Weekly flake update: 2025-12-29 10:38 UTC

Reviewed-on: #1

.gitea/workflows/build-on-push.yml

@@ -34,17 +34,57 @@ jobs:
           nix build .#emacs-vm --quiet
 
       - name: Push to cache
+        continue-on-error: true
         run: |
           echo "Pushing builds to cache..."
+          
+          # Retry function for attic push commands
+          retry_attic_push() {
+            local max_attempts=5
+            local attempt=1
+            local command="$@"
+            
+            while [ $attempt -le $max_attempts ]; do
+              echo "Attempt $attempt/$max_attempts: $command"
+              if eval "$command"; then
+                echo "✓ Successfully pushed to cache on attempt $attempt"
+                return 0
+              else
+                local exit_code=$?
+                echo "✗ Attempt $attempt failed with exit code $exit_code"
+                if [ $attempt -lt $max_attempts ]; then
+                  echo "Waiting 2 seconds before retry..."
+                  sleep 2
+                fi
+                attempt=$((attempt + 1))
+              fi
+            done
+            
+            echo "⚠️ Failed to push to cache after $max_attempts attempts. Continuing anyway..."
+            return 0  # Don't fail the pipeline
+          }
+          
           # Push all built derivations to cache
           if ls result* 1> /dev/null 2>&1; then
-            attic push servidos:nixos result*
+            retry_attic_push "attic push servidos:nixos result*"
           fi
 
           # Push the specific system derivations we just built
-          nix build .#nixosConfigurations.workstation.config.system.build.toplevel --print-out-paths | attic push servidos:nixos --stdin
+          # Get paths and push with retry (paths are already built, so this is fast)
-          nix build .#nixosConfigurations.server.config.system.build.toplevel --print-out-paths | attic push servidos:nixos --stdin
+          workstation_path=$(nix build .#nixosConfigurations.workstation.config.system.build.toplevel --print-out-paths 2>/dev/null || echo "")
-          nix build .#emacs-vm --print-out-paths | attic push servidos:nixos --stdin
+          if [ -n "$workstation_path" ]; then
+            retry_attic_push "echo \"$workstation_path\" | attic push servidos:nixos --stdin"
+          fi
+          
+          server_path=$(nix build .#nixosConfigurations.server.config.system.build.toplevel --print-out-paths 2>/dev/null || echo "")
+          if [ -n "$server_path" ]; then
+            retry_attic_push "echo \"$server_path\" | attic push servidos:nixos --stdin"
+          fi
+          
+          emacs_path=$(nix build .#emacs-vm --print-out-paths 2>/dev/null || echo "")
+          if [ -n "$emacs_path" ]; then
+            retry_attic_push "echo \"$emacs_path\" | attic push servidos:nixos --stdin"
+          fi
 
       - name: Summary
         run: |

.gitea/workflows/build-schemes.yml

@@ -36,9 +36,36 @@ jobs:
           attic login servidos http://127.0.0.1:2343 ${{ secrets.ATTIC_TOKEN }}
 
       - name: Build and push all schemes
+        continue-on-error: true
         run: |
           echo "Building and pushing all schemes..."
 
+          # Retry function for attic push commands
+          retry_attic_push() {
+            local max_attempts=5
+            local attempt=1
+            local command="$@"
+            
+            while [ $attempt -le $max_attempts ]; do
+              echo "Attempt $attempt/$max_attempts: $command"
+              if eval "$command"; then
+                echo "✓ Successfully pushed to cache on attempt $attempt"
+                return 0
+              else
+                local exit_code=$?
+                echo "✗ Attempt $attempt failed with exit code $exit_code"
+                if [ $attempt -lt $max_attempts ]; then
+                  echo "Waiting 2 seconds before retry..."
+                  sleep 2
+                fi
+                attempt=$((attempt + 1))
+              fi
+            done
+            
+            echo "⚠️ Failed to push to cache after $max_attempts attempts. Continuing anyway..."
+            return 0  # Don't fail the pipeline
+          }
+
           # Store original scheme
           ORIGINAL_SCHEME=$(grep -oP "scheme = schemesFile\.schemes\.\K\w+" config/stylix.nix)
           echo "Original scheme: $ORIGINAL_SCHEME"
@@ -61,14 +88,17 @@ jobs:
               --out-link ./result-$scheme \
               --quiet
 
-            # Push to cache
+            # Push to cache with retry
             echo "Pushing $scheme to cache..."
-            attic push servidos:nixos ./result-$scheme
+            retry_attic_push "attic push servidos:nixos ./result-$scheme"
 
             # Also push using print-out-paths for better cache coverage
-            nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
+            build_path=$(nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
               --print-out-paths \
-              --quiet | attic push servidos:nixos --stdin
+              --quiet 2>/dev/null || echo "")
+            if [ -n "$build_path" ]; then
+              retry_attic_push "echo \"$build_path\" | attic push servidos:nixos --stdin"
+            fi
 
             echo "✓ Completed $scheme"
             echo ""

.gitea/workflows/weekly-build-cache.yml

@@ -60,17 +60,57 @@ jobs:
 
       - name: Push to cache
         if: steps.check_changes.outputs.changes == 'true'
+        continue-on-error: true
         run: |
           echo "Pushing builds to cache..."
+          
+          # Retry function for attic push commands
+          retry_attic_push() {
+            local max_attempts=5
+            local attempt=1
+            local command="$@"
+            
+            while [ $attempt -le $max_attempts ]; do
+              echo "Attempt $attempt/$max_attempts: $command"
+              if eval "$command"; then
+                echo "✓ Successfully pushed to cache on attempt $attempt"
+                return 0
+              else
+                local exit_code=$?
+                echo "✗ Attempt $attempt failed with exit code $exit_code"
+                if [ $attempt -lt $max_attempts ]; then
+                  echo "Waiting 2 seconds before retry..."
+                  sleep 2
+                fi
+                attempt=$((attempt + 1))
+              fi
+            done
+            
+            echo "⚠️ Failed to push to cache after $max_attempts attempts. Continuing anyway..."
+            return 0  # Don't fail the pipeline
+          }
+          
           # Push all built derivations to cache
           if ls result* 1> /dev/null 2>&1; then
-            attic push servidos:nixos result*
+            retry_attic_push "attic push servidos:nixos result*"
           fi
 
           # Push the specific system derivations we just built
-          nix build .#nixosConfigurations.workstation.config.system.build.toplevel --print-out-paths | attic push servidos:nixos --stdin
+          # Get paths and push with retry (paths are already built, so this is fast)
-          nix build .#nixosConfigurations.server.config.system.build.toplevel --print-out-paths | attic push servidos:nixos --stdin
+          workstation_path=$(nix build .#nixosConfigurations.workstation.config.system.build.toplevel --print-out-paths 2>/dev/null || echo "")
-          nix build .#emacs-vm --print-out-paths | attic push servidos:nixos --stdin
+          if [ -n "$workstation_path" ]; then
+            retry_attic_push "echo \"$workstation_path\" | attic push servidos:nixos --stdin"
+          fi
+          
+          server_path=$(nix build .#nixosConfigurations.server.config.system.build.toplevel --print-out-paths 2>/dev/null || echo "")
+          if [ -n "$server_path" ]; then
+            retry_attic_push "echo \"$server_path\" | attic push servidos:nixos --stdin"
+          fi
+          
+          emacs_path=$(nix build .#emacs-vm --print-out-paths 2>/dev/null || echo "")
+          if [ -n "$emacs_path" ]; then
+            retry_attic_push "echo \"$emacs_path\" | attic push servidos:nixos --stdin"
+          fi
 
       - name: Commit updated flake.lock
         if: steps.check_changes.outputs.changes == 'true'

TODO.md

@@ -0,0 +1,39 @@
+# Keycloak SSO Rollout (Server)
+
+## Compatible services to cover (assume up-to-date versions)
+- Gitea (OAuth2/OIDC)
+- Nextcloud (Social Login app)
+- Paperless-ngx (OIDC)
+- Mealie (OIDC v1+)
+- Jellyfin (OIDC plugin)
+- Kavita (OIDC-capable builds)
+- Readeck (OIDC-capable builds)
+- Audiobookshelf (OIDC-capable builds)
+- Matrix Synapse – intentionally excluded (see below) but natively OIDC if needed
+
+## Explicit exclusions (no SSO for now)
+- Syncplay
+- Matrix/Synapse
+- Arr stack (sonarr, radarr, lidarr, prowlarr, bazarr)
+- qbittorrent
+- sabnzbd
+- metube
+- multi-scrobbler
+- microbin
+- ryot
+- maloja
+- plex
+- atticd
+
+## Phased rollout plan
+1) Base identity
+   - Add Keycloak deployment/module and realm/client defaults.
+2) Gateway/proxy auth
+   - Add oauth2-proxy (Keycloak provider) + nginx auth_request for non-OIDC apps (e.g., homepage-dashboard, stash).
+3) Native OIDC wiring
+   - Configure native OIDC services (Gitea, Nextcloud, Paperless, Mealie, Jellyfin/Kavita/Readeck/Audiobookshelf) with Keycloak clients.
+4) Per-service rollout
+   - Enable per app in priority order; document client IDs/secrets and callback URLs.
+5) Verification
+   - Smoke-test login flows and cache any needed public keys/metadata.
+

