = "blog.danilo-reyes.com";
+      };
+      "danilo-reyes.com" = {
+        forceSSL = true;
+        enableACME = true;
+        root = "/var/www/html/portfolio";
+        locations = hugoLocations;
+      };
+      "blog.danilo-reyes.com" = {
+        forceSSL = true;
+        enableACME = true;
+        root = "/var/www/html/blog";
+        locations = hugoLocations // {
+          "^~ /isso" = {
+            proxyPass = "http://${issoCfg.ip}:${toString issoCfg.port}";
+            extraConfig = ''
+              rewrite ^/isso/?(.*)$ /$1 break;
+              proxy_set_header Host $host;
+              ${hugoSecurityHeaders}
+            '';
+          };
+        };
+      };
+    };
+  };
+}

parts/core.nix

@@ -224,7 +224,6 @@ in
         nixworkstation = ../secrets/ssh/ed25519_nixworkstation.pub;
         nixserver = ../secrets/ssh/ed25519_nixserver.pub;
         nixminiserver = ../secrets/ssh/ed25519_nixminiserver.pub;
-        windows_vm = ../secrets/ssh/ed25519_windows_vm.pub;
       };
       getSshKeys = keyNames: keyNames |> map (name: inputs.self.lib.sshKeys.${name});
       # Helper functions for multi-user toggle support

parts/packages.nix

@@ -26,11 +26,36 @@
           exec ${mcpPython}/bin/python -m mcp_server.server
         '';
       };
+      vpsLinodeConfig = inputs.self.nixosConfigurations.vps.extendModules {
+        modules = [
+          (
+            { lib, ... }:
+            {
+              my.secureHost = lib.mkForce false;
+              my.build.baseImage = true;
+            }
+          )
+        ];
+      };
+      mcpTests = pkgs.writeShellApplication {
+        name = "mcp-tests";
+        runtimeInputs = with pkgs.python3Packages; [
+          black
+          click
+          mypy
+          pytest
+          ruff
+        ];
+        text = ''
+          exec bash ${inputs.self}/scripts/mcp-server/run-tests.sh "$@"
+        '';
+      };
     in
     {
       packages = (inputs.jawz-scripts.packages.${system} or { }) // {
         emacs-vm = inputs.self.nixosConfigurations.emacs.config.system.build.vm;
-        vps-linode = inputs.self.nixosConfigurations.vps.config.system.build.images.linode;
+        vps-linode = vpsLinodeConfig.config.system.build.images.linode;
+        mcp-tests = mcpTests;
         nixos-mcp = nixosMcp;
         nixos-mcp-server = mcpServerPkg;
       };

scripts/mcp-server/run-tests.sh

@@ -6,6 +6,16 @@ set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$here"
 
+cache_root="${TMPDIR:-/tmp}/mcp-tests-cache"
+mkdir -p "$cache_root"
+export HOME="${TMPDIR:-/tmp}/mcp-tests-home"
+mkdir -p "$HOME"
+export XDG_CACHE_HOME="$cache_root/xdg"
+export RUFF_CACHE_DIR="$cache_root/ruff"
+export MYPY_CACHE_DIR="$cache_root/mypy"
+export PYTEST_ADDOPTS="${PYTEST_ADDOPTS:-} -o cache_dir=$cache_root/pytest"
+export PYTHONDONTWRITEBYTECODE=1
+
 fix=false
 for arg in "$@"; do
   if [ "$arg" = "--fix" ]; then

secrets/certs.yaml

@@ -22,38 +22,38 @@ sops:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5VUMzYjZ5WlZtQ05LdnVt
-            b3V3RmFyM0VZWmh4dC9YZFpsZkRIdC9TRzFrCnBuYnhSaUgwb3JuSUNFSWlwSmVq
-            bEoyQ09XSjNBMks3M2ZYdlh0eDFNYjAKLS0tIERpaGhISDFYd3RCYUV6Y0lmdGNQ
-            VTNibTBMN2RuN3doU3lYK1drNjVTVkkKMmRW0NtiYKBcUQ8kKjXcS6KjoPdVfN5d
-            6vczsKTTbUwI0n6T5xrwRdbVIFsP4HisjceQWxJIVBthR0u9dLfXGw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdVVSeEtOTE1XQTBHVW5C
+            aUVVbUltOGMrV2l6VGhRQXFnbUR1NVpnYmgwCjEzWXB5SVBtbjBzMkx4OUhkUXll
+            b0FkcUl2b0d0YkEwQU9iNFZrcDJTV3MKLS0tIHNrY2JFbVEwNTFaWUdmdFJPZmJI
+            SnhZK1h2ejhQUUNtbzFINUJmNGhiYVkKCMeBiPt80A8/ynEWy2e881y1tVnqANK+
+            wU9Bn+oRwoudPb1io9LAoTdu7+IQpLByt1phAju8m243nM48hAkipA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvb1ZtMjV5TjlhMVRwdWNU
-            ME93Y0xhVGlxdGxmeWtXQ09EN3lORlJpV3k0CkJxdE14YXpwcytjbnZuMWpHVzZ3
-            dVVBYVE0RW1naWVVQ0JRY0NoWG9LZTQKLS0tIG1udE1GbEtTQ2o3bGl0SW9NZmtF
-            OFNqTncyaHFUSzBNRzZiSTVBdkhFWVkK2v81N8c8cU1Ig9fQZOn0fltqO+Ej8Wtk
-            D0nMQv2fbWp6YlyE17VYPgmhdEY6+Zstve6PlBG86iQE3LTAfjG3Uw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhUmQzMU9hTlpQbHBQMm9R
+            Y0d5Z0lGTkFvYnc5MkRDbjNTMlUxWmI0U2t3CkdRQzdGTTNjbmprWEdYc0Nkckpr
+            Z2xqYkhlcHlQNG0rRFVvVTFLdFQxWVUKLS0tIFNPS1o2UVZobU5xN0U2QnI4dXA5
+            WWR1MWNGMVIyTGFBZXFyZlhwM09qakUK8Q26phHWY9zN5j6ZxB7+kmSgmcukfgiv
+            qAAzIGdgsvnUiFZCEJHD1D686C+ZxvakD4p9sA/zEIyeIBtKCq3lIA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSVdUWXRUa2tHVGczelhu
-            UWk5RFl6azRJTkdxZGxvbWlnSDc3K3NlNlgwCjBRZEVta3RuNW1DZmo4RXJyTTNk
-            cnpxTDRGL0kwQXJmc29LNE0wV01hUGsKLS0tIGgyTWZrOHVNTGExRWtYMzJ1aXhp
-            cURNZXBtbnp2OUZDZDZKeEMrZlN0TEEKznlmLKFHYDm/hv3EPcHjT0A8r06GL7if
-            tbuJei8aWWg+uuvCBTZjHqmPUyNR1ixt84vxy1HlwXVu3dYHcG0Wug==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHR05GcVViZTY1Q0NaR1RG
+            SWZzYjlxQUttS0tXc1ZDbDljbXczd1gxL25ZCkM3TVJ5NzlIdUx1dTc5d3R4U3BY
+            RVBLazRRZ2F0anJZRXl3bFdsbXJhdVkKLS0tIFVXN21DQmtqZ2hIRi9FM2dtTTlw
+            aHQvOUt5UGhhR2ZXMVFOOEtKMDRtZmcK0ZX5pF08o+HLztgL1/LocDGIcOGPKqXe
+            9bRBkUtr5QuIxQEYj6NenhkeIxRoPxK9Re/Vsqpphv4NqKpzyOujcw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZYnlaTkd3LzFRbldWL3RZ
-            N2ZneVIzMnRpVVNHVWRMdXJLdjQwSWFKS2pFCmlQZUZMbG03VFVuUXcxZ3NRWjVH
-            SHVPYzk5NGpkeUVSU1BmQnNuaWZnZFUKLS0tIFdQZEU1YnhHZWRIajNYWTYxMEwr
-            UVBjaDFtSWs1b29DR0R2WS9pSGh3OEkKmG34ldBy4s9nj3ng/HQr+gN0LHJCOPJ8
-            EWhh7cTLSF9AmZKP0sBsj7I4hHhZlOn85bvTM9RDiRVOSz8VrObXHA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYcmxldjA2UllycEFyTnpW
+            c2dIa1NXYVJSU1lwb0EvckxQQ0J4ckhSeDFBCnBTZGRYUzdSK08xeWFmaUM3SEZ3
+            bXJSUG1OVEU1T0Z5VGRqYUloa3k0RmsKLS0tIHdRcXE3Q2lLZTRvL3ZCSnZtSk1K
+            TU5Iby9qamRIcEUwc2dTdERFVmNreTAKh55E4KbM6WeFhVx3KDI/pYq+1vCNwDj6
+            6zfXWJvyD9Icn2ZgqpK30wyJ/R/DzmpTDR8AtujXHT6/Uikn7M1fig==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-09-21T20:28:29Z"
     mac: ENC[AES256_GCM,data:e267Kxv1Pyun/VOcLepBDBEKN6uSf8/iuY8KQ8u4xK58wsWkMdSDVcDKvO/iKF/Tj9hj+lZapkaKmp5SdeX+gjpyWiZi6QmUuKsCs0jlkV2NydLtZZt9vkmY/LCguIBRMmhDgidrNcfoghTxDDK5lng5H+2MBs0r2zLID65pHUQ=,iv:tr4YFdBltnsD4uTt+0NCam7r1QzhOmdoEbfz5/+JGPI=,tag:R2dDWTC1qrwPI9ghaf1FEw==,type:str]

