part 3 of the flake-parts migration

.github/workflows/build-schemes.yml

@@ -0,0 +1,92 @@
+name: Build All Color Schemes
+
+on:
+  push:
+    paths:
+      - 'config/schemes.nix'
+      - 'config/scheme-utils.nix'
+  workflow_dispatch:
+
+jobs:
+  build-schemes:
+    runs-on: nixos
+    env:
+      HOSTNAME: server
+    
+    steps:
+    - uses: actions/checkout@v4
+    
+    - name: Get available schemes
+      id: schemes
+      run: |
+        SCHEMES=$(nix eval --raw --impure --expr '
+          let
+            pkgs = import <nixpkgs> {};
+            inputs = {};
+            utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
+          in
+          builtins.concatStringsSep " " utils.availableSchemes
+        ')
+        echo "schemes=$SCHEMES" >> $GITHUB_OUTPUT
+        echo "Available schemes: $SCHEMES"
+    
+    - name: Configure Attic cache
+      run: |
+        # Configure attic client to use your cache server
+        attic login servidos https://cache.servidos.lat ${{ secrets.ATTIC_TOKEN }}
+    
+    - name: Build and push all schemes
+      run: |
+        echo "Building and pushing all schemes..."
+        
+        # Store original scheme
+        ORIGINAL_SCHEME=$(grep -oP "scheme = schemesFile\.schemes\.\K\w+" config/stylix.nix)
+        echo "Original scheme: $ORIGINAL_SCHEME"
+        
+        # Build and push each scheme
+        for scheme in ${{ steps.schemes.outputs.schemes }}; do
+          echo "========================================="
+          echo "Processing scheme: $scheme"
+          echo "========================================="
+          
+          # Update stylix.nix to use this scheme
+          sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$scheme;/" config/stylix.nix
+          
+          # Verify the change
+          grep "scheme = schemesFile.schemes" config/stylix.nix
+          
+          # Build the configuration
+          echo "Building $scheme..."
+          nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
+            --out-link ./result-$scheme \
+            --quiet
+          
+          # Push to cache
+          echo "Pushing $scheme to cache..."
+          attic push servidos:nixos ./result-$scheme
+          
+          # Also push using print-out-paths for better cache coverage
+          nix build .#nixosConfigurations.${HOSTNAME}.config.system.build.toplevel \
+            --print-out-paths \
+            --quiet | attic push servidos:nixos --stdin
+          
+          echo "✓ Completed $scheme"
+          echo ""
+        done
+        
+        # Restore original scheme
+        echo "Restoring original scheme: $ORIGINAL_SCHEME"
+        sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$ORIGINAL_SCHEME;/" config/stylix.nix
+        
+        echo "========================================="
+        echo "All schemes built and pushed successfully!"
+        echo "========================================="
+    
+    - name: Summary
+      run: |
+        SCHEME_COUNT=$(echo "${{ steps.schemes.outputs.schemes }}" | wc -w)
+        echo "✅ Color scheme builds completed successfully!"
+        echo "- Built $SCHEME_COUNT schemes: ${{ steps.schemes.outputs.schemes }}"
+        echo "- Pushed all builds to Atticd cache"
+        echo ""
+        echo "You can now switch schemes quickly without waiting for builds!"

.gitignore

@@ -2,3 +2,7 @@
 config.el
 *.qcow2
 result
+# Prevent accidentally committing unencrypted secrets
+**/secrets/*.yaml.dec
+**/*-decrypted.*
+**/temp-secrets.*

.sops.yaml

@@ -25,6 +25,13 @@ creation_rules:
           - *workstation
           - *server
           - *miniserver
+  - path_regex: secrets/gallery.yaml$
+    key_groups:
+      - age:
+          - *devkey
+          - *workstation
+          - *server
+          - *miniserver
   - path_regex: secrets/wireguard.yaml$
     key_groups:
       - age:

README.org

@@ -0,0 +1,239 @@
+#+TITLE: JawZ NixOS Configuration
+#+AUTHOR: JawZ
+#+EMAIL: danilo.reyes.251@proton.me
+#+OPTIONS: toc:t num:t
+#+STARTUP: content
+
+* Overview
+
+This repository contains my personal NixOS configuration flake, managing
+multiple hosts with a modular approach. Designed the configuration for a
+self-hosted infrastructure with services and development environments.
+
+* Architecture
+
+** Hosts
+- =workstation= :: Main development machine with GNOME desktop
+- =server= :: Primary server with containerized services
+- =miniserver= :: Secondary server for additional services
+- =galaxy= :: Minimal configuration host
+- =emacs= :: Development VM for Emacs configuration
+
+** Key Features
+- Modular configuration system
+- SOPS-based secrets management
+- Container orchestration with Podman
+- Automated builds and caching
+- Multi-language development environments
+- Self-hosted service stack
+
+* Quick Start
+
+** Prerequisites
+- NixOS 23.05 or later
+- SOPS configured with age keys
+- SSH keys for remote builds
+
+** Initial Setup
+#+BEGIN_SRC bash
+# Clone the repository git clone <repository-url> /home/jawz/Development/NixOS
+cd /home/jawz/Development/NixOS
+
+# Install dependencies nix flake update
+
+# Build and switch to configuration sudo nixos-rebuild switch --flake
+.#<hostname>
+#+END_SRC
+
+** Development Environment
+#+BEGIN_SRC bash
+# Enter development shell for specific language nix develop .#<language>
+
+# Available languages: python, rust, go, haskell, javascript, julia, zig, sh,
+cc, nix
+#+END_SRC
+
+* Configuration Structure
+
+** Core Configuration
+- =config/base.nix= :: Common system configuration
+- =config/jawz.nix= :: User and SSH configuration
+- =config/stylix.nix= :: Theming configuration
+- =config/schemes.nix= :: Color scheme definitions
+
+** Host Configurations
+- =hosts/<hostname>/configuration.nix= :: Host-specific settings
+- =hosts/<hostname>/hardware-configuration.nix= :: Hardware-specific config
+- =hosts/<hostname>/toggles.nix= :: Feature toggles
+
+** Modules
+- =modules/apps/= :: Application packages and configurations
+- =modules/dev/= :: Development environment modules
+- =modules/servers/= :: Self-hosted service configurations
+- =modules/services/= :: System service configurations
+- =modules/scripts/= :: Custom scripts and utilities
+- =modules/shell/= :: Shell and terminal configurations
+
+* Services
+
+** Core Services
+- PostgreSQL 17 :: Database backend
+- Nginx :: Reverse proxy and web server
+- Podman :: Container runtime
+- Syncthing :: File synchronization
+- WireGuard :: VPN connectivity
+
+** Self-Hosted Applications
+- Nextcloud :: File sharing and collaboration
+- Gitea :: Git repository hosting
+- Jellyfin :: Media server
+- Plex :: Media streaming
+- Sonarr/Radarr/Lidarr :: Media management
+- Vaultwarden :: Password manager
+- Homepage :: Service dashboard
+- And more...
+
+* Development
+
+** Available Development Shells
+The configuration provides development shells for my favorite programming
+languages:
+
+#+BEGIN_SRC bash
+# Python development nix develop .#python
+
+# Rust development   nix develop .#rust
+
+# Go development nix develop .#go
+
+# JavaScript/Node.js development nix develop .#javascript
+
+# Haskell development nix develop .#haskell
+
+# Julia development nix develop .#julia
+
+# Zig development nix develop .#zig
+
+# Shell scripting nix develop .#sh
+
+# C/C++ development nix develop .#cc
+
+# Nix development nix develop .#nix
+#+END_SRC
+
+** Adding New Modules
+1. Create module file in appropriate directory under =modules/=
+2. Add module to =modules/modules.nix= if needed
+3. Enable module in host configuration or toggles
+
+** Adding New Hosts
+1. Create host directory under =hosts/<hostname>/
+2. Add =configuration.nix= and =hardware-configuration.nix=
+3. Add host to =flake.nix= outputs
+4. Create =toggles.nix= for feature management
+
+* Secrets Management
+
+** SOPS Configuration
+Manage secrets using SOPS with age encryption:
+
+- =secrets/secrets.yaml= :: Main secrets file
+- =secrets/keys.yaml= :: SSH and encryption keys
+- =secrets/env.yaml= :: Environment variables
+- =secrets/wireguard.yaml= :: VPN configuration
+- =secrets/certs.yaml= :: SSL certificates
+
+** Adding New Secrets
+#+BEGIN_SRC bash
+# Edit secrets file sops secrets/secrets.yaml
+
+# Add new secret sops -i -a 'new-secret: "value"' secrets/secrets.yaml
+#+END_SRC
+
+* CI/CD
+
+** GitHub Actions
+The repository includes automated workflows:
+
+- =weekly-build-cache.yml= :: Weekly builds and cache updates
+- =build-schemes.yml= :: Color scheme builds
+
+** Build Cache
+Builds are automatically cached using Atticd for faster rebuilds.
+
+
+* Customization
+
+** Theming
+The configuration uses Stylix for theming. Define color schemes in
+=config/schemes.nix= and can set them via the =config/stylix.nix= file.
+
+** Adding New Services
+1. Create service module in =modules/servers/=
+2. Add service configuration
+3. Enable service in host toggles
+4. Add to homepage if needed
+
+** Custom Scripts
+Scripts are in =modules/scripts/= and toggle them per host.
+
+* Troubleshooting
+
+** Common Issues
+
+*** Build Failures
+- Check flake inputs are up to date: =nix flake update=
+- Verify all required secrets are present
+- Check host-specific configuration
+
+*** Service Issues
+- Check service status: =systemctl status <service>=
+- View logs: =journalctl -u <service>=
+- Verify firewall rules
+
+*** Development Environment
+- Rebuild development shell: =nix develop .#<language>=
+- Check available packages: =nix search nixpkgs <package>=
+
+** Getting Help
+- Check NixOS documentation
+- Review module documentation
+- Check service-specific documentation
+
+* Maintenance
+
+** Regular Tasks
+- Update flake inputs weekly
+- Review and rotate secrets quarterly
+- Update system packages monthly
+- Clean old generations: =sudo nix-collect-garbage -d=
+
+** Backup Strategy
+- Configuration is version controlled
+- Secrets are encrypted and backed up
+- BTRFS snapshots for data protection
+
+* Contributing
+
+** Code Style
+- Use consistent formatting
+- Add comments for complex configurations
+- Follow Nix conventions
+
+** Pull Requests
+- Test changes on development host first
+- Update documentation as needed
+- Ensure all secrets are properly managed
+
+* License
+
+This configuration is for personal use. Please respect the licenses of
+individual packages and services used.
+
+* Contact
+
+For questions or issues, contact danilo.reyes.251@proton.me
+
+---
+
+*Last updated: 2025*

config/base.nix

@@ -47,7 +47,7 @@
   };
   security = {
     polkit.enable = true;
-    sudo = {
+    sudo-rs = {
       enable = true;
       wheelNeedsPassword = false;
     };
@@ -78,6 +78,7 @@
     ];
   };
   nix = {
+    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
     distributedBuilds = true;
     optimise.automatic = true;
     settings = {
@@ -123,33 +124,7 @@
         sops
         ;
     };
-    variables =
-      let
-        XDG_DATA_HOME = "\${HOME}/.local/share";
-        XDG_CONFIG_HOME = "\${HOME}/.config";
-        XDG_CACHE_HOME = "\${HOME}/.cache";
-      in
-      {
-        # PATH
-        inherit XDG_DATA_HOME XDG_CONFIG_HOME XDG_CACHE_HOME;
-        XDG_BIN_HOME = "\${HOME}/.local/bin";
-        XDG_STATE_HOME = "\${HOME}/.local/state";
-        # DEV PATH
-        PSQL_HISTORY = "${XDG_DATA_HOME}/psql_history";
-        REDISCLI_HISTFILE = "${XDG_DATA_HOME}/redis/rediscli_history";
-        WINEPREFIX = "${XDG_DATA_HOME}/wine";
-        # OPTIONS
-        ELECTRUMDIR = "${XDG_DATA_HOME}/electrum";
-        WGETRC = "${XDG_CONFIG_HOME}/wgetrc";
-        XCOMPOSECACHE = "${XDG_CACHE_HOME}/X11/xcompose";
-        "_JAVA_OPTIONS" = "-Djava.util.prefs.userRoot=${XDG_CONFIG_HOME}/java";
-        ORG_DEVICE = "workstation";
-        # WAYLAND
-        WLR_NO_HARDWARE_CURSORS = 1;
-        NIXOS_OZONE_WL = 1;
-        PATH = [ "\${HOME}/.local/bin" ];
-        NH_USE_DOAS = 1;
-      };
+    variables = inputs.self.lib.xdgEnvironment;
   };
   programs = {
     nh = {

