.github/workflows/build-schemes.yml

@@ -1,92 +0,0 @@
-name: Build All Color Schemes
-
-on:
-  push:
-    paths:
-      - "config/schemes.nix"
-      - "config/scheme-utils.nix"
-  workflow_dispatch:
-
-jobs:
-  build-schemes:
-    runs-on: nixos
-    env:
-      HOSTNAME: server
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Get available schemes
-        id: schemes
-        run: |
-          SCHEMES=$(nix eval --raw --impure --expr '
-            let
-              pkgs = import <nixpkgs> {};
-              inputs = {};
-              utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
-            in
-            builtins.concatStringsSep " " utils.availableSchemes
-          ')
-          echo "schemes=$SCHEMES" >> $GITHUB_OUTPUT
-          echo "Available schemes: $SCHEMES"
-
-      - name: Configure Attic cache
-        run: |
-          # Configure attic client to use your cache server
-          attic login servidos http://127.0.0.1:2343 ${{ secrets.ATTIC_TOKEN }}
-
-      - name: Build and push all schemes
-        run: |
-          echo "Building and pushing all schemes..."
-
-          # Store original scheme
-          ORIGINAL_SCHEME=$(grep -oP "scheme = schemesFile\.schemes\.\K\w+" config/stylix.nix)
-          echo "Original scheme: $ORIGINAL_SCHEME"
-
-          # Build and push each scheme
-          for scheme in ${{ steps.schemes.outputs.schemes }}; do
-            echo "========================================="
-            echo "Processing scheme: $scheme"
-            echo "========================================="
-
-            # Update stylix.nix to use this scheme
-            sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$scheme;/" config/stylix.nix
-
-            # Verify the change
-            grep "scheme = schemesFile.schemes" config/stylix.nix
-
-            # Build the configuration
-            echo "Building $scheme..."
-            nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
-              --out-link ./result-$scheme \
-              --quiet
-
-            # Push to cache
-            echo "Pushing $scheme to cache..."
-            attic push servidos:nixos ./result-$scheme
-
-            # Also push using print-out-paths for better cache coverage
-            nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
-              --print-out-paths \
-              --quiet | attic push servidos:nixos --stdin
-
-            echo "✓ Completed $scheme"
-            echo ""
-          done
-
-          # Restore original scheme
-          echo "Restoring original scheme: $ORIGINAL_SCHEME"
-          sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$ORIGINAL_SCHEME;/" config/stylix.nix
-
-          echo "========================================="
-          echo "All schemes built and pushed successfully!"
-          echo "========================================="
-
-      - name: Summary
-        run: |
-          SCHEME_COUNT=$(echo "${{ steps.schemes.outputs.schemes }}" | wc -w)
-          echo "✅ Color scheme builds completed successfully!"
-          echo "- Built $SCHEME_COUNT schemes: ${{ steps.schemes.outputs.schemes }}"
-          echo "- Pushed all builds to Atticd cache"
-          echo ""
-          echo "You can now switch schemes quickly without waiting for builds!"

.github/workflows/weekly-build-cache.yml

@@ -38,7 +38,7 @@ jobs:
         if: steps.check_changes.outputs.changes == 'true'
         run: |
           # Configure attic client to use your cache server
-          attic login servidos http://127.0.0.1:2343 ${{ secrets.ATTIC_TOKEN }}
+          attic login servidos https://cache.servidos.lat ${{ secrets.ATTIC_TOKEN }}
 
       - name: Build workstation configuration
         if: steps.check_changes.outputs.changes == 'true'

.gitignore

@@ -2,7 +2,3 @@
 config.el
 *.qcow2
 result
-# Prevent accidentally committing unencrypted secrets
-**/secrets/*.yaml.dec
-**/*-decrypted.*
-**/temp-secrets.*

.sops.yaml

@@ -25,13 +25,6 @@ creation_rules:
           - *workstation
           - *server
           - *miniserver
-  - path_regex: secrets/gallery.yaml$
-    key_groups:
-      - age:
-          - *devkey
-          - *workstation
-          - *server
-          - *miniserver
   - path_regex: secrets/wireguard.yaml$
     key_groups:
       - age:

README.org

@@ -1,239 +0,0 @@
-#+TITLE: JawZ NixOS Configuration
-#+AUTHOR: JawZ
-#+EMAIL: danilo.reyes.251@proton.me
-#+OPTIONS: toc:t num:t
-#+STARTUP: content
-
-* Overview
-
-This repository contains my personal NixOS configuration flake, managing
-multiple hosts with a modular approach. Designed the configuration for a
-self-hosted infrastructure with services and development environments.
-
-* Architecture
-
-** Hosts
-- =workstation= :: Main development machine with GNOME desktop
-- =server= :: Primary server with containerized services
-- =miniserver= :: Secondary server for additional services
-- =galaxy= :: Minimal configuration host
-- =emacs= :: Development VM for Emacs configuration
-
-** Key Features
-- Modular configuration system
-- SOPS-based secrets management
-- Container orchestration with Podman
-- Automated builds and caching
-- Multi-language development environments
-- Self-hosted service stack
-
-* Quick Start
-
-** Prerequisites
-- NixOS 23.05 or later
-- SOPS configured with age keys
-- SSH keys for remote builds
-
-** Initial Setup
-#+BEGIN_SRC bash
-# Clone the repository git clone <repository-url> /home/jawz/Development/NixOS
-cd /home/jawz/Development/NixOS
-
-# Install dependencies nix flake update
-
-# Build and switch to configuration sudo nixos-rebuild switch --flake
-.#<hostname>
-#+END_SRC
-
-** Development Environment
-#+BEGIN_SRC bash
-# Enter development shell for specific language nix develop .#<language>
-
-# Available languages: python, rust, go, haskell, javascript, julia, zig, sh,
-cc, nix
-#+END_SRC
-
-* Configuration Structure
-
-** Core Configuration
-- =config/base.nix= :: Common system configuration
-- =config/jawz.nix= :: User and SSH configuration
-- =config/stylix.nix= :: Theming configuration
-- =config/schemes.nix= :: Color scheme definitions
-
-** Host Configurations
-- =hosts/<hostname>/configuration.nix= :: Host-specific settings
-- =hosts/<hostname>/hardware-configuration.nix= :: Hardware-specific config
-- =hosts/<hostname>/toggles.nix= :: Feature toggles
-
-** Modules
-- =modules/apps/= :: Application packages and configurations
-- =modules/dev/= :: Development environment modules
-- =modules/servers/= :: Self-hosted service configurations
-- =modules/services/= :: System service configurations
-- =modules/scripts/= :: Custom scripts and utilities
-- =modules/shell/= :: Shell and terminal configurations
-
-* Services
-
-** Core Services
-- PostgreSQL 17 :: Database backend
-- Nginx :: Reverse proxy and web server
-- Podman :: Container runtime
-- Syncthing :: File synchronization
-- WireGuard :: VPN connectivity
-
-** Self-Hosted Applications
-- Nextcloud :: File sharing and collaboration
-- Gitea :: Git repository hosting
-- Jellyfin :: Media server
-- Plex :: Media streaming
-- Sonarr/Radarr/Lidarr :: Media management
-- Vaultwarden :: Password manager
-- Homepage :: Service dashboard
-- And more...
-
-* Development
-
-** Available Development Shells
-The configuration provides development shells for my favorite programming
-languages:
-
-#+BEGIN_SRC bash
-# Python development nix develop .#python
-
-# Rust development   nix develop .#rust
-
-# Go development nix develop .#go
-
-# JavaScript/Node.js development nix develop .#javascript
-
-# Haskell development nix develop .#haskell
-
-# Julia development nix develop .#julia
-
-# Zig development nix develop .#zig
-
-# Shell scripting nix develop .#sh
-
-# C/C++ development nix develop .#cc
-
-# Nix development nix develop .#nix
-#+END_SRC
-
-** Adding New Modules
-1. Create module file in appropriate directory under =modules/=
-2. Add module to =modules/modules.nix= if needed
-3. Enable module in host configuration or toggles
-
-** Adding New Hosts
-1. Create host directory under =hosts/<hostname>/
-2. Add =configuration.nix= and =hardware-configuration.nix=
-3. Add host to =flake.nix= outputs
-4. Create =toggles.nix= for feature management
-
-* Secrets Management
-
-** SOPS Configuration
-Manage secrets using SOPS with age encryption:
-
-- =secrets/secrets.yaml= :: Main secrets file
-- =secrets/keys.yaml= :: SSH and encryption keys
-- =secrets/env.yaml= :: Environment variables
-- =secrets/wireguard.yaml= :: VPN configuration
-- =secrets/certs.yaml= :: SSL certificates
-
-** Adding New Secrets
-#+BEGIN_SRC bash
-# Edit secrets file sops secrets/secrets.yaml
-
-# Add new secret sops -i -a 'new-secret: "value"' secrets/secrets.yaml
-#+END_SRC
-
-* CI/CD
-
-** GitHub Actions
-The repository includes automated workflows:
-
-- =weekly-build-cache.yml= :: Weekly builds and cache updates
-- =build-schemes.yml= :: Color scheme builds
-
-** Build Cache
-Builds are automatically cached using Atticd for faster rebuilds.
-
-
-* Customization
-
-** Theming
-The configuration uses Stylix for theming. Define color schemes in
-=config/schemes.nix= and can set them via the =config/stylix.nix= file.
-
-** Adding New Services
-1. Create service module in =modules/servers/=
-2. Add service configuration
-3. Enable service in host toggles
-4. Add to homepage if needed
-
-** Custom Scripts
-Scripts are in =modules/scripts/= and toggle them per host.
-
-* Troubleshooting
-
-** Common Issues
-
-*** Build Failures
-- Check flake inputs are up to date: =nix flake update=
-- Verify all required secrets are present
-- Check host-specific configuration
-
-*** Service Issues
-- Check service status: =systemctl status <service>=
-- View logs: =journalctl -u <service>=
-- Verify firewall rules
-
-*** Development Environment
-- Rebuild development shell: =nix develop .#<language>=
-- Check available packages: =nix search nixpkgs <package>=
-
-** Getting Help
-- Check NixOS documentation
-- Review module documentation
-- Check service-specific documentation
-
-* Maintenance
-
-** Regular Tasks
-- Update flake inputs weekly
-- Review and rotate secrets quarterly
-- Update system packages monthly
-- Clean old generations: =sudo nix-collect-garbage -d=
-
-** Backup Strategy
-- Configuration is version controlled
-- Secrets are encrypted and backed up
-- BTRFS snapshots for data protection
-
-* Contributing
-
-** Code Style
-- Use consistent formatting
-- Add comments for complex configurations
-- Follow Nix conventions
-
-** Pull Requests
-- Test changes on development host first
-- Update documentation as needed
-- Ensure all secrets are properly managed
-
-* License
-
-This configuration is for personal use. Please respect the licenses of
-individual packages and services used.
-
-* Contact
-
-For questions or issues, contact danilo.reyes.251@proton.me
-
----
-
-*Last updated: 2025*

config/base.nix

@@ -47,7 +47,7 @@
   };
   security = {
     polkit.enable = true;
-    sudo-rs = {
+    sudo = {
       enable = true;
       wheelNeedsPassword = false;
     };
@@ -75,11 +75,9 @@
       "dotnet-runtime-6.0.36"
       "dotnet-sdk-wrapped-6.0.428"
       "dotnet-sdk-6.0.428"
-      "mbedtls-2.28.10"
     ];
   };
   nix = {
-    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
     distributedBuilds = true;
     optimise.automatic = true;
     settings = {
@@ -125,7 +123,33 @@
         sops
         ;
     };
-    variables = inputs.self.lib.xdgEnvironment;
+    variables =
+      let
+        XDG_DATA_HOME = "\${HOME}/.local/share";
+        XDG_CONFIG_HOME = "\${HOME}/.config";
+        XDG_CACHE_HOME = "\${HOME}/.cache";
+      in
+      {
+        # PATH
+        inherit XDG_DATA_HOME XDG_CONFIG_HOME XDG_CACHE_HOME;
+        XDG_BIN_HOME = "\${HOME}/.local/bin";
+        XDG_STATE_HOME = "\${HOME}/.local/state";
+        # DEV PATH
+        PSQL_HISTORY = "${XDG_DATA_HOME}/psql_history";
+        REDISCLI_HISTFILE = "${XDG_DATA_HOME}/redis/rediscli_history";
+        WINEPREFIX = "${XDG_DATA_HOME}/wine";
+        # OPTIONS
+        ELECTRUMDIR = "${XDG_DATA_HOME}/electrum";
+        WGETRC = "${XDG_CONFIG_HOME}/wgetrc";
+        XCOMPOSECACHE = "${XDG_CACHE_HOME}/X11/xcompose";
+        "_JAVA_OPTIONS" = "-Djava.util.prefs.userRoot=${XDG_CONFIG_HOME}/java";
+        ORG_DEVICE = "workstation";
+        # WAYLAND
+        WLR_NO_HARDWARE_CURSORS = 1;
+        NIXOS_OZONE_WL = 1;
+        PATH = [ "\${HOME}/.local/bin" ];
+        NH_USE_DOAS = 1;
+      };
   };
   programs = {
     nh = {

config/home-manager.nix

@@ -14,10 +14,22 @@ let
     ${pokemon-colorscripts}/bin/pokemon-colorscripts -r --no-title
     export command_timeout=60
   '';
-  commonAliases = inputs.self.lib.commonAliases // {
+  commonAliases = {
-    open-gallery = ''
+    cp = "cp -i";
-      cd /srv/pool/scrapping/JawZ/gallery-dl &&
+    mv = "mv -i";
-      xdg-open "$(${fd}/bin/fd . ./ Husbands wikifeet -tdirectory -d 1 | ${fzf}/bin/fzf -i)"'';
+    mkdir = "mkdir -p";
+    mkcd = "(){ mkdir -p \"$1\" && cd \"$1\" }";
+    copy = "xclip -selection clipboard";
+    cdp = "pwd | copy";
+    cfp = "(){ readlink -f \"$1\" | copy }";
+    ".." = "cd ..";
+    "..." = "cd ../..";
+    ".3" = "cd ../../..";
+    ".4" = "cd ../../../..";
+    ".5" = "cd ../../../../..";
+    c = "cat";
+    sc = "systemctl --user";
+    jc = "journalctl --user -xefu";
   };
 in
 {
@@ -31,13 +43,8 @@ in
     };
     git = {
       enable = true;
-      delta.enable = true;
       userName = "Danilo Reyes";
-      userEmail = osConfig.my.email;
+      userEmail = "CaptainJawZ@protonmail.com";
-      extraConfig = {
-        init.defaultBranch = "main";
-        pull.rebase = true;
-      };
     };
     bash = lib.mkIf (shellType == "bash") {
       enable = true;

config/jawz.nix

@@ -1,12 +1,11 @@
-{
+{ config, lib, ... }:
-  config,
-  lib,
-  inputs,
-  ...
-}:
 let
   inherit (config.networking) hostName;
-  nixosHosts = inputs.self.lib.getNixosHosts config.my.ips hostName lib;
+  nixosHosts =
+    lib.attrNames config.my.ips
+    |> lib.filter (
+      name: !(lib.hasPrefix "wg-" name) && name != "vps" && name != "router" && name != hostName
+    );
   nixosHostsMatch = lib.concatStringsSep " " nixosHosts;
 in
 {
@@ -24,6 +23,9 @@ in
       jawz-password.neededForUsers = true;
       "private_keys/${hostName}" = keyConfig "${baseDir}_${hostName}";
       "git_private_keys/${hostName}" = keyConfig "${baseDir}_git";
+      "syncthing_keys/${hostName}" = keyConfig ".config/syncthing/key.pem";
+      "syncthing_certs/${hostName}" = keyConfig ".config/syncthing/cert.pem";
+      "syncthing_password".sopsFile = ../secrets/keys.yaml;
     }
   );
   home-manager.users.jawz = {
@@ -33,7 +35,7 @@ in
       matchBlocks = {
         vps = {
           hostname = config.my.ips.vps;
-          user = "jawz";
+          user = "fedora";
           port = 3456;
           identityFile = config.sops.secrets."private_keys/${hostName}".path;
         };
@@ -46,6 +48,103 @@ in
       };
     };
   };
+  services.syncthing = lib.mkIf config.my.secureHost {
+    enable = true;
+    user = "jawz";
+    group = "users";
+    overrideDevices = true;
+    overrideFolders = true;
+    openDefaultPorts = true;
+    key = config.sops.secrets."syncthing_keys/${hostName}".path;
+    cert = config.sops.secrets."syncthing_certs/${hostName}".path;
+    guiAddress = "${config.my.ips."${hostName}"}:8384";
+    settings = {
+      options = {
+        natEnabled = false;
+        relaysEnabled = false;
+        globalAnnounceEnabled = false;
+      };
+      gui = {
+        user = "jawz";
+        password = config.sops.secrets.syncthing_password.path;
+      };
+      devices = {
+        server.id = "BG6PF7S-KATABWO-7WAZFMX-6YO7IS3-WQTMR3M-VSOSV7V-HFFMNNH-BFX2EQ4";
+        miniserver.id = "HDYEGIR-GFU7ONK-MOOJUFH-N3L3XHX-SXWN3FI-O23K6LD-BJENQK5-VIPV2AT";
+        workstation.id = "4E4KJ6M-MSTNBVF-D7CNHDW-DUTB3VR-SXKZ4NH-ZKAOMF5-V24JECJ-4STSZAA";
+        galaxy.id = "UAZ5YDV-YUFBXOY-QMS6S6R-WPIIKZI-4OPPW5L-G4OVUPO-YW5KFYY-YASRAAV";
+        phone.id = "OSOX2VZ-AO2SA3C-BFB6NKF-K6CR6WX-64TDBKW-RRKEKJ4-FKZE5CV-J2RGJAJ";
+        wg-friend1 = {
+          id = "XBIYCD4-EFKS5SK-WFF73CU-P37GXVH-OMWEIA4-6KC5F3L-U5UQWSF-SYNNRQF";
+          addresses = [ "tcp://${config.my.ips.wg-friend1}:22000" ];
+          introducer = false;
+          autoAcceptFolders = false;
+          paused = false;
+        };
+      };
+      folders =
+        let
+          isMainHost = hostName == "workstation";
+          mkMobile =
+            path:
+            lib.mkIf isMainHost {
+              inherit path;
+              ignorePerms = false;
+              devices = [
+                "galaxy"
+                "phone"
+              ];
+            };
+        in
+        {
+          cache = mkMobile "~/Downloads/cache/";
+          friends = mkMobile "~/Pictures/artist/friends/";
+          forme = mkMobile "~/Pictures/art for me/";
+          comfy = mkMobile "~/Development/AI/ComfyUI/output/";
+          gdl = {
+            path = "~/.config/jawz/";
+            ignorePerms = false;
+            devices = [
+              "server"
+              "miniserver"
+              "workstation"
+            ];
+          };
+          librewolf = {
+            path = "~/.librewolf/";
+            ignorePerms = false;
+            copyOwnershipFromParent = true;
+            type = if isMainHost then "sendonly" else "receiveonly";
+            devices = [
+              "server"
+              "miniserver"
+              "workstation"
+            ];
+          };
+          notes = {
+            path = "~/Documents/Notes";
+            ignorePerms = false;
+            devices = [
+              "galaxy"
+              "phone"
+              "server"
+              "miniserver"
+              "workstation"
+            ];
+          };
+          friend_share = {
+            path = "~/Pictures/encrypted/friends";
+            ignorePerms = false;
+            type = "sendreceive";
+            devices = [
+              "server"
+              "workstation"
+              "wg-friend1"
+            ];
+          };
+        };
+    };
+  };
   users.users.jawz = {
     uid = 1000;
     linger = true;
@@ -68,15 +167,14 @@ in
       "plugdev"
       "bluetooth"
     ];
-    openssh.authorizedKeys.keyFiles = inputs.self.lib.getSshKeys [
+    openssh.authorizedKeys.keyFiles = [
-      "deacero"
+      ../secrets/ssh/ed25519_deacero.pub
-      "workstation"
+      ../secrets/ssh/ed25519_workstation.pub
-      "server"
+      ../secrets/ssh/ed25519_server.pub
-      "miniserver"
+      ../secrets/ssh/ed25519_miniserver.pub
-      "galaxy"
+      ../secrets/ssh/ed25519_galaxy.pub
-      "phone"
+      ../secrets/ssh/ed25519_phone.pub
-      "vps"
+      ../secrets/ssh/ed25519_vps.pub
-      "windows_vm"
     ];
   };
 }