secrets/env.yaml

@@ -21,38 +21,38 @@ sops:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjcWpKQ3RqSVdxcDllajc2
-            UzVtdmxBWmJ2QkI3SGhYRlRadGJYaDU3UVN3CkpQYkxhVm5ZQ2djbldYL2VmQWsv
-            SEJmam0zMzlJSFpHS3JZWVorUmh5ZDgKLS0tIFdWdU44VlRDZllCYXRTQzNyajRy
-            cDJqNzA3ektRWll6SkFsVnFMd1FBUEEK0j9X4lYcFaj4MnVh4jnNwrTg2Sl5TTdZ
-            uFvTdE4ZNtZsh3nKmj+v2J3JM8dDUtw2NSooqpoqEvCYdDqwK1kDXQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhV0xoZEhJYlZIUDdOSlVv
+            RGlOQmdSSDROaVY4L2xHSEt3cVVpc3MrRkg0CktGQ204UDNYcXN6NDJqTXFpdmxQ
+            RUYrWDNCZzlObWNyYStWQlRqQ0VJQzQKLS0tIEY4bG41R1k4NDlabGhoUEl4VitI
+            YmYvaDNWRzRlMkdUdVBxM2lwd0N1bXcKp1iUENgs/0RL6PN7b/mwbBdIPuDFfWM4
+            9gXuoW7FiS5MYGdUY5Ub8WlSfA6iUww+t6FB/rBhK9TDXOfIKRYmgg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGSXlITkpxcHZqR0kzMlFY
-            TStOVitPSm0zTURZcE92NkM2ak8xcVF6OVZBCkRRbkpBNW9yek9rWFlOa1pLSk0r
-            ViszS3pMNFhLQlcwdW83R1hhTUJLT0UKLS0tIG9NTm5tNzlidlJmejdoOUkvUE9X
-            RzV2MUFEMnlHVmp3UmgvNmJKSDFrWHcKQ7y2W0PFLs/I6Tb0J/M91+toDP8XmgWh
-            LYuNc9lkjTs+ylIWuMTwtXdceI+kK8hJlELT47FyKl755DzuB1ufAg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWNEtaUndrMGszbHpuYWtx
+            RTRCc29YcmQwYWFKeTFtaHBpM1NjR1R1dGxjCklsTFVXSmp0OUxVUzVYeFJnSWI5
+            M2hEM0pjTXowbGZsQ0tHdnJYdkxjTncKLS0tIG0zUEJ6ZnNOVmd5UWF1K013N1JT
+            dk1HeEJ3bkVUWnhIakt4eEdNUi9aSkkK6Ug6dwtSEpzMpgKvozR8BO0ir1YeRBQd
+            jDtkNhpc32P5uZtx/kv74vIXgOT7KCSb03b7mSIl13J2IeHQDZTPBg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzYXRodjgzR1hoR2VDNHd6
-            NGJ3SXpqRmJKVlY5aTI0R0hBLzFGQ0VSYmpVCi9BakFwRGlXd1ZPbWpHY2h6RUo0
-            VGl0T0d1LzdaZGNOZ0pDekZxVVBWUlEKLS0tIEdtVDZlN2FrcFhEU2pTMUdiZ3NH
-            d3ZSMGdkNzNaczBYOHFuZWJmcEM4MXMK6ayh37HUhOYPryv2Y2WlE1U0CX7qZF89
-            PzvHQZYcbZ2gsRW2f1uU2VoJp/6XnSipD7fCjma3iNovoPlu2+A0yw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWMm5NRmg5Y1NYNDA4MkpR
+            M2RPM2JLZ2NMQm9uNURNc0lSVnJaMHE1MG1JCi9CY3U5V1pnQjhPOXl5NlN0eTJW
+            d3dXQ3hMRGNjWlBQZDAzc0ZDWWUzNm8KLS0tIHMxQWdvY0F4Mk9zaElhMlhManFu
+            TXNGcFZRd1hPdW1wWFpPRklScGZqVXMKwHv5CDSdlaGlXqFKoK9motAWNVMzerXy
+            6K2KVn3tmlAiBzkwuEVVa4jafQjd0t3J6bPx047DP6fPZVNLMElctQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aUk0WVhTUTZXOVRqam9O
-            WkVNd1FKdDA1SWpwWndHbmVBRlNaSWI4aEVnCnJTTDNYTkRtNkR5cUl0SURVQWxh
-            d0c5cEhJVTZ2YXdLdHFQRk9KN04vcW8KLS0tIGF3Rmp2Z0pwM0x1WnpKaVBiUE5x
-            MVBONDBmQjI2enNIVFFQT1hyYm45YXMK2NXWvm8G+Yrvw1NAC6AiDaxA9UftuqYe
-            ZB7QpfkdCT3vS52lBgcEJrM1TbaVX2868trk5kB4gjqVMPVPYxcGHg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaTNnYlFsdFBJeGFwdUNl
+            MVc4OXorOVhJcDBTWDZaT3pQbTg0UFlGNkhrCnVST0IrTnliREpmS0dPMzVDZUJm
+            aUg4SnhtNlcydFYyTkp3N0xaSzVCREEKLS0tIE9tZmZLUERnSzY0aDdkTnY0SXJz
+            UDltYm4zalM2VmxmQjJRSVQ0YWpuM3cKsYQOOppHVJT2tbQQ/jXy4NcUX6aWjQxT
+            Y/I40tBrkwnzVFpVvf6COS+oC6/yRISwWJYYvia9xVfC5+kss9cFIw==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-02-02T03:55:24Z"
     mac: ENC[AES256_GCM,data:+NN+RgkHAIox1IgUuC2ACHneRBzgn5FzsujpbPtmw1IecxeKMMXM7Wa1ZziSkWJSjjDCcBoanox57e+BoNWN5WhWuMdCed04AKcknfKlHAtHrKhoLCsi1sZnsQX7xBmTsA5qHD8788EWfIgPk4gToXkq5KkEfvEWLvalClRK7tY=,iv:kGyw9hk6vp5iu0iMHaCLgVqdcv1gNUBqBhZbRSCa4Ks=,tag:FdKL/5ZraejphDIE2ig8GQ==,type:str]

secrets/gallery.yaml

@@ -5,38 +5,38 @@ sops:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4R05sUnl0UFd3T3pzRm1y
-            U3piNzlpTmpZeEhkeWJxRkMzRzBWRW9LQmtBCjRHTVg5ZlozUnpsVjhIK05xYjlz
-            c2dwbWVKWVNXWFhTWEtlUUFjVUw2RkkKLS0tIElaNXN2ZmROdHd4bWljM3FyMEh6
-            Szg3WTdrVlFmSUJ1S05xNXY5RlM1V1UK7YETep9hn49UqRUjbRv6oGFUT/8lRgXx
-            5O5eGB1X8kPCY8zXiGWSzfo6X8O5659vWIvqjoY8nZxekgvsISS/WA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNWNIek9yVUJIYlhSQmVZ
+            NENoS2dvRDVENit2bnVNQmJ3TVZGWTkwTFh3CnViekVsaTVFZ29iQXNXUTNPS2U0
+            Z2JsWWN4T2tUckVJU0tpNWFaYXpGVTAKLS0tIFowcE1tZDdPREY0ZGVzYS8xNFFp
+            elN4TnZjZUtGOGZ1c3FiU0h4YytLTmMK9wXfpIgMcPD4FpO5CNIXnJc0wJliB35g
+            v4wiDb4zU4VFfWzdimSXjgZrI/ZIqB4Bx/PPi6SPhuT4oQ6LSH5sKw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpT1oraHpJb0NUQndMZW9l
-            YWZrOVBqOG1KME5PYS9YVE4zd2VQb0hRN1dJCmVqSzhkbU5DVmc4MFVnSnVYTi9V
-            RUR2UDNEK3JGOEFUWVoraGtqQVFFWkUKLS0tIDVRdU8rV3diVXNUQSsrKzlBdmFN
-            Q0x5QXdaOXRMc211TUhqTndQOXR6ODAKtJYiAeVTYPOpS+GykBDOLx1g3VloFo2P
-            fDIkOCrINnAU4y07KPhGBxCV3/2cvOPhIgsd02XqxfZPCEU/cYdCgQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtSmsyR0N6SWMvQVl2RzRZ
+            TUpXbm9oTmswdXViczVBOFBLL0lhUmV4WXhvCkdqRG5pcStUVDE4S3FSL0R2TTlG
+            Sm1aZTcrejRHdzU2dFozSUZucHFtUHcKLS0tIDJTSmU1dVhSeUxMSnd1NGlkR1RC
+            cVVIcy9QRFArUkdIM05neG5aM2EyM0UKSCIv0iU/X9bVoQCRxcQXwMbr0GE7MGkb
+            pn420gXMiLFBE8OOhkHg7EEjuR3n9iB3f+pTgN5v6UkxZBmZ2Xr4yg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4dTIzeCttSGNVNmhPejdW
-            ZFkySng2T2ZYdkRrRGRXQVpER1NJMW5XN2xVCkc0VTdsbXdLUkg5d29zZ3VmY0hH
-            U1cybHNob3VkdzRWbGt1bFhNeW9XN0EKLS0tIDdoc2cyaEIybjBHOU5tdVRsTWFZ
-            TmdZTGNDOFovMDVPakF0WTdHaUpHeFUKl0ub1OOylE2JGJNpeReebiOaVdxbd0wv
-            nvJD7tYYXI666Pi31OHttWhsHR+xkL8TU9Dd6uDs4QxIRQfwy/VxcA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlL3picmtSZE8vS0Jod1RV
+            aGNlK2t6b3RTZWRPUmNCZXN0KytSRnRuMHdNCkd1VjU3NEhBOE9jN3gvblM2NnZF
+            TDRhVGh1Y21YM2J4WTZtenFHSDBBNncKLS0tIHZqcnpRbldWN2cxT1I0Qzgva3R5
+            a2lsbG5SUFgvZXlHWUhOc0xQS1dxaHMKDMGQujRa0s4kjrQod11mn0otxO2Zl/bv
+            kHG8ufANpJS5RfKNLMhAK4piUtr1o97471MSGA0ebZAUSK01fQBNfA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUldWbldqTTEwMGF5RVFV
-            ZkZ0Y24ycU1hVDlaTnpGQW1SeFlzaXc2a1FrCmtrUkxLcjNsVHNXemd1cWJJdXI5
-            bDFxUThzSFptNWtXMlNqM09aeklUMTgKLS0tIHR5KzE3dStMTXlhUWhtUWUwSkY0
-            ZldyVmtRVGppQ0d0SnN5Tld4cEtmQ28K1Yij+7OxQUpEsPt/GTnP+dhEErBH1HuL
-            pBFXqHLAwpqiEiiNhYnb0KVWeQnIqDo9WUnrbPavcWSrSkmCsszgxQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4WlgxL2xMR1p4eG1Ca3FM
+            c1JOcDBhaHNlUjRNZjFhVm9CdkN6NEdqdGtnCnUwUFBtLzYvM1kvd1NVREdwL3B5
+            MVc1UEdaSTlhWXFadSsvbHNTaUZKcDgKLS0tIDc3RDg3ZUkvRVFvRWhBWDFHZjV1
+            NGlweEtoVGdqT2J3UzNGaGt2RFM5eE0KUCFvcv39dFM0Vm6uDuntsnZyMq+LHfJW
+            Sts7AJwVIGTmOolImqoVTeKFYJZu5oeKZZNsEG+gvIZptxaR0jPtow==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-10-10T05:09:54Z"
     mac: ENC[AES256_GCM,data:N/BwfrwWcnot36Kn6RFZjjpUIluzq5Upy5iVVV4XSs+/0PYdlZGytjoAB+E3gXyPsLZ93UqI0A9/5KbfXBuR2oY2F7iKsu5puzgyYWa0Gl2z9YcPnyDnk1dj7Ne77xJlqR9YquGzFKF8QdqFXFA9cdE3b/1usTFhP26oxofMXs0=,iv:Iz/LzS8yeKQgDiGchYdKNymBeekhopJtBWaQGOwRZlE=,tag:hMRwxJlKR21W7otW01GmGw==,type:str]