config/base.nix

@@ -9,6 +9,7 @@
 {
   imports = [
     inputs.home-manager.nixosModules.home-manager
+    ./users.nix
     ./jawz.nix
     ../modules/modules.nix
   ];
@@ -97,6 +98,7 @@
       ];
       substituters = [
         "${config.my.servers.atticd.url}/nixos"
+        "${config.my.servers.atticd.url}/webref"
         "https://nix-gaming.cachix.org"
         "https://nixpkgs-python.cachix.org"
         "https://devenv.cachix.org"
@@ -106,7 +108,8 @@
         "https://cosmic.cachix.org"
       ];
       trusted-public-keys = [
-        "nixos:kubuWhYCk9/aZp5GDJFAScYgigM66DszP8i1Pzbq0Fc="
+        "nixos:GAnxnubP07Qu+6v8MErkuAa4uGCR4Npmu4acmQrUXpI="
+        "webref:qobPVDWPzbSJ0JIUoLBnWILcc+zbPa16CVAiN8MN6tg="
         "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
         "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU="
         "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="

config/overlay.nix

@@ -38,6 +38,15 @@ _final: prev: {
   waybar = prev.waybar.overrideAttrs (old: {
     mesonFlags = old.mesonFlags ++ [ "-Dexperimental=true" ];
   });
+  qbittorrent = prev.qbittorrent.overrideAttrs (_old: rec {
+    version = "5.1.3";
+    src = prev.fetchFromGitHub {
+      owner = "qbittorrent";
+      repo = "qBittorrent";
+      rev = "release-${version}";
+      hash = "sha256-RIItbrpkMFglO2NwbgpBhgBSk5+vdywatGVwnbWkNVQ=";
+    };
+  });
   inherit (pkgsU)
     code-cursor
     symbola

config/stylix.nix

@@ -9,7 +9,7 @@ let
   schemesFile = import ./schemes.nix {
     inherit pkgs inputs;
   };
-  scheme = schemesFile.schemes.febroary;
+  scheme = schemesFile.schemes.jesus;
   cfg = config.my.stylix;
   gnomeEnabled = config.services.desktopManager.gnome.enable;
 in

config/users.nix

@@ -0,0 +1,12 @@
+_: {
+  users.users = {
+    sonarr = {
+      uid = 274;
+      group = "piracy";
+    };
+    radarr = {
+      uid = 275;
+      group = "piracy";
+    };
+  };
+}

environments/hyprland.nix

@@ -112,8 +112,8 @@ in
           "${mod} SHIFT, 8, movetoworkspace, 8"
           "${mod} SHIFT, 9, movetoworkspace, 9"
           "${mod} SHIFT, 0, movetoworkspace, 10"
-          "${mod}, F3, exec, grimblast save area ~/Pictures/screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
+          "${mod}, F3, exec, grimblast save area ~/Pictures/Screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
-          "${mod} SHIFT, F3, exec, grimblast save screen ~/Pictures/screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
+          "${mod} SHIFT, F3, exec, grimblast save screen ~/Pictures/Screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
         ];
         binde = [
           "${mod} SHIFT, h, moveactive, -20 0"