config/home-manager.nix

@@ -2,59 +2,66 @@
   inputs,
   config,
   pkgs,
+  lib,
+  osConfig,
   ...
 }:
+let
+  inherit (pkgs) fd fzf;
+  inherit (inputs.jawz-scripts.packages.x86_64-linux) pokemon-colorscripts;
+  shellType = osConfig.my.shell.type;
+  commonInit = ''
+    ${pokemon-colorscripts}/bin/pokemon-colorscripts -r --no-title
+    export command_timeout=60
+  '';
+  commonAliases = inputs.self.lib.commonAliases // {
+    open-gallery = ''
+      cd /srv/pool/scrapping/JawZ/gallery-dl &&
+      xdg-open "$(${fd}/bin/fd . ./ Husbands wikifeet -tdirectory -d 1 | ${fzf}/bin/fzf -i)"'';
+  };
+in
 {
   home.stateVersion = "23.05";
   programs = {
     direnv = {
       enable = true;
-      enableBashIntegration = true;
+      enableBashIntegration = shellType == "bash";
+      enableZshIntegration = shellType == "zsh";
       nix-direnv.enable = true;
     };
     git = {
       enable = true;
+      delta.enable = true;
       userName = "Danilo Reyes";
-      userEmail = "CaptainJawZ@protonmail.com";
+      userEmail = osConfig.my.email;
+      extraConfig = {
+        init.defaultBranch = "main";
+        pull.rebase = true;
       };
-    bash =
-      let
-        inherit (pkgs) fd fzf;
-        inherit (inputs.jawz-scripts.packages.x86_64-linux) pokemon-colorscripts;
-      in
-      {
+    };
+    bash = lib.mkIf (shellType == "bash") {
       enable = true;
       historyFile = "\${XDG_STATE_HOME}/bash/history";
+      shellAliases = commonAliases;
+      enableVteIntegration = true;
+      initExtra = commonInit;
       historyControl = [
         "erasedups"
         "ignorespace"
         "ignoredups"
       ];
-        shellAliases = {
-          cp = "cp -i";
-          mv = "mv -i";
-          mkdir = "mkdir -p";
-          mkcd = "(){ mkdir -p \"$1\" && cd \"$1\" }";
-          copy = "xclip -selection clipboard";
-          cdp = "pwd | copy";
-          cfp = "(){ readlink -f \"$1\" | copy }";
-          ".." = "cd ..";
-          "..." = "cd ../..";
-          ".3" = "cd ../../..";
-          ".4" = "cd ../../../..";
-          ".5" = "cd ../../../../..";
-          c = "cat";
-          sc = "systemctl --user";
-          jc = "journalctl --user -xefu";
-          open-gallery = ''
-            cd /srv/pool/scrapping/JawZ/gallery-dl &&
-            xdg-open "$(${fd}/bin/fd . ./ Husbands wikifeet -tdirectory -d 1 | ${fzf}/bin/fzf -i)"'';
     };
-        enableVteIntegration = true;
-        initExtra = ''
-          ${pokemon-colorscripts}/bin/pokemon-colorscripts -r --no-title
-          export command_timeout=60
-        '';
+    zsh = lib.mkIf (shellType == "zsh") {
+      enable = true;
+      dotDir = ".config/zsh";
+      shellAliases = commonAliases;
+      initContent = commonInit;
+      history = {
+        path = "\${XDG_STATE_HOME}/zsh/history";
+        expireDuplicatesFirst = true;
+        ignoreSpace = true;
+        ignoreAllDups = true;
+      };
     };
   };
   xdg = {

config/jawz.nix

@@ -1,11 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
 let
   inherit (config.networking) hostName;
-  nixosHosts =
-    lib.attrNames config.my.ips
-    |> lib.filter (
-      name: !(lib.hasPrefix "wg-" name) && name != "vps" && name != "router" && name != hostName
-    );
+  nixosHosts = inputs.self.lib.getNixosHosts config.my.ips hostName lib;
   nixosHostsMatch = lib.concatStringsSep " " nixosHosts;
 in
 {
@@ -23,9 +24,6 @@ in
       jawz-password.neededForUsers = true;
       "private_keys/${hostName}" = keyConfig "${baseDir}_${hostName}";
       "git_private_keys/${hostName}" = keyConfig "${baseDir}_git";
-      "syncthing_keys/${hostName}" = keyConfig ".config/syncthing/key.pem";
-      "syncthing_certs/${hostName}" = keyConfig ".config/syncthing/cert.pem";
-      "syncthing_password".sopsFile = ../secrets/keys.yaml;
     }
   );
   home-manager.users.jawz = {
@@ -48,103 +46,6 @@ in
       };
     };
   };
-  services.syncthing = lib.mkIf config.my.secureHost {
-    enable = true;
-    user = "jawz";
-    group = "users";
-    overrideDevices = true;
-    overrideFolders = true;
-    openDefaultPorts = true;
-    key = config.sops.secrets."syncthing_keys/${hostName}".path;
-    cert = config.sops.secrets."syncthing_certs/${hostName}".path;
-    guiAddress = "${config.my.ips."${hostName}"}:8384";
-    settings = {
-      options = {
-        natEnabled = false;
-        relaysEnabled = false;
-        globalAnnounceEnabled = false;
-      };
-      gui = {
-        user = "jawz";
-        password = config.sops.secrets.syncthing_password.path;
-      };
-      devices = {
-        server.id = "BG6PF7S-KATABWO-7WAZFMX-6YO7IS3-WQTMR3M-VSOSV7V-HFFMNNH-BFX2EQ4";
-        miniserver.id = "HDYEGIR-GFU7ONK-MOOJUFH-N3L3XHX-SXWN3FI-O23K6LD-BJENQK5-VIPV2AT";
-        workstation.id = "4E4KJ6M-MSTNBVF-D7CNHDW-DUTB3VR-SXKZ4NH-ZKAOMF5-V24JECJ-4STSZAA";
-        galaxy.id = "UAZ5YDV-YUFBXOY-QMS6S6R-WPIIKZI-4OPPW5L-G4OVUPO-YW5KFYY-YASRAAV";
-        phone.id = "OSOX2VZ-AO2SA3C-BFB6NKF-K6CR6WX-64TDBKW-RRKEKJ4-FKZE5CV-J2RGJAJ";
-        wg-friend1 = {
-          id = "XBIYCD4-EFKS5SK-WFF73CU-P37GXVH-OMWEIA4-6KC5F3L-U5UQWSF-SYNNRQF";
-          addresses = [ "tcp://${config.my.ips.wg-friend1}:22000" ];
-          introducer = false;
-          autoAcceptFolders = false;
-          paused = false;
-        };
-      };
-      folders =
-        let
-          isMainHost = hostName == "workstation";
-          mkMobile =
-            path:
-            lib.mkIf isMainHost {
-              inherit path;
-              ignorePerms = false;
-              devices = [
-                "galaxy"
-                "phone"
-              ];
-            };
-        in
-        {
-          cache = mkMobile "~/Downloads/cache/";
-          friends = mkMobile "~/Pictures/artist/friends/";
-          forme = mkMobile "~/Pictures/art for me/";
-          comfy = mkMobile "~/Development/AI/ComfyUI/output/";
-          gdl = {
-            path = "~/.config/jawz/";
-            ignorePerms = false;
-            devices = [
-              "server"
-              "miniserver"
-              "workstation"
-            ];
-          };
-          librewolf = {
-            path = "~/.librewolf/";
-            ignorePerms = false;
-            copyOwnershipFromParent = true;
-            type = if isMainHost then "sendonly" else "receiveonly";
-            devices = [
-              "server"
-              "miniserver"
-              "workstation"
-            ];
-          };
-          notes = {
-            path = "~/Documents/Notes";
-            ignorePerms = false;
-            devices = [
-              "galaxy"
-              "phone"
-              "server"
-              "miniserver"
-              "workstation"
-            ];
-          };
-          friend_share = {
-            path = "~/Pictures/encrypted/friends";
-            ignorePerms = false;
-            type = "sendreceive";
-            devices = [
-              "server"
-              "workstation"
-              "wg-friend1"
-            ];
-          };
-        };
-    };
-  };
   users.users.jawz = {
     uid = 1000;
     linger = true;

config/overlay.nix

@@ -8,6 +8,8 @@ let
   pkgsU = mkpkgs inputs.nixpkgs-unstable;
 in
 _final: prev: {
+  handbrake = prev.handbrake.override { useGtk = true; };
+  ripgrep = prev.ripgrep.override { withPCRE2 = true; };
   nautilus = prev.nautilus.overrideAttrs (old: {
     buildInputs =
       old.buildInputs
@@ -29,8 +31,6 @@ _final: prev: {
         wineWowPackages.stable
       ]);
   };
-  handbrake = prev.handbrake.override { useGtk = true; };
-  ripgrep = prev.ripgrep.override { withPCRE2 = true; };
   discord = prev.discord.override {
     withVencord = true;
     withOpenASAR = true;
@@ -38,5 +38,11 @@ _final: prev: {
   waybar = prev.waybar.overrideAttrs (old: {
     mesonFlags = old.mesonFlags ++ [ "-Dexperimental=true" ];
   });
-  inherit (pkgsU) symbola mealie flaresolver;
+  inherit (pkgsU)
+    code-cursor
+    symbola
+    mealie
+    flaresolver
+    deadnix
+    ;
 }

config/schemes.nix

@@ -56,6 +56,18 @@ in
       polarity = "dark";
       image = "${wallpapers}/Waay-Ballerinas.jpeg";
     };
+    febroary = mkScheme {
+      color = "yellow";
+      name = "gruvbox-light";
+      polarity = "light";
+      image = "${wallpapers}/febroary.jpg";
+    };
+    paul3 = mkScheme {
+      color = "bluegrey";
+      name = "mexico-light";
+      polarity = "light";
+      image = "${wallpapers}/paul3.jpg";
+    };
     paul = mkScheme {
       color = "green";
       name = "valua";
@@ -99,7 +111,7 @@ in
         base0A = "#daa520"; # goldenrod
         base0B = "#228b22"; # forest green
         base0C = "#20b2aa"; # light sea green
-        base0D = "#4169e1"; # royal blue
+        base0D = "#daa520"; # goldenrod
         base0E = "#8b008b"; # dark magenta
         base0F = "#dc143c"; # crimson
       };

config/stylix.nix

@@ -9,8 +9,9 @@ let
   schemesFile = import ./schemes.nix {
     inherit pkgs inputs;
   };
-  scheme = schemesFile.schemes.cheems;
+  scheme = schemesFile.schemes.febroary;
   cfg = config.my.stylix;
+  gnomeEnabled = config.services.xserver.desktopManager.gnome.enable;
 in
 {
   options.my.stylix.enable = lib.mkEnableOption "system-wide theming with Stylix";
@@ -23,7 +24,7 @@ in
     }
     // lib.optionalAttrs (scheme ? base16Scheme) { inherit (scheme) base16Scheme; };
     home-manager.users.jawz = {
-      gtk = lib.mkIf (!cfg.enable) {
+      gtk = lib.mkIf (!cfg.enable && gnomeEnabled) {
         enable = true;
         iconTheme = {
           name = "Papirus-Light";
@@ -33,7 +34,7 @@ in
         };
       };
       stylix = {
-        enable = true;
+        inherit (cfg) enable;
         autoEnable = cfg.enable;
         iconTheme = {
           inherit (cfg) enable;

dotfiles/gallery-dl.nix

@@ -13,8 +13,8 @@
       directory = [ ];
     };
     bluesky = {
+      limit-rate = "400k-1M";
       username = "blablablamagic.bsky.social";
-      password = "bb3m-xr4w-4vgf-oxmi";
       reposts = false;
       videos = true;
       directory = [ "{author['handle']}" ];
@@ -30,8 +30,6 @@
     };
     flickr = {
       size-max = "Original";
-      access-token = "72157720915197374-51a26dc4fdfdf173";
-      access-token-secret = "a1ddb10902f3fa85";
       directory = [
         "{category}"
         "{owner[username]}"
@@ -49,8 +47,9 @@
       ];
     };
     instagram = {
+      limit-rate = "200k-300k";
       browser = "firefox:linux";
-      user-agent = "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0";
+      user-agent = "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0";
       sleep = "66-123";
       sleep-request = "66-123";
       parent-directory = true;
@@ -71,6 +70,7 @@
       ];
     };
     kemonoparty = {
+      limit-rate = "200k-300k";
       retries = 10;
       timeout = 5;
       filename = "{id}_{filename}.{extension}";
@@ -84,19 +84,15 @@
       "{title}"
     ];
     tumblr = {
-      access-token = "5VwIW8TNBoNVPo9CzvKMza2wcn9gJXd6rnUBy6Ctqb4BCPpI59";
-      access-token-secret = "8krZGeauA171aZpXZhwgZN8nZCxKQkXYKXWL473mTQPKrqoP3e";
       external = true;
       inline = true;
       posts = "all";
       reblogs = false;
       parent-directory = true;
-      api-key = "uhBUtgPaX9gl7eaD8suGWW6ZInRedQoVT6xsZzopljy0jXHqm5";
-      api-secret = "D3FDj1INyPzXikVpp4jmzSqjlC9czFUQ8oj2I883PSYJdqwURv";
       directory = [ "{blog_name}" ];
     };
     deviantart = {
-      refresh-token = "4364d30b6f3777b3c5c1ab2c1c428b0245272ebe";
+      limit-rate = "200k-300k";
       include = "gallery,scraps";
       flat = true;
       original = true;
@@ -116,6 +112,7 @@
       ];
     };
     patreon = {
+      limit-rate = "400k-1M";
       filename = "{filename}.{num}.{extension}";
       browser = "firefox";
       directory = [
@@ -139,7 +136,6 @@
     reddit = {
       user-agent = "Python:gallery-dl:v1.0 (by /u/captainjawz)";
       client-id = "T7nZ6WZ3_onJWBhLP8r08g";
-      refresh-token = "184157546842-UHdPQX1c7kG1kbO09NAHY2O2taEiwg";
       parent-directory = true;
       directory = [ "{author}" ];
     };
@@ -162,7 +158,6 @@
     ];
     baraag.directory = [ "{account[username]}" ];
     pixiv = {
-      refresh-token = "O4kc9tTzGItuuacDcfmevW6NELjm5CJdWiAbZdUv3Kk";
       directory = [ "{user[account]} - {user[id]}" ];
       ugoira = true;
       favorite.directory = [
@@ -196,6 +191,7 @@
       ];
     };
     readcomiconline = {
+      limit-rate = "400k-1M";
       chapter-reverse = true;
       quality = "hq";
       captcha = "wait";