secrets/homepage.yaml

@@ -4,38 +4,38 @@ sops:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDa3NpNG5tenhqWVQ5RFAv
-            bjhhRWJWK0NFQVk0cGVpcVJGS3BFeWlSQWc0Ci9IT05mQTVWbmk3SFFpWE9KUnh6
-            bHhCSktlbzVUQm1lOHp3cVpiSHU3MDgKLS0tIGg1UU4vVVo0SXRwMjJsVUZEZkFC
-            TC9Eb2JaVUFDSWRMYm5jR1BBa2lEamMK4V77WUVbMXcsw83FFdL2Rk30oR4cAkqQ
-            kc8Z0+5kNJFUFilFb54dnWTOh27K7KZvU1qIdhG3X9fuMIHSuPnyTw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWaEZKVnhKR3ZnalQ1dWZy
+            THJ1Qi9EK2NHQXUxYlg1NWZqd1VuRUY0a1FNCkg0UmphaktuWklNVE85c1RuT3FV
+            bUwrVzIxQ2JhZmNqdnR2SUlIcGNiazgKLS0tIEVDZk4rV2tTT0pLd3I2RXVIZ0pC
+            RWJCbkxHMm1DRFJKZkRhRldiRFVFd2cKQvohCMbXDJzOKzfAN72/1S4CXj5d0bbK
+            Ge+V8Ew9S4+UR39iLtQzs7lNYYCtDxNnayEm0V8LlVkgeEj2HnS0bA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDRVdYVTY3QzR2MFJPVW9j
-            SUtmTldMRCs0dTlJcGFoMDVnaWMyNlF4OHlnCjg0OFFrOERKRFZVMm9NREhBOGRs
-            dTEwc0NZUk9hOEtvNVJDRXl0TDhCaTQKLS0tIE5OWm5CNzc5SW9IdGFud1N6Vm1D
-            djhzM29HK0FIdXIvaGIrRXlOMisxaTgKVCAiniAmfqJuwwiUpcGAvoyqnUEZ9gOS
-            SyhXMzv2cbomuOb0NiALRkd2up/uX0TVuz9wuBQvYYjJhqpFuSnbRg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBheTV2MllUaFMzTWpiRnFw
+            a3hHeFhyNHZGek9tWVhySnVLUzNDVzV2VUIwCitWLzJ1ZG4rVHRwZElOdTdXMmdX
+            ZG9RVktFQ0VvdDViSi92YzRIZXJYOHMKLS0tIDZkRHYrMmtyZUh6bE5KaldvMDY2
+            MitQdXpDTkNxME1pV1BML1ZRRG1NaWsKUBHmQa1io7qNp+xkEmYsn7Q6XSpQ/566
+            KYVB7GMSyp5YYsJv1vA8tLHnavLDam4zMZ1t24dgk8pWOZpJ4T6T4g==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1UlM2MC90SEM5elBtNmpm
-            cnpTQVF0VEpLUDJPZkEyeGNuYnl0cEY4M0U0CjhOY25BcERjOThkbkVhNnJtaVpv
-            N00zOUZPWnNYaEtYMzlXZk56dGVPeGsKLS0tIDVDcGY5cG1ETHk4eXRFN1hVOXhV
-            Y2xncFJuNUs5ZkhLSjJyc2pzdDZxbEkKn/8BtUXPQ0OdR35ZwiHWFB0AqaDtAlG7
-            N4Z7iztqiscuxn8G8VVVFdkQLBY3JcrXhxPYWK4xtJeEtpIMhegxeQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkanhPTzY4WEhVLzFvbjhR
+            emVmVmZIRmVDelpONmM1SUhuT2Zadi84aW5ZClRaVGwrbjlGYkZiOVR0V2RuVWR3
+            UVBlNG9RUlpUZlJ6VFhKRHQ3T1VMRVkKLS0tIGpUTzM5MVA1LzdsNW5IMGlZcitR
+            aG9pR0RRd1NBalhweEdGNnNCVHFvb0UKIiFruo9rV/VD6XykanHIpbI6G6D3cGG/
+            ZGSxH1HD9qIVYDQ5LpBfUy/dZxRnpTiBJ7Veg/Siemz7kmChlmVDQA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzd1VYanVSZTd5elNlZ2NC
-            bnd0V0VZVmtrVDhBbW5KUHJDMUkrekVZeldRCjBNY3g1SkVKUzhRL2xsbjloUERi
-            UXM4T1A0a1V2eEFlQWlTQ2tDdFdaZ1kKLS0tIFFtNDZzbzYyaE5UT3R4eDJzNnU1
-            RG9UbWM4YTVHcFpKblQwemNScDVteVEKA6fibq6Ozwrz/tg9Hrx4bH9LCadmW5fR
-            IkFalgD7nqew8KwS0keyKFk93i2p6sTDZPy2/t+WryMXBIc/y0iQ5Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UWRTR2x6aWJEZ1p4aE1O
+            RGpSM0xVRVJpTDhVa0dhTWwwTVp1Z0NkTW1RCkxRVUhkMklZUVhDSEE0bkZHaFlu
+            UGRvYURuMWwzOUtoTzV2V05kblRpNnMKLS0tIEgrYXBpYysvenRGMENNcTY5L0dk
+            a1pWRTkzSkZGaTVtbVc4VjdHdkpneGMKq+3Pd2dOJAnC/PKEYijWbk1vQSes3ykt
+            1A88VIO2o/isCLr9643SVkZQ4WbISA4xvInG+peEdbja0oZNRQNU3w==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-02-01T22:31:04Z"
     mac: ENC[AES256_GCM,data:gtTuLmgVd5t1Eic+ld6x3pmAlv2+SVf4OgUICu78DJ9L1YCtmJ+LsqIoHFueMdQAmubPA8c4xYsHWCDu2dbrUDUs/79BF2u4P9lbNkJx5cco8bnPdy2tmkhcLwb0HwRduVIbgcm0wzYKUMd76Y0ChxdCddkrkk+PjXkUE7OBNg8=,iv:Eqhoc6GjB1NOnIIeRIdVoQNQm51DguH3vEX4zRUgeBE=,tag:V25oIemZpdJDMRFcZkH4bA==,type:str]

secrets/keys.yaml

@@ -51,38 +51,38 @@ sops:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRGVscDJsU0ErZ1VBRzVq
-            dE5aNUZvcmhVRHVjYUJFT09hdDd0UzhIS3hNCkRFRlphRXBTd3VFTE81RjJRaE5w
-            bzJSaCtsT0QwMkx2WDVyZ0FzeFphWk0KLS0tIGN5M0QyWmQ4Y3lCU0FXaU9vL0hv
-            MEp1ekxTdWp2b2g4dFd3OVNkUlZBMGMKzNGSzYgQsNW6HEvzTWmo73GShAAv/g8+
-            h3/6n/ObqlKsjDyVFgiOYop3LWfwPMzmOhx4S0wsOHit0UxdyoJwWA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnVVQ3NG9lM0l0MzlYaVA4
+            dEpOajlJeUxYTmJlMXJJMlN3UnRwZHEyaHlVCmYya09LMU5UQ29pQ3JCeWJnRkI4
+            ZEpzRk93WUhXR25QK2c0UjRlTnZld0UKLS0tIHZPUGthU0tBTVNzRmFmVUxnSkda
+            RUVNLzM0QUZLRFRCOFpjTXY4eHprUWcKK0+r6kWEw+gC8P+afVvw31SY63PTKb1C
+            D1KCOugRHnNT+xOELiVg9jjFW5lTJc4U2OBe/IpsGBujleXrWKwpvQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLUGFaaHFtVWl1cG1XdlRT
-            TUh0MHZTa0JhdDFSTVJZOWJBd0F0SWI0N2tNCkdnaG5DcXdDT3dqRVJDcjlsZ3Fz
-            ZFFaeTB4UTBQRVYzcldndm1RSjhCTzQKLS0tIDJySFIvbGpBd0l4RzYwVUd1MWpF
-            ZHhxdERrd3VNUGpTTlZUM25RYzJwSjAKG2DZUyomWm8Nxn6mPDKbBh1YsEUr642a
-            nGYxmuRVBVINbOB3gBPwgLeD+S2Vlm4vrC/u2761fTgm8KFLC+txpQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZY0JpODFjNkhQbnFHNlJU
+            V0s0YWZSTC9OTWdXR2h3S0FkM21CN3NocURVCjM5TWNNYzhkUW5jcHVuSW40ejJs
+            MkgydVlpejhzWFlMZHNGMzdqaEpPcFEKLS0tIHdzQ3UySDFpeWhVMDk0dmswTW9N
+            U1M3aXlqSHQwaG1DZysza25KZVRDU2sKp6kZa/6/Or9zdLTfFf/lKWcoHDz4v6p7
+            UEAA3twa1VXAk7dqmDmp0Szngu8y7iF9BE5fS1nb5n+rUa9DrwWvng==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXTnc0N3JWUGk3cWV0QXNK
-            L0ZWM0I0NVlVbTdsZmdRall2V3FUTllidlJnCjQwbFJ1TjVNQjl3NURQenBDZVhy
-            QXEybkIvc0RnV1dNL1Rhem9GajhzY2cKLS0tIFk0Nm9JK2ZvenJsYVF2RUJLVzVL
-            bzFWRnFjd01wbDVrQnhlb3NYampEVEkKWl3/oymEX/TdMHyxE8mOopIwu4Kots27
-            teyBmo6aVTAQ1zSxGDszI6kgK6PC3Z/WqaMaoJilGI6k8vCkOT3oMw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrU2Y1RC9aczBVWjZoS1Vp
+            VFp4VmtkME0vNVpnZXRYQmxmdHhZb01MelY4CjhHcnpVenVFd0YxOGJmT3pOOEF0
+            a1VBNGpSNSttblF3b3ljRDI2NjAwbzgKLS0tIEdiYWpucEY5N0JVN215ZWNDZmkr
+            SlJJaUFzaGdwdjhwdjJUWG1TdnZIWHMKGvQWCQNr83Z0CP5jGHc2wvqOIUdGC7+2
+            8buS4XK22o7EotL4bbKsEw5dgWQIBRXH+9XCq56RIUYR0T/T9UW0ew==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtaG1Ea0ZyZ1IrRGxEaUdw
-            TzlMRE84ZDBXRTNFWHcwNE81MDZlYStTZWdFCmxLbUxORFNVVHRGYXV4bDRvV1Ra
-            Rzg0YnpkaDJ3alhxalFFck10MjF4MG8KLS0tIDgwSEhReERtZHZ3U2RWcnFaaHlI
-            UmQzNEJVVTVPRHFqVlAraTR2bHNOdmsKKCVCzZ10sEA7rGRCUxbpYlaR6Y2jZvho
-            THbZe5MHY1a44L2XQSZe3I+1qOVBWVSL10KYTjJIBTxoeBtjlQJAVQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnblN2TkRudTZCN2Vvcldr
+            UDdBNXYyaUJVdkRDL1Zlb21vK1NlTnJyV1MwClFRMWpQYmo5amRWMTRCTlYySTRY
+            YStldXhHdnR4RUcvNFpVbUZPMGpFQU0KLS0tIEV4MGZ3YUJjOVdLNDF6RFhIOGs1
+            bmtmNDJ5OFlQYlZTWmQ5S2FmdEZ3clEKYRQ7nuP3G63vwyhW0wLQISrkiY98F3jx
+            7c9qMd2eGVvrOQr5M2OEPcjKexBa9Qt6O5t+dABrTmXCa42B251zWg==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-02-03T21:56:09Z"
     mac: ENC[AES256_GCM,data:Bnjo3TFYoGbtB8HF1i+ZQLlfeBMOjq14lu8oLRqcZ6Fx5Am0uuh+/PHClWZ/JX5suC0Kb81+aBHg2QTsLoB6zdUrRpaqa0CUxTDoGw8tpo8m6zLWvSggpYLAuRgTYqBZ0lVK1QxAi9+qVJQ5AIhYwSPrf2oq/Mpq4tFGUoG/tzM=,iv:8JqAeBVYnZM8A+CPAlKN+6SDty0XQ4AKEBJLGV8Q738=,tag:CQXE5QsfJMiI7UQoCfE3dQ==,type:str]