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762356719,
+        "lastModified": 1765900596,
-        "narHash": "sha256-qwd/xdoOya1m8FENle+4hWnydCtlXUWLAW/Auk6WL7s=",
+        "narHash": "sha256-+hn8v9jkkLP9m+o0Nm5SiEq10W0iWDSotH2XfjU45fA=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "6d0b3567584691bf9d8fedb5d0093309e2f979c7",
+        "rev": "d83c97f8f5c0aae553c1489c7d9eff3eadcadace",
         "type": "github"
       },
       "original": {
@@ -54,28 +54,28 @@
     "base16-fish": {
       "flake": false,
       "locked": {
-        "lastModified": 1754405784,
+        "lastModified": 1765809053,
-        "narHash": "sha256-l9xHIy+85FN+bEo6yquq2IjD1rSg9fjfjpyGP1W8YXo=",
+        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
         "type": "github"
       },
       "original": {
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
         "type": "github"
       }
     },
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1752979451,
+        "lastModified": 1760703920,
-        "narHash": "sha256-0CQM+FkYy0fOO/sMGhOoNL80ftsAzYCg9VhIrodqusM=",
+        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "27cf1e66e50abc622fb76a3019012dc07c678fac",
+        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
         "type": "github"
       },
       "original": {
@@ -182,11 +182,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1758112371,
+        "lastModified": 1764724327,
-        "narHash": "sha256-lizRM2pj6PHrR25yimjyFn04OS4wcdbc38DCdBVa2rk=",
+        "narHash": "sha256-OkFLrD3pFR952TrjQi1+Vdj604KLcMnkpa7lkW7XskI=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "0909cfe4a2af8d358ad13b20246a350e14c2473d",
+        "rev": "66b7c635763d8e6eb86bd766de5a1e1fbfcc1047",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
+        "lastModified": 1761588595,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
@@ -216,11 +216,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1762440070,
+        "lastModified": 1765835352,
-        "narHash": "sha256-xxdepIcb39UJ94+YydGP221rjnpkDZUlykKuF54PsqI=",
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "26d05891e14c88eb4a5d5bee659c0db5afb609d8",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
         "type": "github"
       },
       "original": {
@@ -234,11 +234,11 @@
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1762440070,
+        "lastModified": 1765835352,
-        "narHash": "sha256-xxdepIcb39UJ94+YydGP221rjnpkDZUlykKuF54PsqI=",
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "26d05891e14c88eb4a5d5bee659c0db5afb609d8",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
         "type": "github"
       },
       "original": {
@@ -293,11 +293,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756770412,
+        "lastModified": 1763759067,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
         "type": "github"
       },
       "original": {
@@ -324,24 +324,6 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_4"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "fonts": {
       "flake": false,
       "locked": {
@@ -399,18 +381,20 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "lastModified": 1748186689,
+        "host": "gitlab.gnome.org",
-        "narHash": "sha256-UaD7Y9f8iuLBMGHXeJlRu6U1Ggw5B9JnkFs3enZlap0=",
+        "lastModified": 1764524476,
+        "narHash": "sha256-bTmNn3Q4tMQ0J/P0O5BfTQwqEnCiQIzOGef9/aqAZvk=",
         "owner": "GNOME",
         "repo": "gnome-shell",
-        "rev": "8c88f917db0f1f0d80fa55206c863d3746fa18d0",
+        "rev": "c0e1ad9f0f703fd0519033b8f46c3267aab51a22",
-        "type": "github"
+        "type": "gitlab"
       },
       "original": {
+        "host": "gitlab.gnome.org",
         "owner": "GNOME",
-        "ref": "48.2",
+        "ref": "gnome-49",
         "repo": "gnome-shell",
-        "type": "github"
+        "type": "gitlab"
       }
     },
     "home-manager": {
@@ -420,15 +404,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1762787259,
+        "lastModified": 1766939458,
-        "narHash": "sha256-t2U/GLLXHa2+kJkwnFNRVc2fEJ/lUfyZXBE5iKzJdcs=",
+        "narHash": "sha256-VvZeAKyB3vhyHStSO8ACKzWRKNQPmVWktjfuSVdvtUA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "37a3d97f2873e0f68711117c34d04b7c7ead8f4e",
+        "rev": "e298a148013c980e3c8c0ac075295fab5074d643",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
+        "ref": "release-25.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -478,11 +463,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762462052,
+        "lastModified": 1763733840,
-        "narHash": "sha256-6roLYzcDf4V38RUMSqycsOwAnqfodL6BmhRkUtwIgdA=",
+        "narHash": "sha256-JnET78yl5RvpGuDQy3rCycOCkiKoLr5DN1fPhRNNMco=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "ffc999d980c7b3bca85d3ebd0a9fbadf984a8162",
+        "rev": "8f1bec691b2d198c60cccabca7a94add2df4ed1a",
         "type": "github"
       },
       "original": {
@@ -501,6 +486,7 @@
         "hyprlang": "hyprlang",
         "hyprutils": "hyprutils",
         "hyprwayland-scanner": "hyprwayland-scanner",
+        "hyprwire": "hyprwire",
         "nixpkgs": [
           "nixpkgs"
         ],
@@ -509,11 +495,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1762755326,
+        "lastModified": 1766929444,
-        "narHash": "sha256-YYTzQUQDnVdtN3k40sC5kq6yL70riU8bM8cQLz38jzk=",
+        "narHash": "sha256-mGk+mk/miObjivy+6qMqQm+Jyl8R7t6B/1SaiBkUUyY=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "0b1d690676589503f0addece30e936a240733699",
+        "rev": "6a055fc747a5a899b97f9b4c1d1a52229a805b1e",
         "type": "github"
       },
       "original": {
@@ -555,11 +541,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762755186,
+        "lastModified": 1765643131,
-        "narHash": "sha256-ZjjETUHtoEhVN7JI1Cbt3p/KcXpK8ZQaPHx7UkG1OgA=",
+        "narHash": "sha256-CCGohW5EBIRy4B7vTyBMqPgsNcaNenVad/wszfddET0=",
         "owner": "hyprwm",
         "repo": "hyprland-guiutils",
-        "rev": "66356e20a8ed348aa49c1b9ceace786e224225b3",
+        "rev": "e50ae912813bdfa8372d62daf454f48d6df02297",
         "type": "github"
       },
       "original": {
@@ -580,11 +566,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759610243,
+        "lastModified": 1765214753,
-        "narHash": "sha256-+KEVnKBe8wz+a6dTLq8YDcF3UrhQElwsYJaVaHXJtoI=",
+        "narHash": "sha256-P9zdGXOzToJJgu5sVjv7oeOGPIIwrd9hAUAP3PsmBBs=",
         "owner": "hyprwm",
         "repo": "hyprland-protocols",
-        "rev": "bd153e76f751f150a09328dbdeb5e4fab9d23622",
+        "rev": "3f3860b869014c00e8b9e0528c7b4ddc335c21ab",
         "type": "github"
       },
       "original": {
@@ -609,11 +595,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758927902,
+        "lastModified": 1764612430,
-        "narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
+        "narHash": "sha256-54ltTSbI6W+qYGMchAgCR6QnC1kOdKXN6X6pJhOWxFg=",
         "owner": "hyprwm",
         "repo": "hyprlang",
-        "rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
+        "rev": "0d00dc118981531aa731150b6ea551ef037acddd",
         "type": "github"
       },
       "original": {
@@ -661,11 +647,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762463729,
+        "lastModified": 1764592794,
-        "narHash": "sha256-2fYkU/mdz8WKY3dkDPlE/j6hTxIwqultsx4gMMsMns0=",
+        "narHash": "sha256-7CcO+wbTJ1L1NBQHierHzheQGPWwkIQug/w+fhTAVuU=",
         "owner": "hyprwm",
         "repo": "hyprtoolkit",
-        "rev": "88483bdee5329ec985f0c8f834c519cd18cfe532",
+        "rev": "5cfe0743f0e608e1462972303778d8a0859ee63e",
         "type": "github"
       },
       "original": {
@@ -686,11 +672,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762387740,
+        "lastModified": 1766160771,
-        "narHash": "sha256-gQ9zJ+pUI4o+Gh4Z6jhJll7jjCSwi8ZqJIhCE2oqwhQ=",
+        "narHash": "sha256-roINUGikWRqqgKrD4iotKbGj3ZKJl3hjMz5l/SyKrHw=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "926689ddb9c0a8787e58c02c765a62e32d63d1f7",
+        "rev": "5ac060bfcf2f12b3a6381156ebbc13826a05b09f",
         "type": "github"
       },
       "original": {
@@ -711,11 +697,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755184602,
+        "lastModified": 1763640274,
-        "narHash": "sha256-RCBQN8xuADB0LEgaKbfRqwm6CdyopE1xIEhNc67FAbw=",
+        "narHash": "sha256-Uan1Nl9i4TF/kyFoHnTq1bd/rsWh4GAK/9/jDqLbY5A=",
         "owner": "hyprwm",
         "repo": "hyprwayland-scanner",
-        "rev": "b3b0f1f40ae09d4447c20608e5a4faf8bf3c492d",
+        "rev": "f6cf414ca0e16a4d30198fd670ec86df3c89f671",
         "type": "github"
       },
       "original": {
@@ -724,6 +710,35 @@
         "type": "github"
       }
     },
+    "hyprwire": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766253200,
+        "narHash": "sha256-26qPwrd3od+xoYVywSB7hC2cz9ivN46VPLlrsXyGxvE=",
+        "owner": "hyprwm",
+        "repo": "hyprwire",
+        "rev": "1079777525b30a947c8d657fac158e00ae85de9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprwire",
+        "type": "github"
+      }
+    },
     "jawz-scripts": {
       "inputs": {
         "nixpkgs": [
@@ -732,11 +747,11 @@
         "sudoku-solver": "sudoku-solver"
       },
       "locked": {
-        "lastModified": 1762799327,
+        "lastModified": 1766276320,
-        "narHash": "sha256-HhIC8Ucb4ZruU7Yr1gV4qGVKkhuYpAhXbRnSfAmjQoY=",
+        "narHash": "sha256-0OjLvaFkXUPy1lCICUH/QUsUpcDpB2rlDner/f8wirQ=",
         "ref": "refs/heads/master",
-        "rev": "6efd55712d73e65c0fb4304cfd1649723bb757ef",
+        "rev": "64676aca5db212e7a84b154811d69b74c9cd265f",
-        "revCount": 120,
+        "revCount": 125,
         "type": "git",
         "url": "https://git.lebubu.org/jawz/scripts.git"
       },
@@ -747,17 +762,16 @@
     },
     "lidarr-mb-gap": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1762882489,
+        "lastModified": 1763107451,
-        "narHash": "sha256-YFk5GkD7TkIMbcnJzFz+IRN4vH7QJSRphpS3zje3PRU=",
+        "narHash": "sha256-mG2RevGmQchx7FMK4F3GowUzMmD+JVva6Zt/sZnQTeQ=",
         "ref": "refs/heads/main",
-        "rev": "35e6c7e330868b00e7c8dbc878db776ba01f719d",
+        "rev": "cc9521f7a402c0339d55911f3718967ec00c2666",
-        "revCount": 11,
+        "revCount": 22,
         "type": "git",
         "url": "https://git.lebubu.org/vibe-coded/lidarr-mb-gap.git"
       },
@@ -774,11 +788,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762740007,
+        "lastModified": 1766887720,
-        "narHash": "sha256-CtMgV9vfm16x/0NBQmQQe/Vbv423cPWeNfBtiVYcUBk=",
+        "narHash": "sha256-h0rnexpjILYVpOcE76FQ7ieyqevTQhjah6y/bM9A4kE=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "8dce0b23e30b03efbdc94e8db7cb27298446e4cc",
+        "rev": "c308874a31ba27dbf83a66418268079cdb7e320f",
         "type": "github"
       },
       "original": {
@@ -810,11 +824,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751903740,
+        "lastModified": 1764234087,
-        "narHash": "sha256-PeSkNMvkpEvts+9DjFiop1iT2JuBpyknmBUs0Un0a4I=",
+        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "032decf9db65efed428afd2fa39d80f7089085eb",
+        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
         "type": "github"
       },
       "original": {
@@ -841,11 +855,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1761765539,
+        "lastModified": 1765674936,
-        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
         "type": "github"
       },
       "original": {
@@ -856,11 +870,11 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1761765539,
+        "lastModified": 1765674936,
-        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
         "type": "github"
       },
       "original": {
@@ -889,27 +903,27 @@
     },
     "nixpkgs-small": {
       "locked": {
-        "lastModified": 1762800201,
+        "lastModified": 1766945671,
-        "narHash": "sha256-uSPI4VB/GKfVeH72q3V94sHB6Spy0L5uUTxTmmZH/FQ=",
+        "narHash": "sha256-02c5lD9jxmuHK3pa9zvoRaSEtwmR1Dyp3cquGt5i7B4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "25a9ff6075a050210f8fc276a67d21399c90a797",
+        "rev": "66ab54eb48d681dd7babe2d0eb9bc36f823ec6d8",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "master",
+        "ref": "nixos-25.11-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1762596750,
+        "lastModified": 1766902085,
-        "narHash": "sha256-rXXuz51Bq7DHBlfIjN7jO8Bu3du5TV+3DSADBX7/9YQ=",
+        "narHash": "sha256-coBu0ONtFzlwwVBzmjacUQwj3G+lybcZ1oeNSQkgC0M=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b6a8526db03f735b89dd5ff348f53f752e7ddc8e",
+        "rev": "c0b0e0fddf73fd517c3471e546c0df87a42d53f4",
         "type": "github"
       },
       "original": {
@@ -921,16 +935,16 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1762800201,
+        "lastModified": 1766736597,
-        "narHash": "sha256-uSPI4VB/GKfVeH72q3V94sHB6Spy0L5uUTxTmmZH/FQ=",
+        "narHash": "sha256-BASnpCLodmgiVn0M1MU2Pqyoz0aHwar/0qLkp7CjvSQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "25a9ff6075a050210f8fc276a67d21399c90a797",
+        "rev": "f560ccec6b1116b22e6ed15f4c510997d99d5852",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "master",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -964,11 +978,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762800743,
+        "lastModified": 1767000376,
-        "narHash": "sha256-6SjknGi7vOyZV2AghcYI6wzqqKTWMeFOv9JlN5YFICQ=",
+        "narHash": "sha256-pbK0Nw0Ye/Ftbn0fLHgcNTgdN7k3MNk+ffNNv9IN+i4=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "32c80839213416ea24e3138f2fe18b316dff08eb",
+        "rev": "3ba02c75254298131216fd7f00871d69879a20be",
         "type": "github"
       },
       "original": {
@@ -989,11 +1003,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758998580,
+        "lastModified": 1764773531,
-        "narHash": "sha256-VLx0z396gDCGSiowLMFz5XRO/XuNV+4EnDYjdJhHvUk=",
+        "narHash": "sha256-mCBl7MD1WZ7yCG6bR9MmpPO2VydpNkWFgnslJRIT1YU=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "ba8d9c98f5f4630bcb0e815ab456afd90c930728",
+        "rev": "1d9616689e98beded059ad0384b9951e967a17fa",
         "type": "github"
       },
       "original": {
@@ -1012,11 +1026,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762441963,
+        "lastModified": 1765911976,
-        "narHash": "sha256-j+rNQ119ffYUkYt2YYS6rnd6Jh/crMZmbqpkGLXaEt0=",
+        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "8e7576e79b88c16d7ee3bbd112c8d90070832885",
+        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
         "type": "github"
       },
       "original": {
@@ -1028,11 +1042,11 @@
     "qbit_manage": {
       "flake": false,
       "locked": {
-        "lastModified": 1758160887,
+        "lastModified": 1764428351,
-        "narHash": "sha256-cTxM3nHQQto7lpoNjShYcCbJCSYiwS9bKqw0DWAjw6A=",
+        "narHash": "sha256-JCsbf2mPRhs7Mbekl946G/y/CSNSSvQBLvlwVy/Avcg=",
         "owner": "StuffAnThings",
         "repo": "qbit_manage",
-        "rev": "21812368bc5366f3388dfb21769fee1da48083c5",
+        "rev": "371627bbeb082e68f057bbe4599565c2e63a14c7",
         "type": "github"
       },
       "original": {
@@ -1071,11 +1085,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762659808,
+        "lastModified": 1766894905,
-        "narHash": "sha256-2Kv2mANf+FRisqhpfeZ8j9firBxb23ZvEXwdcunbpGI=",
+        "narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "524312bc62e3f34bd9231a2f66622663d3355133",
+        "rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
         "type": "github"
       },
       "original": {
@@ -1097,7 +1111,7 @@
           "nixpkgs"
         ],
         "nur": "nur_2",
-        "systems": "systems_5",
+        "systems": "systems_4",
         "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
@@ -1105,15 +1119,16 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1762264356,
+        "lastModified": 1766603740,
-        "narHash": "sha256-QVfC53Ri+8n3e7Ujx9kq6all3+TLBRRPRnc6No5qY5w=",
+        "narHash": "sha256-F0BovrhzY/siRQYBRUFn2sZH7TJEuwetOJiGgKtITjk=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "647bb8dd96a206a1b79c4fd714affc88b409e10b",
+        "rev": "cfe89cabaae6ea1bbf80709bd53181494566a1b0",
         "type": "github"
       },
       "original": {
         "owner": "danth",
+        "ref": "release-25.11",
         "repo": "stylix",
         "type": "github"
       }
@@ -1195,21 +1210,6 @@
         "type": "github"
       }
     },
-    "systems_5": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tinted-foot": {
       "flake": false,
       "locked": {
@@ -1246,11 +1246,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1757716333,
+        "lastModified": 1763914658,
-        "narHash": "sha256-d4km8W7w2zCUEmPAPUoLk1NlYrGODuVa3P7St+UrqkM=",
+        "narHash": "sha256-Hju0WtMf3iForxtOwXqGp3Ynipo0EYx1AqMKLPp9BJw=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "317a5e10c35825a6c905d912e480dfe8e71c7559",
+        "rev": "0f6be815d258e435c9b137befe5ef4ff24bea32c",
         "type": "github"
       },
       "original": {
@@ -1262,11 +1262,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1757811970,
+        "lastModified": 1764465359,
-        "narHash": "sha256-n5ZJgmzGZXOD9pZdAl1OnBu3PIqD+X3vEBUGbTi4JiI=",
+        "narHash": "sha256-lbSVPqLEk2SqMrnpvWuKYGCaAlfWFMA6MVmcOFJjdjE=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "d217ba31c846006e9e0ae70775b0ee0f00aa6b1e",
+        "rev": "edf89a780e239263cc691a987721f786ddc4f6aa",
         "type": "github"
       },
       "original": {
@@ -1278,11 +1278,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1757811247,
+        "lastModified": 1764464512,
-        "narHash": "sha256-4EFOUyLj85NRL3OacHoLGEo0wjiRJzfsXtR4CZWAn6w=",
+        "narHash": "sha256-rCD/pAhkMdCx6blsFwxIyvBJbPZZ1oL2sVFrH07lmqg=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "824fe0aacf82b3c26690d14e8d2cedd56e18404e",
+        "rev": "907dbba5fb8cf69ebfd90b00813418a412d0a29a",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,19 +2,16 @@
   description = "JawZ NixOS flake setup";
   inputs = {
     flake-parts.url = "github:hercules-ci/flake-parts";
-    nixpkgs.url = "github:nixos/nixpkgs?ref=master";
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-25.11";
-    nixpkgs-small.url = "github:nixos/nixpkgs?ref=master";
+    nixpkgs-small.url = "github:nixos/nixpkgs?ref=nixos-25.11-small";
-    # nixpkgs-small.url = "github:nixos/nixpkgs?ref=nixos-25.05-small";
     nixpkgs-unstable.url = "github:nixos/nixpkgs?ref=nixos-unstable";
     ucodenix.url = "github:e-tho/ucodenix/ba7f0a366460e0fbea9622fc770cb982be0e4720";
     home-manager = {
-      # url = "github:nix-community/home-manager?ref=release-25.05";
+      url = "github:nix-community/home-manager?ref=release-25.11";
-      url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     stylix = {
-      # url = "github:danth/stylix/release-25.05";
+      url = "github:danth/stylix/release-25.11";
-      url = "github:danth/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     doom-emacs = {