dotfiles/unpackerr.conf

@@ -1,222 +0,0 @@
-##      Unpackerr Example Configuration File      ##
-## The following values are application defaults. ##
-## Environment Variables may override all values. ##
-####################################################
-
-# [true/false] Turn on debug messages in the output. Do not wrap this in quotes.
-# Recommend trying this so you know what it looks like. I personally leave it on.
-debug = false
-
-# Disable writing messages to stdout. This silences the app. You should set a log
-# file below if you set this to true. Recommended when starting with systemctl.
-quiet = false
-
-# Setting activity to true will silence all app queue log lines with only zeros.
-# Set this to true when you want less log spam.
-activity = false
-
-# The application queue data is logged on an interval. Adjust that interval with this setting.
-# Default is a minute. 2m, 5m, 10m, 30m, 1h are also perfectly acceptable.
-log_queues = "1m"
-
-# Write messages to a log file. This is the same data that is normally output to stdout.
-# This setting is great for Docker users that want to export their logs to a file.
-# The alternative is to use syslog to log the output of the application to a file.
-# Default is no log file; this is unset. log_files=0 turns off auto-rotation.
-# Default files is 10 and size(mb) is 10 Megabytes; both doubled if debug is true.
-#log_file = '/downloads/unpackerr.log'
-log_files = 10
-log_file_mb = 10
-
-# How often to poll sonarr and radarr.
-# Recommend 1m-5m. Uses Go Duration.
-interval = "5m"
-
-# How long an item must be queued (download complete) before extraction will start.
-# One minute is the historic default and works well. Set higher if your downloads
-# take longer to finalize (or transfer locally). Uses Go Duration.
-start_delay = "1m"
-
-# How long to wait before removing the history for a failed extraction.
-# Once the history is deleted the item will be recognized as new and
-# extraction will start again. Uses Go Duration.
-retry_delay = "5m"
-
-# How many files may be extracted in parallel. 1 works fine.
-# Do not wrap the number in quotes. Raise this only if you have fast disks and CPU.
-parallel = 1
-
-# Use these configurations to control the file modes used for newly extracted
-# files and folders. Recommend 0644/0755 or 0666/0777.
-file_mode = "0664"
-dir_mode = "0775"
-
-[webserver]
-## The web server currently only supports metrics; set this to true if you wish to use it.
-  metrics = false
-## This may be set to a port or an ip:port to bind a specific IP. 0.0.0.0 binds ALL IPs.
-  listen_addr = "0.0.0.0:5656"
-## Recommend setting a log file for HTTP requests. Otherwise, they go with other logs.
-  log_file = ""
-## This app automatically rotates logs. Set these to the size and number to keep.
-  log_files = 10
-  log_file_mb = 10
-## Set both of these to valid file paths to enable HTTPS/TLS.
-  ssl_cert_file = ""
-  ssl_key_file = ""
-## Base URL from which to serve content.
-  urlbase = "/"
-## Upstreams should be set to the IP or CIDR of your trusted upstream proxy.
-## Setting this correctly allows X-Forwarded-For to be used in logs.
-## In the future it may control auth proxy trust. Must be a list of strings.
-  upstreams = [ ] # example: upstreams = [ "127.0.0.1/32", "10.1.2.0/24" ]
-
-##-Notes-#######-READ THIS!!!-##################################################
-## The following sections can be repeated if you have more than one Sonarr,   ##
-## Radarr or Lidarr, Readarr, Folder, Webhook, or Command Hook.               ##
-## You MUST uncomment the [[header]] and api_key at a minimum for Starr apps. ##
-##                ALL LINES BEGINNING WITH A HASH # ARE IGNORED               ##
-##            REMOVE THE HASH # FROM CONFIG LINES YOU WANT TO CHANGE          ##
-################################################################################
-
-[[sonarr]]
-url = "http://localhost:8989"
-api_key = "52869fe7bec4482dafb21c4053fe71e4"
-## File system path where downloaded Sonarr items are located.
-paths = ['/srv/pool/multimedia/downloads/torrent']
-## Default protocols is torrent. Alternative: "torrent,usenet"
-protocols = "torrent"
-## How long to wait for a reply from the backend.
-timeout = "10s"
-## How long to wait after import before deleting the extracted items.
-delete_delay = "5m"
-## If you use this app with NZB you may wish to delete archives after extraction.
-## General recommendation is: do not enable this for torrent use.
-## Setting this to true deletes the entire original download folder after import.
-# delete_orig = false
-## If you use Syncthing, setting this to true will make unpackerr wait for syncs to finish.
-# syncthing = false
-
-[[radarr]]
-url = "http://127.0.0.1:7878"
-api_key = "a987ac45ca2c47bc88e762031ea33296"
-## File system path where downloaded Radarr items are located.
-paths = ['/srv/pool/multimedia/downloads/torrent']
-## Default protocols is torrents. Alternative: "torrent,usenet"
-protocols = "torrent"
-## How long to wait for a reply from the backend.
-timeout = "10s"
-## How long to wait after import before deleting the extracted items.
-delete_delay = "5m"
-## If you use this app with NZB you may wish to delete archives after extraction.
-## General recommendation is: do not enable this for torrent use.
-## Setting this to true deletes the entire original download folder after import.
-# delete_orig = false
-## If you use Syncthing, setting this to true will make unpackerr wait for syncs to finish.
-# syncthing = false
-
-#[[lidarr]]
-# url = "http://127.0.0.1:8686"
-# api_key = "0123456789abcdef0123456789abcdef"
-## File system path where downloaded Lidarr items are located.
-# paths = ['/downloads']
-## Default protocols is torrent. Alternative: "torrent,usenet"
-# protocols = "torrent"
-## How long to wait for a reply from the backend.
-# timeout = "10s"
-## How long to wait after import before deleting the extracted items.
-# delete_delay = "5m"
-## If you use this app with NZB you may wish to delete archives after extraction.
-## General recommendation is: do not enable this for torrent use.
-## Setting this to true deletes the entire original download folder after import.
-# delete_orig = false
-## If you use Syncthing, setting this to true will make unpackerr wait for syncs to finish.
-# syncthing = false
-
-#[[readarr]]
-# url = "http://127.0.0.1:8787"
-# api_key = "0123456789abcdef0123456789abc"
-## File system path where downloaded Readarr items are located.
-# paths = ['/downloads']
-## Default protocols is torrent. Alternative: "torrent,usenet"
-# protocols = "torrent"
-## How long to wait for a reply from the backend.
-# timeout = "10s"
-## How long to wait after import before deleting the extracted items.
-# delete_delay = "5m"
-## If you use this app with NZB you may wish to delete archives after extraction.
-## General recommendation is: do not enable this for torrent use.
-## Setting this to true deletes the entire original download folder after import.
-# delete_orig = false
-## If you use Syncthing, setting this to true will make unpackerr wait for syncs to finish.
-# syncthing = false
-
-
-##################################################################################
-### ###  STOP HERE ### STOP HERE ### STOP HERE ### STOP HERE #### STOP HERE  ### #
-### Only using Starr apps? The things above. The below configs are OPTIONAL. ### #
-##################################################################################
-
-##-Folders-#######################################################################
-## This application can also watch folders for things to extract. If you copy a ##
-## subfolder into a watched folder (defined below) any extractable items in the ##
-## folder will be decompressed. This has nothing to do with Starr applications. ##
-##################################################################################
-#[[folder]]
-# path = '/some/folder/to/watch'
-## Path to extract files to. The default (leaving this blank) is the same as `path` (above).
-# extract_path = ""
-## Delete extracted or original files this long after extraction.
-## The default is 0. Set to 0 to disable all deletes. Uncomment it to enable deletes. Uses Go Duration.
-# delete_after = "10m"
-## Delete extracted files after successful extraction? true/false, no quotes. Honors delete_after.
-# delete_files = false
-## Delete original items after successful extraction? true/false, no quotes. Honors delete_after.
-# delete_original = false
-## Disable extraction log (unpackerred.txt) file creation? true/false, no quotes.
-# disable_log = false
-## Move extracted files into original folder? If false, files go into an _unpackerred folder.
-# move_back = false
-## Set this to true if you want this app to extract ISO files with .iso extension.
-# extract_isos = false
-
-
-################
-### Webhooks ###
-################
-# Sends a webhook when an extraction queues, starts, finishes, and/or is deleted.
-# Created to integrate with notifiarr.com.
-# Also works natively with Discord.com, Telegram.org, and Slack.com webhooks.
-# Can possibly be used with other services by providing a custom template_path.
-###### Don't forget to uncomment [[webhook]] and url at a minimum !!!!
-#[[webhook]]
-# url    = "https://notifiarr.com/api/v1/notification/unpackerr/api_key_from_notifiarr_com"
-# name   = ""    # Set this to hide the URL in logs.
-# silent = false # do not log success (less log spam)
-# events = [0]   # list of event ids to include, 0 == all.
-## Advanced Optional Webhook Configuration
-# nickname      = ""    # Used in Discord and Slack templates as bot name, in Telegram as chat_id.
-# channel       = ""    # Also passed into templates. Used in Slack templates for destination channel.
-# exclude       = []    # list of apps to exclude, ie. ["radarr", "lidarr"]
-# template_path = ""    # Override internal webhook template for discord.com or other hooks.
-# template      = ""    # Override automatic template detection. Values: notifiarr, discord, telegram, gotify, pushover, slack
-# ignore_ssl    = false # Set this to true to ignore the SSL certificate on the server.
-# timeout       = "10s" # You can adjust how long to wait for a server response.
-# content_type  = "application/json" # If your custom template uses another MIME type, set this.
-
-
-#####################
-### Command Hooks ###
-#####################
-# Executes a script or command when an extraction queues, starts, finishes, and/or is deleted.
-# All data is passed in as environment variables. Try /usr/bin/env to see what variables are available.
-###### Don't forget to uncomment [[cmdhook]] and url at a minimum !!!!
-#[[cmdhook]]
-# command = '/my/cool/app' # Path to command or script.
-# shell   = false # Runs the command inside /bin/sh ('nix) or cmd.exe (Windows).
-# name    = ""    # Provide an optional name for logging.
-# silent  = false # Hides command output from logs.
-# events  = [0]   # list of event ids to include, 0 == all.
-## Optional Command Hook Configuration
-# exclude       = []    # list of apps to exclude, ie. ["radarr", "lidarr"]
-# timeout       = "10s" # You can adjust how long to wait for a server response.