config/overlay.nix

@@ -8,8 +8,6 @@ let
   pkgsU = mkpkgs inputs.nixpkgs-unstable;
 in
 _final: prev: {
-  handbrake = prev.handbrake.override { useGtk = true; };
-  ripgrep = prev.ripgrep.override { withPCRE2 = true; };
   nautilus = prev.nautilus.overrideAttrs (old: {
     buildInputs =
       old.buildInputs
@@ -31,6 +29,8 @@ _final: prev: {
         wineWowPackages.stable
       ]);
   };
+  handbrake = prev.handbrake.override { useGtk = true; };
+  ripgrep = prev.ripgrep.override { withPCRE2 = true; };
   discord = prev.discord.override {
     withVencord = true;
     withOpenASAR = true;
@@ -38,11 +38,5 @@ _final: prev: {
   waybar = prev.waybar.overrideAttrs (old: {
     mesonFlags = old.mesonFlags ++ [ "-Dexperimental=true" ];
   });
-  inherit (pkgsU)
+  inherit (pkgsU) symbola mealie flaresolver;
-    code-cursor
-    symbola
-    mealie
-    flaresolver
-    deadnix
-    ;
 }

config/schemes.nix

@@ -56,18 +56,6 @@ in
       polarity = "dark";
       image = "${wallpapers}/Waay-Ballerinas.jpeg";
     };
-    febroary = mkScheme {
-      color = "yellow";
-      name = "gruvbox-light";
-      polarity = "light";
-      image = "${wallpapers}/febroary.jpg";
-    };
-    paul3 = mkScheme {
-      color = "bluegrey";
-      name = "mexico-light";
-      polarity = "light";
-      image = "${wallpapers}/paul3.jpg";
-    };
     paul = mkScheme {
       color = "green";
       name = "valua";
@@ -111,7 +99,7 @@ in
         base0A = "#daa520"; # goldenrod
         base0B = "#228b22"; # forest green
         base0C = "#20b2aa"; # light sea green
-        base0D = "#daa520"; # goldenrod
+        base0D = "#4169e1"; # royal blue
         base0E = "#8b008b"; # dark magenta
         base0F = "#dc143c"; # crimson
       };

config/stylix.nix

@@ -9,7 +9,7 @@ let
   schemesFile = import ./schemes.nix {
     inherit pkgs inputs;
   };
-  scheme = schemesFile.schemes.febroary;
+  scheme = schemesFile.schemes.cheems;
   cfg = config.my.stylix;
   gnomeEnabled = config.services.xserver.desktopManager.gnome.enable;
 in

dotfiles/gallery-dl.nix

@@ -12,14 +12,6 @@
       filename = "{filename}.{extension}";
       directory = [ ];
     };
-    bluesky = {
-      limit-rate = "400k-1M";
-      username = "blablablamagic.bsky.social";
-      reposts = false;
-      videos = true;
-      directory = [ "{author['handle']}" ];
-      include = [ "media" ];
-    };
     twitter = {
       skip = "abort:1";
       retweets = false;
@@ -28,28 +20,13 @@
       include = [ "media" ];
       directory = [ "{user[name]}" ];
     };
-    flickr = {
-      size-max = "Original";
-      directory = [
-        "{category}"
-        "{owner[username]}"
-      ];
-    };
     pinterest.directory = [
       "{board[owner][username]}"
       "{board[name]}"
     ];
-    wikifeet = {
-      page-reverse = true;
-      directory = [
-        "{category}"
-        "{celebrity}"
-      ];
-    };
     instagram = {
-      limit-rate = "200k-300k";
       browser = "firefox:linux";
-      user-agent = "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0";
+      user-agent = "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0";
       sleep = "66-123";
       sleep-request = "66-123";
       parent-directory = true;
@@ -69,38 +46,6 @@
         "{tagged_username}"
       ];
     };
-    kemonoparty = {
-      limit-rate = "200k-300k";
-      retries = 10;
-      timeout = 5;
-      filename = "{id}_{filename}.{extension}";
-      directory = [
-        "{category}"
-        "{user}"
-      ];
-    };
-    exhentai.directory = [
-      "{category}"
-      "{title}"
-    ];
-    tumblr = {
-      external = true;
-      inline = true;
-      posts = "all";
-      reblogs = false;
-      parent-directory = true;
-      directory = [ "{blog_name}" ];
-    };
-    deviantart = {
-      limit-rate = "200k-300k";
-      include = "gallery,scraps";
-      flat = true;
-      original = true;
-      mature = true;
-      auto-watch = true;
-      auto-unwatch = true;
-      directory = [ "{username}" ];
-    };
     furaffinity = {
       directory = [
         "{user}"
@@ -112,7 +57,6 @@
       ];
     };
     patreon = {
-      limit-rate = "400k-1M";
       filename = "{filename}.{num}.{extension}";
       browser = "firefox";
       directory = [
@@ -134,8 +78,6 @@
     };
     gfycat.format = "webm";
     reddit = {
-      user-agent = "Python:gallery-dl:v1.0 (by /u/captainjawz)";
-      client-id = "T7nZ6WZ3_onJWBhLP8r08g";
       parent-directory = true;
       directory = [ "{author}" ];
     };
@@ -144,45 +86,6 @@
       directory = [ "{userName}" ];
     };
     imgur.mp4 = true;
-    paheal.directory = [
-      "Husbands"
-      "{search_tags}"
-    ];
-    rule34.directory = [
-      "Husbands"
-      "{search_tags}"
-    ];
-    e621.directory = [
-      "Husbands"
-      "{search_tags}"
-    ];
-    baraag.directory = [ "{account[username]}" ];
-    pixiv = {
-      directory = [ "{user[account]} - {user[id]}" ];
-      ugoira = true;
-      favorite.directory = [
-        "{user_bookmark[account]} - {user_bookmark[id]}"
-        "Bookmarks"
-      ];
-      postprocessors = [
-        {
-          name = "ugoira";
-          extension = "webm";
-          keep-files = false;
-          whitelist = [ "pixiv" ];
-          ffmpeg-twopass = true;
-          ffmpeg-args = [
-            "-c:v"
-            "libvpx"
-            "-crf"
-            "4"
-            "-b:v"
-            "5000k"
-            "-an"
-          ];
-        }
-      ];
-    };
     fanbox = {
       embeds = true;
       directory = [
@@ -191,7 +94,6 @@
       ];
     };
     readcomiconline = {
-      limit-rate = "400k-1M";
       chapter-reverse = true;
       quality = "hq";
       captcha = "wait";

dotfiles/stignore

@@ -1,7 +1,6 @@
 (?d)jawz/chrome/userChrome.css
 (?d)jawz/chrome/userContent.css
 (?d)jawz/lock
-(?d)jawz/storage
 (?d)jawz/user.js
 (?d)native-messaging-hosts/org.gnome.browser_connector.json
 (?d)native-messaging-hosts/org.gnome.chrome_gnome_shell.json

dotfiles/unpackerr.conf

@@ -0,0 +1,222 @@
+##      Unpackerr Example Configuration File      ##
+## The following values are application defaults. ##
+## Environment Variables may override all values. ##
+####################################################
+
+# [true/false] Turn on debug messages in the output. Do not wrap this in quotes.
+# Recommend trying this so you know what it looks like. I personally leave it on.
+debug = false
+
+# Disable writing messages to stdout. This silences the app. You should set a log
+# file below if you set this to true. Recommended when starting with systemctl.
+quiet = false
+
+# Setting activity to true will silence all app queue log lines with only zeros.
+# Set this to true when you want less log spam.
+activity = false
+
+# The application queue data is logged on an interval. Adjust that interval with this setting.
+# Default is a minute. 2m, 5m, 10m, 30m, 1h are also perfectly acceptable.
+log_queues = "1m"
+
+# Write messages to a log file. This is the same data that is normally output to stdout.
+# This setting is great for Docker users that want to export their logs to a file.
+# The alternative is to use syslog to log the output of the application to a file.
+# Default is no log file; this is unset. log_files=0 turns off auto-rotation.
+# Default files is 10 and size(mb) is 10 Megabytes; both doubled if debug is true.
+#log_file = '/downloads/unpackerr.log'
+log_files = 10
+log_file_mb = 10
+
+# How often to poll sonarr and radarr.
+# Recommend 1m-5m. Uses Go Duration.
+interval = "5m"
+
+# How long an item must be queued (download complete) before extraction will start.
+# One minute is the historic default and works well. Set higher if your downloads
+# take longer to finalize (or transfer locally). Uses Go Duration.
+start_delay = "1m"
+
+# How long to wait before removing the history for a failed extraction.
+# Once the history is deleted the item will be recognized as new and
+# extraction will start again. Uses Go Duration.
+retry_delay = "5m"
+
+# How many files may be extracted in parallel. 1 works fine.
+# Do not wrap the number in quotes. Raise this only if you have fast disks and CPU.
+parallel = 1
+
+# Use these configurations to control the file modes used for newly extracted
+# files and folders. Recommend 0644/0755 or 0666/0777.
+file_mode = "0664"
+dir_mode = "0775"
+
+[webserver]
+## The web server currently only supports metrics; set this to true if you wish to use it.
+  metrics = false
+## This may be set to a port or an ip:port to bind a specific IP. 0.0.0.0 binds ALL IPs.
+  listen_addr = "0.0.0.0:5656"
+## Recommend setting a log file for HTTP requests. Otherwise, they go with other logs.
+  log_file = ""
+## This app automatically rotates logs. Set these to the size and number to keep.
+  log_files = 10
+  log_file_mb = 10
+## Set both of these to valid file paths to enable HTTPS/TLS.
+  ssl_cert_file = ""
+  ssl_key_file = ""
+## Base URL from which to serve content.
+  urlbase = "/"
+## Upstreams should be set to the IP or CIDR of your trusted upstream proxy.
+## Setting this correctly allows X-Forwarded-For to be used in logs.
+## In the future it may control auth proxy trust. Must be a list of strings.
+  upstreams = [ ] # example: upstreams = [ "127.0.0.1/32", "10.1.2.0/24" ]
+
+##-Notes-#######-READ THIS!!!-##################################################
+## The following sections can be repeated if you have more than one Sonarr,   ##
+## Radarr or Lidarr, Readarr, Folder, Webhook, or Command Hook.               ##
+## You MUST uncomment the [[header]] and api_key at a minimum for Starr apps. ##
+##                ALL LINES BEGINNING WITH A HASH # ARE IGNORED               ##
+##            REMOVE THE HASH # FROM CONFIG LINES YOU WANT TO CHANGE          ##
+################################################################################
+
+[[sonarr]]
+url = "http://localhost:8989"
+api_key = "52869fe7bec4482dafb21c4053fe71e4"
+## File system path where downloaded Sonarr items are located.
+paths = ['/srv/pool/multimedia/downloads/torrent']
+## Default protocols is torrent. Alternative: "torrent,usenet"
+protocols = "torrent"
+## How long to wait for a reply from the backend.
+timeout = "10s"
+## How long to wait after import before deleting the extracted items.
+delete_delay = "5m"
+## If you use this app with NZB you may wish to delete archives after extraction.
+## General recommendation is: do not enable this for torrent use.
+## Setting this to true deletes the entire original download folder after import.
+# delete_orig = false
+## If you use Syncthing, setting this to true will make unpackerr wait for syncs to finish.
+# syncthing = false
+
+[[radarr]]
+url = "http://127.0.0.1:7878"
+api_key = "a987ac45ca2c47bc88e762031ea33296"
+## File system path where downloaded Radarr items are located.
+paths = ['/srv/pool/multimedia/downloads/torrent']
+## Default protocols is torrents. Alternative: "torrent,usenet"
+protocols = "torrent"
+## How long to wait for a reply from the backend.
+timeout = "10s"
+## How long to wait after import before deleting the extracted items.
+delete_delay = "5m"
+## If you use this app with NZB you may wish to delete archives after extraction.
+## General recommendation is: do not enable this for torrent use.
+## Setting this to true deletes the entire original download folder after import.
+# delete_orig = false
+## If you use Syncthing, setting this to true will make unpackerr wait for syncs to finish.
+# syncthing = false
+
+#[[lidarr]]
+# url = "http://127.0.0.1:8686"
+# api_key = "0123456789abcdef0123456789abcdef"
+## File system path where downloaded Lidarr items are located.
+# paths = ['/downloads']
+## Default protocols is torrent. Alternative: "torrent,usenet"
+# protocols = "torrent"
+## How long to wait for a reply from the backend.
+# timeout = "10s"
+## How long to wait after import before deleting the extracted items.
+# delete_delay = "5m"
+## If you use this app with NZB you may wish to delete archives after extraction.
+## General recommendation is: do not enable this for torrent use.
+## Setting this to true deletes the entire original download folder after import.
+# delete_orig = false
+## If you use Syncthing, setting this to true will make unpackerr wait for syncs to finish.
+# syncthing = false
+
+#[[readarr]]
+# url = "http://127.0.0.1:8787"
+# api_key = "0123456789abcdef0123456789abc"
+## File system path where downloaded Readarr items are located.
+# paths = ['/downloads']
+## Default protocols is torrent. Alternative: "torrent,usenet"
+# protocols = "torrent"
+## How long to wait for a reply from the backend.
+# timeout = "10s"
+## How long to wait after import before deleting the extracted items.
+# delete_delay = "5m"
+## If you use this app with NZB you may wish to delete archives after extraction.
+## General recommendation is: do not enable this for torrent use.
+## Setting this to true deletes the entire original download folder after import.
+# delete_orig = false
+## If you use Syncthing, setting this to true will make unpackerr wait for syncs to finish.
+# syncthing = false
+
+
+##################################################################################
+### ###  STOP HERE ### STOP HERE ### STOP HERE ### STOP HERE #### STOP HERE  ### #
+### Only using Starr apps? The things above. The below configs are OPTIONAL. ### #
+##################################################################################
+
+##-Folders-#######################################################################
+## This application can also watch folders for things to extract. If you copy a ##
+## subfolder into a watched folder (defined below) any extractable items in the ##
+## folder will be decompressed. This has nothing to do with Starr applications. ##
+##################################################################################
+#[[folder]]
+# path = '/some/folder/to/watch'
+## Path to extract files to. The default (leaving this blank) is the same as `path` (above).
+# extract_path = ""
+## Delete extracted or original files this long after extraction.
+## The default is 0. Set to 0 to disable all deletes. Uncomment it to enable deletes. Uses Go Duration.
+# delete_after = "10m"
+## Delete extracted files after successful extraction? true/false, no quotes. Honors delete_after.
+# delete_files = false
+## Delete original items after successful extraction? true/false, no quotes. Honors delete_after.
+# delete_original = false
+## Disable extraction log (unpackerred.txt) file creation? true/false, no quotes.
+# disable_log = false
+## Move extracted files into original folder? If false, files go into an _unpackerred folder.
+# move_back = false
+## Set this to true if you want this app to extract ISO files with .iso extension.
+# extract_isos = false
+
+
+################
+### Webhooks ###
+################
+# Sends a webhook when an extraction queues, starts, finishes, and/or is deleted.
+# Created to integrate with notifiarr.com.
+# Also works natively with Discord.com, Telegram.org, and Slack.com webhooks.
+# Can possibly be used with other services by providing a custom template_path.
+###### Don't forget to uncomment [[webhook]] and url at a minimum !!!!
+#[[webhook]]
+# url    = "https://notifiarr.com/api/v1/notification/unpackerr/api_key_from_notifiarr_com"
+# name   = ""    # Set this to hide the URL in logs.
+# silent = false # do not log success (less log spam)
+# events = [0]   # list of event ids to include, 0 == all.
+## Advanced Optional Webhook Configuration
+# nickname      = ""    # Used in Discord and Slack templates as bot name, in Telegram as chat_id.
+# channel       = ""    # Also passed into templates. Used in Slack templates for destination channel.
+# exclude       = []    # list of apps to exclude, ie. ["radarr", "lidarr"]
+# template_path = ""    # Override internal webhook template for discord.com or other hooks.
+# template      = ""    # Override automatic template detection. Values: notifiarr, discord, telegram, gotify, pushover, slack
+# ignore_ssl    = false # Set this to true to ignore the SSL certificate on the server.
+# timeout       = "10s" # You can adjust how long to wait for a server response.
+# content_type  = "application/json" # If your custom template uses another MIME type, set this.
+
+
+#####################
+### Command Hooks ###
+#####################
+# Executes a script or command when an extraction queues, starts, finishes, and/or is deleted.
+# All data is passed in as environment variables. Try /usr/bin/env to see what variables are available.
+###### Don't forget to uncomment [[cmdhook]] and url at a minimum !!!!
+#[[cmdhook]]
+# command = '/my/cool/app' # Path to command or script.
+# shell   = false # Runs the command inside /bin/sh ('nix) or cmd.exe (Windows).
+# name    = ""    # Provide an optional name for logging.
+# silent  = false # Hides command output from logs.
+# events  = [0]   # list of event ids to include, 0 == all.
+## Optional Command Hook Configuration
+# exclude       = []    # list of apps to exclude, ie. ["radarr", "lidarr"]
+# timeout       = "10s" # You can adjust how long to wait for a server response.