hosts/server/configuration.nix

@@ -26,6 +26,8 @@
       22000 # syncthing relay
       3452 # sonarqube
       8448 # synapse ssl
+      8265 # tdarr
+      5173 # media map
     ];
   };
   nix.buildMachines = [
@@ -45,12 +47,14 @@
     lidarr-mb-gap = lib.mkIf config.my.secureHost {
       sopsFile = ../../secrets/env.yaml;
     };
-    "private_keys/lidarr-mb-gap" = lib.mkIf config.my.secureHost {
+    "private_keys/lidarr-mb-gap" =
-      sopsFile = ../../secrets/keys.yaml;
+      lib.mkIf (config.my.secureHost && config.services.lidarr-mb-gap.enable)
-      owner = config.users.users.lidarr-mb-gap.name;
+        {
-      inherit (config.users.users.lidarr-mb-gap) group;
+          sopsFile = ../../secrets/keys.yaml;
-      path = "~/.ssh/ed25519_lidarr-mb-gap";
+          owner = config.users.users.lidarr-mb-gap.name;
-    };
+          inherit (config.users.users.lidarr-mb-gap) group;
+          path = "${config.users.users.lidarr-mb-gap.home}/.ssh/ed25519_lidarr-mb-gap";
+        };
   };
   networking = {
     hostName = "server";
@@ -87,11 +91,12 @@
     };
     lidarr-mb-gap = {
       enable = true;
-      package = inputs.lidarr-mb-gap.packages.${pkgs.system}.lidarr-mb-gap;
+      package = inputs.lidarr-mb-gap.packages.${pkgs.stdenv.hostPlatform.system}.lidarr-mb-gap;
-      reportDir = "/var/lib/lidarr-mb-gap/reports";
+      home = "/var/lib/lidarr-mb-gap";
       envFile = config.sops.secrets.lidarr-mb-gap.path;
       runInterval = "weekly";
-      syncToVPS = false;
+      syncToVPS = true;
+      vpsPort = 3456;
       vpsHost = "lidarr-reports@${config.my.ips.vps}";
       vpsPath = "/var/www/html/lidarr-mb-gap";
       sshKeyFile = config.sops.secrets."private_keys/lidarr-mb-gap".path;

hosts/server/toggles.nix

@@ -81,5 +81,9 @@ in
     "audiobookshelf"
     "vaultwarden"
     "readeck"
+    "keycloak"
+    "oauth2-proxy"
+    "isso"
+    "plausible"
   ];
 }

hosts/workstation/configuration.nix

@@ -88,7 +88,6 @@ in
         gnome-epub-thumbnailer
         podman-compose
         scrcpy
-        mpv
         ;
       inherit (pkgs.libheif) out;
     };
@@ -111,7 +110,6 @@ in
       enableVirtualCamera = true;
       plugins = builtins.attrValues {
         inherit (pkgs.obs-studio-plugins)
-          droidcam-obs
           obs-vkcapture
           obs-vaapi
           obs-tuna

modules/apps/multimedia.nix

@@ -9,8 +9,6 @@
   config = lib.mkIf config.my.apps.multimedia.enable {
     users.users.jawz.packages = builtins.attrValues {
       inherit (pkgs)
-        recordbox # libadwaita music player
-        celluloid # video player
         curtail # image compressor
         easyeffects # equalizer
         identity # compare images or videos

modules/dev/nix.nix

@@ -42,6 +42,11 @@ in
             nix run nixpkgs#nixfmt-tree && \
             statix fix
           '';
+          nix-push-cache = ''
+            nix build $NH_FLAKE#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel \
+            --print-out-paths --fallback --max-jobs 100 --cores 0 |
+            nix run nixpkgs#attic-client -- push lan:nixos --stdin
+          '';
         };
   };
 }

modules/network/nginx.nix

@@ -7,6 +7,8 @@
 let
   proxyReverseServices = [
     "firefox-syncserver"
+    "isso"
+    "plausible"
     "readeck"
     "microbin"
     "ryot"

modules/servers/atticd.nix

@@ -17,7 +17,10 @@ in
       settings = {
         listen = "[::]:${toString cfg.port}";
         jwt = { };
-        database.heartbeat = true; # 5 minutes
+        database = {
+          heartbeat = true;
+          url = "postgresql:///${cfg.name}?host=${config.my.postgresSocket}";
+        };
         chunking = {
           nar-size-threshold = 64 * 1024; # 64 KiB
           min-size = 16 * 1024; # 16 KiB

modules/servers/gitea.nix

@@ -30,6 +30,10 @@ in
           FROM = config.my.smtpemail;
           SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp";
         };
+        service = {
+          DISABLE_REGISTRATION = true;
+          ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+        };
       };
       database = {
         socket = config.my.postgresSocket;

modules/servers/homepage/bookmarks/servers.nix

@@ -54,5 +54,59 @@
         }
       ];
     }
+    {
+      gpt = [
+        {
+          abbr = "GPT";
+          href = "http://127.0.0.1:8080";
+          description = "";
+        }
+      ];
+    }
+    {
+      syncthing-workstation = [
+        {
+          abbr = "STW";
+          href = "http://workstation:8384";
+          description = "";
+        }
+      ];
+    }
+    {
+      syncthing-server = [
+        {
+          abbr = "STS";
+          href = "http://server:8384";
+          description = "";
+        }
+      ];
+    }
+    {
+      music-report = [
+        {
+          abbr = "MR";
+          href = "https://mb-report.lebubu.org";
+          description = "";
+        }
+      ];
+    }
+    {
+      portfolio = [
+        {
+          abbr = "PF";
+          href = "https://danilo-reyes.com";
+          description = "";
+        }
+      ];
+    }
+    {
+      webref = [
+        {
+          abbr = "WR";
+          href = "https://webref.lebubu.org";
+          description = "";
+        }
+      ];
+    }
   ];
 }