environments/gnome.nix

@@ -4,6 +4,7 @@
   ...
 }:
 {
+  qt.enable = true;
   services = {
     gvfs.enable = true;
     libinput.enable = true;
@@ -32,7 +33,6 @@
       totem
       ;
   };
-  qt.enable = true;
   users.users.jawz.packages = builtins.attrValues {
     inherit (pkgs.gnomeExtensions)
       tactile # window manager
@@ -40,6 +40,7 @@
       gamemode-shell-extension # I guess I'm a gamer now?
       burn-my-windows # special effects for when closing windows
       pano # clipboard manager
+      pop-shell
       ;
   };
 }

environments/hyprland.nix

@@ -1,13 +1,12 @@
 {
   pkgs,
+  config,
   ...
 }:
 let
-  startupScript = pkgs.pkgs.writeShellScriptBin "start" ''
-    ${pkgs.waybar}/bin/waybar &
-    ${pkgs.swww}/bin/swww init &
-    sleep 1
-  '';
+  mod = "SUPER";
+  waybarConfig = import ./waybar-config.nix { inherit pkgs config; };
+  waybarStyle = import ./waybar-style.nix { inherit config; };
 in
 {
   programs.hyprland.enable = true;
@@ -18,90 +17,119 @@ in
       user = "greeter";
     };
   };
-  xdg.portal = {
-    enable = true;
-    extraPortals = [
-      pkgs.xdg-desktop-portal-hyprland
-      pkgs.xdg-desktop-portal-gtk
-    ];
-  };
   users.users.jawz.packages = builtins.attrValues {
     inherit (pkgs)
       # Wayland utilities
-      wl-clipboard
+      wl-clipboard-rs
       wf-recorder
-      grim
-      slurp
-
-      wofi # Application launcher
-      mako # Notification daemon
+      grimblast # screenshots
+      mako # notification daemon
       libnotify # dependency of mako
-      swaylock-effects # Screen locker
-      nautilus # File manager
+      swaylock-effects # screen locker
+      yazi # file manager
+      imv # images
+      playerctl # media player control
       ;
   };
   home-manager.users.jawz = {
-    programs.kitty.enable = true;
+    programs = {
+      wofi = {
+        enable = true;
+        settings = {
+          allow_images = true;
+          allow_markup = true;
+          insensitive = true;
+          width = "30%";
+        };
+      };
+      waybar = waybarConfig.programs.waybar // {
+        style = waybarStyle;
+      };
+    };
     wayland.windowManager.hyprland = {
       enable = true;
       settings = {
-        "$mainMod" = "SUPER";
-        exec-once = "${startupScript}/bin/start";
         general = {
           gaps_in = 5;
           gaps_out = 10;
-          border_size = 2;
+          border_size = 3;
           layout = "dwindle";
         };
+        misc = {
+          disable_hyprland_logo = true;
+          disable_splash_rendering = true;
+          force_default_wallpaper = 0;
+        };
         dwindle = {
           pseudotile = true;
           preserve_split = true;
           force_split = 2;
         };
         bind = [
-          "$mainMod, return, exec, kitty"
-          "$mainMod, Q, killactive,"
-          "$mainMod SHIFT, F, togglefloating,"
-          "$mainMod, F, fullscreen,"
-          "$mainMod, T, pin,"
-          "$mainMod, G, togglegroup,"
-          "$mainMod, bracketleft, changegroupactive, b"
-          "$mainMod, bracketright, changegroupactive, f"
-          "$mainMod, S, exec, wofi --show drun icons"
-          "$mainMod, P, pin, active"
-
-          ",XF86AudioRaiseVolume, exec, wpctl set-volume -l 1.4 @DEFAULT_AUDIO_SINK@ 5%+"
-          ",XF86AudioLowerVolume, exec, wpctl set-volume -l 1.4 @DEFAULT_AUDIO_SINK@ 5%-"
-
-          "$mainMod, left, movefocus, l"
-          "$mainMod, right, movefocus, r"
-          "$mainMod, up, movefocus, u"
-          "$mainMod, down, movefocus, d"
-
-          "$mainMod, h, movefocus, l"
-          "$mainMod, l, movefocus, r"
-          "$mainMod, k, movefocus, u"
-          "$mainMod, j, movefocus, d"
-
-          "$mainMod SHIFT, h, movewindow, l"
-          "$mainMod SHIFT, l, movewindow, r"
-          "$mainMod SHIFT, k, movewindow, u"
-          "$mainMod SHIFT, j, movewindow, d"
+          "${mod}, return, exec, ghostty"
+          "${mod}, Q, killactive,"
+          "${mod} SHIFT, F, togglefloating,"
+          "${mod}, F, fullscreen,"
+          "${mod}, T, pin,"
+          "${mod}, G, togglegroup,"
+          "${mod}, bracketleft, changegroupactive, b"
+          "${mod}, bracketright, changegroupactive, f"
+          "${mod}, S, exec, wofi --show drun icons"
+          "${mod}, P, pin, active"
+          "${mod}, left, movefocus, l"
+          "${mod}, right, movefocus, r"
+          "${mod}, up, movefocus, u"
+          "${mod}, down, movefocus, d"
+          "${mod}, h, movefocus, l"
+          "${mod}, l, movefocus, r"
+          "${mod}, k, movefocus, u"
+          "${mod}, j, movefocus, d"
+          "${mod} SHIFT, left, movewindow, l"
+          "${mod} SHIFT, right, movewindow, r"
+          "${mod} SHIFT, up, movewindow, u"
+          "${mod} SHIFT, down, movewindow, d"
+          "${mod} SHIFT, h, movewindow, l"
+          "${mod} SHIFT, l, movewindow, r"
+          "${mod} SHIFT, k, movewindow, u"
+          "${mod} SHIFT, j, movewindow, d"
+          "${mod}, 1, workspace, 1"
+          "${mod}, 2, workspace, 2"
+          "${mod}, 3, workspace, 3"
+          "${mod}, 4, workspace, 4"
+          "${mod}, 5, workspace, 5"
+          "${mod}, 6, workspace, 6"
+          "${mod}, 7, workspace, 7"
+          "${mod}, 8, workspace, 8"
+          "${mod}, 9, workspace, 9"
+          "${mod}, 0, workspace, 10"
+          "${mod} SHIFT, 1, movetoworkspace, 1"
+          "${mod} SHIFT, 2, movetoworkspace, 2"
+          "${mod} SHIFT, 3, movetoworkspace, 3"
+          "${mod} SHIFT, 4, movetoworkspace, 4"
+          "${mod} SHIFT, 5, movetoworkspace, 5"
+          "${mod} SHIFT, 6, movetoworkspace, 6"
+          "${mod} SHIFT, 7, movetoworkspace, 7"
+          "${mod} SHIFT, 8, movetoworkspace, 8"
+          "${mod} SHIFT, 9, movetoworkspace, 9"
+          "${mod} SHIFT, 0, movetoworkspace, 10"
+          "${mod}, F3, exec, grimblast save area ~/Pictures/screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
+          "${mod} SHIFT, F3, exec, grimblast save screen ~/Pictures/screenshots/$(date +'%Y-%m-%d_%H-%M-%S').png"
         ];
         binde = [
-          "$mainMod SHIFT, h, moveactive, -20 0"
-          "$mainMod SHIFT, l, moveactive, 20 0"
-          "$mainMod SHIFT, k, moveactive, 0 -20"
-          "$mainMod SHIFT, j, moveactive, 0 20"
-
-          "$mainMod CTRL, l, resizeactive, 30 0"
-          "$mainMod CTRL, h, resizeactive, -30 0"
-          "$mainMod CTRL, k, resizeactive, 0 -10"
-          "$mainMod CTRL, j, resizeactive, 0 10"
+          "${mod} SHIFT, h, moveactive, -20 0"
+          "${mod} SHIFT, l, moveactive, 20 0"
+          "${mod} SHIFT, k, moveactive, 0 -20"
+          "${mod} SHIFT, j, moveactive, 0 20"
+          "${mod} CTRL, l, resizeactive, 30 0"
+          "${mod} CTRL, h, resizeactive, -30 0"
+          "${mod} CTRL, k, resizeactive, 0 -10"
+          "${mod} CTRL, j, resizeactive, 0 10"
+          ",XF86AudioRaiseVolume, exec, wpctl set-volume -l 1.4 @DEFAULT_AUDIO_SINK@ 5%+"
+          ",XF86AudioLowerVolume, exec, wpctl set-volume -l 1.4 @DEFAULT_AUDIO_SINK@ 5%-"
         ];
         bindm = [
-          "$mainMod, mouse:272, movewindow"
-          "$mainMod, mouse:273, resizewindow"
+          "${mod}, mouse:272, movewindow"
+          "${mod}, mouse:273, resizewindow"
         ];
       };
     };

environments/waybar-config.nix

@@ -0,0 +1,113 @@
+_: {
+  programs.waybar = {
+    enable = true;
+    systemd.enable = true;
+    settings.main-bar = {
+      layer = "top";
+      height = 18;
+      tray.spacing = 5;
+      clock = {
+        format = "{:%a %b %d  %I:%M %p}";
+        tooltip-format = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
+      };
+      modules-left = [
+        "hyprland/workspaces"
+        "custom/separator"
+        "temperature#cpu"
+        "custom/gpu-temp"
+      ];
+      modules-center = [
+        "clock"
+      ];
+      modules-right = [
+        "tray"
+        "mpris"
+        "wireplumber"
+        "wireplumber#microphone"
+      ];
+      "hyprland/workspaces" = {
+        format = "{icon}";
+        active-only = true;
+        on-scroll-up = "hyprctl dispatch workspace e-1";
+        on-scroll-down = "hyprctl dispatch workspace e+1";
+        persistent-workspaces."*" = 10; # Show 5 workspaces on all monitors
+      };
+      "custom/separator" = {
+        format = "|";
+        tooltip = false;
+      };
+      cava = {
+        bars = 14;
+        method = "pulse";
+        framerate = 20;
+        bar_delimiter = 0;
+        stereo = false;
+        format-icons.default = [
+          "▁"
+          "▂"
+          "▃"
+          "▄"
+          "▅"
+          "▆"
+          "▇"
+          "█"
+        ];
+      };
+      "temperature#cpu" = {
+        interval = 2;
+        format = " {temperatureC}°C";
+        critical-threshold = 80;
+        hwmon-path = "/sys/class/hwmon/hwmon1/temp1_input";
+        tooltip-format = "CPU: {temperatureC}°C";
+      };
+      "custom/gpu-temp" = {
+        exec = "nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits";
+        format = "󰢮 {}°C";
+        interval = 2;
+        tooltip-format = "GPU: {}°C";
+      };
+      mpris = {
+        interval = 2;
+        format = "{player_icon} {dynamic}";
+        format-paused = "{status_icon} {dynamic}";
+        dynamic-len = 40;
+        on-click = "playerctl play-pause";
+        on-scroll-up = "playerctl next";
+        on-scroll-down = "playerctl previous";
+        dynamic-order = [
+          "title"
+          "artist"
+        ];
+        player-icons = {
+          default = "🎵";
+          firefox = "🦊";
+          librewolf = "🦊";
+        };
+        status-icons = {
+          paused = "";
+          playing = "";
+        };
+      };
+      wireplumber = {
+        format = "{icon}  {volume}%";
+        format-muted = "󰝟  muted";
+        scroll-step = 5;
+        on-click = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+        format-icons.default = [
+          "󰕿"
+          "󰖀"
+          "󰕾"
+        ];
+      };
+      "wireplumber#microphone" = {
+        format = "{format_source}";
+        format-source = "  {volume}%";
+        format-source-muted = "";
+        on-click = "wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle";
+        on-scroll-up = "wpctl set-volume @DEFAULT_AUDIO_SOURCE@ 5%+";
+        on-scroll-down = "wpctl set-volume @DEFAULT_AUDIO_SOURCE@ 5%-";
+        tooltip-format = "{source_desc}";
+      };
+    };
+  };
+}

environments/waybar-style.nix

@@ -0,0 +1,41 @@
+{
+  config,
+  ...
+}:
+let
+  inherit (config.lib.stylix) colors;
+in
+''
+  * {
+    border: none;
+    font-family: "${config.stylix.fonts.monospace.name}";
+    font-size: ${toString config.stylix.fonts.sizes.desktop}pt;
+    color: #${colors.base04};
+  }
+  window#waybar {
+    background: #${colors.base00};
+    min-height: 18px;
+  }
+  .module {
+    background: #${colors.base00};
+    margin: 0px 3px 0px 3px;
+    padding: 4px 6px 4px 6px;
+  }
+  #workspaces button {
+    padding: 2px 8px;
+    margin: 2px;
+    border-radius: 8px;
+    background: transparent;
+    color: #${colors.base03};
+    border: none;
+    min-width: 20px;
+  }
+  #workspaces button.active {
+    background: #${colors.base02};
+    color: #${colors.base05};
+  }
+  #workspaces button:hover {
+    background: #${colors.base01};
+    color: #${colors.base04};
+  }
+''