secrets/secrets.yaml

@@ -19,38 +19,38 @@ sops:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQTUEycms3ZkdMd3hpcXJz
-            R2pZZEc5STZ3dUdYbUdsSGJaRWI5TWNMK1RRCjVxR1pzY0ZVUmcwSjJFYktteWoz
-            YmlaVkFPRnZha3h5ckV1TVQyVWZKdGMKLS0tIFgvdWF5VEJwTTcwdXZ6SDRMU3BL
-            V2x6NlhyY0pmUVBsYmZITjArdjJRbEkKvzsJxs5EHR0uumwhZ36MhKuMS+WkogXU
-            nSVRQoc5TClzYwShY1ltHK+LCl0DlB4xFoMiO4GWwH1TySKe/ywpUQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCWm1RTldOekErU3pxcEpP
+            dWducG4vTGpuYkhlZDY2a1lLemRFaW9uNFRNCnNtRExLbVBXUVBXRjhhMW1NcjR2
+            dkR1MFBPdDhPMldaYzk2V2pYQjZWeHMKLS0tIFc3RDhLVXdtaC82RUpPWnVGdjc3
+            d2JyM043WFJSL0grR0FheldHdWFSTXMKxf4LZ1sKH+HKKCT4w8AmKk+DtVoSobtn
+            20acQeJsbuAng+/DIQccPSp//3+3YkfsBRfSGg90vQPNKzxxNmrY1Q==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnQytNaUs1M0hiYi8vdDUx
-            V1NtZ3VGNFVjRHRWUzliR3M3Q2Z6K3RWSHo4ClQ1RE1PeHJ4REpubVJHb0lJcGJ2
-            SEFvT2YvNWhMc2lneWR5NmRYc2pzVE0KLS0tIGxkRWRRRTNtVDUzVXh2L0lEa3RK
-            YjFSUDJHUjFUeVBFbUlKOS8ya1ZhMW8KssRH3/XT1iCVgV+6Sh25Axp0c96aHtVX
-            /HXN3AwTm0GJZCQnZsVIIPtoCzhUZSza+bzGZIZODYtgtCIxtdzVSw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmSTA4Yk5TbmIyVzJWb3h1
+            bEFsb0l0Uk5jVDdvL0hMdlBFUzBJdTA3bEZvCmRMRmdyM3lieDVGVDZ0bjRpSngz
+            c0FqNjRWN29zdzFsRnhtcEhUeEtwb1EKLS0tIEkwcVdpWmhKZEVZM052WU16aXZi
+            UjFxUlExazVhc1hkcmZuT0ZadG1pTmcKADLIwbz9KlPgTrs3kxeWEgKsfh9K9Qyp
+            +PSLBc8OjORDBBqqRcFJ3D9paiqppegGAPKaZ9INCXVoWke+wEOL3g==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbkZpZFJCY21IRkJjNkRB
-            UEdEVlZhRWhRb1ZDMjJtMmpkUmpnY3ZvMGlFCnBLcHlkMWNyMy8wenYwT2pmRTZL
-            dWtiWFlaR1FrL21HQTFZM2N3a3BHYW8KLS0tIFlYZWVHb0VEeDU5NnRjbDk5M2po
-            K0xRRFhua09DRE04WUd6NlZuQldFbEEK2OgiawCbCtbrk8l45QdjVu8+VNWbrl4i
-            3U9iwek30JkQSZaWBXaCZlWLvbKNjIMpwTtxDOhxmu4DUh3Hx6In/g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSM2h6Rkp3T1c3UTJXVGEw
+            ZHJJNndrUGdtVnZNOWJobzZFb2U5d09LekJzCm5mSUd6V05BUUZpMm9US2JhRUNP
+            YnZ4U1RBSUdMaHJnd2ZGNVFyT2hKeWMKLS0tIGpzUHlVU0JMbitmSzNjOWdaRFFI
+            YlJoZUVoQWFHMEg4Umo3WDZHUVppQncKL8HtEF3+uI/qm8K/u7V7IlEv8Lt0QwQv
+            SPzuq89L/aT7hK3LyB88B2pvAKE2Z1Kj/3Z3depQfujIQsulpIg1lA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySjBmaC9rREpUQ3BvWWNU
-            MWEvM3ZGb2RXZ0dMdWxLRTJCR2VSdyt5VUhBCjBvL3MxZ3pTaFQ4aGdZVnAxUmd3
-            YUtoZkhEV01TU0drRUdDaFZ5M2tZLzAKLS0tIHpBL3NwV2NhN0QwcHdwbFpQWlZn
-            eUNjc2RPOUxLTGowTlRqN3lEdjRLU2cKTTEXmHyhnL/hZGDr8ONrmzdU6Or5xkKY
-            GHADDt+LCg8njcZom39Aj4kpCx+f7HlV65glKwr37vZ0sL9KE+O9+w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNWFNMXVsdWJKYXJaMCtM
+            NHRVeVV0d0dXQjhwTk9ZbkpINUxUTkNISXpzCjI3blp0bkZiM1pVcDBYaVkwaUVQ
+            ZTRicDhmdXpybzI1SjZSdDAyYmR1eEUKLS0tIDdUTGdvQzFXMDBMemJUMTc3MURD
+            S3FxRUI2eEg3bGs3Rjh2YXhiMnQ5eGcKAHlMDXwb1uULH+lLuWW4dMxofXSbKRMt
+            Ce/mfgDwqERw8h2yotOoSkNSFBQ2kPLu3/NeTsVAfbdSMyp/T3aJ5A==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-01-16T15:38:39Z"
     mac: ENC[AES256_GCM,data:4xaoGvLq1UIdozNqQ7v+pORVPDCk+FZRsCRvZ3C5AZOwSaM+UfDYZcI32AI0K80yFyhVIrrjqylykvXghbpQGAju3mv7+7Tbn5p2gqXrB/m1FuyVe/ftw7SSn8FTGL14cdHuPPkQTvV/u7z1IfX4YAOEGqtWiEfOe4YoWT3xc3A=,iv:dygbKjQ0ljgBPyk2aEIa/Mpbs/At+UzuhYy8Sndx/nk=,tag:jYbROlRxeDxqF1YqrBGL8A==,type:str]

secrets/ssh/ed25519_nixvps

@@ -1,7 +0,0 @@
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-QyNTUxOQAAACAg2NEQIaCDPaucUAqi1iUIppNyQJH2AHGm8RhZ8ZjQagAAAJggRAEdIEQB
-HQAAAAtzc2gtZWQyNTUxOQAAACAg2NEQIaCDPaucUAqi1iUIppNyQJH2AHGm8RhZ8ZjQag
-AAAECI12wNotU67+KnPGhWMcLUxotEQdz4jry+aijaiHP26CDY0RAhoIM9q5xQCqLWJQim
-k3JAkfYAcabxGFnxmNBqAAAAEGphd3pAd29ya3N0YXRpb24BAgMEBQ==
------END OPENSSH PRIVATE KEY-----

secrets/wireguard.yaml

@@ -14,38 +14,38 @@ sops:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlemJmbnAwUHZHT3ozdWxH
-            Njh1ZFUvVW8zcVV6SGxrVW1IWW9ZUFBaTEh3CnJsMnFnM0d5YnBKWE5CT2Flang0
-            TkNZb0xCY2c4Qk1kdXRkRXcvOU1TSW8KLS0tIE1VdGEraW03bnV4VEc5c0ZheFJ0
-            MFJpVTlvTGJ0YXBKSnFFbXhEUEwwSmMKxOtHLbRw5e6dRW4jvqFLsl6UzKZ+mvfR
-            hwKJ4KEbXuCqwtPQEWk/pF0i4vzrgUP1Cp1Y7BxGGyK9ufyV/CCQIg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXN25MZVQzTmora3o3YjJs
+            aUptdGxJY2YxZU5XSjBjczFnTFVVdHVsRkM0CkNFN2JoelQva1ZucUxNNUJsVk9z
+            cVZVU0MxL2Y3b2dNRnhJSzZrSVlaRWcKLS0tIG1vTHB1dHNWa0RLR1BRV0hFUVdx
+            blY1QTNhUGpKZ3EzRHNadStxaCtLb1kKtyXKpZGLtrUo1HE26IWhv8245Bjcwcqe
+            IR2WGv7qtnpWZoaFv76LNN7YY1JViy2k2AY+TdLmFQr0Vh2n5+tH1A==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5cnE5VENCMUxxOVZUdC9X
-            QWFMRytGamhaWENZY1Q4STR5L0Jsdk90SlUwCis4ekFWYmMwN2dESXMrVFNIamFG
-            RzhET2ZGdGN6b1V1ZHkyOCtDNzBWVjQKLS0tIEF1NGdoU2lqYVdIN3hwRk13SFpP
-            RHNOeDBlSHFpays2VkRuR2RxaGpYZ1EKwxZfRZthZHVuJe3D5pamCSxYo3hyaaVc
-            I0UvMDMgcDRZuEzV9g1ZEYnaVXg5InyOO0dDZuCYX/HZqTLPiaOIxg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZbHVXV2hVTWZlemdCQmI0
+            SGwwK0hDYjNkWGJMMTVuWnNMVW1Ebldsd0RRCmNoN2dZN2JiSEpzUzNwcjU3eFVv
+            QmNnWERpQVByYlRqUDQrWEF4bkRPQm8KLS0tIHNOaDhQZExuOVJIVXZGQVdFeGhQ
+            QXRJRFlZWXJUVW9nVDhOaUFacjFlSzgKYSs6Woc/lAr2ECcrqoMCAwvIbXTpbtTr
+            J4ljY3BRCdSzHEMS9IFV2j9nGu8sUrHRsO7V/Kc8i+XmTGZP76LRJA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaUhOcHV2TkYrZWxnOCtI
-            TzF1RVpFY3pSa1Y2MmJjVlpKcWZnWGtOOTJ3CmRnTUpyRms2aUtvS1ZvVXFsb0ZQ
-            U0RiYXM3S0RKQjVwL2hqYllhZENUdmsKLS0tIDNTRHR2ZU1VTzdNNXRDU0xkcTRM
-            ckowd2p5bitGYVhMNU9Qc0NUeFFJV3MKPKT1/06/fKpWPOMsRaU/fpyVUf7onWGB
-            0P22NBzP1i5caqSrFnVVeyuhgYxabC4oUKVmjU5QIj1R8Rqh7gworw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlRGwzbm9rY3hXeHZReWZW
+            VngyN3ZlZDJWekExNkNBdCtLT1J6d0ZYU0hrCi9RRWNYUyt3OGh1ZVNCNWI1U3Vn
+            dnByZnVpYmV1RndKQUxHbUtrS0F5L3cKLS0tIDJONlcvMllKOWRxdE5ZWUZmaFEx
+            S1JCM2x1WDF0Z3c0ODZNb3FKOGNhMlUKGP8P/PUcMM1c4VzXLjLNp/zThu8JCiyQ
+            iHdz0LBSAha/m23b316z72yg3YD5q+/qDP8KczAv1SG+VvgHDKxpCg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ml3smrs5mwz4ds84gk0eyss86nwsmp07qh0npxsuae7lfwwpsghssavytw
+        - recipient: age1v2ahkl759cftpcdq4mla2cvmgz4jlnmgj7qtgc9732zxrfvxf3lq76zjpr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3SHdHTDhKQzFUQVdqM0hW
-            Tm9QdVozaHViQVRuTExhV1BpdWYvY012enk0CmhjODlUN0FkNldGRG94bVFSTVBv
-            QUNWZmszRStZN24vZWhnajhIcWdXVDgKLS0tIG9ueVZsT29KRE1iM2oreWtGWGVC
-            SG40OS8wMHlKNmxQa0VScHQrU2NmT2sKt9xw/8jsgnV1cZndqYNiHvIf8VdEJYCl
-            UUJ1KPz9mvUx3ny+rK50FSD61U8PHEZm2UC0w+/qkZwRtCx21Ku6dw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5Z3hyOGFJTlpxOWFQaWsx
+            WE9oYmJaaWxURjdmRlVJMUcxaUZKWDZCS1VJCmxWV01DRloyM3lLemJYc2FxcUdH
+            M1NZRGxjVUVEUExTWjFaazhRaDdCUXcKLS0tIFF6NW4vSGJSWjN3NHFlOXRUYXhM
+            NXZzQmlneDNEb1UvR2NGK0kyY1lsa1kK7IQmyuVxa2hmic4yTeiAcxN41RvMcIDV
+            Pofrhu7q8VvB/Cxb7FjVs3Ed5Hdz9xQ60mXUKsnJV/rIssm9wx4cfg==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-02-04T18:37:11Z"
     mac: ENC[AES256_GCM,data:AlrMK34dWDm5hfVwnQnzk3l8NIRbiVV6KHa6io9S9l07WvC3TYLTOJS6xOi4pkEz6sqQ7IpZU7RRdosxuQp50NmMEt2QYawTHFZIgzFYeKRbl5N5LCu9afC6yTtvG/sT7uenTMhh2qT1JBwebJiUdM9zNVUzWlW5d1SdxrHgIbs=,iv:dvqsDaC+trhY1kheYUEOEwHfCDz0Mu7N0LpfjnKko5g=,tag:tuqyK8vuwSrk1kf+Vi7MKg==,type:str]