environments/gnome.nix

@@ -4,7 +4,6 @@
   ...
 }:
 {
-  qt.enable = true;
   services = {
     gvfs.enable = true;
     libinput.enable = true;
@@ -33,6 +32,7 @@
       totem
       ;
   };
+  qt.enable = true;
   users.users.jawz.packages = builtins.attrValues {
     inherit (pkgs.gnomeExtensions)
       tactile # window manager
@@ -40,7 +40,6 @@
       gamemode-shell-extension # I guess I'm a gamer now?
       burn-my-windows # special effects for when closing windows
       pano # clipboard manager
-      pop-shell
       ;
   };
 }

environments/hyprland.nix

@@ -1,12 +1,13 @@
 {
   pkgs,
-  config,
   ...
 }:
 let
-  mod = "SUPER";
+  startupScript = pkgs.pkgs.writeShellScriptBin "start" ''
-  waybarConfig = import ./waybar-config.nix { inherit pkgs config; };
+    ${pkgs.waybar}/bin/waybar &
-  waybarStyle = import ./waybar-style.nix { inherit config; };
+    ${pkgs.swww}/bin/swww init &
+    sleep 1
+  '';
 in
 {
   programs.hyprland.enable = true;
@@ -17,119 +18,90 @@ in
       user = "greeter";
     };
   };
+  xdg.portal = {
+    enable = true;
+    extraPortals = [
+      pkgs.xdg-desktop-portal-hyprland
+      # pkgs.xdg-desktop-portal-gtk
+    ];
+  };
   users.users.jawz.packages = builtins.attrValues {
     inherit (pkgs)
       # Wayland utilities
-      wl-clipboard-rs
+      wl-clipboard
       wf-recorder
-      grimblast # screenshots
+      grim
-      mako # notification daemon
+      slurp
+
+      wofi # Application launcher
+      mako # Notification daemon
       libnotify # dependency of mako
-      swaylock-effects # screen locker
+      swaylock-effects # Screen locker
-      yazi # file manager
+      # nautilus # File manager
-      imv # images
-      playerctl # media player control
       ;
   };
   home-manager.users.jawz = {
-    programs = {
+    programs.kitty.enable = true;
-      wofi = {
-        enable = true;
-        settings = {
-          allow_images = true;
-          allow_markup = true;
-          insensitive = true;
-          width = "30%";
-        };
-      };
-      waybar = waybarConfig.programs.waybar // {
-        style = waybarStyle;
-      };
-    };
     wayland.windowManager.hyprland = {
       enable = true;
       settings = {
+        "$mainMod" = "SUPER";
+        exec-once = "${startupScript}/bin/start";
         general = {
           gaps_in = 5;
           gaps_out = 10;
-          border_size = 3;
+          border_size = 2;
           layout = "dwindle";
         };
-        misc = {
-          disable_hyprland_logo = true;
-          disable_splash_rendering = true;
-          force_default_wallpaper = 0;
-        };
         dwindle = {
           pseudotile = true;
           preserve_split = true;
           force_split = 2;
         };
         bind = [
-          "${mod}, return, exec, ghostty"
+          "$mainMod, return, exec, kitty"
-          "${mod}, Q, killactive,"
+          "$mainMod, Q, killactive,"
-          "${mod} SHIFT, F, togglefloating,"
+          "$mainMod SHIFT, F, togglefloating,"
-          "${mod}, F, fullscreen,"
+          "$mainMod, F, fullscreen,"
-          "${mod}, T, pin,"
+          "$mainMod, T, pin,"
-          "${mod}, G, togglegroup,"
+          "$mainMod, G, togglegroup,"
-          "${mod}, bracketleft, changegroupactive, b"
+          "$mainMod, bracketleft, changegroupactive, b"
-          "${mod}, bracketright, changegroupactive, f"
+          "$mainMod, bracketright, changegroupactive, f"
-          "${mod}, S, exec, wofi --show drun icons"
+          "$mainMod, S, exec, wofi --show drun icons"
-          "${mod}, P, pin, active"
+          "$mainMod, P, pin, active"
-          "${mod}, left, movefocus, l"
+
-          "${mod}, right, movefocus, r"
-          "${mod}, up, movefocus, u"
-          "${mod}, down, movefocus, d"
-          "${mod}, h, movefocus, l"
-          "${mod}, l, movefocus, r"
-          "${mod}, k, movefocus, u"
-          "${mod}, j, movefocus, d"
-          "${mod} SHIFT, left, movewindow, l"
-          "${mod} SHIFT, right, movewindow, r"
-          "${mod} SHIFT, up, movewindow, u"
-          "${mod} SHIFT, down, movewindow, d"
-          "${mod} SHIFT, h, movewindow, l"
-          "${mod} SHIFT, l, movewindow, r"
-          "${mod} SHIFT, k, movewindow, u"
-          "${mod} SHIFT, j, movewindow, d"
-          "${mod}, 1, workspace, 1"
-          "${mod}, 2, workspace, 2"
-          "${mod}, 3, workspace, 3"
-          "${mod}, 4, workspace, 4"
-          "${mod}, 5, workspace, 5"
-          "${mod}, 6, workspace, 6"
-          "${mod}, 7, workspace, 7"
-          "${mod}, 8, workspace, 8"
-          "${mod}, 9, workspace, 9"
-          "${mod}, 0, workspace, 10"
-          "${mod} SHIFT, 1, movetoworkspace, 1"
-          "${mod} SHIFT, 2, movetoworkspace, 2"
-          "${mod} SHIFT, 3, movetoworkspace, 3"
-          "${mod} SHIFT, 4, movetoworkspace, 4"
-          "${mod} SHIFT, 5, movetoworkspace, 5"
-          "${mod} SHIFT, 6, movetoworkspace, 6"
-          "${mod} SHIFT, 7, movetoworkspace, 7"
-          "${mod} SHIFT, 8, movetoworkspace, 8"
-          "${mod} SHIFT, 9, movetoworkspace, 9"
-          "${mod} SHIFT, 0, movetoworkspace, 10"
-          "${mod}, F3, exec, grimblast save area ~/Pictures/screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
-          "${mod} SHIFT, F3, exec, grimblast save screen ~/Pictures/screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
-        ];
-        binde = [
-          "${mod} SHIFT, h, moveactive, -20 0"
-          "${mod} SHIFT, l, moveactive, 20 0"
-          "${mod} SHIFT, k, moveactive, 0 -20"
-          "${mod} SHIFT, j, moveactive, 0 20"
-          "${mod} CTRL, l, resizeactive, 30 0"
-          "${mod} CTRL, h, resizeactive, -30 0"
-          "${mod} CTRL, k, resizeactive, 0 -10"
-          "${mod} CTRL, j, resizeactive, 0 10"
           ",XF86AudioRaiseVolume, exec, wpctl set-volume -l 1.4 @DEFAULT_AUDIO_SINK@ 5%+"
           ",XF86AudioLowerVolume, exec, wpctl set-volume -l 1.4 @DEFAULT_AUDIO_SINK@ 5%-"
+
+          "$mainMod, left, movefocus, l"
+          "$mainMod, right, movefocus, r"
+          "$mainMod, up, movefocus, u"
+          "$mainMod, down, movefocus, d"
+
+          "$mainMod, h, movefocus, l"
+          "$mainMod, l, movefocus, r"
+          "$mainMod, k, movefocus, u"
+          "$mainMod, j, movefocus, d"
+
+          "$mainMod SHIFT, h, movewindow, l"
+          "$mainMod SHIFT, l, movewindow, r"
+          "$mainMod SHIFT, k, movewindow, u"
+          "$mainMod SHIFT, j, movewindow, d"
+        ];
+        binde = [
+          "$mainMod SHIFT, h, moveactive, -20 0"
+          "$mainMod SHIFT, l, moveactive, 20 0"
+          "$mainMod SHIFT, k, moveactive, 0 -20"
+          "$mainMod SHIFT, j, moveactive, 0 20"
+
+          "$mainMod CTRL, l, resizeactive, 30 0"
+          "$mainMod CTRL, h, resizeactive, -30 0"
+          "$mainMod CTRL, k, resizeactive, 0 -10"
+          "$mainMod CTRL, j, resizeactive, 0 10"
         ];
         bindm = [
-          "${mod}, mouse:272, movewindow"
+          "$mainMod, mouse:272, movewindow"
-          "${mod}, mouse:273, resizewindow"
+          "$mainMod, mouse:273, resizewindow"
         ];
       };
     };

environments/waybar-config.nix

@@ -1,113 +0,0 @@
-_: {
-  programs.waybar = {
-    enable = true;
-    systemd.enable = true;
-    settings.main-bar = {
-      layer = "top";
-      height = 18;
-      tray.spacing = 5;
-      clock = {
-        format = "{:%a %b %d  %I:%M %p}";
-        tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
-      };
-      modules-left = [
-        "hyprland/workspaces"
-        "custom/separator"
-        "temperature#cpu"
-        "custom/gpu-temp"
-      ];
-      modules-center = [
-        "clock"
-      ];
-      modules-right = [
-        "tray"
-        "mpris"
-        "wireplumber"
-        "wireplumber#microphone"
-      ];
-      "hyprland/workspaces" = {
-        format = "{icon}";
-        active-only = true;
-        on-scroll-up = "hyprctl dispatch workspace e-1";
-        on-scroll-down = "hyprctl dispatch workspace e+1";
-        persistent-workspaces."*" = 10; # Show 5 workspaces on all monitors
-      };
-      "custom/separator" = {
-        format = "|";
-        tooltip = false;
-      };
-      cava = {
-        bars = 14;
-        method = "pulse";
-        framerate = 20;
-        bar_delimiter = 0;
-        stereo = false;
-        format-icons.default = [
-          "▁"
-          "▂"
-          "▃"
-          "▄"
-          "▅"
-          "▆"
-          "▇"
-          "█"
-        ];
-      };
-      "temperature#cpu" = {
-        interval = 2;
-        format = " {temperatureC}°C";
-        critical-threshold = 80;
-        hwmon-path = "/sys/class/hwmon/hwmon1/temp1_input";
-        tooltip-format = "CPU: {temperatureC}°C";
-      };
-      "custom/gpu-temp" = {
-        exec = "nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits";
-        format = "󰢮 {}°C";
-        interval = 2;
-        tooltip-format = "GPU: {}°C";
-      };
-      mpris = {
-        interval = 2;
-        format = "{player_icon} {dynamic}";
-        format-paused = "{status_icon} {dynamic}";
-        dynamic-len = 40;
-        on-click = "playerctl play-pause";
-        on-scroll-up = "playerctl next";
-        on-scroll-down = "playerctl previous";
-        dynamic-order = [
-          "title"
-          "artist"
-        ];
-        player-icons = {
-          default = "🎵";
-          firefox = "🦊";
-          librewolf = "🦊";
-        };
-        status-icons = {
-          paused = "";
-          playing = "";
-        };
-      };
-      wireplumber = {
-        format = "{icon}  {volume}%";
-        format-muted = "󰝟  muted";
-        scroll-step = 5;
-        on-click = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-        format-icons.default = [
-          "󰕿"
-          "󰖀"
-          "󰕾"
-        ];
-      };
-      "wireplumber#microphone" = {
-        format = "{format_source}";
-        format-source = "  {volume}%";
-        format-source-muted = "";
-        on-click = "wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle";
-        on-scroll-up = "wpctl set-volume @DEFAULT_AUDIO_SOURCE@ 5%+";
-        on-scroll-down = "wpctl set-volume @DEFAULT_AUDIO_SOURCE@ 5%-";
-        tooltip-format = "{source_desc}";
-      };
-    };
-  };
-}

environments/waybar-style.nix

@@ -1,41 +0,0 @@
-{
-  config,
-  ...
-}:
-let
-  inherit (config.lib.stylix) colors;
-in
-''
-  * {
-    border: none;
-    font-family: "${config.stylix.fonts.monospace.name}";
-    font-size: ${toString config.stylix.fonts.sizes.desktop}pt;
-    color: #${colors.base04};
-  }
-  window#waybar {
-    background: #${colors.base00};
-    min-height: 18px;
-  }
-  .module {
-    background: #${colors.base00};
-    margin: 0px 3px 0px 3px;
-    padding: 4px 6px 4px 6px;
-  }
-  #workspaces button {
-    padding: 2px 8px;
-    margin: 2px;
-    border-radius: 8px;
-    background: transparent;
-    color: #${colors.base03};
-    border: none;
-    min-width: 20px;
-  }
-  #workspaces button.active {
-    background: #${colors.base02};
-    color: #${colors.base05};
-  }
-  #workspaces button:hover {
-    background: #${colors.base01};
-    color: #${colors.base04};
-  }
-''