modules/servers/isso.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.isso;
+in
+{
+  options.my.servers.isso = setup.mkOptions "isso" "comments" 8180;
+  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+    my.servers.isso.domain = "danilo-reyes.com";
+    sops.secrets.isso = {
+      sopsFile = ../../secrets/env.yaml;
+    };
+    services.isso = {
+      inherit (cfg) enable;
+      settings = {
+        guard.require-author = true;
+        server.listen = "http://${cfg.ip}:${toString cfg.port}/";
+        admin = {
+          enabled = true;
+          password = "$ISSO_ADMIN_PASSWORD";
+        };
+        general = {
+          host = "https://blog.${cfg.domain}";
+          max-age = "1h";
+          gravatar = true;
+        };
+      };
+    };
+    systemd.services.isso = {
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      serviceConfig.EnvironmentFile = config.sops.secrets.isso.path;
+    };
+  };
+}

modules/servers/keycloak.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
+let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.keycloak;
+in
+{
+  options.my.servers.keycloak = setup.mkOptions "keycloak" "auth" 8090;
+  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+    sops.secrets.postgres-password.sopsFile = ../../secrets/secrets.yaml;
+    sops.secrets.keycloak = {
+      sopsFile = ../../secrets/env.yaml;
+      restartUnits = [ "keycloak.service" ];
+    };
+    services.keycloak = {
+      inherit (cfg) enable;
+      database = {
+        type = "postgresql";
+        host = "localhost";
+        createLocally = false;
+        username = "keycloak";
+        name = "keycloak";
+        passwordFile = config.sops.secrets.postgres-password.path;
+      };
+      settings = {
+        hostname = cfg.host;
+        hostname-strict = true;
+        hostname-strict-https = false;
+        http-enabled = true;
+        http-port = cfg.port;
+        http-host = cfg.ip;
+        proxy-headers = "xforwarded";
+      };
+    };
+    systemd.services.keycloak.serviceConfig.EnvironmentFile = config.sops.secrets.keycloak.path;
+    services.nginx.virtualHosts.${cfg.host} = lib.mkIf (cfg.enableProxy && config.my.enableProxy) (
+      inputs.self.lib.proxyReverseFix cfg
+    );
+  };
+}

modules/servers/lidarr.nix

@@ -11,7 +11,7 @@ in
   options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;
   config.virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
     autoStart = true;
-    image = "linuxserver/lidarr:version-2.13.3.4711";
+    image = "linuxserver/lidarr:version-3.0.1.4866";
     ports = [ "${toString cfg.port}:${toString cfg.port}" ];
     environment = {
       TZ = config.my.timeZone;

modules/servers/mealie.nix

@@ -17,7 +17,7 @@ in
         TZ = config.my.timeZone;
         DEFAULT_GROUP = "Home";
         BASE_URL = cfg.url;
-        API_DOCS = "false";
+        API_DOCS = "true";
         ALLOW_SIGNUP = "false";
         DB_ENGINE = "postgres";
         POSTGRES_URL_OVERRIDE = "postgresql://${cfg.name}:@/${cfg.name}?host=${config.my.postgresSocket}";
@@ -25,6 +25,13 @@ in
         WEB_CONCURRENCY = "1";
         SMTP_HOST = "smtp.gmail.com";
         SMTP_PORT = "587";
+        OIDC_AUTH_ENABLED = "true";
+        OIDC_SIGNUP_ENABLED = "true";
+        OIDC_CLIENT_ID = "mealie";
+        OIDC_ADMIN_GROUP = "/admins";
+        OIDC_USER_CLAIM = "email";
+        OIDC_PROVIDER_NAME = "keycloak";
+        OIDC_SIGNING_ALGORITHM = "RS256";
       };
       credentialsFile = config.sops.secrets.mealie.path;
     };

modules/servers/nextcloud.nix

@@ -65,7 +65,7 @@ in
       nextcloud = {
         enable = true;
         https = false; # vps
-        package = pkgs.nextcloud31;
+        package = pkgs.nextcloud32;
         appstoreEnable = true;
         configureRedis = true;
         extraAppsEnable = true;

modules/servers/oauth2-proxy.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.oauth2-proxy;
+in
+{
+  options.my.servers.oauth2-proxy = setup.mkOptions "oauth2-proxy" "auth-proxy" 4180;
+  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+    sops.secrets.oauth2-proxy = {
+      sopsFile = ../../secrets/env.yaml;
+      restartUnits = [ "oauth2-proxy.service" ];
+    };
+    sops.secrets.oauth2-proxy-cookie = {
+      sopsFile = ../../secrets/secrets.yaml;
+      restartUnits = [ "oauth2-proxy.service" ];
+    };
+    services.oauth2-proxy = {
+      inherit (cfg) enable;
+      provider = "keycloak-oidc";
+      clientID = "oauth2-proxy";
+      keyFile = config.sops.secrets.oauth2-proxy.path;
+      oidcIssuerUrl = "${config.my.servers.keycloak.url}/realms/homelab";
+      httpAddress = "${cfg.ip}:${toString cfg.port}";
+      email.domains = [ "*" ];
+      cookie = {
+        name = "_oauth2_proxy";
+        secure = true;
+        expire = "168h";
+        refresh = "1h";
+        domain = ".lebubu.org";
+        secret = config.sops.secrets.oauth2-proxy-cookie.path;
+      };
+      extraConfig = {
+        skip-auth-route = [ "^/ping$" ];
+        set-xauthrequest = true;
+        pass-access-token = true;
+        pass-user-headers = true;
+        request-logging = true;
+        auth-logging = true;
+        session-store-type = "cookie";
+        skip-provider-button = true;
+        code-challenge-method = "S256";
+        whitelist-domain = [ ".lebubu.org" ];
+      };
+    };
+  };
+}

modules/servers/paperless.nix

@@ -1,21 +1,28 @@
 { lib, config, ... }:
 let
   cfg = config.my.servers.paperless;
+  inherit (config.services.paperless) port;
 in
 {
   options.my.servers.paperless.enable = lib.mkEnableOption "Paperless-ngx document management system";
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable) {
-    networking.firewall.allowedTCPPorts = [ config.services.paperless.port ];
+    networking.firewall.allowedTCPPorts = [ port ];
     services.paperless = {
       inherit (cfg) enable;
-      address = "0.0.0.0";
+      address = config.my.ips.server;
       consumptionDirIsPublic = true;
       consumptionDir = "/srv/pool/scans/";
       settings = {
+        PAPERLESS_ACCOUNT_DEFAULT_HTTP_PROTOCOL = "http";
+        PAPERLESS_URL = "http://${config.my.ips.server}:${builtins.toString port}";
         PAPERLESS_DBENGINE = "postgress";
         PAPERLESS_DBNAME = "paperless";
         PAPERLESS_DBHOST = config.my.postgresSocket;
         PAPERLESS_TIME_ZONE = config.my.timeZone;
+        PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";
+        PAPERLESS_ACCOUNT_ALLOW_SIGNUPS = false;
+        PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS = true;
+        PAPERLESS_SOCIAL_AUTO_SIGNUP = true;
         PAPERLESS_CONSUMER_IGNORE_PATTERN = builtins.toJSON [
           ".DS_STORE/*"
           "desktop.ini"

modules/servers/plausible.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfg = config.my.servers.plausible;
+in
+{
+  options.my.servers.plausible = setup.mkOptions "plausible" "analytics" 8439;
+  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+    sops.secrets.plausible.sopsFile = ../../secrets/secrets.yaml;
+    services.plausible = {
+      inherit (cfg) enable;
+      database.postgres.socket = config.my.postgresSocket;
+      mail.email = config.my.smtpemail;
+      server = {
+        inherit (cfg) port;
+        baseUrl = cfg.url;
+        listenAddress = cfg.ip;
+        secretKeybaseFile = config.sops.secrets.plausible.path;
+        disableRegistration = true;
+      };
+    };
+  };
+}

modules/servers/postgres.nix

@@ -39,6 +39,8 @@ let
     "readeck"
     "sonarqube"
     "gitea"
+    "atticd"
+    "keycloak"
   ];
 in
 {

modules/servers/qbittorrent.nix

@@ -7,16 +7,12 @@
 }:
 let
   inherit (inputs) qbit_manage;
-  pkgsU = import inputs.nixpkgs-unstable {
-    system = "x86_64-linux";
-    config.allowUnfree = true;
-  };
   vuetorrent = pkgs.fetchzip {
-    url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.25.0/vuetorrent.zip";
+    url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.31.0/vuetorrent.zip";
-    sha256 = "sha256-sOaQNw6AnpwNFEextgTnsjEOfpl3/lpoOZFgFOz7Bos=";
+    sha256 = "sha256-kVDnDoCoJlY2Ew71lEMeE67kNOrKTJEMqNj2OfP01qw=";
     stripRoot = true;
   };
-  qbit_manageEnv = pkgsU.python3.withPackages (
+  qbit_manageEnv = pkgs.python3.withPackages (
     ps:
     builtins.attrValues {
       inherit (ps)

modules/servers/ryot.nix

@@ -12,7 +12,7 @@ in
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
     sops.secrets.ryot.sopsFile = ../../secrets/env.yaml;
     virtualisation.oci-containers.containers.ryot = {
-      image = "ghcr.io/ignisda/ryot:v9.3.0";
+      image = "ghcr.io/ignisda/ryot:v9.5.0";
       ports = [ "${toString cfg.port}:8000" ];
       environmentFiles = [ config.sops.secrets.ryot.path ];
       environment = {