specs/001-ai-docs/data-model.md

@@ -14,7 +14,7 @@
 
 ### Reference Map
 - **Role**: Index mapping core concerns to repo paths for navigation and validation.
-- **Key Fields**: category (apps, dev, scripts, servers, services, shell, network, users, nix, patches), hosts list (emacs, server, workstation, miniserver, galaxy), secrets files, proxy rules, auto-import rules, stylix/schemes, audit checklist entries, navigation links to constitution/playbooks.
+- **Key Fields**: category (apps, dev, scripts, servers, services, shell, network, users, nix), root paths (patches), hosts list (emacs, server, workstation, miniserver, galaxy, vps), secrets files, proxy rules, auto-import rules, stylix/schemes, audit checklist entries, navigation links to constitution/playbooks.
 - **Relationships**: Anchors citations used by Constitution and Playbooks.
 
 ## Constraints and States

specs/001-ai-docs/research.md

@@ -29,3 +29,8 @@
 - **Decision**: Gate SOPS configuration behind `config.my.secureHost` so non-secure hosts skip secret loading.
 - **Rationale**: Aligns `config/base.nix` behavior with the constitution’s secureHost rules and avoids secret dependency on non-secure hosts.
 - **Alternatives considered**: (a) Leave SOPS enabled on all hosts (rejected: violates secureHost contract); (b) Duplicate SOPS logic per host (rejected: increases drift risk).
+
+## Decision 7 (2026-02-07): Module categories and patches location; active hosts update
+- **Decision**: Treat `patches/` as a root-level directory (not a module category) and update active hosts to include `vps`.
+- **Rationale**: Repo structure places patches at the root and hosts include `vps`; documentation must reflect actual paths and host inventory.
+- **Alternatives considered**: (a) Move `patches/` under `modules/` (rejected: would change repo layout); (b) Keep `vps` undocumented (rejected: causes host list drift).

specs/001-ai-docs/spec.md

@@ -89,6 +89,6 @@ An AI or contributor can update the constitution and use-case docs when repo rul
 ### Measurable Outcomes
 
 - **SC-001**: An AI with only these docs can describe the correct steps and file locations to add a new server module in under 2 minutes of reading time, matching existing patterns.
-- **SC-002**: The constitution explicitly enumerates 100% of current module categories (apps, dev, scripts, servers, services, shell, network, users, nix, patches) and active hosts (emacs, server, workstation) with their roles.
+- **SC-002**: The constitution explicitly enumerates 100% of current module categories (apps, dev, scripts, servers, services, shell, network, users, nix), documents the root `patches/` directory, and lists active hosts (emacs, server, workstation, miniserver, galaxy, vps) with their roles.
 - **SC-003**: Guidance includes the full secrets file map (certs/env/gallery/homepage/keys/wireguard/secrets) and secureHost behavior with no omissions when audited against the repository.
 - **SC-004**: Playbook locations and required fields are discoverable via the documented index in ≤2 navigation steps from the top of the spec.

specs/004-vps-migration/contracts/openapi.yaml

@@ -14,7 +14,7 @@ paths:
           description: Proxy mappings resolve to services on host server
   /verify/firewall:
     get:
-      summary: Verify iptables ruleset parity
+      summary: Verify nftables parity against the iptables reference
       responses:
         "200":
           description: Firewall flows match expected allow/deny behavior

specs/004-vps-migration/data-model.md

@@ -17,7 +17,7 @@
 
 ## FirewallRuleSet
 
-- **Fields**: sourceFile (iptables), rules[], appliedHost
+- **Fields**: sourceFile (iptables reference), rules[], appliedHost
 - **Rules**: Ruleset must be applied as-is; no translation allowed.
 
 ## VPNPeer

specs/004-vps-migration/plan.md

@@ -5,18 +5,18 @@
 
 ## Summary
 
-Migrate VPS responsibilities to the new NixOS host by making it the primary reverse-proxy host (nginx only), mirroring the existing iptables ruleset, enabling wireguard with secret-managed keys, and restoring SSH/service-user access, while keeping all services running on the host server. Provide validation steps, review historical configs for gaps, and document analytics data migration.
+Migrate VPS responsibilities to the new NixOS host by making it the primary reverse-proxy host (nginx only), mirroring the existing iptables ruleset via nftables/NixOS equivalents, enabling wireguard with secret-managed keys, and restoring SSH/service-user access, while keeping all services running on the host server. Provide validation steps, review historical configs for gaps, and document analytics data migration.
 
 ## Technical Context
 
 **Language/Version**: Nix (flakes; nixpkgs 25.11)  
-**Primary Dependencies**: NixOS modules, sops-nix, nginx, wireguard, openssh, iptables  
+**Primary Dependencies**: NixOS modules, sops-nix, nginx, wireguard, openssh, nftables (iptables reference)  
 **Storage**: Files (configuration and secrets)  
 **Testing**: Manual validation steps (no automated test harness)  
 **Target Platform**: Linux server (NixOS)  
 **Project Type**: configuration repo  
 **Performance Goals**: N/A (configuration change)  
-**Constraints**: Services remain on host server; VPS only terminates proxy and exposes wireguard port; iptables parity required  
+**Constraints**: Services remain on host server; VPS only terminates proxy and exposes wireguard port; nftables parity required  
 **Scale/Scope**: Single VPS + host server, small set of VPN peers and admin SSH principals
 