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760101617,
+        "lastModified": 1755946532,
-        "narHash": "sha256-8jf/3ZCi+B7zYpIyV04+3wm72BD7Z801IlOzsOACR7I=",
+        "narHash": "sha256-POePremlUY5GyA1zfbtic6XLxDaQcqHN6l+bIxdT5gc=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "1826a9923881320306231b1c2090379ebf9fa4f8",
+        "rev": "81584dae2df6ac79f6b6dae0ecb7705e95129ada",
         "type": "github"
       },
       "original": {
@@ -54,17 +54,16 @@
     "base16-fish": {
       "flake": false,
       "locked": {
-        "lastModified": 1754405784,
+        "lastModified": 1622559957,
-        "narHash": "sha256-l9xHIy+85FN+bEo6yquq2IjD1rSg9fjfjpyGP1W8YXo=",
+        "narHash": "sha256-PebymhVYbL8trDVVXxCvZgc0S5VxI7I1Hv4RMSquTpA=",
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
+        "rev": "2f6dd973a9075dabccd26f1cded09508180bf5fe",
         "type": "github"
       },
       "original": {
         "owner": "tomyun",
         "repo": "base16-fish",
-        "rev": "23ae20a0093dca0d7b39d76ba2401af0ccf9c561",
         "type": "github"
       }
     },
@@ -126,28 +125,27 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1757147654,
+        "lastModified": 1759221805,
-        "narHash": "sha256-mGoonbnnd38MZS/H80/vbXCHCxl6KlFup/XKK+zcAuY=",
+        "narHash": "sha256-gKne7A7DWffiqdfUPdX4TK1/a4FU942LM7e6E8ORsTY=",
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
-        "rev": "ad01165af00765af07989b6ad14115960ac675f8",
+        "rev": "5697968fa38469d12012706d9322211de10309c9",
         "type": "github"
       },
       "original": {
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
-        "rev": "ad01165af00765af07989b6ad14115960ac675f8",
         "type": "github"
       }
     },
     "doomemacs": {
       "flake": false,
       "locked": {
-        "lastModified": 1757106921,
+        "lastModified": 1759180402,
-        "narHash": "sha256-vHwgENjip2+AFzs4oZfnKEAJKwf5Zid7fakImvxxQUw=",
+        "narHash": "sha256-Y67ooUjDMWjPk+/IjMRnhe+OPn19Q0wF73prtExwyiI=",
         "owner": "doomemacs",
         "repo": "doomemacs",
-        "rev": "8f55404781edacf66fa330205533b002de3fb5ee",
+        "rev": "5e7e93beb9f2b5a81768aaf4950203ceea21c4f6",
         "type": "github"
       },
       "original": {
@@ -166,11 +164,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757124175,
+        "lastModified": 1759221279,
-        "narHash": "sha256-drA0+kWXGrTgvhlsCiEE7VJ+vFsPi74p32n/7L5L5aU=",
+        "narHash": "sha256-7EAByrl70kQ2gV0opDiNhySsk9KcJiRpnnL+BEaNOhc=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "802b82be7856f6350d5e9ccb536fb4e20cb82069",
+        "rev": "6bbda1ce5dc002b22c95323b01d40518e843a00d",
         "type": "github"
       },
       "original": {
@@ -216,11 +214,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1760948891,
+        "lastModified": 1756770412,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
+        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
+        "rev": "4524271976b625a4a605beefd893f270620fd751",
         "type": "github"
       },
       "original": {
@@ -233,24 +231,6 @@
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
-      "locked": {
-        "lastModified": 1760948891,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_3"
-      },
       "locked": {
         "lastModified": 1712014858,
         "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
@@ -264,7 +244,7 @@
         "type": "indirect"
       }
     },
-    "flake-parts_4": {
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -285,7 +265,7 @@
         "type": "github"
       }
     },
-    "flake-parts_5": {
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -333,11 +313,11 @@
         "rev": "edea9d2aaf2f4e0481fbbb8e26f68a9f39248e3f",
         "revCount": 2,
         "type": "git",
-        "url": "https://git.lebubu.org/jawz/fonts.git"
+        "url": "https://git.servidos.lat/jawz/fonts.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.lebubu.org/jawz/fonts.git"
+        "url": "https://git.servidos.lat/jawz/fonts.git"
       }
     },
     "fromYaml": {
@@ -461,11 +441,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760445448,
+        "lastModified": 1758192433,
-        "narHash": "sha256-fXGjL6dw31FPFRrmIemzGiNSlfvEJTJNsmadZi+qNhI=",
+        "narHash": "sha256-CR6RnqEJSTiFgA6KQY4TTLUWbZ8RBnb+hxQqesuQNzQ=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "50fb9f069219f338a11cf0bcccb9e58357d67757",
+        "rev": "c44e749dd611521dee940d00f7c444ee0ae4cfb7",
         "type": "github"
       },
       "original": {
@@ -492,11 +472,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1761869718,
+        "lastModified": 1759169434,
-        "narHash": "sha256-jLfwwlPGpnGRAtVDyoGj9FgH2D9hWwyEu0yHkflG2EI=",
+        "narHash": "sha256-1u6kq88ICeE9IiJPditYa248ZoEqo00kz6iUR+jLvBQ=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "8e9add2afda58d233a75e4c5ce8503b24fa59ceb",
+        "rev": "38c1e72c9d81fcdad8f173e06102a5da18836230",
         "type": "github"
       },
       "original": {
@@ -517,11 +497,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759610243,
+        "lastModified": 1749046714,
-        "narHash": "sha256-+KEVnKBe8wz+a6dTLq8YDcF3UrhQElwsYJaVaHXJtoI=",
+        "narHash": "sha256-kymV5FMnddYGI+UjwIw8ceDjdeg7ToDVjbHCvUlhn14=",
         "owner": "hyprwm",
         "repo": "hyprland-protocols",
-        "rev": "bd153e76f751f150a09328dbdeb5e4fab9d23622",
+        "rev": "613878cb6f459c5e323aaafe1e6f388ac8a36330",
         "type": "github"
       },
       "original": {
@@ -585,11 +565,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759080228,
+        "lastModified": 1757694755,
-        "narHash": "sha256-RgDoAja0T1hnF0pTc56xPfLfFOO8Utol2iITwYbUhTk=",
+        "narHash": "sha256-j+w5QUUr2QT/jkxgVKecGYV8J7fpzXCMgzEEr6LG9ug=",
         "owner": "hyprwm",
         "repo": "hyprland-qtutils",
-        "rev": "629b15c19fa4082e4ce6be09fdb89e8c3312aed7",
+        "rev": "5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c",
         "type": "github"
       },
       "original": {
@@ -614,11 +594,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758927902,
+        "lastModified": 1756810301,
-        "narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
+        "narHash": "sha256-wgZ3VW4VVtjK5dr0EiK9zKdJ/SOqGIBXVG85C3LVxQA=",
         "owner": "hyprwm",
         "repo": "hyprlang",
-        "rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
+        "rev": "3d63fb4a42c819f198deabd18c0c2c1ded1de931",
         "type": "github"
       },
       "original": {
@@ -639,11 +619,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759619523,
+        "lastModified": 1756117388,
-        "narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
+        "narHash": "sha256-oRDel6pNl/T2tI+nc/USU9ZP9w08dxtl7hiZxa0C/Wc=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
+        "rev": "b2ae3204845f5f2f79b4703b441252d8ad2ecfd0",
         "type": "github"
       },
       "original": {
@@ -685,32 +665,32 @@
         "sudoku-solver": "sudoku-solver"
       },
       "locked": {
-        "lastModified": 1761720517,
+        "lastModified": 1759213850,
-        "narHash": "sha256-YWKeZsstuJMEOlC31pyveuLT9525YW+wzTAMHDawgZ0=",
+        "narHash": "sha256-KnFUzXjSOtSG9U4U4OJonCTZaMWqJjXvHL1PQW994A4=",
         "ref": "refs/heads/master",
-        "rev": "07daae7770da1201de6825de9b65eab0fcd81ca8",
+        "rev": "38959dc37b09d1cb037df02086e4d07b9ef30b80",
-        "revCount": 116,
+        "revCount": 105,
         "type": "git",
-        "url": "https://git.lebubu.org/jawz/scripts.git"
+        "url": "https://git.servidos.lat/jawz/scripts.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.lebubu.org/jawz/scripts.git"
+        "url": "https://git.servidos.lat/jawz/scripts.git"
       }
     },
     "nix-gaming": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1761962248,
+        "lastModified": 1759110900,
-        "narHash": "sha256-tJROzIa21Ser5k12Hvd1W2M5ZQ4DiqROE3+c54zBbLk=",
+        "narHash": "sha256-fcu/r0ijvaYT2VHGkZGr0wq9uBMNFkiftVBy43/2oig=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "537f1d446238a6bb490e1765d39938166f1fb446",
+        "rev": "2ac6a49266e9159ccb001b4c8cb1f50f67d502ae",
         "type": "github"
       },
       "original": {
@@ -787,21 +767,6 @@
       }
     },
     "nixpkgs-lib_2": {
-      "locked": {
-        "lastModified": 1754788789,
-        "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "a73b9c743612e4244d865a2fdee11865283c04e6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib_3": {
       "locked": {
         "dir": "lib",
         "lastModified": 1711703276,
@@ -821,11 +786,11 @@
     },
     "nixpkgs-small": {
       "locked": {
-        "lastModified": 1761999846,
+        "lastModified": 1759250113,
-        "narHash": "sha256-IYlYnp4O4dzEpL77BD/lj5NnJy2J8qbHkNSFiPBCbqo=",
+        "narHash": "sha256-apF3ww4pPkxHI5c424Z6VYdImge1iZSP6TOH45lIqxU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3de8f8d73e35724bf9abef41f1bdbedda1e14a31",
+        "rev": "f579c51fd27e9f66c8236b26a47ed78b315f785d",
         "type": "github"
       },
       "original": {
@@ -837,11 +802,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1761907660,
+        "lastModified": 1759036355,
-        "narHash": "sha256-kJ8lIZsiPOmbkJypG+B5sReDXSD1KGu2VEPNqhRa/ew=",
+        "narHash": "sha256-0m27AKv6ka+q270dw48KflE0LwQYrO7Fm4/2//KCVWg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2fb006b87f04c4d3bdf08cfdbc7fab9c13d94a15",
+        "rev": "e9f00bd893984bc8ce46c895c3bf7cac95331127",
         "type": "github"
       },
       "original": {
@@ -853,11 +818,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1761597516,
+        "lastModified": 1759143472,
-        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
+        "narHash": "sha256-TvODmeR2W7yX/JmOCmP+lAFNkTT7hAxYcF3Kz8SZV3w=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
+        "rev": "5ed4e25ab58fd4c028b59d5611e14ea64de51d23",
         "type": "github"
       },
       "original": {
@@ -869,7 +834,7 @@
     },
     "nixtendo-switch": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": [
           "nixpkgs"
         ]
@@ -890,17 +855,17 @@
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1762014848,
+        "lastModified": 1759260470,
-        "narHash": "sha256-QQVea2dTUs+rOUju0ySleLtZcO/m+3Rw2c2mRasFIhc=",
+        "narHash": "sha256-7KFWm6l+qJl+b1XAx9D8isjCb2kluJEGzquZxmJPEL4=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "c76c2f11f638c4333bfe750c2867aa0d646229e8",
+        "rev": "2b8508603232941676978619d6d4b34fc9e0b486",
         "type": "github"
       },
       "original": {
@@ -945,11 +910,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760663237,
+        "lastModified": 1758108966,
-        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
+        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
+        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
         "type": "github"
       },
       "original": {
@@ -958,26 +923,9 @@
         "type": "github"
       }
     },
-    "qbit_manage": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1758160887,
-        "narHash": "sha256-cTxM3nHQQto7lpoNjShYcCbJCSYiwS9bKqw0DWAjw6A=",
-        "owner": "StuffAnThings",
-        "repo": "qbit_manage",
-        "rev": "21812368bc5366f3388dfb21769fee1da48083c5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "StuffAnThings",
-        "repo": "qbit_manage",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "doom-emacs": "doom-emacs",
-        "flake-parts": "flake-parts",
         "fonts": "fonts",
         "home-manager": "home-manager",
         "hyprland": "hyprland",
@@ -989,7 +937,6 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixtendo-switch": "nixtendo-switch",
         "nur": "nur",
-        "qbit_manage": "qbit_manage",
         "sops-nix": "sops-nix",
         "stylix": "stylix",
         "ucodenix": "ucodenix",
@@ -1003,11 +950,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760998189,
+        "lastModified": 1759188042,
-        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
+        "narHash": "sha256-f9QC2KKiNReZDG2yyKAtDZh0rSK2Xp1wkPzKbHeQVRU=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
+        "rev": "9fcfabe085281dd793589bdc770a2e577a3caa5d",
         "type": "github"
       },
       "original": {
@@ -1023,7 +970,7 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_5",
+        "flake-parts": "flake-parts_4",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
@@ -1037,11 +984,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1761668239,
+        "lastModified": 1759050585,
-        "narHash": "sha256-b0+7/5hBUsLjd/gMY9/LSEsvuWFFolHdpUAOlG73zmw=",
+        "narHash": "sha256-Mj99rGy+K9jaQ85U2YWydZ9OKCIAdkxClrJlfG04GxU=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "a149a557dc306e76d53e7dd488826e61ef9c6289",
+        "rev": "3f71498ed14405aea347b9f5b7f56d97e64e904c",
         "type": "github"
       },
       "original": {
@@ -1246,24 +1193,23 @@
       "original": {
         "owner": "e-tho",
         "repo": "ucodenix",
-        "rev": "ba7f0a366460e0fbea9622fc770cb982be0e4720",
         "type": "github"
       }
     },
     "wallpapers": {
       "flake": false,
       "locked": {
-        "lastModified": 1759463031,
+        "lastModified": 1759117171,
-        "narHash": "sha256-9goyp+g9N4+9PA9V2QerTsxlVy9MA4LXufJaruj2MMs=",
+        "narHash": "sha256-Oyp4MKcld+tlZISm2HvuRErgHUb2mztpOH6v3g8B9uA=",
         "ref": "refs/heads/main",
-        "rev": "0212af5b70347f0721cfe88c25e1efb77b645a2d",
+        "rev": "0bc27e282a4c13d43139c4794e80a5951e4787b8",
-        "revCount": 2,
+        "revCount": 1,
         "type": "git",
-        "url": "https://git.lebubu.org/jawz/wallpapers.git"
+        "url": "https://git.servidos.lat/jawz/wallpapers.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.lebubu.org/jawz/wallpapers.git"
+        "url": "https://git.servidos.lat/jawz/wallpapers.git"
       }
     },
     "xdph": {
@@ -1294,11 +1240,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760713634,
+        "lastModified": 1755354946,
-        "narHash": "sha256-5HXelmz2x/uO26lvW7MudnadbAfoBnve4tRBiDVLtOM=",
+        "narHash": "sha256-zdov5f/GcoLQc9qYIS1dUTqtJMeDqmBmo59PAxze6e4=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "753bbbdf6a052994da94062e5b753288cef28dfb",
+        "rev": "a10726d6a8d0ef1a0c645378f983b6278c42eaa0",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,19 +1,26 @@
 {
   description = "JawZ NixOS flake setup";
   inputs = {
-    flake-parts.url = "github:hercules-ci/flake-parts";
     nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-25.05";
     nixpkgs-small.url = "github:nixos/nixpkgs?ref=nixos-25.05-small";
     nixpkgs-unstable.url = "github:nixos/nixpkgs?ref=nixos-unstable";
-    ucodenix.url = "github:e-tho/ucodenix/ba7f0a366460e0fbea9622fc770cb982be0e4720";
+    ucodenix.url = "github:e-tho/ucodenix";
     doom-emacs = {
-      url = "github:marienz/nix-doom-emacs-unstraightened/ad01165af00765af07989b6ad14115960ac675f8";
+      url = "github:marienz/nix-doom-emacs-unstraightened";
       inputs.nixpkgs.follows = "";
     };
     jawz-scripts = {
-      url = "git+https://git.lebubu.org/jawz/scripts.git";
+      url = "git+https://git.servidos.lat/jawz/scripts.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    wallpapers = {
+      url = "git+https://git.servidos.lat/jawz/wallpapers.git";
+      flake = false;
+    };
+    fonts = {
+      url = "git+https://git.servidos.lat/jawz/fonts.git";
+      flake = false;
+    };
     nur = {
       url = "github:nix-community/nur";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -46,27 +53,78 @@
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    wallpapers = {
-      url = "git+https://git.lebubu.org/jawz/wallpapers.git";
-      flake = false;
-    };
-    fonts = {
-      url = "git+https://git.lebubu.org/jawz/fonts.git";
-      flake = false;
-    };
-    qbit_manage = {
-      url = "github:StuffAnThings/qbit_manage";
-      flake = false;
-    };
   };
   outputs =
-    inputs:
+    { self, jawz-scripts, ... }@inputs:
-    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+    let
-      imports = [
+      inherit (self) outputs;
-        ./parts/core.nix
+      system = "x86_64-linux";
-        ./parts/hosts.nix
+      mkpkgs =
-        ./parts/packages.nix
+        repo:
-        ./parts/devshells.nix
+        import repo {
+          inherit system;
+          config.allowUnfree = true;
+        };
+      langList = builtins.filter (name: name != "emacs") (
+        builtins.map (file: builtins.replaceStrings [ ".nix" ] [ "" ] (baseNameOf file)) (
+          builtins.attrNames (builtins.readDir ./modules/dev)
+        )
+      );
+      commonModules = name: [
+        {
+          nixpkgs.overlays = [
+            (import ./config/overlay.nix { inherit mkpkgs inputs; })
+            inputs.doom-emacs.overlays.default
           ];
+        }
+        {
+          nix.registry = {
+            jawz.flake = self;
+            unstable.flake = inputs.nixpkgs-unstable;
+          };
+        }
+        ./hosts/${name}/configuration.nix
+        inputs.nur.modules.nixos.default
+        inputs.sops-nix.nixosModules.sops
+        inputs.stylix.nixosModules.stylix
+        inputs.nixtendo-switch.nixosModules.nixtendo-switch
+      ];
+      createConfig =
+        name: local-nixpkgs:
+        let
+          lib = local-nixpkgs.lib // inputs.home-manager.lib;
+        in
+        lib.nixosSystem {
+          inherit system;
+          specialArgs = {
+            inherit inputs outputs;
+          };
+          modules = commonModules name;
+        };
+    in
+    {
+      nixosConfigurations = {
+        workstation = createConfig "workstation" inputs.nixpkgs;
+        miniserver = createConfig "miniserver" inputs.nixpkgs-small;
+        server = createConfig "server" inputs.nixpkgs-small;
+        galaxy = createConfig "galaxy" inputs.nixpkgs-small;
+        emacs = createConfig "emacs" inputs.nixpkgs;
+      };
+      packages.${system} = (jawz-scripts.packages.${system} or { }) // {
+        emacs-vm = inputs.nixos-generators.nixosGenerate {
+          inherit system;
+          specialArgs = {
+            inherit inputs outputs;
+          };
+          modules = commonModules "emacs";
+          format = "vm";
+        };
+      };
+      devShells.${system} = builtins.listToAttrs (
+        map (name: {
+          inherit name;
+          value = self.nixosConfigurations.emacs.config.devShells.${name};
+        }) langList
+      );
     };
 }

hosts/miniserver/configuration.nix

@@ -1,17 +1,17 @@
-{ config, inputs, ... }:
+{ config, ... }:
 {
   imports = [
     ./hardware-configuration.nix
     ../../config/base.nix
     ../../config/stylix.nix
   ];
-  my = import ./toggles.nix { inherit inputs; } // {
+  my = import ./toggles.nix // {
     nix.cores = 3;
     nix.maxJobs = 8;
     users.nixremote.enable = true;
-    users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
+    users.nixremote.authorizedKeys = [
-      "nixworkstation"
+      ../../secrets/ssh/ed25519_nixworkstation.pub
-      "nixserver"
+      ../../secrets/ssh/ed25519_nixserver.pub
     ];
   };
   nix.buildMachines =

hosts/miniserver/toggles.nix

@@ -1,6 +1,16 @@
-{ inputs }:
 let
-  inherit (inputs.self.lib) mkEnabled mkEnabledWithProxy enableList;
+  mkEnabled = name: {
+    inherit name;
+    value.enable = true;
+  };
+  mkEnabledWithProxy = name: {
+    inherit name;
+    value = {
+      enable = true;
+      enableProxy = true;
+    };
+  };
+  enableList = func: list: list |> map func |> builtins.listToAttrs;
 in
 {
   emacs.enable = true;

hosts/server/configuration.nix

@@ -2,7 +2,6 @@
   pkgs,
   config,
   lib,
-  inputs,
   ...
 }:
 {
@@ -11,12 +10,12 @@
     ../../config/base.nix
     ../../config/stylix.nix
   ];
-  my = import ./toggles.nix { inherit config inputs; } // {
+  my = import ./toggles.nix { inherit config; } // {
     nix.cores = 6;
     users.nixremote.enable = true;
-    users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
+    users.nixremote.authorizedKeys = [
-      "nixworkstation"
+      ../../secrets/ssh/ed25519_nixworkstation.pub
-      "nixminiserver"
+      ../../secrets/ssh/ed25519_nixminiserver.pub
     ];
     network.firewall.enabledServicePorts = true;
     network.firewall.additionalPorts = [

hosts/server/toggles.nix

@@ -1,7 +1,17 @@
-{ config, inputs }:
+{ config }:
 let
-  inherit (inputs.self.lib) mkEnabled enableList;
+  mkEnabled = name: {
-  mkEnabledIp = inputs.self.lib.mkEnabledIp config.my.ips.wg-server;
+    inherit name;
+    value.enable = true;
+  };
+  mkEnabledIp = name: {
+    inherit name;
+    value = {
+      enable = true;
+      ip = config.my.ips.wg-server;
+    };
+  };
+  enableList = func: list: list |> map func |> builtins.listToAttrs;
 in
 {
   mainServer = "server";
@@ -17,7 +27,6 @@ in
   services = enableList mkEnabled [
     "network"
     "nvidia"
-    "syncthing"
   ];
   dev = enableList mkEnabled [
     "nix"
@@ -55,7 +64,6 @@ in
     "unpackerr"
     "postgres"
     "paperless"
-    "stash"
     "bazarr"
     "collabora"
     "homepage"