modules/services/nvidia.nix

@@ -7,10 +7,11 @@
 {
   options.my.services.nvidia.enable = lib.mkEnableOption "NVIDIA GPU drivers and CUDA";
   config = lib.mkIf config.my.services.nvidia.enable {
-    environment.variables.CUDA_CACHE_PATH = "\${XDG_CACHE_HOME}/nv";
     boot.kernelParams = lib.mkIf (config.networking.hostName == "workstation") [ "nvidia-drm.fbdev=1" ];
     services.xserver.videoDrivers = [ "nvidia" ];
+    environment.variables.CUDA_CACHE_PATH = "\${XDG_CACHE_HOME}/nv";
     hardware = {
+      nvidia-container-toolkit.enable = config.virtualisation.podman.enable;
       graphics = {
         enable = true;
         enable32Bit = true;

modules/services/sound.nix

@@ -1,11 +1,10 @@
 {
   config,
   lib,
-  inputs,
   ...
 }:
 {
-  imports = [ inputs.nix-gaming.nixosModules.pipewireLowLatency ];
+  # imports = [ inputs.nix-gaming.nixosModules.pipewireLowLatency ];
   options.my.services.sound.enable = lib.mkEnableOption "audio system and PipeWire";
   config = lib.mkIf config.my.services.sound.enable {
     services.pulseaudio.enable = false;
@@ -15,11 +14,12 @@
       alsa.enable = true;
       alsa.support32Bit = true;
       pulse.enable = true;
-      lowLatency = {
+      wireplumber.enable = true;
-        enable = true;
+      # lowLatency = {
-        quantum = 64;
+      #   enable = true;
-        rate = 48000;
+      #   quantum = 64;
-      };
+      #   rate = 48000;
+      # };
     };
   };
 }

modules/services/syncthing.nix

@@ -69,9 +69,10 @@ in
         };
         folders = {
           cache = mkMobile "~/Downloads/cache/";
-          friends = mkMobile "~/Pictures/artist/friends/";
+          friends = mkMobile "~/Pictures/Artist/friends/";
-          forme = mkMobile "~/Pictures/art for me/";
+          forme = mkMobile "~/Pictures/Art for me/";
           comfy = mkMobile "~/Development/AI/ComfyUI/output/";
+          clean = mkMobile "~/Pictures/Unorganized/unified mess/sync";
           gdl = {
             path = "~/.config/jawz/";
             ignorePerms = false;
@@ -104,7 +105,7 @@ in
             ];
           };
           friend_share = {
-            path = "~/Pictures/encrypted/friends";
+            path = "~/Pictures/Encrypted/friends";
             ignorePerms = false;
             type = "sendreceive";
             devices = [