 ## Constitution Check
@@ -45,8 +45,8 @@ specs/004-vps-migration/
 hosts/
 modules/
 secrets/
-iptables
+iptables (reference ruleset)
 scripts/
 ```
 
-**Structure Decision**: Use the existing NixOS configuration layout (`hosts/`, `modules/`, `secrets/`) and the root `iptables` ruleset file.
+**Structure Decision**: Use the existing NixOS configuration layout (`hosts/`, `modules/`, `secrets/`) and the root `iptables` ruleset file as the reference for nftables parity.

specs/004-vps-migration/quickstart.md

@@ -3,7 +3,7 @@
 ## Prerequisites
 
 - Access to this repo and the new VPS host configuration
-- Existing iptables ruleset file available at repo root: `iptables`
+- Existing iptables ruleset file available at repo root (reference for nftables parity): `iptables`
 - VPN keys present in the secrets system
 - SSH public keys present in `secrets/ssh/`
 
@@ -19,10 +19,10 @@
 3. Update host configuration:
    - Set new VPS as primary reverse proxy host
    - Enable proxying for all enabled services (services remain on host server)
-   - Apply iptables ruleset as-is
+   - Apply nftables/NixOS firewall rules derived from the iptables reference
    - Enable wireguard on VPS and expose port
    - Add service users and admin SSH keys
-   - Update VPS public IP to `45.33.0.228` in SSH configuration
+   - Update VPS public IP to `45.79.25.87` in SSH configuration
    - Update host server VPN client to target the new VPS
 
 4. Provide and review legacy proxy config snapshot:
@@ -60,9 +60,12 @@
 - `mb-report.lebubu.org` and `torrent.lebubu.org` are present in caddy but no matching Nix server host was found.
 
 5. Migrate analytics data:
-   - Export data from existing server
-   - Import into new server
-   - Validate historical data is present
+   - Identify the analytics system (e.g., Plausible) and its data store location or database
+   - Freeze writes during export (stop the analytics service or enable maintenance mode)
+   - Export analytics data from the existing server (db dump or data directory archive)
+   - Transfer the export to the new server using the secure path already used for secrets/config
+   - Import the data on the new server and restart the analytics service
+   - Validate historical data is present (date range coverage, dashboard counts, and sample events)
 
 6. Run verification steps for each task (per spec FR-012).
 
@@ -79,13 +82,13 @@
 - **T002**: verify this section exists in `/home/jawz/Development/NixOS/specs/004-vps-migration/quickstart.md`
 - **T003**: `rg -n "mainServer|enableProxy" hosts/server/toggles.nix modules/modules.nix`
 - **T004**: `rg -n "wireguard|wg0|services.wireguard" modules/services/wireguard.nix hosts/vps/configuration.nix`
-- **T005**: `rg -n "vps|45.33.0.228|programs.ssh" config/jawz.nix modules/modules.nix`
+- **T005**: `rg -n "vps|45.79.25.87|programs.ssh" config/jawz.nix modules/modules.nix`
 - **T006**: `rg -n "/etc/caddy/Caddyfile.d" sudo_hist jawz_hist`
 - **T007**: `rg -n 'mainServer = "vps"' hosts/server/toggles.nix modules/modules.nix`
 - **T008**: `rg -n "enableProxy = true" hosts/vps/toggles.nix hosts/vps/configuration.nix hosts/server/toggles.nix`
 - **T009**: ensure Caddy vs Nix comparison section remains in this file
 - **T010**: `rg -n "iqQCY4iAWO-ca/pem|certPath|proxyReversePrivate" modules/network/nginx.nix modules/servers`
-- **T011**: `rg -n "iptables.rules|iptables-restore|networking.firewall.enable = false" hosts/vps/configuration.nix`
+- **T011**: `rg -n "nftables|forwardPorts|vps-snat" hosts/vps/configuration.nix`
 - **T012**: `rg -n "services.wireguard.enable = true" hosts/vps/configuration.nix`
 - **T013**: confirm `wireguard/private` exists in `secrets/wireguard.yaml`
 - **T014**: `rg -n "10.77.0.1/24|10.8.0.1/24|10.9.0.1/24|AllowedIPs|allowedIPs" modules/services/wireguard.nix`
@@ -97,7 +100,8 @@
 - **T020**: `rg -n "45\\.33\\.0\\.228" modules/modules.nix config/jawz.nix`
 - **T021**: `rg -n "endpoint = .*my\\.ips\\.vps" hosts/server/configuration.nix`
 - **T022**: verify "Clarification Candidates From History Review" section exists in this file
-- **T023**: intentionally skipped by operator for this implementation pass
+- **T023**: `rg -n "Migrate analytics data|Export analytics|Import.*analytics|Validate historical data" /home/jawz/Development/NixOS/specs/004-vps-migration/quickstart.md`
 - **T024**: verify each task from T001-T026 has a corresponding verification line in this section
 - **T025**: `rg -n "caddy|Caddy" README.org docs || true` and confirm no active-proxy references remain outside legacy migration notes
 - **T026**: `rg -n "T0[0-2][0-9]" /home/jawz/Development/NixOS/specs/004-vps-migration/tasks.md` and confirm each task mentions at least one concrete path
+- **T027**: `rg -n "modules/websites|danilo-reyes.com|blog.danilo-reyes.com|mb-report.lebubu.org" modules/websites hosts/vps/toggles.nix`

specs/004-vps-migration/research.md

@@ -8,7 +8,7 @@
 
 ## Decision 2: Firewall parity
 
-- **Decision**: Apply the existing iptables ruleset as-is on the new VPS.
+- **Decision**: Use the existing iptables ruleset as the source of truth and implement equivalent nftables/NixOS rules on the new VPS.
 - **Rationale**: Ensures exact behavioral parity for complex routing and hot-swap behavior.
 - **Alternatives considered**: Translating to another firewall system; partial translation with mixed rules.
 

specs/004-vps-migration/spec.md

@@ -3,7 +3,7 @@
 **Feature Branch**: `004-vps-migration`  
 **Created**: 2026-02-04  
 **Status**: Draft  
-**Input**: User description: "start feature branch 004, the git fetch command will fail, so force 004. Feature 003 added a new hosts vps, as a linode host, I want to now fully migrate my existing fedora vps to this new nixos vps. to do so I want to bring in the configurations fedora vps has. 1. right now the nginx logic of my servers is disabled, because I let the fedora vps handle the reverse proxy through caddy. But I dont want that caddy logic, on nixos I want to let nginx take care of the reverse proxies, plus the logic is already backed in, there is a isLocal logic to the factory, and I dont remember exactly the name of the code. but there is some flag under the my. options that specifies the mainHost, the constitution mentions that mainHost is the host handling nginx and because the vps will be it, then main host needs to become vps, I think before it was miniserver. This change means, that all the currently enabled servers on the toggles.nix from the host server, should have the enableProxy flag on vps (double check the logic) this should make it so, that nginx runs on vps, and the servers run on server. 2. Add a step to ask me for the caddy files, just to check that the subdomains caddy handles for each server match the subdomains on the servers/.*nix files. 3. I use iptables on the fedora vps, and the nixos vps, well I dont mind you using another firewall but there are some complex firewall rules that I need them to work 100% as the original vps, the rules will be on a file named iptables, this is perhaps the most important step, otherwise the complex network configuration this vps has wont be able to hot swap and serve my servers to the world.
+**Input**: User description: "start feature branch 004, the git fetch command will fail, so force 004. Feature 003 added a new hosts vps, as a linode host, I want to now fully migrate my existing fedora vps to this new nixos vps. to do so I want to bring in the configurations fedora vps has. 1. right now the nginx logic of my servers is disabled, because I let the fedora vps handle the reverse proxy through caddy. But I dont want that caddy logic, on nixos I want to let nginx take care of the reverse proxies, plus the logic is already backed in, there is a isLocal logic to the factory, and I dont remember exactly the name of the code. but there is some flag under the my. options that specifies the mainHost, the constitution mentions that mainHost is the host handling nginx and because the vps will be it, then main host needs to become vps, I think before it was miniserver. This change means, that all the currently enabled servers on the toggles.nix from the host server, should have the enableProxy flag on vps (double check the logic) this should make it so, that nginx runs on vps, and the servers run on server. 2. Add a step to ask me for the caddy files, just to check that the subdomains caddy handles for each server match the subdomains on the servers/.*nix files. 3. I use iptables on the fedora vps, and the nixos vps, well I dont mind you using another firewall but there are some complex firewall rules that I need them to work 100% as the original vps, the rules will be on a file named iptables (treat this as the reference ruleset for nftables parity), this is perhaps the most important step, otherwise the complex network configuration this vps has wont be able to hot swap and serve my servers to the world.
 
 4. modify the existing wireguard.nix module, doublecheck that isnt toggled anywhere, toggle it on vps and add this configuration to it
 [Interface]
@@ -46,7 +46,7 @@ I need you to create the service users and groups for deploy and lidarr-reports.
 in those, I need you to add ./secrets/ssh/ed25519_deploy.pub to authorized_keys for the user deploy
 and for lidarr-reports ed25519_lidarr-reports.pub
 
-6. similar to every other host, add ssh login authorized_keys for workstation, server, deacero, galaxy and check if Im missing one. Because this will replace the ssh vps on the ssh config, you need to replace the existing vps ip with 45.33.0.228. 7. change the configuration on the host server, so that its wireguard session, connects to this server (i think will ve done automagically when the ip changes right?) 8. Ive added sudo_hist and jawz_hist, which are a dump of the histfile of this server, just check if there is a configuration that Im missing, something I did on there that I missed, and add it to the clarification list, so when I run clarify I tell you if I want that or not, granted lots of those commands are trial and error, so I think I have everything. 9. I have setup a plausible server, write the steps necesary to migrate it, I dont know.
+6. similar to every other host, add ssh login authorized_keys for workstation, server, deacero, galaxy and check if Im missing one. Because this will replace the ssh vps on the ssh config, you need to replace the existing vps ip with 45.79.25.87. 7. change the configuration on the host server, so that its wireguard session, connects to this server (i think will ve done automagically when the ip changes right?) 8. Ive added sudo_hist and jawz_hist, which are a dump of the histfile of this server, just check if there is a configuration that Im missing, something I did on there that I missed, and add it to the clarification list, so when I run clarify I tell you if I want that or not, granted lots of those commands are trial and error, so I think I have everything. 9. I have setup a plausible server, write the steps necesary to migrate it, I dont know.
 