hosts/workstation/configuration.nix

@@ -1,7 +1,7 @@
 {
+  lib,
   pkgs,
   config,
-  inputs,
   ...
 }:
 let
@@ -21,21 +21,21 @@ in
     ./hardware-configuration.nix
     ../../config/base.nix
     ../../config/stylix.nix
-    ../../environments/gnome.nix
   ];
-  my = import ./toggles.nix { inherit inputs; } // {
+  my = import ./toggles.nix // {
     nix.cores = 8;
     nix.maxJobs = 8;
     users.nixremote.enable = true;
-    users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
+    users.nixremote.authorizedKeys = [
-      "nixserver"
+      ../../secrets/ssh/ed25519_nixserver.pub
-      "nixminiserver"
+      ../../secrets/ssh/ed25519_nixminiserver.pub
     ];
   };
-  home-manager.users.jawz.programs = {
+  home-manager.users.jawz = {
+    programs = {
       vscode = {
         enable = true;
-      package = pkgs.code-cursor;
+        package = pkgs.vscode;
       };
       ghostty = {
         enable = true;
@@ -44,22 +44,40 @@ in
         enableZshIntegration = shellType == "zsh";
         installBatSyntax = true;
         installVimSyntax = true;
-      settings.term = "xterm-256color";
+      };
+    };
+  };
+  specialisation = {
+    gnome.configuration = {
+      imports = [ ../../environments/gnome.nix ];
+      services.flatpak.enable = true;
+    };
+    hyprland.configuration = {
+      imports = [ ../../environments/hyprland.nix ];
+      services.flatpak.enable = true;
     };
   };
   networking = {
     hostName = "workstation";
-    firewall = {
+    firewall =
-      allowedTCPPorts = [
+      let
-        6674 # ns-usbloader
+        kdeconnectPortRange = {
-        8384 # syncthing
-      ];
-      allowedTCPPortRanges = [
-        {
           from = 1714;
           to = 1764;
-        }
+        };
+        ns-usbloaderPort = 6674;
+        syncthingPort = 8384;
+        openPorts = [
+          ns-usbloaderPort
+          syncthingPort
         ];
+        openPortRanges = [ kdeconnectPortRange ];
+      in
+      {
+        allowedTCPPorts = openPorts;
+        allowedUDPPorts = openPorts;
+        allowedTCPPortRanges = openPortRanges;
+        allowedUDPPortRanges = openPortRanges;
       };
   };
   users.users.jawz.packages = [
@@ -87,6 +105,7 @@ in
         bign-handheld-thumbnailer
         gnome-epub-thumbnailer
         podman-compose
+        code-cursor
         scrcpy
         ;
       inherit (pkgs.libheif) out;
@@ -124,8 +143,7 @@ in
     ../../secrets/ssh/root-private-ca.pem
   ];
   services = {
-    minio.enable = true;
+    flatpak.enable = lib.mkDefault false;
-    flatpak.enable = true;
     open-webui.enable = true;
     scx = {
       enable = true;
@@ -144,48 +162,12 @@ in
       acceleration = "cuda";
       models = "/srv/ai/ollama";
     };
-    postgresql = {
+    sunshine = {
       enable = true;
-      package = pkgs.postgresql_17;
+      autoStart = true;
-      enableTCPIP = true;
+      capSysAdmin = true;
-      authentication = pkgs.lib.mkOverride 10 ''
+      openFirewall = true;
-        local   all    all                                 trust
-        host    all    all    ${config.my.localhost}/32    trust
-        host    all    all    ::1/128                      trust
-      '';
-      ensureDatabases = [ "webref" ];
-      ensureUsers = [
-        {
-          name = "webref";
-          ensureDBOwnership = true;
-        }
-      ];
     };
-  };
+    tailscale.enable = true;
-  programs.virt-manager.enable = true;
-  users.groups.libvirtd.members = [ "jawz" ];
-  virtualisation.libvirtd.enable = true;
-  systemd.services.minio-init = {
-    description = "Initialize MinIO buckets";
-    after = [ "minio.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      # Wait for MinIO to be ready
-      until ${pkgs.curl}/bin/curl -sf http://localhost:9000/minio/health/live > /dev/null 2>&1; do
-        echo "Waiting for MinIO..."
-        sleep 1
-      done
-
-      # Configure mc alias and create bucket
-      ${pkgs.minio-client}/bin/mc alias set local http://localhost:9000 minioadmin minioadmin || true
-      ${pkgs.minio-client}/bin/mc mb local/webref || true
-      ${pkgs.minio-client}/bin/mc anonymous set public local/webref || true
-
-      echo "MinIO initialized with webref bucket"
-    '';
   };
 }

hosts/workstation/hardware-configuration.nix

@@ -34,7 +34,7 @@ in
   boot = {
     plymouth.enable = true;
     consoleLogLevel = 0;
-    loader.timeout = 3;
+    loader.timeout = 5;
     kernelParams = [
       "splash"
       "boot.shell_on_fail"

hosts/workstation/toggles.nix

@@ -1,6 +1,9 @@
-{ inputs }:
 let
-  inherit (inputs.self.lib) mkEnabled enableList;
+  mkEnabled = name: {
+    inherit name;
+    value.enable = true;
+  };
+  enableList = func: list: list |> map func |> builtins.listToAttrs;
 in
 {
   stylix.enable = true;
@@ -9,6 +12,7 @@ in
   servers.drpp.enable = true;
   apps = enableList mkEnabled [
     "art"
+    "piano"
     "dictionaries"
     "fonts"
     "gaming"
@@ -21,6 +25,7 @@ in
   dev = enableList mkEnabled [
     "nix"
     "python"
+    "gameDev"
     "sh"
   ];
   shell = enableList mkEnabled [
@@ -33,7 +38,6 @@ in
     "nvidia"
     "printing"
     "sound"
-    "syncthing"
   ];
   scripts = enableList mkEnabled [
     "tasks"

modules/apps/art.nix

@@ -24,6 +24,7 @@ let
       mypaint-brushes # but it's got some
       mypaint-brushes1 # nice damn brushes
       blender # cgi animation and sculpting
+      drawpile # arty party with friends!!
       pureref # create inspiration/reference boards
       ;
   };

modules/apps/gaming.nix

@@ -5,21 +5,6 @@
   pkgs,
   ...
 }:
-let
-  retroarchWithCores = pkgs.retroarch.withCores (
-    cores:
-    builtins.attrValues {
-      inherit (cores)
-        mgba # gba
-        pcsx2 # ps2
-        dolphin # wii / gamecube
-        snes9x2010 # snes
-        desmume # nintendo ds
-        citra # 3ds
-        ;
-    }
-  );
-in
 {
   imports = [ inputs.nix-gaming.nixosModules.platformOptimizations ];
   options.my.apps = {
@@ -51,7 +36,6 @@ in
       # };
     };
     users.users.jawz.packages = builtins.attrValues {
-      inherit retroarchWithCores;
       inherit (pkgs)
         shipwright # zelda OoT port
         mangohud # fps & stats overlay
@@ -63,8 +47,12 @@ in
         ns-usbloader # load games into my switch
         # emulators
         rpcs3 # ps3
+        pcsx2 # ps2
         cemu # wii u
+        dolphin-emu # wii
+        snes9x-gtk # snes
         ryubing # switch
+        azahar # 3Ds
         prismlauncher # minecraft launcher with jdk overlays
         ;
     };

modules/apps/internet.nix

@@ -40,6 +40,7 @@ in
       inherit (pkgs)
         # thunderbird # email client
         warp # transfer files with based ppl
+        brave # crypto-browser that at least somewhat integrates with gtk
         nextcloud-client # self-hosted google-drive alternative
         fragments # beautiful torrent client
         tor-browser-bundle-bin # dark web, so dark!

modules/apps/librewolf.nix

@@ -7,24 +7,6 @@
   ];
   policies.DisabledFirefoxAccounts = false;
   profiles.jawz = {
-    containersForce = true;
-    containers = {
-      Private = {
-        id = 1;
-        icon = "chill";
-        color = "purple";
-      };
-      Work = {
-        id = 2;
-        icon = "briefcase";
-        color = "orange";
-      };
-      Banking = {
-        id = 3;
-        icon = "dollar";
-        color = "green";
-      };
-    };
     id = 0;
     name = "jawz";
     path = "jawz";
@@ -92,9 +74,6 @@
       "browser.safebrowsing.downloads.remote.block_uncommon" = false;
       # Enable anti-cookie tracking + purge trackers
       "privacy.annotate_channels.strict_list.enabled" = true;
-      # Enable Multi-Account Containers
-      "privacy.userContext.enabled" = true;
-      "privacy.userContext.ui.enabled" = true;
     };
   };
 }

modules/apps/misc.nix

@@ -9,6 +9,7 @@
   config = lib.mkIf config.my.apps.misc.enable {
     users.users.jawz.packages = builtins.attrValues {
       inherit (pkgs)
+        collector # stores things and throws them anywhere
         blanket # background noise
         metadata-cleaner # remove any metadata and geolocation from files
         pika-backup # backups

modules/apps/multimedia.nix

@@ -10,9 +10,11 @@
     users.users.jawz.packages = builtins.attrValues {
       inherit (pkgs)
         recordbox # libadwaita music player
+        pitivi # video editor
         celluloid # video player
         curtail # image compressor
         easyeffects # equalizer
+        handbrake # video converter, may be unnecessary
         identity # compare images or videos
         mousai # poor man shazam
         shortwave # listen to world radio

modules/dev/emacs.nix

@@ -1,6 +1,5 @@
 {
   config,
-  inputs,
   lib,
   pkgs,
   ...
@@ -15,9 +14,7 @@
         "doom/templates/programming.org".source = ../../dotfiles/doom/templates/programming.org;
       };
       services.lorri.enable = true;
-      programs.${config.my.shell.type}.shellAliases =
+      programs.${config.my.shell.type}.shellAliases = {
-        inputs.self.lib.mergeAliases inputs.self.lib.commonAliases
-          {
         edit = "emacsclient -t";
         e = "edit";
       };

modules/dev/nix.nix

@@ -1,6 +1,5 @@
 {
   config,
-  inputs,
   lib,
   pkgs,
   ...
@@ -12,7 +11,6 @@ let
       nixfmt-rfc-style # formatting
       cachix # binary cache management
       nixd # language server for Nix
-      deadnix # detext unused/uneeded dependencies
       statix # linter for Nix expressions
       ;
   };
@@ -34,13 +32,11 @@ in
   };
   config = lib.mkIf config.my.dev.nix.enable {
     users.users.jawz = { inherit packages; };
-    home-manager.users.jawz.programs.${shellType}.shellAliases =
+    home-manager.users.jawz.programs.${shellType}.shellAliases = {
-      inputs.self.lib.mergeAliases inputs.self.lib.commonAliases
-        {
       nixformat = ''
-            deadnix -e && \
+        nix run unstable#deadnix -- -e && \
-            nix run nixpkgs#nixfmt-tree && \
+        nix run unstable#nixfmt-tree && \
-            statix fix
+        nix run unstable#statix fix
       '';
     };
   };

modules/factories/mkserver.nix

@@ -53,8 +53,58 @@ let
       default = null;
     };
   };
+  proxy = locations: {
+    inherit locations;
+    forceSSL = true;
+    enableACME = true;
+    http2 = true;
+  };
+  proxyReverse =
+    cfg:
+    proxy {
+      "/" = {
+        proxyPass = "http://${cfg.ip}:${toString cfg.port}/";
+        proxyWebsockets = cfg.enableSocket;
+      };
+    };
+  proxyReverseFix =
+    cfg:
+    let
+      useLocalhost = cfg.hostName == config.networking.hostName;
+      localHeaders = ''
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header   X-Forwarded-Proto $scheme;
+      '';
+    in
+    proxyReverse cfg
+    // {
+      extraConfig = ''
+        ${if useLocalhost then localHeaders else ""}
+        proxy_set_header   X-Forwarded-Host $host;
+        proxy_set_header   Upgrade $http_upgrade;
+        proxy_set_header   Connection $http_connection;
+        proxy_redirect     off;
+        proxy_http_version 1.1;
+      '';
+    };
+  proxyReversePrivate =
+    cfg:
+    proxyReverse cfg
+    // {
+      extraConfig = ''
+        ssl_verify_client on;
+        ssl_client_certificate ${cfg.certPath};
+        error_page 403 /403.html;
+      '';
+    };
 in
 {
-  inherit mkOptions;
+  inherit
-  mkServerOptions = mkOptions;
+    mkOptions
+    proxy
+    proxyReverse
+    proxyReverseFix
+    proxyReversePrivate
+    ;
 }

modules/modules.nix

@@ -1,23 +1,23 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  inputs,
-  ...
-}:
 let
   filterNames = file: file != "librewolf.nix";
+  autoImport =
+    dir:
+    builtins.readDir ./${dir}
+    |> builtins.attrNames
+    |> builtins.filter (file: builtins.match ".*\\.nix" file != null && filterNames file)
+    |> map (file: ./${dir}/${file});
 in
 {
   imports =
-    inputs.self.lib.autoImport ./apps filterNames
+    autoImport "apps"
-    ++ inputs.self.lib.autoImport ./dev filterNames
+    ++ autoImport "dev"
-    ++ inputs.self.lib.autoImport ./scripts filterNames
+    ++ autoImport "scripts"
-    ++ inputs.self.lib.autoImport ./servers filterNames
+    ++ autoImport "servers"
-    ++ inputs.self.lib.autoImport ./services filterNames
+    ++ autoImport "services"
-    ++ inputs.self.lib.autoImport ./shell filterNames
+    ++ autoImport "shell"
-    ++ inputs.self.lib.autoImport ./network filterNames
+    ++ autoImport "network"
     ++ [
-      ./factories/mkscript.nix
       ./nix/build.nix
       ./users/nixremote.nix
     ];
@@ -39,7 +39,7 @@ in
     };
     domain = lib.mkOption {
       type = lib.types.str;
-      default = "lebubu.org";
+      default = "servidos.lat";
       description = "The domain name.";
     };
     ips = lib.mkOption {
@@ -49,7 +49,7 @@ in
         server = "192.168.100.15";
         miniserver = "192.168.1.100";
         workstation = "192.168.100.18";
-        vps = "45.79.25.87";
+        vps = "51.222.141.104";
         wg-vps = "10.77.0.1";
         wg-server = "10.77.0.2";
         wg-friend1 = "10.8.0.2";
@@ -93,7 +93,7 @@ in
     };
     email = lib.mkOption {
       type = lib.types.str;
-      default = "danilo.reyes.251@proton.me";
+      default = "CaptainJawZ@protonmail.com";
       description = "localhost smtp email";
     };
     timeZone = lib.mkOption {
@@ -105,45 +105,39 @@ in
     enableProxy = lib.mkEnableOption "nginx reverse proxy for services";
   };
   config = {
-    assertions =
+    assertions = [
-      # PostgreSQL dependency assertions
-      inputs.self.lib.mkPostgresDependencies config [
       {
-          service = "nextcloud";
+        assertion = config.my.servers.nextcloud.enable -> config.my.servers.postgres.enable;
-          name = "Nextcloud";
+        message = "Nextcloud requires PostgreSQL to be enabled";
       }
       {
-          service = "vaultwarden";
+        assertion = config.my.servers.vaultwarden.enable -> config.my.servers.postgres.enable;
-          name = "Vaultwarden";
+        message = "Vaultwarden requires PostgreSQL to be enabled";
       }
       {
-          service = "firefly-iii";
+        assertion = config.my.servers.firefly-iii.enable -> config.my.servers.postgres.enable;
-          name = "Firefly III";
+        message = "Firefly III requires PostgreSQL to be enabled";
       }
       {
-          service = "mealie";
+        assertion = config.my.servers.mealie.enable -> config.my.servers.postgres.enable;
-          name = "Mealie";
+        message = "Mealie requires PostgreSQL to be enabled";
       }
       {
-          service = "shiori";
+        assertion = config.my.servers.shiori.enable -> config.my.servers.postgres.enable;
-          name = "Shiori";
+        message = "Shiori requires PostgreSQL to be enabled";
       }
       {
-          service = "ryot";
+        assertion = config.my.servers.ryot.enable -> config.my.servers.postgres.enable;
-          name = "Ryot";
+        message = "Ryot requires PostgreSQL to be enabled";
       }
       {
-          service = "synapse";
+        assertion = config.my.servers.synapse.enable -> config.my.servers.postgres.enable;
-          name = "Matrix Synapse";
+        message = "Matrix Synapse requires PostgreSQL to be enabled";
       }
       {
-          service = "gitea";
+        assertion = config.my.servers.gitea.enable -> config.my.servers.postgres.enable;
-          name = "Gitea";
+        message = "Gitea requires PostgreSQL to be enabled";
       }
-      ]
-      ++
-      # Other assertions
-      [
       {
         assertion =
           config.my.enableProxy