secrets/env.yaml

@@ -1,16 +1,19 @@
 gitea: ENC[AES256_GCM,data:8o+U4qFdyIhCPNlYyflQIuLHsQHtbT6G/a0OyCUeg9DtIeABXNVFhiy4iFRuIF0=,iv:AYwqDRNML1XuzwQnD4VmI4rKWYfTJjOjibrAbI5qgcA=,tag:UPL3UlETdkoFXLihEIGcSw==,type:str]
 shiori: ENC[AES256_GCM,data:tV7+1GusZvcli8dM86xOD71dc2mzcyfQwMeTh//LDb0=,iv:ED9wR6QjQgwd9Ll/UC5FK3CyYK3b0RniC/D6Y0nGEOI=,tag:X/aopMc2vhnRW2iTphFflQ==,type:str]
 flame: ENC[AES256_GCM,data:XsYRsA2xs+juWje2Od2Yl2xIvU0OS8xMrtwtcK/0NyyRrg==,iv:FR8lHsNQNCaOy4P+7BsIjNCz+H38i5RlwLYQ4fpB2+w=,tag:61EV7H04pcr1bSX4nSvlpw==,type:str]
-ryot: ENC[AES256_GCM,data:VMWf3VqcUdyJu2Ygd3XmoqGNWY/W/VJ4213ej0FrA95kAoX+S+j0+4a4B65NtW9UheDSxD1swTXebyenJCIN/tEZwH2wj9I12akNNvSDpt/LG3d1/BZ62cvLCb5n9vyE/vcXgJVfPUqmc67pYDWLpEV/vkKjpqwNH4Y8vnapVo1ytIgsjkTuBb7VFbnRPvYs6J1M0rnaTtkVhOBoRxv+Xg3pWYCgFEXdM/Pg/WKqdHpyh+tJqR74Z91Mwv6G56ZYEDQmAp+Cn+Kk2zZ+t44UAu1SQOgYXPLep+4/PgWw/vQMuyN7GNNP6TrsX3g+ONtJtkdmGu6ArcfbRAky4vM14DxlQP4xSjYSu+FDWGJL/J4TMw6IVDuw/TDVNpMrhBmZdPujYLUW1c6GCCEchBknNfw/Wt+NyTjOzCmZLVw760jY05Fa9kcW2kz+P0iAGTviY7yJZWDctP6PrVNtG1cXc4noJqV/uJ9sQmuGWCiTzaCIIZEhwRKnvjpvZNisKPhx4tctZMWm8l9gKO/TJC/SHMIhvEazmH4v0AzCiRUzdTfnWQZGTNenDrCUetztPh/UUJbLZjhFBH3QR26w/3I5oNpUzUDhfDhcEYtfWuB7ckbkXT8nyYMfe0OR16yJTfQCdnIPBhAUi1g1ZV3jFg+OhYWxk73lPiqC1ADRNh01L1k90PMMWtLXXm6aQ28cB+iQTvvgKbDrr76U8bXoZUyEl30waOQ2HT6nDG61OBUtQHTu6/cFhfhrnU6poAD/k+L7SyqcBoMYAZJN6Us1y3SKhV/3mXVKjRwSl5XZSW+ZpcRe/Cg4bonxFBYsZyY3VjK0LC4Cj8ijh4LpYWrGWtVmWOt/gg7UQPTd81A=,iv:Oa2pvfDpfPr3pqeAg2kYIzjf8KUK9ckMfbVymM78FyE=,tag:XyjYEvWo46BliYXdDH8QrQ==,type:str]
-mealie: ENC[AES256_GCM,data:RjKqDs70lWhGN0LXPp3feQfW/WtfJlR6vX++0hwGtqcA3iepEh2Ab/36YRKbsVRBkglp0u18MusTmP0LSHUpzgCn/c/5ZzzRLGL83K3aQRlg8JtdTvzvEnLQSdE=,iv:GEfa8LwpOhkqWtLk0I5F14zkHcnFjVhVaHeLSFlDkN4=,tag:lkGcFn91hVxraMHCKF7rXQ==,type:str]
 maloja: ENC[AES256_GCM,data:yCwokfD4I1Boy2NOhOTLA3dWgUVOdSzWKIEdYC0klvYu41IGcM8bM65uYFmiOtk+jHgt6j3kO/pBBlC4w/iTElphTqFyFRGdBN4fNRntAhMzqOszBZII,iv:Vf9hfNwSTBkh2cXV7Y2fv4NA8kng2M1i7BtTXJvy4u4=,tag:KLc8sP6N2/Pp/9069E3aPQ==,type:str]
-multi-scrobbler: ENC[AES256_GCM,data:ce3dd0PKm6eyD2AqWmw+8iex/tBHgMhG8ASoOMkT3c9k6kiZabpTTFTkcouMO+s42P+qjWQAUJcJlDdYVYJZbAqw8nnxLrtYmKoBknSbbWijlR//CpgfwuuAWIyGQAGVPliuxz+lR+1cf/G2mXM+FJIfp8Sliak3v/nGg3ry0bdjbOLVoBM4rS90Jrq98ZuBrjlFVhcJTKkEHtgDv8N56wWbPL/r3cTlS9MoEu2ulCSLvfu/snr8HqJ5yssAGQ==,iv:jOJulX6o3t+W6DrD6sU7amDH7JQP/JFGBI9IM8m/sXU=,tag:jFZoLpYFXj+xplbypf3nvw==,type:str]
+oauth2-proxy: ENC[AES256_GCM,data:MnAMX4adm8joZGaxZhgMDGf/15U2tk3dE/0dHFwETIi4JdpNvG/PUHTWGmXJrUnRrFxdZaOtGUzAMF47,iv:eEoo0YM+wt2/pCcONHM9YPRj/q4fC9OQZr+ckRsmhjY=,tag:AevxpvvRt13T5w5xwzay5w==,type:str]
-vaultwarden: ENC[AES256_GCM,data:NituIOyGrYALEkuwKT0RRS1gvi3wjC6ZSAfUIejfi8xoePE6vSNztJTGsRSIh4sJnRrQIiDuKTmRKZDM6AtX/oEBsNW8MVq+lWAq/vtcO7fuTriySEungmpXhQwRZD6NsXE+9283P3s6RshpA4iipmENiW2v2/uxkIXxtTguUxfX0psWYtF6mx5/hpaoNZ523OB69m6veAxD6Pmnj+pTOAORGXHldoNrxNc35WBDdndjAZICyO873tbs22VJOWD9a66BNxtfwIPYoFkuPO6QG3nnFfyPSQ==,iv:rmDJbrP+NQ5HGdRCWSYfymP8dU9WJdMEhAg80eupgeY=,tag:kdNzgWjgeqaTCjqUCc4uWw==,type:str]
-dns: ENC[AES256_GCM,data:fQN3SOm0HzOjSjTohRAD4KlXdEu5PbQc3DvK3rLC1S4G0G4HUPkgucN6vJUwVJPiY0AB+L/iLNcqCRz8OH0qNtfnikBbDicq0OfrwjnN+VzmbwmrS6AdFo6lilbxI3Jb8YwGMrQxXg0U9F2/WVLETbzICG2KpukwIER0xxQpb51OVL+2hviGV8JpWKo66S6pug628Zc+uMJXEBPSqCpz2vXHXnXWMszP6MlqVfNm/zE=,iv:DOj0e8y+2N9eRA81nlT0kS66sXWZoLSVn0NAiUkNcDY=,tag:+0Baqs6TbTAmt3lRfncE6Q==,type:str]
 cloudflare-api: ENC[AES256_GCM,data:iNUMlY8rz5yHVitpK4HGaFSK7j+c8Pm7rOQMOQGmSJ3a8ASyrtouPgLbcnoPY/jalsJYAj991dSiui+Vwqs=,iv:qWONG/KLd9/F4tqrWF5T25Zxst3bk+kOYaOFBFSBAAY=,tag:gRFxar8KS8gnX8oaCD156Q==,type:str]
 synapse: ENC[AES256_GCM,data:IR0pFwQBEM4O8mzzYXrPe2FjulSUGuitzLDLms2uovr6gEU82mCkRO/UCQOybNm03iOQeXX0Whz739kpYSGSInEyx69BNG/etH+bMu+GbYeMdrTEyXHSa7kcH4Ug,iv:Vn2ILYXnCj+Op/E2kWoxV+2ZtlxYJxO6XK3Ql41KW6w=,tag:9wogJFLlmfM5PRgPdwFlcw==,type:str]
 readeck: ENC[AES256_GCM,data:TsIkHLji37dDHQRt78SquBhoSREHDgvgbc6+M1k2MLrgMGJ/Ejfy5AZXCIp/Qj5sXDzKP4j6Y6xFvGLswCqe02XjqGCpX13gZVCFPuKr8Nq051Xg,iv:Rc/pjYP+Vd/DvLCYsfJjDrnAlAiUlZOcNeeYzE6O3UY=,tag:OvR+CXMmrUFbsrHvduhnjA==,type:str]
-lidarr-mb-gap: ENC[AES256_GCM,data:zMr1UJUxqu3BJ2YRZKeIUzcEQRsHM6xeZ9kJ7ElynTD7ay0je+L0i+pyWe3OGwVN/8UUIQnKf42Pr6C4hJSxqwetjG6jQYTUGwTWzvxr/TDr6uhZwG59wLh8e02ymLw0GMJYfkQdZqEWyicHESHNdPmBFx3kByU01/QvOQlFO82/FPTvwpY=,iv:sk57rOrV/lj5f47sF4agZYPScLRiMgtM7iwzmubnZ2Q=,tag:LNl8TK3MswXj6lqBNA9Vqw==,type:str]
+keycloak: ENC[AES256_GCM,data:BmwZxuJaOB8F7zmBNAf42lkw36s5TepimtdyT2xjdGVyuHgRHbTZqeVen7/0II39qrJjko4agZJgToIZ1uhaC/gpGSoHZlib3rJozPCqmBc42nO6SOtpIO8=,iv:kPModK85937/liNk6iLIRiQ/G5yB7S7h24ZzPb8A1zo=,tag:lWvDQAHVRiBz8XZUoADKvw==,type:str]
+ryot: ENC[AES256_GCM,data:VMWf3VqcUdyJu2Ygd3XmoqGNWY/W/VJ4213ej0FrA95kAoX+S+j0+4a4B65NtW9UheDSxD1swTXebyenJCIN/tEZwH2wj9I12akNNvSDpt/LG3d1/BZ62cvLCb5n9vyE/vcXgJVfPUqmc67pYDWLpEV/vkKjpqwNH4Y8vnapVo1ytIgsjkTuBb7VFbnRPvYs6J1M0rnaTtkVhOBoRxv+Xg3pWYCgFEXdM/Pg/WKqdHpyh+tJqR74Z91Mwv6G56ZYEDQmAp+Cn+Kk2zZ+t44UAu1SQOgYXPLep+4/PgWw/vQMuyN7GNNP6TrsX3g+ONtJtkdmGu6ArcfbRAky4vM14DxlQP4xSjYSu+FDWGJL/J4TMw6IVDuw/TDVNpMrhBmZdPujYLUW1c6GCCEchBknNfw/Wt+NyTjOzCmZLVw760jY05Fa9kcW2kz+P0iAGTviY7yJZWDctP6PrVNtG1cXc4noJqV/uJ9sQmuGWCiTzaCIIZEhwRKnvjpvZNisKPhx4tctZMWm8l9gKO/TJC/SHMIhvEazmH4v0AzCiRUzdTfnWQZGTNenDrCUetztPh/UUJbLZjhFBH3QR26w/3I5oNpUzUDhfDhcEYtfWuB7ckbkXT8nyYMfe0OR16yJTfQCdnIPBhAUi1g1ZV3jFg+OhYWxk73lPiqC1ADRNh01L1k90PMMWtLXXm6aQ28cB+iQTvvgKbDrr76U8bXoZUyEl30waOQ2HT6nDG61OBUtQHTu6/cFhfhrnU6poAD/k+L7SyqcBoMYAZJN6Us1y3SKhV/3mXVKjRwSl5XZSW+ZpcRe/Cg4bonxFBYsZyY3VjK0LC4Cj8ijh4LpYWrGWtVmWOt/gg7UQPTd81A=,iv:Oa2pvfDpfPr3pqeAg2kYIzjf8KUK9ckMfbVymM78FyE=,tag:XyjYEvWo46BliYXdDH8QrQ==,type:str]
+isso: ENC[AES256_GCM,data:yfcIsfGuEH3pcpsbBZWXbxrO39AQxHYMaNDHpjhJmwQBUnWgKSWCynIDWgUm+Gjy5r/4GP373xCSiWg3ti7MMgbmqKpd2fL886mrk/7fLMocQqW4sCfWaObzwoEjDvrjDbqAaaJxP4PDcrxOUjj3MiIzQSMPY35I02tbJKTuB6WQw+DftI5Or1/H,iv:j8qp9BSWegV2lKLDlNhlTnWtYABQFPIBEuZJQNpGMjs=,tag:zsiY5crL9bVwOXtwhAeDPw==,type:str]
+mealie: ENC[AES256_GCM,data:/XRyhFGfsSF9y2UEvWIjB05LGkYx4kbl1u5ninGEnkPkbmyRfW0TXybeVKwcX/By05KkbUk+C4N00qykmo16KpI/lRytfnsQHmutST6dV1C5CB6XiPymG8WcntwOtmUiMEwm9qqgEJfoaeFfwdY+03+GFuS2cSphGe6XN8dUOTe+IjNIO4U8U2FXtvcNEsd5SohWkbnObZScKocOSFemjjKoSySwJpK64sQwVKOyIgVECuWo1asXShvmYY3iE6coB7DEk3PaS3hj5u7neN+muZrdANBZjlFxANWDhvFLX6fplRXZLS7DE0KjTqeVjC237Q==,iv:RyRG36wUkiGIZ6l9bXY2cj7jdi8SSJLrbpkOA4uRigU=,tag:frzKD0eabB8O6UH/+pJBTw==,type:str]
+multi-scrobbler: ENC[AES256_GCM,data:ce3dd0PKm6eyD2AqWmw+8iex/tBHgMhG8ASoOMkT3c9k6kiZabpTTFTkcouMO+s42P+qjWQAUJcJlDdYVYJZbAqw8nnxLrtYmKoBknSbbWijlR//CpgfwuuAWIyGQAGVPliuxz+lR+1cf/G2mXM+FJIfp8Sliak3v/nGg3ry0bdjbOLVoBM4rS90Jrq98ZuBrjlFVhcJTKkEHtgDv8N56wWbPL/r3cTlS9MoEu2ulCSLvfu/snr8HqJ5yssAGQ==,iv:jOJulX6o3t+W6DrD6sU7amDH7JQP/JFGBI9IM8m/sXU=,tag:jFZoLpYFXj+xplbypf3nvw==,type:str]
+vaultwarden: ENC[AES256_GCM,data:6PID5tUMZ6BlyddmxumG3Z4uoxDezr8OIRJPYd7SrW1kTGUaQyewIxFajngOY3r251t61IwbKe0MwWeugpi7w2kxVJN4e0WErwUZDjBPCQxukbu81kVbUzCS3VDm1TP0fKylJUPIK3bkKKHkD5XDGo22YtuhICyaPkYXNtEEs2TCAHagBuSrVVEYPbp8as7FS1j8L47XUkjaT919w298nB8s7jNo4VvaNeHFgWVdH0oRRD/VUJj7yewXaugk+mlsRMuNd9HqxpOophIHzX2B59YG3rBA6w==,iv:Xgv4OTDJNf+atQHFAvSEYMXcW65cm7wqN9VtmDHS3MU=,tag:ZN/igsxJb025HmCriLcCZQ==,type:str]
+dns: ENC[AES256_GCM,data:fQN3SOm0HzOjSjTohRAD4KlXdEu5PbQc3DvK3rLC1S4G0G4HUPkgucN6vJUwVJPiY0AB+L/iLNcqCRz8OH0qNtfnikBbDicq0OfrwjnN+VzmbwmrS6AdFo6lilbxI3Jb8YwGMrQxXg0U9F2/WVLETbzICG2KpukwIER0xxQpb51OVL+2hviGV8JpWKo66S6pug628Zc+uMJXEBPSqCpz2vXHXnXWMszP6MlqVfNm/zE=,iv:DOj0e8y+2N9eRA81nlT0kS66sXWZoLSVn0NAiUkNcDY=,tag:+0Baqs6TbTAmt3lRfncE6Q==,type:str]
+lidarr-mb-gap: ENC[AES256_GCM,data:bNzD9Nf9BWAPkm0Yk0J4MJbmo908QX9VsD+40Rngnfec9nzH4vZ2DrelxRllgT1kgnXMQzvoSgNhBwkDN4fgX73hz1FjkytTwahlO0wcY6R+tw4aokh0QYy0TVx5pZ4u1FEQOAp3IMgBsP8HOqaL/NEsEo3yb0K9iC3AfFihkLDJmVh26Pg=,iv:go0qS7/BcfcAMPkAdGWCoL61gNqBG5lWDev++y9DJ/I=,tag:LgtEyTZH8NfhfrKTcAigZw==,type:str]
 sops:
     age:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
@@ -49,7 +52,7 @@ sops:
             QXRUYWtGcWZCVW11U3VYRktuUjlCbDgKsTK4WhUza/JuoDTU3uATa6fq/8eYzxtb
             9BUK1ddzx9Mghea9XBMS17YGtGmW800OsLBomb3SINnOFvejcnKf8Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-11T17:47:23Z"
+    lastmodified: "2025-12-26T03:14:55Z"
-    mac: ENC[AES256_GCM,data:9wWhkUbU/bNV6erUpQhwza47XLbdC7RIfw1J+bFdKW1DLjokeYr1HacZVw+O3bGDFZqKs9JomfnYLxeZay0VXKLb/e61yETi2lx3/BV3Ghp3Tsglf3Eoy4QokvErqDi3GoT7Hvc2bArq4hlYuZI5yjUU+8xvwMopU9MS1C1Muuw=,iv:WfnngiGiY8pnvZHiGueCkZtnGbF42L7ut+tCs8BMskA=,tag:x81EkcXBIk1bylD/QqXzPg==,type:str]
+    mac: ENC[AES256_GCM,data:gIWqEMtFkoEnFV/I4cefglnXxxr1XwON/Oiv/iHv1h5zVLvEwdGC9hyQB1KEKUEHDxWjh8GpKXn9rkZ5pncs7vZdjgiMXyVC7IAiN7uT03RfyGjPtLy7T9qqzmac2uOWLoCnda6No4VIBGG50leh5J7WDk4hKXvlm49xCwSlcLw=,iv:fVtqpXMO3klwAztFRXODLp5H9kq9LJt82Zsoq/59dTU=,tag:XTa90qDkg7ehW6xoXRwEVw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