 10. add verification steps for every task we did, when youre done and"
 
@@ -56,7 +56,7 @@ and for lidarr-reports ed25519_lidarr-reports.pub
 
 - Q: Are any services being migrated to the new VPS, and what does enableProxy do? → A: No services are migrated; enableProxy only configures nginx on the VPS, wireguard exposes the port, and services continue running on the host server.
 - Q: How should the analytics service be migrated? → A: Migrate existing analytics data to the new server.
-- Q: How should firewall parity be achieved on the new VPS? → A: Use the existing iptables ruleset as-is.
+- Q: How should firewall parity be achieved on the new VPS? → A: Use the existing iptables ruleset as the source of truth and implement equivalent nftables/NixOS firewall rules; document any intentional deviations.
 - Q: Where should VPN keys be stored? → A: Preserve keys only in the existing secrets system.
 - Q: Which admin hosts should receive SSH authorized_keys entries? → A: Only the listed hosts (workstation, server, deacero, galaxy).
 
@@ -134,7 +134,7 @@ As an operator, I want a checklist of potential missing configuration from exist
 - **FR-001**: The system MUST designate the new VPS as the primary host for reverse proxying and ensure all enabled services are routed through it without relocating the services.
 - **FR-002**: The system MUST ensure proxy configuration is enabled for all services currently enabled on the host server so traffic flows through the new VPS while services remain on the host server.
 - **FR-003**: The system MUST request existing proxy configuration files for verification and flag any subdomain mismatches against current service definitions.
-- **FR-004**: The system MUST apply the existing iptables ruleset as-is on the new VPS to match the existing VPS behavior for all documented inbound and outbound flows.
+- **FR-004**: The system MUST mirror the existing iptables behavior on the new VPS using nftables/NixOS firewall rules and document any intentional deviations from the source ruleset.
 - **FR-005**: The system MUST enable the VPN configuration on the new VPS with the specified peer addresses and ensure each peer is uniquely identified.
 - **FR-006**: The system MUST support encrypting sensitive VPN keys and pause for user-provided secret material when required.
 - **FR-015**: The system MUST store VPN keys only in the existing secrets system and must not place them in plaintext configuration.
@@ -172,6 +172,6 @@ As an operator, I want a checklist of potential missing configuration from exist
 ## Assumptions
 
 - The existing proxy configuration files will be provided by the user for comparison.
-- The firewall rules from the existing VPS are authoritative and should be mirrored on the new VPS.
+- The firewall rules from the existing VPS are authoritative and should be mirrored on the new VPS, even if implemented via nftables equivalents.
 - The list of standard admin hosts for SSH access is complete unless the review identifies an omission.
 - The analytics service migration steps are documentation-only and do not require immediate cutover.

specs/004-vps-migration/tasks.md

@@ -11,7 +11,7 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host
 
 ## Phase 1: Setup
 
-- [x] T001 Confirm baseline files exist: iptables, secrets/ssh/ed25519_deploy.pub, secrets/ssh/ed25519_lidarr-reports.pub, secrets system entries for VPN keys
+- [x] T001 Confirm baseline files exist: iptables (reference ruleset), secrets/ssh/ed25519_deploy.pub, secrets/ssh/ed25519_lidarr-reports.pub, secrets system entries for VPN keys
 - [x] T002 Create working checklist placeholder for verification steps in /home/jawz/Development/NixOS/specs/004-vps-migration/tasks.md (this file)
 
 ## Phase 2: Foundational
@@ -34,11 +34,11 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host
 
 ## Phase 4: User Story 2 (P1) - Firewall parity
 
-**Story goal**: Firewall behavior on new VPS matches old VPS by applying iptables ruleset as-is.
+**Story goal**: Firewall behavior on new VPS matches old VPS by implementing nftables/NixOS rules derived from the iptables reference.
 
 **Independent test criteria**: Known inbound/outbound flows match existing VPS behavior.
 
-- [x] T011 [US2] Apply iptables ruleset as-is to VPS configuration in hosts/vps/configuration.nix using the repo root iptables file
+- [x] T011 [US2] Apply firewall parity to VPS configuration using nftables/NixOS rules derived from the repo root iptables reference and document any intentional deviations
 
 ## Phase 5: User Story 3 (P2) - Secure access and VPN peers
 
@@ -54,7 +54,7 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host
 - [x] T017 [US3] Configure sshd port and auth settings in hosts/vps/configuration.nix to match: Port 3456, PermitRootLogin no, PasswordAuthentication no
 - [x] T018 [US3] Harden remote rebuild access by switching to a non-root SSH user for rebuilds (nixremote) and requiring sudo for nixos-rebuild in hosts/vps/configuration.nix and modules/users/nixremote.nix
 - [x] T019 [US3] Restrict SSH access for remote rebuilds by limiting allowed users/keys for nixremote (update inputs.self.lib.getSshKeys list in hosts/vps/configuration.nix)
-- [x] T020 [US3] Update VPS IP to 45.33.0.228 in modules/modules.nix and config/jawz.nix SSH host entry
+- [x] T020 [US3] Update VPS IP to 45.79.25.87 in modules/modules.nix and config/jawz.nix SSH host entry
 - [x] T021 [US3] Update host server wireguard client configuration in hosts/server/configuration.nix to target the new VPS endpoint
 
 ## Phase 6: User Story 4 (P3) - Migration gaps and verification
@@ -64,13 +64,14 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host
 **Independent test criteria**: Clarification list exists and each task has a verification step.
 
 - [x] T022 [US4] Review sudo_hist and jawz_hist for missing configuration; record clarification list in specs/004-vps-migration/quickstart.md
-- [ ] T023 [US4] Document analytics data migration steps (export, import, validate) in specs/004-vps-migration/quickstart.md
+- [x] T023 [US4] Document analytics data migration steps (export, import, validate) in specs/004-vps-migration/quickstart.md
 - [x] T024 [US4] Add verification steps for each task in specs/004-vps-migration/quickstart.md
 
 ## Phase 7: Polish & Cross-Cutting Concerns
 
 - [x] T025 [P] Update references to old VPS proxy logic (caddy) to ensure nginx is the only runtime proxy in README.org and docs/*.md
 - [x] T026 [P] Validate all task descriptions include explicit file paths in specs/004-vps-migration/tasks.md and update mismatches
+- [x] T027 [P] Move static site vhosts (portfolio/blog and mb-report) into modules/websites and enable them via host toggles
 
 ## Dependencies
 
@@ -79,7 +80,7 @@ Deliver MVP as User Story 1 (primary host reverse proxy + keep services on host
 ## Parallel Execution Examples
 
 - US1: T007, T008, T009 can proceed once T003 and T006 are reviewed.
-- US2: T011 can proceed once iptables application location is identified.
+- US2: T011 can proceed once the iptables reference ruleset location is identified.
 - US3: T012, T016, T017, T018, and T020 can proceed after T004 and T005 review; T013 depends on user-provided secrets.
 - US4: T022, T023, T024 can proceed independently once logs are reviewed and quickstart.md is open.
 

sudo_hist

@@ -1,457 +0,0 @@
-clear
-exit
-clear
-dnf install wireguard-tools neovim caddy
-systemctl enable --now caddy
-systemctl enable --now iptables
-dnf install iptables-services
-systemctl enable --now iptables
-
-ls /home/
-ls /home/fedora
-nano /etc/ssh/sshd_config
-nano /etc/wireguard/wg0.conf
-nano /etc/wireguard/home_private.key
-sudo useradd -m -s /bin/bash jawz
-sudo passwd jawz
-sudo usermod -aG wheel jawz
-visudo
-ls
-su jawz
-cat /home/jawz/iptables /etc/sysconfig/iptables
-cat /home/jawz/iptables > /etc/sysconfig/iptables
-cat /home/jawz/iptables-config /etc/sysconfig/iptables-config 
-cat /home/jawz/iptables-config > /etc/sysconfig/iptables-config 
-sudo systemctl restart iptables.service 
-nano /etc/hosts
-ls
-sudoedit /etc/ssh/sshd_config
-ls
-sudo reboot
-mv /home/jawz/Caddyfile.d/ /etc/caddy/
-ls /etc/caddy/
-ls /etc/caddy/ -la
-sudo chown root:root /etc/caddy/Caddyfile -R
-ls /etc/caddy/ -la
-chown root:root -R /etc/caddy/Caddyfile
-ls /etc/caddy/ -la
-chown root:root -R /etc/caddy/Caddyfile.d/
-ls /etc/caddy/ -la
-sudo systemctl restart caddy
-exit
-528491
-clear
-export TERM=xterm-256color
-clear
-sudo iptables -S
-ping google.com
-sudoedit /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-sudo systemctl restart wg-quick@wg0.service 
-sudo iptables -L FORWARD -n -v --line-numbers
-sudoedit /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-sudoedit /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-sudoedit /etc/sysconfig/iptables
-sudo iptables-save > /root/iptables-backup-$(date +%s)
-sudo iptables -F FORWARD
-sudo iptables-restore < /tmp/iptables
-sudo iptables -D FORWARD 4
-sudo iptables -S
-sudo systemctl restart iptables.service 
-sudo iptables -S
-sudoedit /etc/sysconfig/iptables
-sud nvim /etc/sysconfig/iptables
-sudo nvim /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-sudo journalctl -xeu iptables
-sudo nvim /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-sudo systemctl restart caddy
-cd /etc/caddy/Caddyfile.d/
-ls
-mv portfolio.caddyfile portfolio.caddyfile_
-sudo systemctl restart caddy
-sudoedit /etc/wireguard/wg0.conf 
-sudo systemctl restart wg-quick@wg0.service 
-ping 10.77.0.2:80
-sudoedit /etc/wireguard/wg0.conf 
-ping 10.77.0.2
-sudo journalctl -xefu wg-quick@wg0
-ping 10.77.0.2
-ping server
-wg show
-sudoedit /etc/wireguard/wg0.conf 
-wg show
-cd /etc/caddy/Caddyfile.d/
-mv portfolio.caddyfile_ portfolio.caddyfile
-mv portfolio.caddyfile portfolio.caddyfile_
-cat /etc/sysconfig/iptables
-sudo nvim /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-journalctl -xeu iptables
-sudo nvim /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-sudo iptables -L FORWARD -n -v --line-numbers
-# In one terminal, watch the iptables counters
-sudo watch -n1 'iptables -L FORWARD -n -v --line-numbers'
-export TERM=xterm-256color
-sudo watch -n1 'iptables -L FORWARD -n -v --line-numbers'
-sudo tcpdump -i any icmp -n
-ip addr show wg0
-sudo iptables -I FORWARD 6 -s 10.8.0.0/24 -d 10.77.0.2/32 -p icmp -j ACCEPT