modules/network/firewall.nix

@@ -1,24 +1,17 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  inputs,
-  ...
-}:
 let
-  firewallBlacklist = [
+  nativeServicesWithOpenFirewall = [
-    "sabnzbd"
+    "adguardhome"
-    "lidarr"
+    "plex"
-    "maloja"
+    "nix-serve"
-    "tranga"
+    "radarr"
-    "flame"
+    "sonarr"
-    "flameSecret"
+    "jellyfin"
-    "ryot"
+    "prowlarr"
-    "drpp"
+    "bazarr"
-    "metube"
+    "ombi"
-    "multi-scrobbler"
+    "flaresolverr"
-    "plex-discord-bot"
   ];
-  nativeServicesWithOpenFirewall = inputs.self.lib.getServicesWithNativeFirewall config firewallBlacklist;
   servicesConfig = lib.listToAttrs (
     map (serviceName: {
       name = serviceName;
@@ -43,7 +36,17 @@ in
   config = lib.mkIf config.my.network.firewall.enabledServicePorts {
     services = servicesConfig;
     networking.firewall.allowedTCPPorts =
-      inputs.self.lib.generateFirewallPorts config nativeServicesWithOpenFirewall lib
+      config.my.network.firewall.staticPorts
+      ++ config.my.network.firewall.additionalPorts
+      ++ (
+        config.my.servers
+        |> lib.filterAttrs (
+          name: srv:
+          (srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServicesWithOpenFirewall)
+        )
+        |> lib.attrValues
+        |> map (srv: srv.port)
+      )
       ++ (lib.optionals config.services.nginx.enable [
         config.services.nginx.defaultHTTPListenPort
         config.services.nginx.defaultSSLListenPort

modules/network/nginx.nix

@@ -1,10 +1,6 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  inputs,
-  ...
-}:
 let
+  setup = import ../factories/mkserver.nix { inherit lib config; };
   proxyReverseServices = [
     "firefox-syncserver"
     "readeck"
@@ -30,7 +26,6 @@ let
     "ombi"
     "radarr"
     "sonarr"
-    "stash"
     "atticd"
   ];
   proxyReversePrivateServices = [
@@ -48,11 +43,11 @@ let
       cfg = config.my.servers.${serviceName};
       proxyFunc =
         if serviceConfig.type == "proxyReverse" then
-          inputs.self.lib.proxyReverse
+          setup.proxyReverse
         else if serviceConfig.type == "proxyReverseFix" then
-          inputs.self.lib.proxyReverseFix
+          setup.proxyReverseFix
         else if serviceConfig.type == "proxyReversePrivate" then
-          inputs.self.lib.proxyReversePrivate
+          setup.proxyReversePrivate
         else
           throw "Unknown proxy type: ${serviceConfig.type}";
     in

modules/nix/gitea-actions-runners/nixos.nix

@@ -9,40 +9,22 @@ let
 in
 {
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
-    users.groups.gitea-runner = { };
-    users.users.gitea-runner = {
-      isSystemUser = true;
-      group = "gitea-runner";
-      extraGroups = [
-        "docker"
-        "podman"
-      ];
-    };
-    nix.settings = {
-      allowed-users = [ "gitea-runner" ];
-      trusted-users = [ "gitea-runner" ];
-    };
     services.gitea-actions-runner.instances.nixos = {
       inherit (cfg) url enable;
       name = "${config.networking.hostName}-nixos";
       tokenFile = config.sops.secrets.gitea.path;
       labels = [
-        "nix:host"
         "nixos:host"
       ];
       hostPackages = builtins.attrValues {
         inherit (pkgs)
           bash
-          curl
           coreutils
           gitMinimal
-          attic-client
-          podman
-          podman-compose
           nix
-          nodejs
+          attic-client
-          openssh
+          nodejs # Required for GitHub Actions
-          python3
+          openssh # Required for SSH git operations
           ;
       };
     };

modules/scripts/download.nix

@@ -6,6 +6,7 @@
   ...
 }:
 {
+  imports = [ ../factories/mkscript.nix ];
   options.my.units = {
     download.enable = lib.mkEnableOption "media download automation scripts";
     downloadManga.enable = lib.mkEnableOption "manga download automation";
@@ -16,26 +17,32 @@
     in
     {
       home-manager.users.jawz.programs.${config.my.shell.type} = {
-        shellAliases = inputs.self.lib.mergeAliases inputs.self.lib.commonAliases {
+        shellAliases = {
           dl = "${download}/bin/download -u jawz -i";
           comic = ''dl "$(cat "$LC" | fzf --multi --exact -i)"'';
           gallery = ''dl "$(cat "$LW" | fzf --multi --exact -i)"'';
         };
       }
-      //
+      // (
-        inputs.self.lib.shellConditional config.my.shell.type
+        if config.my.shell.type == "bash" then
-          ''
+          {
-            list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
+            initExtra = ''
-            export LW=$list_root/watch.txt
-            export LI=$list_root/instant.txt
-            export LC=$list_root/comic.txt
-          ''
-          ''
               list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
               export LW=$list_root/watch.txt
               export LI=$list_root/instant.txt
               export LC=$list_root/comic.txt
             '';
+          }
+        else
+          {
+            initContent = ''
+              list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
+              export LW=$list_root/watch.txt
+              export LI=$list_root/instant.txt
+              export LC=$list_root/comic.txt
+            '';
+          }
+      );
       systemd.user = {
         services =
           let

modules/scripts/ffmpeg4discord.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.ffmpeg4discord = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/ffmpreg.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.ffmpreg = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/find-dup-episode.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.find-dup-episodes = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/library-report.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.library-report = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/manage-library.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.manage-library = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/pika-list.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.pika-list = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/run.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.run = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/split-dir.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.split-dir = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/stream-dl.nix

@@ -6,6 +6,7 @@
   ...
 }:
 {
+  imports = [ ../factories/mkscript.nix ];
   options.my.units.stream-dl.enable = lib.mkEnableOption "streaming media download service";
   config =
     let

modules/scripts/tasks.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.tasks = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/tuh-activity-logger.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.tuh-activity-logger = {
     enable = lib.mkDefault false;
     install = true;

modules/scripts/update-dns.nix

@@ -6,6 +6,7 @@
   ...
 }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config = lib.mkIf config.my.secureHost {
     sops.secrets = {
       cloudflare-api.sopsFile = ../../secrets/env.yaml;

modules/scripts/update-org-agenda-cache.nix

@@ -5,6 +5,7 @@
   ...
 }:
 {
+  imports = [ ../factories/mkscript.nix ];
   config.my.scripts.update-org-agenda-cache = {
     enable = lib.mkDefault false;
     install = config.my.emacs.enable;

modules/servers/atticd.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.atticd;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.atticd = setup.mkOptions "atticd" "cache" 2343;
@@ -17,7 +13,6 @@ in
       settings = {
         listen = "[::]:${toString cfg.port}";
         jwt = { };
-        database.heartbeat = true; # 5 minutes
         chunking = {
           nar-size-threshold = 64 * 1024; # 64 KiB
           min-size = 16 * 1024; # 16 KiB
@@ -26,7 +21,7 @@ in
         };
         compression = {
           type = "zstd";
-          level = 3;
+          level = 8;
         };
         garbage-collection = {
           interval = "7 days";
@@ -34,12 +29,5 @@ in
         };
       };
     };
-    systemd.services.atticd = {
-      serviceConfig = {
-        TimeoutStartSec = "15min";
-        TimeoutStopSec = "5min";
-        MemoryMax = "4G";
-      };
-    };
   };
 }

modules/servers/audiobookshelf.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.audiobookshelf;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.audiobookshelf = setup.mkOptions "audiobookshelf" "audiobooks" 5687;

modules/servers/bazarr.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.bazarr;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.bazarr = setup.mkOptions "bazarr" "subs" config.services.bazarr.listenPort;

modules/servers/drpp.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.drpp;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.drpp = setup.mkOptions "drpp" "drpp" 0;

modules/servers/firefox-syncserver.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.firefox-syncserver;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.firefox-syncserver = setup.mkOptions "firefox-syncserver" "sync" 4233;

modules/servers/flame.nix

@@ -1,8 +1,4 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
   cfg = config.my.servers.flame;
   cfgS = config.my.servers.flameSecret;

modules/servers/gitea.nix

@@ -5,11 +5,12 @@
   ...
 }:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.gitea;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   imports = [
+    ../nix/gitea-actions-runners/ryujinx.nix
     ../nix/gitea-actions-runners/nixos.nix
   ];
   options.my.servers.gitea = setup.mkOptions "gitea" "git" 9083;

modules/servers/homepage.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.homepage;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.homepage = setup.mkOptions "homepage" "home" 8082;

modules/servers/homepage/bookmarks/servers.nix

@@ -4,7 +4,7 @@
       readeck = [
         {
           abbr = "RD";
-          href = "https://laters.lebubu.org/";
+          href = "https://laters.servidos.lat/";
           description = "";
         }
       ];
@@ -13,7 +13,7 @@
       maloja = [
         {
           abbr = "ML";
-          href = "https://maloja.lebubu.org/";
+          href = "https://maloja.servidos.lat/";
           description = "";
         }
       ];
@@ -22,7 +22,7 @@
       microbin = [
         {
           abbr = "CP";
-          href = "https://copy.lebubu.org/";
+          href = "https://copy.servidos.lat/";
           description = "";
         }
       ];
@@ -31,7 +31,7 @@
       multi-scrobbler = [
         {
           abbr = "MS";
-          href = "https://scrobble.lebubu.org/";
+          href = "https://scrobble.servidos.lat/";
           description = "";
         }
       ];
@@ -40,7 +40,7 @@
       ryot = [
         {
           abbr = "RT";
-          href = "https://tracker.lebubu.org/";
+          href = "https://tracker.servidos.lat/";
           description = "";
         }
       ];
@@ -49,7 +49,7 @@
       vaultwarden = [
         {
           abbr = "VW";
-          href = "https://vault.lebubu.org";
+          href = "https://vault.servidos.lat";
           description = "";
         }
       ];

modules/servers/jellyfin.nix

@@ -8,7 +8,6 @@
 let
   cfg = config.my.servers.jellyfin;
   inherit (inputs.jawz-scripts.packages.x86_64-linux) sub-sync;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   sub-sync-path = [
     pkgs.nix
     pkgs.bash
@@ -20,6 +19,7 @@ let
     pkgs.gum
     sub-sync
   ];
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.jellyfin = setup.mkOptions "jellyfin" "flix" 8096;

modules/servers/kavita.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.kavita;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.kavita = setup.mkOptions "kavita" "library" config.services.kavita.settings.Port;

modules/servers/lidarr.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.lidarr;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;

modules/servers/maloja.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.maloja;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.maloja = setup.mkOptions "maloja" "maloja" 42010;

modules/servers/mealie.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.mealie;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.mealie = setup.mkOptions "mealie" "mealie" 9925;

modules/servers/metube.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.metube;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;

modules/servers/microbin.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.microbin;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.microbin = setup.mkOptions "microbin" "copy" 8086;

modules/servers/multi-scrobbler.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.multi-scrobbler;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.multi-scrobbler = setup.mkOptions "multi-scrobbler" "scrobble" 9078;

modules/servers/nextcloud.nix

@@ -6,7 +6,6 @@
   ...
 }:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   commonProxyConfig = ''
     proxy_set_header Host $host;
   '';
@@ -29,9 +28,10 @@ let
       };
     }
   );
-  pytensorflow = pkgs.python3.withPackages (ps: [ ps.tensorflow ]);
+  pytensorflow = pkgs.python311.withPackages (ps: [ ps.tensorflow ]);
   cfg = config.my.servers.nextcloud;
   cfgC = config.my.servers.collabora;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers = {
@@ -175,14 +175,6 @@ in
           ];
           #vps
           serverAliases = [ "cloud.rotehaare.art" ];
-          extraConfig = ''
-            add_header X-XSS-Protection "1; mode=block" always;
-            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-            add_header X-Content-Type-Options "nosniff" always;
-            add_header X-Frame-Options "SAMEORIGIN" always;
-            add_header Referrer-Policy "no-referrer-when-downgrade" always;
-            add_header X-Permitted-Cross-Domain-Policies "none" always;
-          '';
           locations = {
             "/".proxyWebsockets = true;
             "~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|oc[ms]-provider/.+|.+/richdocumentscode/proxy).php(?:$|/)" =
@@ -195,11 +187,6 @@ in
           http2 = true;
           locations = {
             # static files
-            "^~ /browser" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonProxyConfig;
-            };
-            # Legacy static files (for compatibility)
             "^~ /loleaflet" = {
               proxyPass = cfgC.local;
               extraConfig = commonProxyConfig;
@@ -215,21 +202,11 @@ in
               extraConfig = commonProxyConfig;
             };
             # download, presentation, image upload and websocket
-            "~ ^/cool" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
-            # Legacy websocket (for compatibility)
             "~ ^/lool" = {
               proxyPass = cfgC.local;
               extraConfig = commonWebsocketConfig;
             };
             # Admin Console websocket
-            "^~ /cool/adminws" = {
-              proxyPass = cfgC.local;
-              extraConfig = commonWebsocketConfig;
-            };
-            # Legacy Admin Console websocket (for compatibility)
             "^~ /lool/adminws" = {
               proxyPass = cfgC.local;
               extraConfig = commonWebsocketConfig;
@@ -254,23 +231,23 @@ in
       };
       collabora = lib.mkIf cfgC.enable {
         autoStart = true;
-        image = "collabora/code:latest";
+        image = "collabora/code";
+        imageFile = pkgs.dockerTools.pullImage {
+          imageName = "collabora/code";
+          imageDigest = "sha256:aab41379baf5652832e9237fcc06a768096a5a7fccc66cf8bd4fdb06d2cbba7f";
+          sha256 = "sha256-M66lynhzaOEFnE15Sy1N6lBbGDxwNw6ap+IUJAvoCLs=";
+        };
         ports = [ "9980:9980" ];
         environment = {
           TZ = config.my.timeZone;
           domain = cfg.host;
-          aliasgroup1 = "${cfg.url}:443";
+          aliasgroup1 = "${cfg.host}:443";
-          aliasgroup2 = "https://cloud.rotehaare.art:443";
+          aliasgroup2 = "cloud.rotehaare.art:443";
-          server_name = cfgC.host;
           dictionaries = "en_CA en_US es_MX es_ES fr_FR it pt_BR ru";
           extra_params = ''
             --o:ssl.enable=false
             --o:ssl.termination=true
-            --o:remote_font_config.url=${cfg.url}/apps/richdocuments/settings/fonts.json
-            --o:logging.level=information
           '';
-          DONT_GEN_SSL_CERT = "1";
-          SLEEPFORDEBUGGER = "0";
         };
         extraOptions = [
           "--cap-add"

modules/servers/nix-serve.nix

@@ -5,8 +5,8 @@
   ...
 }:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.nix-serve;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.nix-serve = setup.mkOptions "nix-serve" "cache" 5000;

modules/servers/ombi.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.ombi;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.ombi = setup.mkOptions "ombi" "requests" 3425;

modules/servers/plex-discord-bot.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.plex-discord-bot;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
   name = "plex-discord-bot";
 in
 {

modules/servers/plex.nix

@@ -4,8 +4,8 @@
   ...
 }:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.plex;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.plex = setup.mkOptions "plex" "plex" 32400;

modules/servers/portfolio.nix

@@ -4,8 +4,8 @@
   ...
 }:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.websites.portfolio;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.websites.portfolio = setup.mkOptions "portfolio" "portfolio" 0;

modules/servers/prowlarr.nix

@@ -4,8 +4,8 @@
   ...
 }:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.prowlarr;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.prowlarr = setup.mkOptions "prowlarr" "indexer" 9696;

modules/servers/qbittorrent.nix

@@ -1,12 +1,11 @@
 {
-  inputs,
   lib,
   config,
   pkgs,
+  inputs,
   ...
 }:
 let
-  inherit (inputs) qbit_manage;
   pkgsU = import inputs.nixpkgs-unstable {
     system = "x86_64-linux";
     config.allowUnfree = true;
@@ -36,10 +35,6 @@ let
         ;
     }
   );
-  torrentCompletionScript = pkgs.writeShellScript "qbit-torrent-completion" ''
-    chown jawz:piracy -R "$1"
-    chmod -R 775 "$1"
-  '';
 in
 {
   options.my.servers = {
@@ -54,8 +49,14 @@ in
     };
   };
   config = lib.mkIf (config.my.servers.qbittorrent.enable && config.my.secureHost) {
-    my.network.firewall.additionalPorts = [ config.my.servers.qbittorrent.port ];
+    home-manager.users.jawz = {
-    home-manager.users.jawz.xdg.dataFile.vuetorrent.source = vuetorrent;
+      xdg = {
+        dataFile.vuetorrent.source = vuetorrent;
+        configFile."unpackerr.conf" = lib.mkIf config.my.servers.unpackerr.enable {
+          source = ../../dotfiles/unpackerr.conf;
+        };
+      };
+    };
     sops.secrets =
       let
         mkQbitSecret = file: mode: {
@@ -65,37 +66,34 @@ in
           owner = config.users.users.jawz.name;
           path = "/home/jawz/.config/qBittorrent/ssl/${file}";
         };
-        mkUnpackerrSecret = {
-          sopsFile = ../../secrets/secrets.yaml;
-          owner = config.users.users.jawz.name;
-        };
       in
       {
         "certificates/qbit_cert" = mkQbitSecret "server.crt" "0644";
         "certificates/qbit_key" = mkQbitSecret "server.key" "0600";
-        "unpackerr/sonarr-api" = mkUnpackerrSecret;
-        "unpackerr/radarr-api" = mkUnpackerrSecret;
       };
     systemd = {
-      packages = [
+      packages = [ pkgs.qbittorrent-nox ];
-        pkgs.qbittorrent-nox
+      services = {
-        torrentCompletionScript
+        "qbittorrent-nox@jawz" = {
-      ];
-      services."qbittorrent-nox@jawz" = {
           enable = true;
           overrideStrategy = "asDropin";
           wantedBy = [ "multi-user.target" ];
         };
+      };
       user = {
         services = {
           qbit_manage = {
             restartIfChanged = true;
             description = "Tidy up my torrents";
             wantedBy = [ "default.target" ];
-            serviceConfig = {
+            serviceConfig =
+              let
+                env = "/home/jawz/Development/Git/qbit_manage";
+              in
+              {
                 Restart = "on-failure";
                 RestartSec = 30;
-              ExecStart = "${qbit_manageEnv}/bin/python ${qbit_manage}/qbit_manage.py -r -c /home/jawz/.config/qbit_manage/config.yml";
+                ExecStart = "${qbit_manageEnv}/bin/python ${env}/qbit_manage.py -r -c ${env}/config.yml";
               };
           };
           unpackerr = lib.mkIf config.my.servers.unpackerr.enable {
@@ -103,20 +101,12 @@ in
             restartIfChanged = true;
             description = "Run unpackerr";
             wantedBy = [ "default.target" ];
-            environment = {
-              UN_FILE_MODE = "0664";
-              UN_DIR_MODE = "0775";
-              UN_SONARR_0_URL = config.my.servers.sonarr.local;
-              UN_SONARR_0_API_KEY = "filepath:${config.sops.secrets."unpackerr/sonarr-api".path}";
-              UN_SONARR_0_PATHS = "/srv/pool/multimedia/downloads/torrent";
-              UN_RADARR_0_URL = config.my.servers.radarr.local;
-              UN_RADARR_0_API_KEY = "filepath:${config.sops.secrets."unpackerr/radarr-api".path}";
-              UN_RADARR_0_PATHS = "/srv/pool/multimedia/downloads/torrent";
-            };
             serviceConfig = {
               Restart = "on-failure";
               RestartSec = 30;
-              ExecStart = "${pkgs.unpackerr}/bin/unpackerr";
+              ExecStart = ''
+                ${pkgs.unpackerr}/bin/unpackerr \
+                -c /home/jawz/.config/unpackerr.conf'';
             };
           };
         };
@@ -128,5 +118,17 @@ in
         };
       };
     };
+    networking.firewall =
+      let
+        ports = [
+          51411
+          51412
+          51413
+        ];
+      in
+      {
+        allowedTCPPorts = ports ++ [ config.my.servers.qbittorrent.port ];
+        allowedUDPPorts = ports;
+      };
   };
 }