secrets/secrets.yaml

@@ -1,11 +1,10 @@
 jawz-password: ENC[AES256_GCM,data:j5qya2z9bDESQopcBpLBktyBvIuplbq3Ql4TovdAF1BIJHcf4CAjFuCStW0axFEOST6bgJwhcZZvK4rWUyoS47eaFDp2lkiQnQ==,iv:GNEA8v0NR+PGe4yvlm4V6tTJD5NmlswRPH7JnQJUyLk=,tag:dpxDK88cAJSk+XdFF2mDww==,type:str]
-smtp-password: ENC[AES256_GCM,data:KAIn6lp6JXY39SgMPGP3tQ==,iv:Mgmo9bLT3iIGXw6THqJO6+IuPV65VXo1+vE3PrmS44Y=,tag:8urcnZtccaPJSOuHiZAp5A==,type:str]
+smtp-password: ENC[AES256_GCM,data:Reb6wDlZivAn5DVI2swNfQ==,iv:ZT4QvFXYmgFl1Ut07Yic1qnA8JvapSTfKw2DPCoQMEU=,tag:A5jIqUrmUwROS/LKbsahsQ==,type:str]
 nextcloud-adminpass: ENC[AES256_GCM,data:g0bnifEbMykPBVwMF14EhT/RWGsnEzJ6sXXmxSJ6kIVDeRr8XVRbFzusxlxAOOlseVwPT6e4Ad8=,iv:Gy0LwUNCw8gnqlwk91qguSEeufIJDtaqNNLX1vZp7vA=,tag:y8H42B1rue0X7/4nG/Whsw==,type:str]
 firefly-iii-keyfile: ENC[AES256_GCM,data:HTifd3/5apa9f0RiOh33aRRoVkRskgo/2FV9S01wQSEmKFLg2M9gNNFm6gv2/WCQvNc1,iv:4yLIQQkfqhLixQtAOsbQePNlKOrU2p6Dqw9aLPDoJrM=,tag:uSbAMCy4FWRMU+QhExAE2w==,type:str]
-resilio:
+postgres-password: ENC[AES256_GCM,data:V0g4T1cLUFnTN94zZZR83/KVJFUDGEWVEn6nyijnver4QCELUFkNr99s9g==,iv:1ymHA0JaVC2/aHdg4TmJmuKOG8JGZRRvynrgQIGdTss=,tag:xsCVpc+HBaNeswYvzo0PaA==,type:str]
-    host: ENC[AES256_GCM,data:iITbrqpJSdM52A==,iv:8sahhsUA9iIXNlJYKAkakllQDbYVOsGuwBulK9FyvTU=,tag:zKKHwrEFUkl3Fcd0RJcIjw==,type:str]
+oauth2-proxy-cookie: ENC[AES256_GCM,data:eWEgnIGcdq1aRXWokmVO9DDb+t2oAxNCwFeyOUITzHQ=,iv:x5CROKQ5arUMESWQsroC15xbtMA6/HvnArhBiGwAx6k=,tag:U5yYk1ztExZsou7gVvA8Og==,type:str]
-    user: ENC[AES256_GCM,data:31s2ihj2cN9C5Lyr2w==,iv:2MzKiRoDosawbeQ04LUKbfbSVFUUD6uUYynB6B0WNWw=,tag:GR0lXvLZAPof6WE3Verimg==,type:str]
+plausible: ENC[AES256_GCM,data:Vze/uzsB4VkmeQwqJCVwlwT2kLpFoKSKXgaCmZ2633J2L6pVpL+OxnGxiSS7dmEuWRL5HOkMOJJdFWWCUhrv+QUMpp2RQ9bjy1q6gIOtejNTYPNm6/wg+A==,iv:d+ILv3ZDpanUxDJ2IkWaZ3TC14mldafxnjL3yAE+SK0=,tag:YqhGhMtCtvwaazeN7pXQJA==,type:str]
-    password: ENC[AES256_GCM,data:codFGm4O9QkI2+hbrVK3UqwFWETXyfl9y3Q5lY6UfnIRe/IqWG8Ibly1BUlh7OjKIepXm6m35e6QPioVSiUT5Ll1SIE=,iv:QWqKyKrvm2y2UM2Ir1COxjV0jgU8jTeu9ehnyeXTwCE=,tag:Xtr+r7EphaiLjGwK5gmsMQ==,type:str]
 kavita-token: ENC[AES256_GCM,data:kt3bTZNf4S7sKfbxzXc4Q+9yTPFTKzvEaR+mysBhhdnht+FuN9o9i9liqy2pKvB7WQmPnjQ/aYEYkcPSPg0NC5NwE7lNY7kUJtyHzYm2wkKqkkDIc/aI+dHhtX1SBF99ZpWEhmgnIA2HtCpYXUjkl4pUTKgNi0cn+bb1NULMY0zHyF2f7faOOKTWatQEuG1ZvBpiNIbPbsMznfdrWe9VEKrdtMg8IkK138Cn+EOSu0mCHdU=,iv:NCjegkB9/O6xq3fdWqhyVJy5YetqIpcDmD0yyBh3XXQ=,tag:IiqZY0mhqyUHJ61DRNHPlw==,type:str]
 stash:
     password: ENC[AES256_GCM,data:ZYwrETIJ1K5RJePR9TvmPdVHpZY=,iv:nqIvm5MkSmZxgSLUpZC0Iq2QOp4lU9rh9wtE8FhO7a0=,tag:YIlj9iPGjDVewgtjq0tdag==,type:str]
@@ -52,7 +51,7 @@ sops:
             RmRyZldlMjUwMEdUUEpDS2JSa2tDTTAKp/pT+0cNnCuKVL+Z0fEMiw1PL9PB/nSM
             QWVTo0Mt8Y6X0Xt0EAi9G5AYxADZ/mmEWPxB7RFgVAiMKtor5Gy1zw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-02T20:02:38Z"
+    lastmodified: "2025-12-26T08:13:55Z"
-    mac: ENC[AES256_GCM,data:DnbkeF+evVTMhYTg3OU528cRQ+jBiUl7Q7JZxyGRL6USjB2OdIRxqnnCH8L36K2hSAIkKQ/kojyJs+8Pgkx5uD/qsCbGlNT9pSBU1qPdSBxqJsVPxHZmkuf/QxGtE4pgV/50xJMrVyzAetWPZuxcYVfWAPszxDZcR5XDuD+Yjk4=,iv:i2Vt6nv6etIgaaoxsbVlxEnIhIx4adOQZFeyGM/4Saw=,tag:jugPmHU78lap7Hy7RJd9pg==,type:str]
+    mac: ENC[AES256_GCM,data:hZoOrRraR1qg/w6dEseP1sbJxxLBtWIw+hTV6TUQHlA9vCfrLEDlAlMZBNoTx1ijHz0Q22sV39j3ON+PBqfRRqxWr7nynYDZ7zk9rtVlW4xPTqIBusU+lHTFC7MSMfPn7bhTQ0h3QPHtTF778WIbgNYjEIXda4rlmrnc0bLdFA8=,iv:2a1M8KUtEj0rMuJsyu3WyEYdzeKw+VkDDZFsyU00XuM=,tag:vXw2+za466Olq05HJPOYdQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.11.0