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755946532,
-        "narHash": "sha256-POePremlUY5GyA1zfbtic6XLxDaQcqHN6l+bIxdT5gc=",
+        "lastModified": 1759499898,
+        "narHash": "sha256-UNzYHLWfkSzLHDep5Ckb5tXc0fdxwPIrT+MY4kpQttM=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "81584dae2df6ac79f6b6dae0ecb7705e95129ada",
+        "rev": "655e067f96fd44b3f5685e17f566b0e4d535d798",
         "type": "github"
       },
       "original": {
@@ -125,27 +125,28 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1759135438,
-        "narHash": "sha256-2GLoM04OmwN7lVxUZI5y4zw/nFbxkVFkJmkOv4kzsdU=",
+        "lastModified": 1757147654,
+        "narHash": "sha256-mGoonbnnd38MZS/H80/vbXCHCxl6KlFup/XKK+zcAuY=",
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
-        "rev": "7b6f3ca8d26af16e435a9d7d6a27fde60df72312",
+        "rev": "ad01165af00765af07989b6ad14115960ac675f8",
         "type": "github"
       },
       "original": {
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
+        "rev": "ad01165af00765af07989b6ad14115960ac675f8",
         "type": "github"
       }
     },
     "doomemacs": {
       "flake": false,
       "locked": {
-        "lastModified": 1758860516,
-        "narHash": "sha256-ulQq9+RHIQELZVQuXsLQInqeAhOCDqRltUDRVBjQ1c0=",
+        "lastModified": 1757106921,
+        "narHash": "sha256-vHwgENjip2+AFzs4oZfnKEAJKwf5Zid7fakImvxxQUw=",
         "owner": "doomemacs",
         "repo": "doomemacs",
-        "rev": "1d1d17e9c910146731cb7b19d5bcbf6c4b283a74",
+        "rev": "8f55404781edacf66fa330205533b002de3fb5ee",
         "type": "github"
       },
       "original": {
@@ -164,11 +165,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759111708,
-        "narHash": "sha256-vFFue5sy7YRPhQQGW9kiCj+tAY3Gfm05svmDLFt5FIw=",
+        "lastModified": 1757124175,
+        "narHash": "sha256-drA0+kWXGrTgvhlsCiEE7VJ+vFsPi74p32n/7L5L5aU=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "c8f778ca07cc9d8182599be4e794db6c8e03682e",
+        "rev": "802b82be7856f6350d5e9ccb536fb4e20cb82069",
         "type": "github"
       },
       "original": {
@@ -214,11 +215,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1759362264,
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
         "type": "github"
       },
       "original": {
@@ -231,6 +232,24 @@
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
+      "locked": {
+        "lastModified": 1759362264,
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_3"
+      },
       "locked": {
         "lastModified": 1712014858,
         "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
@@ -244,7 +263,7 @@
         "type": "indirect"
       }
     },
-    "flake-parts_3": {
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -265,7 +284,7 @@
         "type": "github"
       }
     },
-    "flake-parts_4": {
+    "flake-parts_5": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -304,6 +323,22 @@
         "type": "github"
       }
     },
+    "fonts": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1759200391,
+        "narHash": "sha256-S5LwvPL7sKgwKUhCyTpcuWUxCq57RFh7wbZ6rIc5AgU=",
+        "ref": "refs/heads/master",
+        "rev": "edea9d2aaf2f4e0481fbbb8e26f68a9f39248e3f",
+        "revCount": 2,
+        "type": "git",
+        "url": "https://git.servidos.lat/jawz/fonts.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.servidos.lat/jawz/fonts.git"
+      }
+    },
     "fromYaml": {
       "flake": false,
       "locked": {
@@ -425,11 +460,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758192433,
-        "narHash": "sha256-CR6RnqEJSTiFgA6KQY4TTLUWbZ8RBnb+hxQqesuQNzQ=",
+        "lastModified": 1759490292,
+        "narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "c44e749dd611521dee940d00f7c444ee0ae4cfb7",
+        "rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
         "type": "github"
       },
       "original": {
@@ -456,11 +491,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1759094452,
-        "narHash": "sha256-j7IOTFnQRDjX4PzYb2p6CPviAc8cDrcorzGpM8J89uM=",
+        "lastModified": 1760143218,
+        "narHash": "sha256-OhJPROcRcwBkjOKkXr/f3/7wuSjhAIqr8WfmEUF9Uuo=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "f854b5bffbdd13cfe7edad0ee157d6947ff99619",
+        "rev": "d599513d4a72d66ac62ffdedc41d6653fa81b39e",
         "type": "github"
       },
       "original": {
@@ -549,11 +584,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757694755,
-        "narHash": "sha256-j+w5QUUr2QT/jkxgVKecGYV8J7fpzXCMgzEEr6LG9ug=",
+        "lastModified": 1759080228,
+        "narHash": "sha256-RgDoAja0T1hnF0pTc56xPfLfFOO8Utol2iITwYbUhTk=",
         "owner": "hyprwm",
         "repo": "hyprland-qtutils",
-        "rev": "5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c",
+        "rev": "629b15c19fa4082e4ce6be09fdb89e8c3312aed7",
         "type": "github"
       },
       "original": {
@@ -578,11 +613,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756810301,
-        "narHash": "sha256-wgZ3VW4VVtjK5dr0EiK9zKdJ/SOqGIBXVG85C3LVxQA=",
+        "lastModified": 1758927902,
+        "narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
         "owner": "hyprwm",
         "repo": "hyprlang",
-        "rev": "3d63fb4a42c819f198deabd18c0c2c1ded1de931",
+        "rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
         "type": "github"
       },
       "original": {
@@ -603,11 +638,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756117388,
-        "narHash": "sha256-oRDel6pNl/T2tI+nc/USU9ZP9w08dxtl7hiZxa0C/Wc=",
+        "lastModified": 1759619523,
+        "narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "b2ae3204845f5f2f79b4703b441252d8ad2ecfd0",
+        "rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
         "type": "github"
       },
       "original": {
@@ -649,11 +684,11 @@
         "sudoku-solver": "sudoku-solver"
       },
       "locked": {
-        "lastModified": 1758693316,
-        "narHash": "sha256-cy8CdWOyDJdIe2gVPP3mtRIYXwv8m08HhLet8eSyrHM=",
+        "lastModified": 1760073554,
+        "narHash": "sha256-Ydqg/9lpoha2vgspjviqeRh6/tsWN+pZcUxn1ZyrFZM=",
         "ref": "refs/heads/master",
-        "rev": "64a81ca78d03816ddcbbdc8a7b6186c975c6653a",
-        "revCount": 104,
+        "rev": "5c13b806a094f3605e2da70e133551848ad8d9a9",
+        "revCount": 109,
         "type": "git",
         "url": "https://git.servidos.lat/jawz/scripts.git"
       },
@@ -664,17 +699,17 @@
     },
     "nix-gaming": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1759110900,
-        "narHash": "sha256-fcu/r0ijvaYT2VHGkZGr0wq9uBMNFkiftVBy43/2oig=",
+        "lastModified": 1760146997,
+        "narHash": "sha256-x2sF8Q4tWz3DI166s+KFDXySrK+cN+/YEd3DfhnhBLQ=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "2ac6a49266e9159ccb001b4c8cb1f50f67d502ae",
+        "rev": "ad505387568d024654da88fef03d9c5319cba92f",
         "type": "github"
       },
       "original": {
@@ -751,6 +786,21 @@
       }
     },
     "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1754788789,
+        "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "a73b9c743612e4244d865a2fdee11865283c04e6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_3": {
       "locked": {
         "dir": "lib",
         "lastModified": 1711703276,
@@ -770,11 +820,11 @@
     },
     "nixpkgs-small": {
       "locked": {
-        "lastModified": 1759008180,
-        "narHash": "sha256-hVpxYhilbBxQj0D6u6hUb6OXhNl85xIdhUE23AmqBdA=",
+        "lastModified": 1760081104,
+        "narHash": "sha256-n9NgHBtZgLrT1FtJ2W9AvVKM7bXWBgqw/is739m72WQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9a51fe84a7214f70a17e5d7ce085385baa24ee29",
+        "rev": "872106a411643f96e2c9576d247cf96e7c8c1b97",
         "type": "github"
       },
       "original": {
@@ -786,11 +836,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1758690382,
-        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
+        "lastModified": 1760038930,
+        "narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
+        "rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
         "type": "github"
       },
       "original": {
@@ -802,11 +852,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1758791193,
-        "narHash": "sha256-F8WmEwFoHsnix7rt290R0rFXNJiMbClMZyIC/e+HYf0=",
+        "lastModified": 1759994382,
+        "narHash": "sha256-wSK+3UkalDZRVHGCRikZ//CyZUJWDJkBDTQX1+G77Ow=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "25e53aa156d47bad5082ff7618f5feb1f5e02d01",
+        "rev": "5da4a26309e796daa7ffca72df93dbe53b8164c7",
         "type": "github"
       },
       "original": {
@@ -818,7 +868,7 @@
     },
     "nixtendo-switch": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": [
           "nixpkgs"
         ]
@@ -839,17 +889,17 @@
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1759136191,
-        "narHash": "sha256-1FhgEzYRwLWUWjm/csTr+OmzRVGgvlUDySqhFOyhPGM=",
+        "lastModified": 1760150127,
+        "narHash": "sha256-McDmxx/bruodgHLD4sFIl0fKkEkNj5VE3DglImfslrk=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "c7f19a28eaa25be9451bd48508eabf2b386fb72d",
+        "rev": "886a5646695563cbae3c1e10369c6070c7645e73",
         "type": "github"
       },
       "original": {
@@ -907,9 +957,27 @@
         "type": "github"
       }
     },
+    "qbit_manage": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1758160887,
+        "narHash": "sha256-cTxM3nHQQto7lpoNjShYcCbJCSYiwS9bKqw0DWAjw6A=",
+        "owner": "StuffAnThings",
+        "repo": "qbit_manage",
+        "rev": "21812368bc5366f3388dfb21769fee1da48083c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "StuffAnThings",
+        "repo": "qbit_manage",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "doom-emacs": "doom-emacs",
+        "flake-parts": "flake-parts",
+        "fonts": "fonts",
         "home-manager": "home-manager",
         "hyprland": "hyprland",
         "jawz-scripts": "jawz-scripts",
@@ -920,6 +988,7 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixtendo-switch": "nixtendo-switch",
         "nur": "nur",
+        "qbit_manage": "qbit_manage",
         "sops-nix": "sops-nix",
         "stylix": "stylix",
         "ucodenix": "ucodenix",
@@ -933,11 +1002,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759030640,
-        "narHash": "sha256-53VP3BqMXJqD1He1WADTFyUnpta3mie56H7nC59tSic=",
+        "lastModified": 1759635238,
+        "narHash": "sha256-UvzKi02LMFP74csFfwLPAZ0mrE7k6EiYaKecplyX9Qk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "9ac51832c70f2ff34fcc97b05fa74b4a78317f9e",
+        "rev": "6e5a38e08a2c31ae687504196a230ae00ea95133",
         "type": "github"
       },
       "original": {
@@ -953,7 +1022,7 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_5",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
@@ -967,11 +1036,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1759050585,
-        "narHash": "sha256-Mj99rGy+K9jaQ85U2YWydZ9OKCIAdkxClrJlfG04GxU=",
+        "lastModified": 1759596342,
+        "narHash": "sha256-1Eda1V8pjpviMdBTdDXrFp7jkaUokIgXgBYTZyzDODk=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "3f71498ed14405aea347b9f5b7f56d97e64e904c",
+        "rev": "4d065856e936fc6a99ba55d39ac2df9ded6bedbe",
         "type": "github"
       },
       "original": {
@@ -1176,17 +1245,18 @@
       "original": {
         "owner": "e-tho",
         "repo": "ucodenix",
+        "rev": "ba7f0a366460e0fbea9622fc770cb982be0e4720",
         "type": "github"
       }
     },
     "wallpapers": {
       "flake": false,
       "locked": {
-        "lastModified": 1759117171,
-        "narHash": "sha256-Oyp4MKcld+tlZISm2HvuRErgHUb2mztpOH6v3g8B9uA=",
+        "lastModified": 1759463031,
+        "narHash": "sha256-9goyp+g9N4+9PA9V2QerTsxlVy9MA4LXufJaruj2MMs=",
         "ref": "refs/heads/main",
-        "rev": "0bc27e282a4c13d43139c4794e80a5951e4787b8",
-        "revCount": 1,
+        "rev": "0212af5b70347f0721cfe88c25e1efb77b645a2d",
+        "revCount": 2,
         "type": "git",
         "url": "https://git.servidos.lat/jawz/wallpapers.git"
       },