modules/servers/radarr.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.radarr;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.radarr = setup.mkOptions "radarr" "movies" 7878;

modules/servers/readeck.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.readeck;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.readeck = setup.mkOptions "readeck" "laters" 9546;

modules/servers/ryot.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.ryot;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.ryot = setup.mkOptions "ryot" "tracker" 8765;

modules/servers/sabnzbd.nix

@@ -12,7 +12,6 @@ in
     };
   };
   config = lib.mkIf cfg.enable {
-    my.network.firewall.additionalPorts = [ cfg.port ];
     services.sabnzbd = {
       inherit (cfg) enable;
       group = "piracy";

modules/servers/shiori.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.shiori;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.shiori = setup.mkOptions "shiori" "bookmarks" 4368;

modules/servers/sonarr.nix

@@ -1,11 +1,7 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.sonarr;
+  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers.sonarr = setup.mkOptions "sonarr" "series" 8989;

modules/servers/stash.nix

@@ -1,71 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
-  cfg = config.my.servers.stash;
-  cfgS = config.services.stash;
-  stashPythonFHS = pkgs.buildFHSEnv {
-    name = "stash-python-fhs";
-    targetPkgs =
-      pkgs:
-      builtins.attrValues {
-        inherit (pkgs)
-          python3
-          gcc
-          glibc
-          ;
-        inherit (pkgs.python3Packages)
-          pip
-          virtualenv
-          ;
-        inherit (pkgs.stdenv.cc.cc) lib;
-      };
-    runScript = "bash";
-  };
-in
-{
-  options.my.servers.stash = setup.mkOptions "stash" "xxx" 9999;
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
-    sops.secrets = {
-      "stash/password".sopsFile = ../../secrets/secrets.yaml;
-      "stash/jwt".sopsFile = ../../secrets/secrets.yaml;
-      "stash/session".sopsFile = ../../secrets/secrets.yaml;
-    };
-    services.stash = {
-      inherit (cfg) enable;
-      group = "piracy";
-      mutableSettings = true;
-      username = "Suing8150";
-      passwordFile = config.sops.secrets."stash/password".path;
-      jwtSecretKeyFile = config.sops.secrets."stash/jwt".path;
-      sessionStoreKeyFile = config.sops.secrets."stash/session".path;
-      settings = {
-        inherit (cfg) port;
-        host = "0.0.0.0";
-        stash = [
-          {
-            path = "/srv/pool/glue/";
-          }
-        ];
-      };
-    };
-    systemd.services.stash = {
-      environment = {
-        PYTHONPATH = "/var/lib/stash/venv/lib/python3.12/site-packages";
-        LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib:${pkgs.glibc}/lib:${pkgs.zlib}/lib:${pkgs.libffi}/lib:${pkgs.openssl}/lib";
-      };
-      serviceConfig = {
-        BindReadOnlyPaths = lib.mkForce [ ];
-        BindPaths = lib.mkIf (cfgS.settings != { }) (map (stash: "${stash.path}") cfgS.settings.stash);
-      };
-    };
-    users.users.stash = {
-      isSystemUser = true;
-      packages = [ stashPythonFHS ];
-    };
-  };
-}

modules/servers/synapse.nix

@@ -5,10 +5,10 @@
   ...
 }:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.synapse;
   cfgE = config.my.servers.element;
   domain = "wedsgk5ac2qcaf9yb.click";
+  setup = import ../factories/mkserver.nix { inherit lib config; };
   clientConfig."m.homeserver".base_url = cfg.url;
   serverConfig."m.server" = "${cfg.host}:443";
   mkWellKnown = data: ''
@@ -58,7 +58,7 @@ in
         ];
         settings = {
           server_name = cfg.domain;
-          public_baseurl = "http://${config.my.ips.wg-server}:${toString cfg.port}";
+          public_baseurl = cfg.url;
           federation_domain_whitelist = [ ];
           allow_public_rooms_without_auth = false;
           allow_public_rooms_over_federation = false;

modules/servers/tranga.nix

@@ -1,8 +1,4 @@
-{
+{ config, lib, ... }:
-  config,
-  lib,
-  ...
-}:
 let
   setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.tranga;

modules/services/syncthing.nix

@@ -1,120 +0,0 @@
-{ config, lib, ... }:
-let
-  inherit (config.networking) hostName;
-  isMainHost = hostName == "workstation";
-  mkMobile =
-    path:
-    lib.mkIf isMainHost {
-      inherit path;
-      ignorePerms = false;
-      devices = [
-        "galaxy"
-        "phone"
-      ];
-    };
-in
-{
-  options.my.services.syncthing.enable = lib.mkEnableOption "Syncthing file synchronization";
-  config = lib.mkIf (config.my.services.syncthing.enable && config.my.secureHost) {
-    sops.secrets = {
-      "syncthing_keys/${hostName}" = {
-        sopsFile = ../../secrets/keys.yaml;
-        owner = config.users.users.jawz.name;
-        inherit (config.users.users.jawz) group;
-        path = "/home/jawz/.config/syncthing/key.pem";
-      };
-      "syncthing_certs/${hostName}" = {
-        sopsFile = ../../secrets/keys.yaml;
-        owner = config.users.users.jawz.name;
-        inherit (config.users.users.jawz) group;
-        path = "/home/jawz/.config/syncthing/cert.pem";
-      };
-      "syncthing_password" = {
-        sopsFile = ../../secrets/keys.yaml;
-      };
-    };
-    services.syncthing = {
-      enable = true;
-      user = "jawz";
-      group = "users";
-      overrideDevices = true;
-      overrideFolders = true;
-      openDefaultPorts = true;
-      key = config.sops.secrets."syncthing_keys/${hostName}".path;
-      cert = config.sops.secrets."syncthing_certs/${hostName}".path;
-      guiAddress = "${config.my.ips."${hostName}"}:8384";
-      settings = {
-        options = {
-          natEnabled = false;
-          relaysEnabled = false;
-          globalAnnounceEnabled = false;
-        };
-        gui = {
-          user = "jawz";
-          password = config.sops.secrets.syncthing_password.path;
-        };
-        devices = {
-          server.id = "BG6PF7S-KATABWO-7WAZFMX-6YO7IS3-WQTMR3M-VSOSV7V-HFFMNNH-BFX2EQ4";
-          miniserver.id = "HDYEGIR-GFU7ONK-MOOJUFH-N3L3XHX-SXWN3FI-O23K6LD-BJENQK5-VIPV2AT";
-          workstation.id = "4E4KJ6M-MSTNBVF-D7CNHDW-DUTB3VR-SXKZ4NH-ZKAOMF5-V24JECJ-4STSZAA";
-          galaxy.id = "UAZ5YDV-YUFBXOY-QMS6S6R-WPIIKZI-4OPPW5L-G4OVUPO-YW5KFYY-YASRAAV";
-          phone.id = "OSOX2VZ-AO2SA3C-BFB6NKF-K6CR6WX-64TDBKW-RRKEKJ4-FKZE5CV-J2RGJAJ";
-          wg-friend1 = {
-            id = "XBIYCD4-EFKS5SK-WFF73CU-P37GXVH-OMWEIA4-6KC5F3L-U5UQWSF-SYNNRQF";
-            addresses = [ "tcp://${config.my.ips.wg-friend1}:22000" ];
-            introducer = false;
-            autoAcceptFolders = false;
-            paused = false;
-          };
-        };
-        folders = {
-          cache = mkMobile "~/Downloads/cache/";
-          friends = mkMobile "~/Pictures/artist/friends/";
-          forme = mkMobile "~/Pictures/art for me/";
-          comfy = mkMobile "~/Development/AI/ComfyUI/output/";
-          gdl = {
-            path = "~/.config/jawz/";
-            ignorePerms = false;
-            devices = [
-              "server"
-              "miniserver"
-              "workstation"
-            ];
-          };
-          librewolf = {
-            path = "~/.librewolf/";
-            ignorePerms = false;
-            copyOwnershipFromParent = true;
-            type = if isMainHost then "sendonly" else "receiveonly";
-            devices = [
-              "server"
-              "miniserver"
-              "workstation"
-            ];
-          };
-          notes = {
-            path = "~/Documents/Notes";
-            ignorePerms = false;
-            devices = [
-              "galaxy"
-              "phone"
-              "server"
-              "miniserver"
-              "workstation"
-            ];
-          };
-          friend_share = {
-            path = "~/Pictures/encrypted/friends";
-            ignorePerms = false;
-            type = "sendreceive";
-            devices = [
-              "server"
-              "workstation"
-              "wg-friend1"
-            ];
-          };
-        };
-      };
-    };
-  };
-}

modules/shell/multimedia.nix

@@ -1,6 +1,5 @@
 {
   config,
-  inputs,
   lib,
   pkgs,
   ...
@@ -8,11 +7,6 @@
 {
   options.my.shell.multimedia.enable = lib.mkEnableOption "multimedia CLI tools and codecs";
   config = lib.mkIf config.my.shell.multimedia.enable {
-    sops.secrets."gallery-dl/secrets" = {
-      sopsFile = ../../secrets/gallery.yaml;
-      owner = "jawz";
-      mode = "0400";
-    };
     home-manager.users.jawz.programs = {
       yt-dlp = {
         enable = true;
@@ -25,16 +19,7 @@
       };
       gallery-dl = {
         enable = true;
-        settings = inputs.self.lib.importDotfile ../../dotfiles/gallery-dl.nix;
+        settings = import ../../dotfiles/gallery-dl.nix;
-      };
-      ${config.my.shell.type} = {
-        initExtra = lib.mkAfter ''
-          if [ -r "${config.sops.secrets."gallery-dl/secrets".path}" ]; then
-            set -a  # automatically export all variables
-            source "${config.sops.secrets."gallery-dl/secrets".path}"
-            set +a  # stop automatically exporting
-          fi
-        '';
       };
     };
     users.users.jawz.packages = builtins.attrValues {

modules/shell/tools.nix

@@ -17,16 +17,45 @@ in
         enable = true;
         package = pkgs.htop-vim;
       };
-      eza = {
-        enable = true;
-        git = true;
-        icons = "auto";
-      };
       zoxide = {
         enable = true;
         enableBashIntegration = shellType == "bash";
         enableZshIntegration = shellType == "zsh";
       };
+      ${shellType} = {
+        shellAliases = {
+          cd = "z";
+          hh = "hstr";
+          ls = "eza --icons --group-directories-first";
+          rm = "trash";
+          b = "bat";
+          f = "fzf --multi --exact -i";
+          unique-extensions = ''
+            fd -tf | rev | cut -d. -f1 | rev |
+            tr '[:upper:]' '[:lower:]' | sort |
+            uniq --count | sort -rn'';
+        };
+      }
+      // (
+        if shellType == "bash" then
+          {
+            initExtra = ''
+              if command -v fzf-share >/dev/null; then
+              source "$(fzf-share)/key-bindings.bash"
+              source "$(fzf-share)/completion.bash"
+              fi
+            '';
+          }
+        else
+          {
+            initContent = ''
+              if command -v fzf-share >/dev/null; then
+              source "$(fzf-share)/key-bindings.bash"
+              source "$(fzf-share)/completion.bash"
+              fi
+            '';
+          }
+      );
       bat = {
         enable = true;
         config.pager = "less -FR";
@@ -56,34 +85,6 @@ in
           PASSWORD_STORE_SAFECONTENT = "true";
         };
       };
-      ${shellType} = {
-        shellAliases = inputs.self.lib.mergeAliases inputs.self.lib.commonAliases {
-          cd = "z";
-          hh = "hstr";
-          ls = "eza --icons --group-directories-first";
-          rm = "trash";
-          b = "bat";
-          f = "fzf --multi --exact -i";
-          unique-extensions = ''
-            fd -tf | rev | cut -d. -f1 | rev |
-            tr '[:upper:]' '[:lower:]' | sort |
-            uniq --count | sort -rn'';
-        };
-      }
-      //
-        inputs.self.lib.shellConditional shellType
-          ''
-            if command -v fzf-share >/dev/null; then
-            source "$(fzf-share)/key-bindings.bash"
-            source "$(fzf-share)/completion.bash"
-            fi
-          ''
-          ''
-            if command -v fzf-share >/dev/null; then
-            source "$(fzf-share)/key-bindings.bash"
-            source "$(fzf-share)/completion.bash"
-            fi
-          '';
     };
     programs = {
       starship.enable = true;
@@ -98,6 +99,7 @@ in
       inherit (pkgs)
         ripgrep # modern grep
         du-dust # rusty du similar to gdu
+        eza # like ls but with colors
         fd # modern find, faster searches
         fzf # fuzzy finder! super cool and useful
         gdu # disk-space utility checker, somewhat useful
@@ -106,6 +108,8 @@ in
         jq # json parser
         yq # yaml parser
         smartmontools # check hard drie health
+        ;
+      inherit (inputs.jawz-scripts.packages.x86_64-linux)
         rmlint # amazing dupe finder that integrates well with BTRFS
         ;
     };

modules/users/nixremote.nix

@@ -1,18 +1,13 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  inputs,
-  ...
-}:
 {
   options.my.users.nixremote = {
     enable = lib.mkEnableOption "nixremote user for distributed builds";
     authorizedKeys = lib.mkOption {
       type = lib.types.listOf lib.types.path;
-      default = inputs.self.lib.getSshKeys [
+      default = [
-        "nixworkstation"
+        ../../secrets/ssh/ed25519_nixworkstation.pub
-        "nixserver"
+        ../../secrets/ssh/ed25519_nixserver.pub
-        "nixminiserver"
+        ../../secrets/ssh/ed25519_nixminiserver.pub
       ];
       description = "List of SSH public key files to authorize for nixremote user";
     };