-sudo iptables -I FORWARD 7 -s 10.77.0.2/32 -d 10.8.0.0/24 -p icmp -j ACCEPT
-sudo iptables -L FORWARD -n -v --line-numbers
-sudo iptables-save > /etc/sysconfig/iptables
-nano /etc/wireguard/wg0.conf 
-export TERM=xterm-256color
-nano /etc/wireguard/wg0.conf 
-systemctl restart wg-quick.target 
-systemctl restart wg-quick@wg0
-cat /etc/wireguard/wg0.conf 
-sudo nvim /etc/wireguard/wg0.conf 
-sudo systemctl restart wg-quick@wg0.service 
-wg show
-sudo nvim /etc/wireguard/wg0.conf 
-sudo systemctl restart wg-quick@wg0.service 
-wg show
-sudo systemctl enable ip6tables
-sudo systemctl disable --now nftables 2>/dev/null || true
-sudo systemctl mask nftables 2>/dev/null || true
-exit
-export TERM=xterm-256color
-sudo nano /etc/sysconfig/iptables
-cd /etc/caddy/Caddyfile.d/
-ls
-cat fun.caddyfile__ 
-rm fun.caddyfile__ 
-ls
-nano simple.caddyfile 
-export TERM=xterm-256color
-nano simple.caddyfile 
-nvim simple.caddyfile 
-mv simple.caddyfile servers.caddyfile
-systemctl restart caddy
-ls
-exit
-export TERM=xterm-256color
-cd /etc/caddy/Caddyfile.d/
-nvim servers.caddyfile 
-sudo systemctl restart caddy
-journalctl -xeu caddy
-cd /etc/caddy/Caddyfile.d/
-nvim redirect.caddyfile 
-sudo systemctl restart caddy
-nvim redirect.caddyfile 
-sudo journalctl -u caddy -f
-ls
-nvim redirect.caddyfile 
-mv redirect.caddyfile 10-redirect.caddyfile
-nvim 00-allowlist.caddyfile
-mv servers.caddyfile 20-servers.caddyfile
-cd ..
-ls
-nvim Caddyfile
-sudo systemctl restart caddy
-sudo journalctl -u caddy -f
-nvim Caddyfile
-sudo systemctl restart caddy
-nvim Caddyfile
-ls
-cd Caddyfile.d/
-ls
-mv 00-allowlist.caddyfile 00-allowlist.caddyfile_
-mv 10-redirect.caddyfile 10-redirect.caddyfile_
-sudo systemctl restart caddy
-exit
-cd /etc/caddy/Caddyfile.d/
-nvim servers.caddyfile 
-nvim redirect.caddyfile
-sudo caddy fmt --overwrite redirect.caddyfile 
-sudo caddy validate --config redirect.caddyfile 
-nvim /etc/caddy/Caddyfile.d/servers.caddyfile 
-systemctl restart caddy
-cd /etc/caddy/Caddyfile.d/
-ls
-rm 00-allowlist.caddyfile_ 10-redirect.caddyfile_ portfolio.caddyfile_ 
-ls
-mv portfolio.caddyfile_ 30-portfolio.caddyfile_
-nvim 30-portfolio.caddyfile_ 
-ls
-cat 20-servers.caddyfile 
-nvim 20-servers.caddyfile 
-systemctl restart caddy
-nvim 20-servers.caddyfile 
-nvim 10-nextcloud.caddyfile
-nvim 20-servers.caddyfile 
-cd ..
-cat Caddyfile.d/20-servers.caddyfile 
-cat Caddyfile.d/20-servers.caddyfile  | head -n 30
-cat Caddyfile.d/20-servers.caddyfile  | head -n 10
-nvim /etc/caddy/client_ca.pem
-nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-systemctl restart caddy
-cat Caddyfile.d/20-servers.caddyfile  | head -n 10
-exit
-nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-nvim /etc/caddy/Caddyfile.d/15-private.caddyfile
-sudo systemctl restart caddy
-nvim /etc/caddy/Caddyfile.d/10-nextcloud.caddyfile 
-nvim /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-cat /etc/caddy/Caddyfile.d/20-servers.caddyfile 
-exit
-cd /etc/
-ls
-cd sysconfig/
-ls
-nvim iptables
-cat iptables
-curl 10.77.0.2:8999
-nvim iptables
-sudo systemctl restart iptables.service 
-exit
-curl 10.77.0.2:8999
-curl 10.8.0.2:8999
-curl 10.8.0.1:8999
-exit
-cd /etc/wireguard/
-ls
-cat wg0.conf 
-exit
-cd /etc/caddy/
-ls
-cd Caddyfile.d/
-ls
-mv 30-portfolio.caddyfile_ 30-portfolio.caddyfile
-cat 15-private.caddyfile__ 
-ls
-cat 25-static.caddyfile 
-cat 30-portfolio.caddyfile 
-rm 30-portfolio.caddyfile 
-nvim 25-static.caddyfile 
-systemctl restart caddy
-exit
-cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-nvim /etc/caddy/Caddyfile.d/25-static.caddyfile 
-sudo systemctl restart caddy
-cat /etc/caddy/Caddyfile.d/25-static.caddyfile 
-caddy validate --config /etc/caddy/Caddyfile.d/25-static.caddyfile 
-caddy fmt --overwrite /etc/caddy/Caddyfile.d/*
-caddy fmt --overwrite /etc/caddy/Caddyfile.d/25-static.caddyfile 
-find -tf /etc/caddy/Caddyfile.d/25-static.caddyfile 
-find -type f /etc/caddy/Caddyfile.d/
-find  /etc/caddy/Caddyfile.d/ -type f
-find  /etc/caddy/Caddyfile.d/ -type f -exec caddy fmt --overwrite {}
-find  /etc/caddy/Caddyfile.d/ -type f -exec caddy fmt --overwrite {} \;
-caddy validate --config /etc/caddy/Caddyfile.d/25-static.caddyfile 
-ls -la /var/www/html/portfolio/
-ls -la /var/www/html/portfolio/images/
-ls -la /var/www/html/portfolio/old_ijwbs/
-du -sh /var/www/html/portfolio/
-ls -la /var/www/html/portfolio/
-ls -la /var/www/html/portfolio/friends/
-cd /etc/sysconfig/
-ls
-cat iptables
-rg 51413
-rg 51412
-cat iptables
-sudo tcpdump -ni eth0 port 51412
-sudo tcpdump -ni wg0 port 51412
-sudo tcpdump -ni eth0 port 51412
-ss -ltnp | grep ":51412"
-sysctl -w net.ipv4.ip_forward=1
-# ---- NAT (insert at top) ----
-iptables -t nat -I PREROUTING 1 -i eth0 -p tcp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -t nat -I PREROUTING 2 -i eth0 -p udp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -t nat -I POSTROUTING 1 -s 10.77.0.0/24 -o eth0 -j MASQUERADE
-# ---- FORWARD ----
-iptables -I FORWARD 1 -i eth0 -o wg0 -p tcp -d 10.77.0.2 --dport 51412 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
-iptables -I FORWARD 2 -i eth0 -o wg0 -p udp -d 10.77.0.2 --dport 51412 -j ACCEPT
-iptables -I FORWARD 3 -i wg0 -o eth0 -s 10.77.0.2 -p tcp --sport 51412 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -I FORWARD 4 -i wg0 -o eth0 -s 10.77.0.2 -p udp --sport 51412 -j ACCEPT
-iptables -I FORWARD 5 -i wg0 -o eth0 -j ACCEPT
-iptables -I FORWARD 6 -i eth0 -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-net.ipv4.ip_forward = 1
-sysctl -w net.ipv4.ip_forward=1
-iptables -t nat -I PREROUTING 1 -i eth0 -p tcp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -t nat -I PREROUTING 2 -i eth0 -p udp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -t nat -I POSTROUTING 1 -s 10.77.0.0/24 -o eth0 -j MASQUERADE
-iptables -I FORWARD 1 -i eth0 -o wg0 -p tcp -d 10.77.0.2 --dport 51412 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
-iptables -I FORWARD 2 -i eth0 -o wg0 -p udp -d 10.77.0.2 --dport 51412 -j ACCEPT
-iptables -I FORWARD 3 -i wg0 -o eth0 -s 10.77.0.2 -p tcp --sport 51412 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -I FORWARD 4 -i wg0 -o eth0 -s 10.77.0.2 -p udp --sport 51412 -j ACCEPT
-iptables -I FORWARD 5 -i wg0 -o eth0 -j ACCEPT
-iptables -I FORWARD 6 -i eth0 -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -L FORWARD -n -v --line-numbers
-iptables -t nat -L -n -v --line-numbers
-iptables -L FORWARD -n -v --line-numbers
-iptables -t nat -L -n -v --line-numbers
-sudo tcpdump -ni eth0 port 51412
-curl -4 ifconfig.me
-tcpdump -ni eth0 port 51412
-ss -lntup | grep 51412
-iptables -t raw -I PREROUTING 1 -p tcp --dport 51412 -j NOTRACK
-iptables -t raw -I PREROUTING 1 -p udp --dport 51412 -j NOTRACK
-iptables -t nat -I PREROUTING 1 -i eth0 -p tcp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -t nat -I PREROUTING 2 -i eth0 -p udp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -I FORWARD 1 -i eth0 -o wg0 -p tcp -d 10.77.0.2 --dport 51412 -j ACCEPT
-iptables -I FORWARD 2 -i eth0 -o wg0 -p udp -d 10.77.0.2 --dport 51412 -j ACCEPT
-iptables -I FORWARD 3 -i wg0 -o eth0 -s 10.77.0.2 --sport 51412 -j ACCEPT
-iptables -t nat -I POSTROUTING 1 -s 10.77.0.2 -o eth0 -j MASQUERADE
-tcpdump -ni wg0 port 51412
-sysctl net.ipv4.ip_forward
-iptables -t raw -I PREROUTING 1 -p tcp --dport 51412 -j NOTRACK
-iptables -t raw -I PREROUTING 2 -p udp --dport 51412 -j NOTRACK
-iptables -t nat -I PREROUTING 1 -i eth0 -p tcp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -t nat -I PREROUTING 2 -i eth0 -p udp --dport 51412 -j DNAT --to-destination 10.77.0.2:51412
-iptables -I FORWARD 1 -i eth0 -o wg0 -p tcp -d 10.77.0.2 --dport 51412 -j ACCEPT
-iptables -I FORWARD 2 -i eth0 -o wg0 -p udp -d 10.77.0.2 --dport 51412 -j ACCEPT
-iptables -I FORWARD 3 -i wg0 -o eth0 -s 10.77.0.2 --sport 51412 -j ACCEPT
-iptables -t nat -I POSTROUTING 1 -s 10.77.0.2 -o eth0 -j MASQUERADE
-tcpdump -ni wg0 port 51412
-tcpdump -ni eth0 'tcp port 51412'
-sysctl net.ipv4.conf.eth0.route_localnet
-sysctl -w net.ipv4.conf.eth0.route_localnet=1
-ip rule add fwmark 0x1 lookup 100
-ip route add default dev wg0 table 100
-iptables -t mangle -I PREROUTING 1 -i eth0 -p tcp --dport 51412 -j MARK --set-mark 1
-iptables -t mangle -I PREROUTING 2 -i eth0 -p udp --dport 51412 -j MARK --set-mark 1
-tcpdump -ni eth0 'tcp port 51412'
-reboot
-mkfs.ext4 "/dev/disk/by-id/scsi-0Linode_Volume_box"
-mkdir /mnt/box
-mount "/dev/disk/by-id/scsi-0Linode_Volume_box" "/mnt/box"
-nvim /etc/fstab 
-cd /mnt/box/
-ls -lag
-sudo dnf install -y qbittorrent-nox
-exit
-cd /srv/torrents/downloads/
-ls
-cd The.Sims.4.Jenny/
-ls
-du -sh
-rm rune
-rm rune.nfo 
-exit
-cd /srv/torrents/downloads/
-ls
-ls ../incomplete/
-ls
-ls in
-ls ../incomplete/
-ls
-ls -lag
-cd ..
-su -sh
-dh -sh
-du -sh
-df -h
-ls
-rm -rf incomplete/The.Sims.4.Jenny/
-exit
-cd
-cd /srv/torrents/
-ls -lag
-du -sh
-ls
-mv tits/The.Sims.4.Jenny/ incomplete/
-rmdir tits/
-chown -R qbittorrent:qbittorrent incomplete/
-cd /etc/sysconfig/
-ls
-cp iptables iptables_working
-nvim iptables
-systemctl restart iptables.service 
-journal -xeu iptables
-journalctl -xeu iptables
-nvim iptables
-systemctl restart iptables.service 
-journalctl -xeu iptables
-exit
-nvim iptables
-cd /etc/sysconfig/
-nvim iptables
-cd /etc/wireguard/
-ls
-nvim wg0.conf 
-nvim /etc/sysconfig/iptables
-cd /etc/wireguard/
-ls
-wg genkey | tee privatekey | wg pubkey > publickey
-ls
-rm privatekey publickey 
-ls
-mkdir friend
-cd friend/
-wg genkey | tee privatekey | wg pubkey > publickey
-ls
-cat privatekey 
-cat publickey 
-nvim ../wg0.conf 
-cat privatekey 
-nvim ../wg0.conf 
-systemctl restart wireguard
-systemctl restart wg-quick@wg0.service 
-nvim /etc/sysconfig/iptables
-nvim ../wg0.conf 
-systemctl restart wg-quick@wg0.service 
-nvim ../wg0.conf 
-wg show
-nvim ../wg0.conf 
-nvim /etc/sysconfig/iptables
-sudo systemctl restart iptables.service 
-nvim ../wg0.conf 
-cd /etc/wireguard/
-ls
-cd friend/
-ls
-rm *
-wg genkey | tee privatekey | wg pubkey > publickey
-cat publickey 
-nvim ../wg0.conf 
-cat privatekey 
-nvim ../wg0.conf 
-rm *
-wg genkey | tee privatekey | wg pubkey > publickey
-cat publickey 
-nvim ../wg0.conf 
-cat privatekey 
-rm *
-wg genkey | tee privatekey | wg pubkey > publickey
-cat publickey 
-nvim ../wg0.conf 
-cat privatekey 
-nvim /etc/sysconfig/iptables
-sudo reboot 
-cd /etc/caddy/Caddyfile.d/
-ls
-rg xxx
-nvim 15-private.caddyfile
-sudo systemctl restart caddy
-nvim 15-private.caddyfile
-nvim 15-private.caddyfile__ 
-exit
-cd /etc/wireguard/
-ls
-cat wg0.conf 
-ls
-ls friend/
-rm friend/ -rf
-ls
-cd /var/www/html/
-ls -lag blog/          lidarr-mb-gap/ portfolio/
-ls -lag
-ls -la
-ls
-cd
-su deploy
-su lidarr-reports 
-exit