flake.nix

@@ -1,22 +1,19 @@
 {
   description = "JawZ NixOS flake setup";
   inputs = {
+    flake-parts.url = "github:hercules-ci/flake-parts";
     nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-25.05";
     nixpkgs-small.url = "github:nixos/nixpkgs?ref=nixos-25.05-small";
     nixpkgs-unstable.url = "github:nixos/nixpkgs?ref=nixos-unstable";
-    ucodenix.url = "github:e-tho/ucodenix";
+    ucodenix.url = "github:e-tho/ucodenix/ba7f0a366460e0fbea9622fc770cb982be0e4720";
     doom-emacs = {
-      url = "github:marienz/nix-doom-emacs-unstraightened";
+      url = "github:marienz/nix-doom-emacs-unstraightened/ad01165af00765af07989b6ad14115960ac675f8";
       inputs.nixpkgs.follows = "";
     };
     jawz-scripts = {
       url = "git+https://git.servidos.lat/jawz/scripts.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    wallpapers = {
-      url = "git+https://git.servidos.lat/jawz/wallpapers.git";
-      flake = false;
-    };
     nur = {
       url = "github:nix-community/nur";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -49,78 +46,27 @@
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    wallpapers = {
+      url = "git+https://git.servidos.lat/jawz/wallpapers.git";
+      flake = false;
+    };
+    fonts = {
+      url = "git+https://git.servidos.lat/jawz/fonts.git";
+      flake = false;
+    };
+    qbit_manage = {
+      url = "github:StuffAnThings/qbit_manage";
+      flake = false;
+    };
   };
   outputs =
-    { self, jawz-scripts, ... }@inputs:
-    let
-      inherit (self) outputs;
-      system = "x86_64-linux";
-      mkpkgs =
-        repo:
-        import repo {
-          inherit system;
-          config.allowUnfree = true;
-        };
-      langList = builtins.filter (name: name != "emacs") (
-        builtins.map (file: builtins.replaceStrings [ ".nix" ] [ "" ] (baseNameOf file)) (
-          builtins.attrNames (builtins.readDir ./modules/dev)
-        )
-      );
-      commonModules = name: [
-        {
-          nixpkgs.overlays = [
-            (import ./config/overlay.nix { inherit mkpkgs inputs; })
-            inputs.doom-emacs.overlays.default
+    inputs:
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+      imports = [
+        ./parts/core.nix
+        ./parts/hosts.nix
+        ./parts/packages.nix
+        ./parts/devshells.nix
       ];
-        }
-        {
-          nix.registry = {
-            jawz.flake = self;
-            unstable.flake = inputs.nixpkgs-unstable;
-          };
-        }
-        ./hosts/${name}/configuration.nix
-        inputs.nur.modules.nixos.default
-        inputs.sops-nix.nixosModules.sops
-        inputs.stylix.nixosModules.stylix
-        inputs.nixtendo-switch.nixosModules.nixtendo-switch
-      ];
-      createConfig =
-        name: local-nixpkgs:
-        let
-          lib = local-nixpkgs.lib // inputs.home-manager.lib;
-        in
-        lib.nixosSystem {
-          inherit system;
-          specialArgs = {
-            inherit inputs outputs;
-          };
-          modules = commonModules name;
-        };
-    in
-    {
-      nixosConfigurations = {
-        workstation = createConfig "workstation" inputs.nixpkgs;
-        miniserver = createConfig "miniserver" inputs.nixpkgs-small;
-        server = createConfig "server" inputs.nixpkgs-small;
-        galaxy = createConfig "galaxy" inputs.nixpkgs-small;
-        emacs = createConfig "emacs" inputs.nixpkgs;
-      };
-      packages.${system} = (jawz-scripts.packages.${system} or { }) // {
-        emacs-vm = inputs.nixos-generators.nixosGenerate {
-          inherit system;
-          specialArgs = {
-            inherit inputs outputs;
-          };
-          modules = commonModules "emacs";
-          format = "vm";
-        };
-      };
-      devShells.${system} = builtins.listToAttrs (
-        map (name: {
-          inherit name;
-          value = self.nixosConfigurations.emacs.config.devShells.${name};
-        }) langList
-      );
     };
 }

hosts/server/toggles.nix

@@ -27,6 +27,7 @@ in
   services = enableList mkEnabled [
     "network"
     "nvidia"
+    "syncthing"
   ];
   dev = enableList mkEnabled [
     "nix"

hosts/workstation/configuration.nix

@@ -1,8 +1,10 @@
 {
   pkgs,
+  config,
   ...
 }:
 let
+  shellType = config.my.shell.type;
   krita-thumbnailer = pkgs.writeTextFile {
     name = "krita-thumbnailer";
     destination = "/share/thumbnailers/kra.thumbnailer";
@@ -33,12 +35,13 @@ in
     programs = {
       vscode = {
         enable = true;
-        package = pkgs.vscode;
+        package = pkgs.code-cursor-fhs;
       };
       ghostty = {
         enable = true;
         package = pkgs.ghostty;
-        enableBashIntegration = true;
+        enableBashIntegration = shellType == "bash";
+        enableZshIntegration = shellType == "zsh";
         installBatSyntax = true;
         installVimSyntax = true;
       };
@@ -46,25 +49,17 @@ in
   };
   networking = {
     hostName = "workstation";
-    firewall =
-      let
-        kdeconnectPortRange = {
+    firewall = {
+      allowedTCPPorts = [
+        6674 # ns-usbloader
+        8384 # syncthing
+      ];
+      allowedTCPPortRanges = [
+        {
           from = 1714;
           to = 1764;
-        };
-        ns-usbloaderPort = 6674;
-        syncthingPort = 8384;
-        openPorts = [
-          ns-usbloaderPort
-          syncthingPort
+        }
       ];
-        openPortRanges = [ kdeconnectPortRange ];
-      in
-      {
-        allowedTCPPorts = openPorts;
-        allowedUDPPorts = openPorts;
-        allowedTCPPortRanges = openPortRanges;
-        allowedUDPPortRanges = openPortRanges;
     };
   };
   users.users.jawz.packages = [
@@ -92,7 +87,6 @@ in
         bign-handheld-thumbnailer
         gnome-epub-thumbnailer
         podman-compose
-        code-cursor
         scrcpy
         ;
       inherit (pkgs.libheif) out;
@@ -132,6 +126,7 @@ in
   services = {
     flatpak.enable = true;
     open-webui.enable = true;
+    tailscale.enable = true;
     scx = {
       enable = true;
       scheduler = "scx_lavd";
@@ -151,10 +146,9 @@ in
     };
     sunshine = {
       enable = true;
-      autoStart = true;
+      autoStart = false;
       capSysAdmin = true;
       openFirewall = true;
     };
-    tailscale.enable = true;
   };
 }

hosts/workstation/hardware-configuration.nix

@@ -24,25 +24,18 @@ in
       cpuModelId = "00A50F00";
     };
   };
-  hardware = {
-    bluetooth = {
+  hardware.bluetooth = {
     enable = true;
     settings.General = {
       Enable = "Source,Sink,Media,Socket";
       Experimental = true;
     };
   };
-    opentabletdriver = {
-      enable = true;
-      daemon.enable = true;
-    };
-  };
   boot = {
     plymouth.enable = true;
     consoleLogLevel = 0;
-    loader.timeout = 0;
+    loader.timeout = 3;
     kernelParams = [
-      "quiet"
       "splash"
       "boot.shell_on_fail"
       "loglevel=3"
@@ -84,17 +77,11 @@ in
         "usb_storage"
         "sd_mod"
       ];
-      luks.devices =
-        let
-          decryptLuks = uuid: {
-            device = getUUID uuid;
+      luks.devices.nvme = {
+        device = getUUID "e9618e85-a631-4374-b2a4-22c376d6e41b";
         keyFile = "/keyfile";
         preLVM = true;
       };
-        in
-        {
-          nvme = decryptLuks "e9618e85-a631-4374-b2a4-22c376d6e41b";
-        };
     };
   };
   fileSystems =

hosts/workstation/toggles.nix

@@ -12,7 +12,6 @@ in
   servers.drpp.enable = true;
   apps = enableList mkEnabled [
     "art"
-    "piano"
     "dictionaries"
     "fonts"
     "gaming"
@@ -25,7 +24,6 @@ in
   dev = enableList mkEnabled [
     "nix"
     "python"
-    "gameDev"
     "sh"
   ];
   shell = enableList mkEnabled [
@@ -38,6 +36,7 @@ in
     "nvidia"
     "printing"
     "sound"
+    "syncthing"
   ];
   scripts = enableList mkEnabled [
     "tasks"

modules/apps/art.nix

@@ -24,7 +24,6 @@ let
       mypaint-brushes # but it's got some
       mypaint-brushes1 # nice damn brushes
       blender # cgi animation and sculpting
-      drawpile # arty party with friends!!
       pureref # create inspiration/reference boards
       ;
   };

modules/apps/fonts.nix

@@ -2,13 +2,30 @@
   config,
   lib,
   pkgs,
+  inputs,
   ...
 }:
+let
+  customFonts = pkgs.stdenvNoCC.mkDerivation {
+    name = "custom-fonts";
+    src = inputs.fonts;
+    installPhase = ''
+      mkdir -p $out/share/fonts
+      find $src -type f \( \
+        -name "*.ttf" -o \
+        -name "*.otf" -o \
+        -name "*.woff" -o \
+        -name "*.woff2" \
+      \) -exec cp {} $out/share/fonts/ \;
+    '';
+  };
+in
 {
   options.my.apps.fonts.enable = lib.mkEnableOption "additional fonts and typography";
   config = lib.mkIf config.my.apps.fonts.enable {
     nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "corefonts" ];
     fonts.packages = builtins.attrValues {
+      inherit customFonts;
       inherit (pkgs)
         symbola
         comic-neue

modules/apps/gaming.nix

@@ -5,6 +5,21 @@
   pkgs,
   ...
 }:
+let
+  retroarchWithCores = pkgs.retroarch.withCores (
+    cores:
+    builtins.attrValues {
+      inherit (cores)
+        mgba # gba
+        pcsx2 # ps2
+        dolphin # wii / gamecube
+        snes9x2010 # snes
+        desmume # nintendo ds
+        citra # 3ds
+        ;
+    }
+  );
+in
 {
   imports = [ inputs.nix-gaming.nixosModules.platformOptimizations ];
   options.my.apps = {
@@ -36,6 +51,7 @@
       # };
     };
     users.users.jawz.packages = builtins.attrValues {
+      inherit retroarchWithCores;
       inherit (pkgs)
         shipwright # zelda OoT port
         mangohud # fps & stats overlay
@@ -47,12 +63,8 @@
         ns-usbloader # load games into my switch
         # emulators
         rpcs3 # ps3
-        pcsx2 # ps2
         cemu # wii u
-        dolphin-emu # wii
-        snes9x-gtk # snes
         ryubing # switch
-        azahar # 3Ds
         prismlauncher # minecraft launcher with jdk overlays
         ;
     };

modules/apps/internet.nix

@@ -40,7 +40,6 @@ in
       inherit (pkgs)
         # thunderbird # email client
         warp # transfer files with based ppl
-        brave # crypto-browser that at least somewhat integrates with gtk
         nextcloud-client # self-hosted google-drive alternative
         fragments # beautiful torrent client
         tor-browser-bundle-bin # dark web, so dark!

modules/apps/librewolf.nix

@@ -7,6 +7,24 @@
   ];
   policies.DisabledFirefoxAccounts = false;
   profiles.jawz = {
+    containersForce = true;
+    containers = {
+      Private = {
+        id = 1;
+        icon = "chill";
+        color = "purple";
+      };
+      Work = {
+        id = 2;
+        icon = "briefcase";
+        color = "orange";
+      };
+      Banking = {
+        id = 3;
+        icon = "dollar";
+        color = "green";
+      };
+    };
     id = 0;
     name = "jawz";
     path = "jawz";
@@ -74,6 +92,9 @@
       "browser.safebrowsing.downloads.remote.block_uncommon" = false;
       # Enable anti-cookie tracking + purge trackers
       "privacy.annotate_channels.strict_list.enabled" = true;
+      # Enable Multi-Account Containers
+      "privacy.userContext.enabled" = true;
+      "privacy.userContext.ui.enabled" = true;
     };
   };
 }

modules/apps/misc.nix

@@ -9,7 +9,6 @@
   config = lib.mkIf config.my.apps.misc.enable {
     users.users.jawz.packages = builtins.attrValues {
       inherit (pkgs)
-        collector # stores things and throws them anywhere
         blanket # background noise
         metadata-cleaner # remove any metadata and geolocation from files
         pika-backup # backups

modules/apps/multimedia.nix

@@ -10,11 +10,9 @@
     users.users.jawz.packages = builtins.attrValues {
       inherit (pkgs)
         recordbox # libadwaita music player
-        pitivi # video editor
         celluloid # video player
         curtail # image compressor
         easyeffects # equalizer
-        handbrake # video converter, may be unnecessary
         identity # compare images or videos
         mousai # poor man shazam
         shortwave # listen to world radio

modules/dev/emacs.nix

@@ -1,5 +1,6 @@
 {
   config,
+  inputs,
   lib,
   pkgs,
   ...
@@ -14,7 +15,9 @@
         "doom/templates/programming.org".source = ../../dotfiles/doom/templates/programming.org;
       };
       services.lorri.enable = true;
-      programs.bash.shellAliases = {
+      programs.${config.my.shell.type}.shellAliases =
+        inputs.self.lib.mergeAliases inputs.self.lib.commonAliases
+          {
             edit = "emacsclient -t";
             e = "edit";
           };

modules/dev/nix.nix

@@ -1,15 +1,18 @@
 {
   config,
+  inputs,
   lib,
   pkgs,
   ...
 }:
 let
+  shellType = config.my.shell.type;
   packages = builtins.attrValues {
     inherit (pkgs)
       nixfmt-rfc-style # formatting
       cachix # binary cache management
       nixd # language server for Nix
+      deadnix # detext unused/uneeded dependencies
       statix # linter for Nix expressions
       ;
   };
@@ -31,5 +34,14 @@ in
   };
   config = lib.mkIf config.my.dev.nix.enable {
     users.users.jawz = { inherit packages; };
+    home-manager.users.jawz.programs.${shellType}.shellAliases =
+      inputs.self.lib.mergeAliases inputs.self.lib.commonAliases
+        {
+          nixformat = ''
+            deadnix -e && \
+            nix run nixpkgs#nixfmt-tree && \
+            statix fix
+          '';
+        };
   };
 }