parts/core.nix

@@ -1,218 +0,0 @@
-{ inputs, ... }:
-let
-  system = "x86_64-linux";
-  mkpkgs =
-    repo:
-    import repo {
-      inherit system;
-      config.allowUnfree = true;
-    };
-in
-{
-  systems = [ system ];
-  flake = {
-    lib = {
-      commonModules = name: [
-        ../hosts/${name}/configuration.nix
-        inputs.nur.modules.nixos.default
-        inputs.sops-nix.nixosModules.sops
-        inputs.stylix.nixosModules.stylix
-        inputs.nixtendo-switch.nixosModules.nixtendo-switch
-        {
-          nixpkgs.overlays = [
-            (import ../config/overlay.nix { inherit mkpkgs inputs; })
-            inputs.doom-emacs.overlays.default
-          ];
-        }
-        {
-          nix.registry = {
-            jawz.flake = inputs.self;
-            unstable.flake = inputs.nixpkgs-unstable;
-          };
-        }
-      ];
-      createConfig =
-        name: local-nixpkgs:
-        let
-          lib = local-nixpkgs.lib // inputs.home-manager.lib;
-        in
-        lib.nixosSystem {
-          inherit system;
-          modules = inputs.self.lib.commonModules name;
-          specialArgs = {
-            inherit inputs;
-            outputs = inputs.self;
-          };
-        };
-      langList =
-        builtins.readDir ../modules/dev
-        |> builtins.attrNames
-        |> map (file: baseNameOf file |> builtins.replaceStrings [ ".nix" ] [ "" ])
-        |> builtins.filter (name: name != "emacs");
-      autoImport =
-        dir: filterFn:
-        builtins.readDir dir
-        |> builtins.attrNames
-        |> builtins.filter (file: builtins.match ".*\\.nix" file != null && filterFn file)
-        |> map (file: dir + "/${file}");
-      proxy = locations: {
-        inherit locations;
-        forceSSL = true;
-        enableACME = true;
-        http2 = true;
-      };
-      proxyReverse =
-        cfg:
-        inputs.self.lib.proxy {
-          "/" = {
-            proxyPass = "http://${cfg.ip}:${toString cfg.port}/";
-            proxyWebsockets = cfg.enableSocket or false;
-          };
-        };
-      proxyReverseFix =
-        cfg:
-        let
-          useLocalhost = cfg.hostName == cfg.hostName;
-          localHeaders = ''
-            proxy_set_header   Host $host;
-            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header   X-Forwarded-Proto $scheme;
-          '';
-        in
-        inputs.self.lib.proxyReverse cfg
-        // {
-          extraConfig = ''
-            ${if useLocalhost then localHeaders else ""}
-            proxy_set_header   X-Forwarded-Host $host;
-            proxy_set_header   Upgrade $http_upgrade;
-            proxy_set_header   Connection $http_connection;
-            proxy_redirect     off;
-            proxy_http_version 1.1;
-          '';
-        };
-      proxyReversePrivate =
-        cfg:
-        inputs.self.lib.proxyReverse cfg
-        // {
-          extraConfig = ''
-            ssl_verify_client on;
-            ssl_client_certificate ${cfg.certPath};
-            error_page 403 /403.html;
-          '';
-        };
-      commonAliases = {
-        cp = "cp -i";
-        mv = "mv -i";
-        mkdir = "mkdir -p";
-        mkcd = "(){ mkdir -p \"$1\" && cd \"$1\" }";
-        copy = "xclip -selection clipboard";
-        cdp = "pwd | copy";
-        cfp = "(){ readlink -f \"$1\" | copy }";
-        ".." = "cd ..";
-        "..." = "cd ../..";
-        ".3" = "cd ../../..";
-        ".4" = "cd ../../../..";
-        ".5" = "cd ../../../../..";
-        c = "cat";
-        sc = "systemctl --user";
-        jc = "journalctl --user -xefu";
-      };
-      xdgEnvironment =
-        let
-          XDG_DATA_HOME = "\${HOME}/.local/share";
-          XDG_CONFIG_HOME = "\${HOME}/.config";
-          XDG_CACHE_HOME = "\${HOME}/.cache";
-        in
-        {
-          inherit XDG_DATA_HOME XDG_CONFIG_HOME XDG_CACHE_HOME;
-          XDG_BIN_HOME = "\${HOME}/.local/bin";
-          XDG_STATE_HOME = "\${HOME}/.local/state";
-          PSQL_HISTORY = "${XDG_DATA_HOME}/psql_history";
-          REDISCLI_HISTFILE = "${XDG_DATA_HOME}/redis/rediscli_history";
-          WINEPREFIX = "${XDG_DATA_HOME}/wine";
-          ELECTRUMDIR = "${XDG_DATA_HOME}/electrum";
-          WGETRC = "${XDG_CONFIG_HOME}/wgetrc";
-          XCOMPOSECACHE = "${XDG_CACHE_HOME}/X11/xcompose";
-          "_JAVA_OPTIONS" = "-Djava.util.prefs.userRoot=${XDG_CONFIG_HOME}/java";
-          ORG_DEVICE = "workstation";
-          PATH = [ "\${HOME}/.local/bin" ];
-        };
-      getNixosHosts =
-        ips: hostName: lib:
-        builtins.attrNames ips
-        |> builtins.filter (
-          name: !(lib.hasPrefix "wg-" name) && name != "vps" && name != "router" && name != hostName
-        );
-      shellConditional =
-        shellType: bashContent: zshContent:
-        if shellType == "bash" then { initExtra = bashContent; } else { initContent = zshContent; };
-      mergeAliases = baseAliases: extraAliases: baseAliases // extraAliases;
-      importDotfile = path: import path;
-      getServicesWithNativeFirewall =
-        config: blacklist:
-        config.my.servers
-        |> builtins.attrNames
-        |> builtins.filter (
-          name:
-          (config.my.servers.${name}.enable or false)
-          && !(builtins.elem name blacklist)
-          && builtins.hasAttr name config.services
-          && (config.services.${name} ? openFirewall)
-        );
-      generateFirewallPorts =
-        config: nativeServices: lib:
-        config.my.network.firewall.staticPorts
-        ++ config.my.network.firewall.additionalPorts
-        ++ (
-          config.my.servers
-          |> lib.filterAttrs (
-            name: srv: (srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServices)
-          )
-          |> lib.attrValues
-          |> map (srv: srv.port)
-        );
-      mkEnabled = name: {
-        inherit name;
-        value.enable = true;
-      };
-      mkEnabledWithProxy = name: {
-        inherit name;
-        value = {
-          enable = true;
-          enableProxy = true;
-        };
-      };
-      mkEnabledIp = ip: name: {
-        inherit name;
-        value = {
-          enable = true;
-          inherit ip;
-        };
-      };
-      enableList = func: list: list |> map func |> builtins.listToAttrs;
-      mkPostgresDependency = config: serviceName: displayName: {
-        assertion = config.my.servers.${serviceName}.enable -> config.my.servers.postgres.enable;
-        message = "${displayName} requires PostgreSQL to be enabled";
-      };
-      mkPostgresDependencies =
-        config: serviceMap:
-        serviceMap |> map (entry: inputs.self.lib.mkPostgresDependency config entry.service entry.name);
-      sshKeys = {
-        deacero = ../secrets/ssh/ed25519_deacero.pub;
-        workstation = ../secrets/ssh/ed25519_workstation.pub;
-        server = ../secrets/ssh/ed25519_server.pub;
-        miniserver = ../secrets/ssh/ed25519_miniserver.pub;
-        galaxy = ../secrets/ssh/ed25519_galaxy.pub;
-        phone = ../secrets/ssh/ed25519_phone.pub;
-        vps = ../secrets/ssh/ed25519_vps.pub;
-        emacs = ../secrets/ssh/ed25519_emacs.pub;
-        # Build user keys (nixremote)
-        nixworkstation = ../secrets/ssh/ed25519_nixworkstation.pub;
-        nixserver = ../secrets/ssh/ed25519_nixserver.pub;
-        nixminiserver = ../secrets/ssh/ed25519_nixminiserver.pub;
-        windows_vm = ../secrets/ssh/ed25519_windows_vm.pub;
-      };
-      getSshKeys = keyNames: keyNames |> map (name: inputs.self.lib.sshKeys.${name});
-    };
-  };
-}

parts/devshells.nix

@@ -1,12 +0,0 @@
-{ inputs, ... }:
-{
-  perSystem = _: {
-    devShells =
-      inputs.self.lib.langList
-      |> map (name: {
-        inherit name;
-        value = inputs.self.nixosConfigurations.emacs.config.devShells.${name};
-      })
-      |> builtins.listToAttrs;
-  };
-}

parts/hosts.nix

@@ -1,10 +0,0 @@
-{ inputs, ... }:
-{
-  flake.nixosConfigurations = {
-    workstation = inputs.self.lib.createConfig "workstation" inputs.nixpkgs;
-    miniserver = inputs.self.lib.createConfig "miniserver" inputs.nixpkgs-small;
-    server = inputs.self.lib.createConfig "server" inputs.nixpkgs-small;
-    galaxy = inputs.self.lib.createConfig "galaxy" inputs.nixpkgs-small;
-    emacs = inputs.self.lib.createConfig "emacs" inputs.nixpkgs;
-  };
-}

parts/packages.nix

@@ -1,18 +0,0 @@
-{ inputs, ... }:
-{
-  perSystem =
-    { system, ... }:
-    {
-      packages = (inputs.jawz-scripts.packages.${system} or { }) // {
-        emacs-vm = inputs.nixos-generators.nixosGenerate {
-          inherit system;
-          modules = inputs.self.lib.commonModules "emacs";
-          format = "vm";
-          specialArgs = {
-            inherit inputs;
-            outputs = inputs.self;
-          };
-        };
-      };
-    };
-}

scripts/list-schemes.sh

@@ -1,47 +0,0 @@
-#!/usr/bin/env bash
-# Script to list all available schemes from schemes.nix
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
-
-echo "Available schemes:"
-nix eval --raw --impure --expr "
-  let
-    pkgs = import <nixpkgs> {};
-    inputs = {};
-    utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
-  in
-  builtins.concatStringsSep \"\n\" utils.availableSchemes
-"
-
-echo -e "\nLight schemes:"
-nix eval --raw --impure --expr "
-  let
-    pkgs = import <nixpkgs> {};
-    inputs = {};
-    utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
-  in
-  builtins.concatStringsSep \"\n\" utils.lightSchemes
-"
-
-echo -e "\nDark schemes:"
-nix eval --raw --impure --expr "
-  let
-    pkgs = import <nixpkgs> {};
-    inputs = {};
-    utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
-  in
-  builtins.concatStringsSep \"\n\" utils.darkSchemes
-"
-
-echo -e "\nAvailable colors:"
-nix eval --raw --impure --expr "
-  let
-    pkgs = import <nixpkgs> {};
-    inputs = {};
-    utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
-  in
-  builtins.concatStringsSep \"\n\" utils.availableColors
-"

scripts/push-to-cache.sh

@@ -1,125 +0,0 @@
-#!/usr/bin/env bash
-# Script to push NixOS builds to Atticd cache
-
-set -euo pipefail
-
-# Colors for output
-GREEN='\033[0;32m'
-BLUE='\033[0;34m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-# Configuration
-CACHE_NAME="servidos:nixos"
-CACHE_URL="https://cache.lebubu.org"
-
-echo -e "${BLUE}=========================================${NC}"
-echo -e "${BLUE}NixOS Build Cache Pusher${NC}"
-echo -e "${BLUE}=========================================${NC}"
-echo ""
-
-# Check if attic is available
-if ! command -v attic &> /dev/null; then
-    echo -e "${YELLOW}Error: attic is not installed or not in PATH${NC}"
-    exit 1
-fi
-
-# Check if ATTIC_TOKEN is set
-if [ -z "${ATTIC_TOKEN:-}" ]; then
-    echo -e "${YELLOW}Warning: ATTIC_TOKEN environment variable is not set${NC}"
-    echo "Please set it with: export ATTIC_TOKEN=your_token_here"
-    exit 1
-fi
-
-# Login to cache
-echo -e "${GREEN}→ Logging into cache...${NC}"
-attic login servidos "$CACHE_URL" "$ATTIC_TOKEN"
-
-# Determine what to push
-if [ $# -eq 0 ]; then
-    # No arguments - push all result* symlinks
-    if ls result* 1> /dev/null 2>&1; then
-        echo -e "${GREEN}→ Found result symlinks, pushing to cache...${NC}"
-        attic push "$CACHE_NAME" result*
-        echo -e "${GREEN}✓ Successfully pushed all results to cache!${NC}"
-    else
-        echo -e "${YELLOW}No result symlinks found. Build something first!${NC}"
-        echo ""
-        echo "Usage examples:"
-        echo "  1. Push all results:    $0"
-        echo "  2. Push specific path:  $0 /nix/store/xxxxx-nixos-system-xxx"
-        echo "  3. Push current config: $0 --current [hostname]"
-        exit 1
-    fi
-elif [ "$1" = "--current" ]; then
-    # Push current system configuration
-    HOSTNAME="${2:-$(hostname)}"
-    echo -e "${GREEN}→ Building current configuration for $HOSTNAME...${NC}"
-    nix build ".#nixosConfigurations.$HOSTNAME.config.system.build.toplevel" --print-out-paths | \
-        attic push "$CACHE_NAME" --stdin
-    echo -e "${GREEN}✓ Successfully pushed $HOSTNAME configuration to cache!${NC}"
-elif [ "$1" = "--all-schemes" ]; then
-    # Build and push all schemes
-    HOSTNAME="${2:-server}"
-    
-    # Get current directory
-    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-    PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
-    
-    cd "$PROJECT_ROOT"
-    
-    # Get available schemes
-    SCHEMES=$(nix eval --raw --impure --expr '
-      let
-        pkgs = import <nixpkgs> {};
-        inputs = {};
-        utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
-      in
-      builtins.concatStringsSep " " utils.availableSchemes
-    ')
-    
-    echo -e "${GREEN}→ Building and pushing all schemes for $HOSTNAME...${NC}"
-    echo -e "Schemes: $SCHEMES"
-    echo ""
-    
-    # Store original scheme
-    ORIGINAL_SCHEME=$(grep -oP "scheme = schemesFile\.schemes\.\K\w+" config/stylix.nix)
-    echo -e "Original scheme: $ORIGINAL_SCHEME"
-    echo ""
-    
-    # Build and push each scheme
-    for scheme in $SCHEMES; do
-        echo -e "${BLUE}→ Processing $scheme...${NC}"
-        
-        # Update stylix.nix
-        sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$scheme;/" config/stylix.nix
-        
-        # Build and push
-        nix build ".#nixosConfigurations.$HOSTNAME.config.system.build.toplevel" \
-            --out-link "./result-$scheme"
-        attic push "$CACHE_NAME" "./result-$scheme"
-        
-        echo -e "${GREEN}✓ Completed $scheme${NC}"
-        echo ""
-    done
-    
-    # Restore original scheme
-    echo -e "${BLUE}→ Restoring original scheme: $ORIGINAL_SCHEME${NC}"
-    sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$ORIGINAL_SCHEME;/" config/stylix.nix
-    
-    echo -e "${GREEN}✓ All schemes pushed successfully!${NC}"
-else
-    # Push specific store path(s)
-    echo -e "${GREEN}→ Pushing specified path(s) to cache...${NC}"
-    for path in "$@"; do
-        echo "  - $path"
-        echo "$path" | attic push "$CACHE_NAME" --stdin
-    done
-    echo -e "${GREEN}✓ Successfully pushed to cache!${NC}"
-fi
-
-echo ""
-echo -e "${BLUE}=========================================${NC}"
-echo -e "${GREEN}Cache push completed!${NC}"
-echo -e "${BLUE}=========================================${NC}"
-

scripts/scheme-utils.nix

@@ -1,28 +0,0 @@
-{ pkgs, inputs }:
-let
-  schemesConfig = import ../config/schemes.nix { inherit pkgs inputs; };
-  availableSchemes = builtins.attrNames schemesConfig.schemes;
-in
-{
-  inherit availableSchemes;
-  lightSchemes = builtins.filter (
-    name: schemesConfig.schemes.${name}.polarity == "light"
-  ) availableSchemes;
-  darkSchemes = builtins.filter (
-    name: schemesConfig.schemes.${name}.polarity == "dark"
-  ) availableSchemes;
-  schemesByColor =
-    color: builtins.filter (name: schemesConfig.schemes.${name}.color == color) availableSchemes;
-  getScheme = name: schemesConfig.schemes.${name};
-  isValidScheme = name: builtins.hasAttr name schemesConfig.schemes;
-  availableColors = pkgs.lib.unique (
-    builtins.filter (color: color != null) (
-      builtins.map (name: schemesConfig.schemes.${name}.color) availableSchemes
-    )
-  );
-  availableBase16Schemes = pkgs.lib.unique (
-    builtins.filter (name: name != null) (
-      builtins.map (name: schemesConfig.schemes.${name}.name) availableSchemes
-    )
-  );
-}

secrets/env.yaml

@@ -1,3 +1,7 @@
+stash:
+    password: ENC[AES256_GCM,data:DVtKQmtOQA/jS3ZncbuPKMukJyo=,iv:FSLl4Qbq58X0WNjqz8LLOW6XpBQxE5W7L9yOTBQkBOA=,tag:Qun+5Vf193Qt8n+Yp9lBJg==,type:str]
+    jwt: ENC[AES256_GCM,data:C1RcyQn3j5LaCSDGPjBAm6RYsqvVn1HIFxxBP4FNx7NVCroju4VEtkV98Ve0D6Z60L3mB1yOqi8OrEgXNJv+vw==,iv:t8pmLzXwg1g9kkiL98ql9YLaSitaXoJiiLiUf3G1cWk=,tag:D3mdFIe3m3219E4V8yhmpg==,type:str]
+    session: ENC[AES256_GCM,data:ifUXaGIO7xKPgtTVEeERx0OyBDni2eoWo7dFxazQ4W2DBrnzQfJ7Plqt8EYLhQQRP4I6e33+oEKNzpuiG+XJCw==,iv:AOI0lMcTT02GpOCQuX74hPBKth3WdFN2W2wlqKgrKJM=,tag:1I+brf4G2oKE7o2E90q/CQ==,type:str]
 gitea: ENC[AES256_GCM,data:8o+U4qFdyIhCPNlYyflQIuLHsQHtbT6G/a0OyCUeg9DtIeABXNVFhiy4iFRuIF0=,iv:AYwqDRNML1XuzwQnD4VmI4rKWYfTJjOjibrAbI5qgcA=,tag:UPL3UlETdkoFXLihEIGcSw==,type:str]
 shiori: ENC[AES256_GCM,data:tV7+1GusZvcli8dM86xOD71dc2mzcyfQwMeTh//LDb0=,iv:ED9wR6QjQgwd9Ll/UC5FK3CyYK3b0RniC/D6Y0nGEOI=,tag:X/aopMc2vhnRW2iTphFflQ==,type:str]
 flame: ENC[AES256_GCM,data:XsYRsA2xs+juWje2Od2Yl2xIvU0OS8xMrtwtcK/0NyyRrg==,iv:FR8lHsNQNCaOy4P+7BsIjNCz+H38i5RlwLYQ4fpB2+w=,tag:61EV7H04pcr1bSX4nSvlpw==,type:str]
@@ -48,7 +52,7 @@ sops:
             QXRUYWtGcWZCVW11U3VYRktuUjlCbDgKsTK4WhUza/JuoDTU3uATa6fq/8eYzxtb
             9BUK1ddzx9Mghea9XBMS17YGtGmW800OsLBomb3SINnOFvejcnKf8Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-02T19:58:54Z"
+    lastmodified: "2025-09-28T03:54:20Z"
-    mac: ENC[AES256_GCM,data:xplk6z63m35V1IL/PpvnjNU1+bUrrplGg60SufnGV6307V520Ajo63dKkQ5yMuiGq/JQETc+sdm9GLQrmOflwhl92YwK2+/11MlMp0vMkC91mAJsobLUmNt3WXVml54CiCbvH+c8fH0T0pIaLGK3MxSRFX//hrfLjSCAvwQagsE=,iv:oE6g0WPM4Rf3YrdgkIdE8qWfiWQxbZ62Axa56ZQYWSA=,tag:QMaWvCD3sbHTv1NFctIBZA==,type:str]
+    mac: ENC[AES256_GCM,data:nPA5SF8fw+x0t5O1aqR7bZk2dpSjf37KKWJ976vx+TjaxWDz8DQVBUNuQmy6d3uX0TT6ysmsA8S4VqjgyRKli1vdEXWXPyULyUwPv3jtR4/NS2hnFabglOn0BhjfNrcArUkdyaQBm02Y96u2XIa0LcCyPOpJauIl5SbSSHaULQs=,iv:Qh7p70oFZbp4mAzDX87hkbPW22S4SoTY/CDzJabQQ0M=,tag:2YGmN2E3y1dcqW5M8WDvUQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2