modules/modules.nix

@@ -1,22 +1,21 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   filterNames = file: file != "librewolf.nix";
-  autoImport =
-    dir:
-    builtins.readDir ./${dir}
-    |> builtins.attrNames
-    |> builtins.filter (file: builtins.match ".*\\.nix" file != null && filterNames file)
-    |> map (file: ./${dir}/${file});
 in
 {
   imports =
-    autoImport "apps"
-    ++ autoImport "dev"
-    ++ autoImport "scripts"
-    ++ autoImport "servers"
-    ++ autoImport "services"
-    ++ autoImport "shell"
-    ++ autoImport "network"
+    inputs.self.lib.autoImport ./apps filterNames
+    ++ inputs.self.lib.autoImport ./dev filterNames
+    ++ inputs.self.lib.autoImport ./scripts filterNames
+    ++ inputs.self.lib.autoImport ./servers filterNames
+    ++ inputs.self.lib.autoImport ./services filterNames
+    ++ inputs.self.lib.autoImport ./shell filterNames
+    ++ inputs.self.lib.autoImport ./network filterNames
     ++ [
       ./nix/build.nix
       ./users/nixremote.nix
@@ -93,7 +92,7 @@ in
     };
     email = lib.mkOption {
       type = lib.types.str;
-      default = "CaptainJawZ@protonmail.com";
+      default = "danilo.reyes.251@proton.me";
       description = "localhost smtp email";
     };
     timeZone = lib.mkOption {

modules/network/firewall.nix

@@ -1,18 +1,23 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
-  nativeServicesWithOpenFirewall = [
-    "adguardhome"
-    "plex"
-    "nix-serve"
-    "radarr"
-    "sonarr"
-    "jellyfin"
-    "prowlarr"
-    "bazarr"
-    "stash"
-    "ombi"
-    "flaresolverr"
+  firewallBlacklist = [
+    "lidarr"
+    "maloja"
+    "tranga"
+    "flame"
+    "flameSecret"
+    "ryot"
+    "drpp"
+    "metube"
+    "multi-scrobbler"
+    "plex-discord-bot"
   ];
+  nativeServicesWithOpenFirewall = inputs.self.lib.getServicesWithNativeFirewall config firewallBlacklist;
   servicesConfig = lib.listToAttrs (
     map (serviceName: {
       name = serviceName;
@@ -37,17 +42,7 @@ in
   config = lib.mkIf config.my.network.firewall.enabledServicePorts {
     services = servicesConfig;
     networking.firewall.allowedTCPPorts =
-      config.my.network.firewall.staticPorts
-      ++ config.my.network.firewall.additionalPorts
-      ++ (
-        config.my.servers
-        |> lib.filterAttrs (
-          name: srv:
-          (srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServicesWithOpenFirewall)
-        )
-        |> lib.attrValues
-        |> map (srv: srv.port)
-      )
+      inputs.self.lib.generateFirewallPorts config nativeServicesWithOpenFirewall lib
       ++ (lib.optionals config.services.nginx.enable [
         config.services.nginx.defaultHTTPListenPort
         config.services.nginx.defaultSSLListenPort

modules/network/nginx.nix

@@ -1,6 +1,10 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   proxyReverseServices = [
     "firefox-syncserver"
     "readeck"
@@ -44,11 +48,11 @@ let
       cfg = config.my.servers.${serviceName};
       proxyFunc =
         if serviceConfig.type == "proxyReverse" then
-          setup.proxyReverse
+          inputs.self.lib.proxyReverse
         else if serviceConfig.type == "proxyReverseFix" then
-          setup.proxyReverseFix
+          inputs.self.lib.proxyReverseFix
         else if serviceConfig.type == "proxyReversePrivate" then
-          setup.proxyReversePrivate
+          inputs.self.lib.proxyReversePrivate
         else
           throw "Unknown proxy type: ${serviceConfig.type}";
     in

modules/scripts/download.nix

@@ -16,21 +16,27 @@
       inherit (inputs.jawz-scripts.packages.x86_64-linux) download;
     in
     {
-      home-manager.users.jawz = {
-        programs.bash = {
-          shellAliases = {
+      home-manager.users.jawz.programs.${config.my.shell.type} = {
+        shellAliases = inputs.self.lib.mergeAliases inputs.self.lib.commonAliases {
           dl = "${download}/bin/download -u jawz -i";
           comic = ''dl "$(cat "$LC" | fzf --multi --exact -i)"'';
           gallery = ''dl "$(cat "$LW" | fzf --multi --exact -i)"'';
         };
-          initExtra = ''
+      }
+      //
+        inputs.self.lib.shellConditional config.my.shell.type
+          ''
+            list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
+            export LW=$list_root/watch.txt
+            export LI=$list_root/instant.txt
+            export LC=$list_root/comic.txt
+          ''
+          ''
             list_root=$XDG_CONFIG_HOME/jawz/lists/jawz
             export LW=$list_root/watch.txt
             export LI=$list_root/instant.txt
             export LC=$list_root/comic.txt
           '';
-        };
-      };
       systemd.user = {
         services =
           let

modules/servers/atticd.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.atticd;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.atticd = setup.mkOptions "atticd" "cache" 2343;
+  options.my.servers.atticd = inputs.self.lib.mkServerOptions "atticd" "cache" 2343 lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets."private_cache_keys/atticd".sopsFile = ../../secrets/keys.yaml;
     services.atticd = {

modules/servers/audiobookshelf.nix

@@ -1,10 +1,16 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.audiobookshelf;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.audiobookshelf = setup.mkOptions "audiobookshelf" "audiobooks" 5687;
+  options.my.servers.audiobookshelf =
+    inputs.self.lib.mkServerOptions "audiobookshelf" "audiobooks" 5687
+      lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     my.servers.audiobookshelf.enableSocket = true;
     services.audiobookshelf = {

modules/servers/bazarr.nix

@@ -1,10 +1,16 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.bazarr;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.bazarr = setup.mkOptions "bazarr" "subs" config.services.bazarr.listenPort;
+  options.my.servers.bazarr =
+    inputs.self.lib.mkServerOptions "bazarr" "subs" config.services.bazarr.listenPort
+      lib;
   config.services.bazarr = lib.mkIf cfg.enable {
     inherit (cfg) enable;
     group = "piracy";

modules/servers/drpp.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.drpp;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.drpp = setup.mkOptions "drpp" "drpp" 0;
+  options.my.servers.drpp = inputs.self.lib.mkServerOptions "drpp" "drpp" 0 lib;
   config.virtualisation.oci-containers.containers.drpp = lib.mkIf cfg.enable {
     image = "ghcr.io/phin05/discord-rich-presence-plex:latest";
     environment = {

modules/servers/firefox-syncserver.nix

@@ -1,10 +1,16 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.firefox-syncserver;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.firefox-syncserver = setup.mkOptions "firefox-syncserver" "sync" 4233;
+  options.my.servers.firefox-syncserver =
+    inputs.self.lib.mkServerOptions "firefox-syncserver" "sync" 4233
+      lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     # sops.secrets.firefox-syncserver.sopsFile = ../../secrets/env.yaml;
     services.firefox-syncserver = {

modules/servers/flame.nix

@@ -1,14 +1,18 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.flame;
   cfgS = config.my.servers.flameSecret;
   enable = (cfg.enable || cfgS.enable) && config.my.secureHost;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers = {
-    flame = setup.mkOptions "flame" "start" 5005;
-    flameSecret = setup.mkOptions "flameSecret" "qampqwn4wprhqny8h8zj" 5007;
+    flame = inputs.self.lib.mkServerOptions "flame" "start" 5005 lib;
+    flameSecret = inputs.self.lib.mkServerOptions "flameSecret" "qampqwn4wprhqny8h8zj" 5007 lib;
   };
   config = lib.mkIf enable {
     sops.secrets = {

modules/servers/gitea.nix

@@ -1,19 +1,19 @@
 {
   lib,
   config,
+  inputs,
   pkgs,
   ...
 }:
 let
   cfg = config.my.servers.gitea;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   imports = [
     ../nix/gitea-actions-runners/ryujinx.nix
     ../nix/gitea-actions-runners/nixos.nix
   ];
-  options.my.servers.gitea = setup.mkOptions "gitea" "git" 9083;
+  options.my.servers.gitea = inputs.self.lib.mkServerOptions "gitea" "git" 9083 lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.gitea.sopsFile = ../../secrets/env.yaml;
     services.gitea = {

modules/servers/homepage.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.homepage;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.homepage = setup.mkOptions "homepage" "home" 8082;
+  options.my.servers.homepage = inputs.self.lib.mkServerOptions "homepage" "home" 8082 lib;
   config = lib.mkIf config.my.secureHost {
     sops.secrets = lib.mkIf cfg.enable {
       homepage.sopsFile = ../../secrets/homepage.yaml;

modules/servers/jellyfin.nix

@@ -19,10 +19,9 @@ let
     pkgs.gum
     sub-sync
   ];
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.jellyfin = setup.mkOptions "jellyfin" "flix" 8096;
+  options.my.servers.jellyfin = inputs.self.lib.mkServerOptions "jellyfin" "flix" 8096 lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     environment.systemPackages = [
       pkgs.jellyfin-ffmpeg

modules/servers/kavita.nix

@@ -1,10 +1,16 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.kavita;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.kavita = setup.mkOptions "kavita" "library" config.services.kavita.settings.Port;
+  options.my.servers.kavita =
+    inputs.self.lib.mkServerOptions "kavita" "library" config.services.kavita.settings.Port
+      lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.kavita-token = {
       owner = config.users.users.kavita.name;

modules/servers/lidarr.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.lidarr;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;
+  options.my.servers.lidarr = inputs.self.lib.mkServerOptions "lidarr" "music" 8686 lib;
   config.virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
     autoStart = true;
     image = "linuxserver/lidarr:version-2.13.3.4711";

modules/servers/maloja.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.maloja;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.maloja = setup.mkOptions "maloja" "maloja" 42010;
+  options.my.servers.maloja = inputs.self.lib.mkServerOptions "maloja" "maloja" 42010 lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.maloja.sopsFile = ../../secrets/env.yaml;
     virtualisation.oci-containers.containers.maloja = {

modules/servers/mealie.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.mealie;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.mealie = setup.mkOptions "mealie" "mealie" 9925;
+  options.my.servers.mealie = inputs.self.lib.mkServerOptions "mealie" "mealie" 9925 lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.mealie.sopsFile = ../../secrets/env.yaml;
     services.mealie = {

modules/servers/metube.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.metube;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;
+  options.my.servers.metube = inputs.self.lib.mkServerOptions "metube" "bajameesta" 8881 lib;
   config.virtualisation.oci-containers.containers.metube = lib.mkIf cfg.enable {
     image = "ghcr.io/alexta69/metube:latest";
     ports = [ "${toString cfg.port}:8081" ];

modules/servers/microbin.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.microbin;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.microbin = setup.mkOptions "microbin" "copy" 8086;
+  options.my.servers.microbin = inputs.self.lib.mkServerOptions "microbin" "copy" 8086 lib;
   config.services.microbin = lib.mkIf (cfg.enable && config.my.secureHost) {
     inherit (cfg) enable;
     settings = {

modules/servers/multi-scrobbler.nix

@@ -1,10 +1,16 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.multi-scrobbler;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.multi-scrobbler = setup.mkOptions "multi-scrobbler" "scrobble" 9078;
+  options.my.servers.multi-scrobbler =
+    inputs.self.lib.mkServerOptions "multi-scrobbler" "scrobble" 9078
+      lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.multi-scrobbler.sopsFile = ../../secrets/env.yaml;
     virtualisation.oci-containers.containers.multi-scrobbler = {

modules/servers/nextcloud.nix

@@ -31,12 +31,11 @@ let
   pytensorflow = pkgs.python311.withPackages (ps: [ ps.tensorflow ]);
   cfg = config.my.servers.nextcloud;
   cfgC = config.my.servers.collabora;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
   options.my.servers = {
-    nextcloud = setup.mkOptions "nextcloud" "cloud" 80;
-    collabora = setup.mkOptions "collabora" "collabora" 9980;
+    nextcloud = inputs.self.lib.mkServerOptions "nextcloud" "cloud" 80 lib;
+    collabora = inputs.self.lib.mkServerOptions "collabora" "collabora" 9980 lib;
     go-vod.enable = lib.mkEnableOption "Go-VOD video transcoding service";
   };
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {

modules/servers/nix-serve.nix

@@ -1,15 +1,15 @@
 {
   lib,
+  inputs,
   config,
   pkgs,
   ...
 }:
 let
   cfg = config.my.servers.nix-serve;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.nix-serve = setup.mkOptions "nix-serve" "cache" 5000;
+  options.my.servers.nix-serve = inputs.self.lib.mkServerOptions "nix-serve" "cache" 5000 lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets."private_cache_keys/miniserver".sopsFile = ../../secrets/keys.yaml;
     services.nix-serve = {

modules/servers/ombi.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.ombi;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.ombi = setup.mkOptions "ombi" "requests" 3425;
+  options.my.servers.ombi = inputs.self.lib.mkServerOptions "ombi" "requests" 3425 lib;
   config.services.ombi = lib.mkIf cfg.enable {
     inherit (cfg) enable port;
   };

modules/servers/plex-discord-bot.nix

@@ -1,11 +1,15 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.plex-discord-bot;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   name = "plex-discord-bot";
 in
 {
-  options.my.servers.plex-discord-bot = setup.mkOptions name name 0;
+  options.my.servers.plex-discord-bot = inputs.self.lib.mkServerOptions name name 0 lib;
   config.virtualisation.oci-containers.containers.plex-discord-bot = lib.mkIf cfg.enable {
     image = "ghcr.io/phin05/discord-rich-presence-plex:latest";
     environment = {

modules/servers/plex.nix

@@ -1,14 +1,14 @@
 {
   lib,
+  inputs,
   config,
   ...
 }:
 let
   cfg = config.my.servers.plex;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.plex = setup.mkOptions "plex" "plex" 32400;
+  options.my.servers.plex = inputs.self.lib.mkServerOptions "plex" "plex" 32400 lib;
   config.services = lib.mkIf (cfg.enable && config.my.secureHost) {
     plex = {
       inherit (cfg) enable;

modules/servers/portfolio.nix

@@ -1,14 +1,14 @@
 {
   config,
   lib,
+  inputs,
   ...
 }:
 let
   cfg = config.my.websites.portfolio;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.websites.portfolio = setup.mkOptions "portfolio" "portfolio" 0;
+  options.my.websites.portfolio = inputs.self.lib.mkServerOptions "portfolio" "portfolio" 0 lib;
   config.services.nginx.virtualHosts."danilo-reyes.com" = lib.mkIf cfg.enableProxy {
     forceSSL = true;
     enableACME = true;

modules/servers/prowlarr.nix

@@ -1,14 +1,14 @@
 {
   lib,
+  inputs,
   config,
   ...
 }:
 let
   cfg = config.my.servers.prowlarr;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.prowlarr = setup.mkOptions "prowlarr" "indexer" 9696;
+  options.my.servers.prowlarr = inputs.self.lib.mkServerOptions "prowlarr" "indexer" 9696 lib;
   config = lib.mkIf cfg.enable {
     users.users.prowlarr = {
       group = "piracy";

modules/servers/qbittorrent.nix

@@ -6,6 +6,7 @@
   ...
 }:
 let
+  inherit (inputs) qbit_manage;
   pkgsU = import inputs.nixpkgs-unstable {
     system = "x86_64-linux";
     config.allowUnfree = true;
@@ -49,14 +50,7 @@ in
     };
   };
   config = lib.mkIf (config.my.servers.qbittorrent.enable && config.my.secureHost) {
-    home-manager.users.jawz = {
-      xdg = {
-        dataFile.vuetorrent.source = vuetorrent;
-        configFile."unpackerr.conf" = lib.mkIf config.my.servers.unpackerr.enable {
-          source = ../../dotfiles/unpackerr.conf;
-        };
-      };
-    };
+    home-manager.users.jawz.xdg.dataFile.vuetorrent.source = vuetorrent;
     sops.secrets =
       let
         mkQbitSecret = file: mode: {
@@ -66,34 +60,34 @@ in
           owner = config.users.users.jawz.name;
           path = "/home/jawz/.config/qBittorrent/ssl/${file}";
         };
+        mkUnpackerrSecret = {
+          sopsFile = ../../secrets/secrets.yaml;
+          owner = config.users.users.jawz.name;
+        };
       in
       {
         "certificates/qbit_cert" = mkQbitSecret "server.crt" "0644";
         "certificates/qbit_key" = mkQbitSecret "server.key" "0600";
+        "unpackerr/sonarr-api" = mkUnpackerrSecret;
+        "unpackerr/radarr-api" = mkUnpackerrSecret;
       };
     systemd = {
       packages = [ pkgs.qbittorrent-nox ];
-      services = {
-        "qbittorrent-nox@jawz" = {
+      services."qbittorrent-nox@jawz" = {
         enable = true;
         overrideStrategy = "asDropin";
         wantedBy = [ "multi-user.target" ];
       };
-      };
       user = {
         services = {
           qbit_manage = {
             restartIfChanged = true;
             description = "Tidy up my torrents";
             wantedBy = [ "default.target" ];
-            serviceConfig =
-              let
-                env = "/home/jawz/Development/Git/qbit_manage";
-              in
-              {
+            serviceConfig = {
               Restart = "on-failure";
               RestartSec = 30;
-                ExecStart = "${qbit_manageEnv}/bin/python ${env}/qbit_manage.py -r -c ${env}/config.yml";
+              ExecStart = "${qbit_manageEnv}/bin/python ${qbit_manage}/qbit_manage.py -r -c /home/jawz/.config/qbit_manage/config.yml";
             };
           };
           unpackerr = lib.mkIf config.my.servers.unpackerr.enable {
@@ -101,12 +95,20 @@ in
             restartIfChanged = true;
             description = "Run unpackerr";
             wantedBy = [ "default.target" ];
+            environment = {
+              UN_FILE_MODE = "0664";
+              UN_DIR_MODE = "0775";
+              UN_SONARR_0_URL = config.my.servers.sonarr.local;
+              UN_SONARR_0_API_KEY = "filepath:${config.sops.secrets."unpackerr/sonarr-api".path}";
+              UN_SONARR_0_PATHS = "/srv/pool/multimedia/downloads/torrent";
+              UN_RADARR_0_URL = config.my.servers.radarr.local;
+              UN_RADARR_0_API_KEY = "filepath:${config.sops.secrets."unpackerr/radarr-api".path}";
+              UN_RADARR_0_PATHS = "/srv/pool/multimedia/downloads/torrent";
+            };
             serviceConfig = {
               Restart = "on-failure";
               RestartSec = 30;
-              ExecStart = ''
-                ${pkgs.unpackerr}/bin/unpackerr \
-                -c /home/jawz/.config/unpackerr.conf'';
+              ExecStart = "${pkgs.unpackerr}/bin/unpackerr";
             };
           };
         };
@@ -118,17 +120,5 @@ in
         };
       };
     };
-    networking.firewall =
-      let
-        ports = [
-          51411
-          51412
-          51413
-        ];
-      in
-      {
-        allowedTCPPorts = ports ++ [ config.my.servers.qbittorrent.port ];
-        allowedUDPPorts = ports;
-      };
   };
 }

modules/servers/radarr.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.radarr;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.radarr = setup.mkOptions "radarr" "movies" 7878;
+  options.my.servers.radarr = inputs.self.lib.mkServerOptions "radarr" "movies" 7878 lib;
   config = lib.mkIf cfg.enable {
     services.radarr = {
       inherit (cfg) enable;

modules/servers/readeck.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.readeck;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.readeck = setup.mkOptions "readeck" "laters" 9546;
+  options.my.servers.readeck = inputs.self.lib.mkServerOptions "readeck" "laters" 9546 lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.readeck.sopsFile = ../../secrets/env.yaml;
     services.readeck = {

modules/servers/ryot.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.ryot;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.ryot = setup.mkOptions "ryot" "tracker" 8765;
+  options.my.servers.ryot = inputs.self.lib.mkServerOptions "ryot" "tracker" 8765 lib;
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
     sops.secrets.ryot.sopsFile = ../../secrets/env.yaml;
     virtualisation.oci-containers.containers.ryot = {

modules/servers/shiori.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.shiori;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.shiori = setup.mkOptions "shiori" "bookmarks" 4368;
+  options.my.servers.shiori = inputs.self.lib.mkServerOptions "shiori" "bookmarks" 4368 lib;
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
     sops.secrets.shiori.sopsFile = ../../secrets/env.yaml;
     services.shiori = {

modules/servers/sonarr.nix

@@ -1,10 +1,14 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 let
   cfg = config.my.servers.sonarr;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.sonarr = setup.mkOptions "sonarr" "series" 8989;
+  options.my.servers.sonarr = inputs.self.lib.mkServerOptions "sonarr" "series" 8989 lib;
   config.services.sonarr = lib.mkIf cfg.enable {
     inherit (cfg) enable;
     group = "piracy";

modules/servers/stash.nix

@@ -1,15 +1,39 @@
-{ lib, config, ... }:
+{
+  lib,
+  inputs,
+  config,
+  pkgs,
+  ...
+}:
 let
   cfg = config.my.servers.stash;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
+  cfgS = config.services.stash;
+  stashPythonFHS = pkgs.buildFHSEnv {
+    name = "stash-python-fhs";
+    targetPkgs =
+      pkgs:
+      builtins.attrValues {
+        inherit (pkgs)
+          python3
+          gcc
+          glibc
+          ;
+        inherit (pkgs.python3Packages)
+          pip
+          virtualenv
+          ;
+        inherit (pkgs.stdenv.cc.cc) lib;
+      };
+    runScript = "bash";
+  };
 in
 {
-  options.my.servers.stash = setup.mkOptions "stash" "xxx" 9999;
+  options.my.servers.stash = inputs.self.lib.mkServerOptions "stash" "xxx" 9999 lib;
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets = {
-      "stash/password".sopsFile = ../../secrets/env.yaml;
-      "stash/jwt".sopsFile = ../../secrets/env.yaml;
-      "stash/session".sopsFile = ../../secrets/env.yaml;
+      "stash/password".sopsFile = ../../secrets/secrets.yaml;
+      "stash/jwt".sopsFile = ../../secrets/secrets.yaml;
+      "stash/session".sopsFile = ../../secrets/secrets.yaml;
     };
     services.stash = {
       inherit (cfg) enable;
@@ -29,5 +53,19 @@ in
         ];
       };
     };
+    systemd.services.stash = {
+      environment = {
+        PYTHONPATH = "/var/lib/stash/venv/lib/python3.12/site-packages";
+        LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib:${pkgs.glibc}/lib:${pkgs.zlib}/lib:${pkgs.libffi}/lib:${pkgs.openssl}/lib";
+      };
+      serviceConfig = {
+        BindReadOnlyPaths = lib.mkForce [ ];
+        BindPaths = lib.mkIf (cfgS.settings != { }) (map (stash: "${stash.path}") cfgS.settings.stash);
+      };
+    };
+    users.users.stash = {
+      isSystemUser = true;
+      packages = [ stashPythonFHS ];
+    };
   };
 }

modules/servers/synapse.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  inputs,
   config,
   pkgs,
   ...
@@ -8,7 +9,6 @@ let
   cfg = config.my.servers.synapse;
   cfgE = config.my.servers.element;
   domain = "wedsgk5ac2qcaf9yb.click";
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   clientConfig."m.homeserver".base_url = cfg.url;
   serverConfig."m.server" = "${cfg.host}:443";
   mkWellKnown = data: ''
@@ -19,8 +19,8 @@ let
 in
 {
   options.my.servers = {
-    synapse = setup.mkOptions "synapse" "pYLemuAfsrzNBaH77xSu" 8008;
-    element = setup.mkOptions "element" "55a608953f6d64c199" 5345;
+    synapse = inputs.self.lib.mkServerOptions "synapse" "pYLemuAfsrzNBaH77xSu" 8008 lib;
+    element = inputs.self.lib.mkServerOptions "element" "55a608953f6d64c199" 5345 lib;
   };
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     my.servers = {

modules/servers/tranga.nix

@@ -1,10 +1,14 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
 let
-  setup = import ../factories/mkserver.nix { inherit lib config; };
   cfg = config.my.servers.tranga;
 in
 {
-  options.my.servers.tranga = setup.mkOptions "tranga" "tranga" 9555;
+  options.my.servers.tranga = inputs.self.lib.mkServerOptions "tranga" "tranga" 9555 lib;
   config = lib.mkIf cfg.enable {
     virtualisation.oci-containers.containers = {
       tranga-api = {

modules/servers/vaultwarden.nix

@@ -1,15 +1,15 @@
 {
   lib,
+  inputs,
   config,
   pkgs,
   ...
 }:
 let
   cfg = config.my.servers.vaultwarden;
-  setup = import ../factories/mkserver.nix { inherit lib config; };
 in
 {
-  options.my.servers.vaultwarden = setup.mkOptions "vaultwarden" "vault" 8222;
+  options.my.servers.vaultwarden = inputs.self.lib.mkServerOptions "vaultwarden" "vault" 8222 lib;
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
     sops.secrets.vaultwarden.sopsFile = ../../secrets/env.yaml;
     services.vaultwarden = {

modules/services/syncthing.nix

@@ -0,0 +1,120 @@
+{ config, lib, ... }:
+let
+  inherit (config.networking) hostName;
+  isMainHost = hostName == "workstation";
+  mkMobile =
+    path:
+    lib.mkIf isMainHost {
+      inherit path;
+      ignorePerms = false;
+      devices = [
+        "galaxy"
+        "phone"
+      ];
+    };
+in
+{
+  options.my.services.syncthing.enable = lib.mkEnableOption "Syncthing file synchronization";
+  config = lib.mkIf (config.my.services.syncthing.enable && config.my.secureHost) {
+    sops.secrets = {
+      "syncthing_keys/${hostName}" = {
+        sopsFile = ../../secrets/keys.yaml;
+        owner = config.users.users.jawz.name;
+        inherit (config.users.users.jawz) group;
+        path = "/home/jawz/.config/syncthing/key.pem";
+      };
+      "syncthing_certs/${hostName}" = {
+        sopsFile = ../../secrets/keys.yaml;
+        owner = config.users.users.jawz.name;
+        inherit (config.users.users.jawz) group;
+        path = "/home/jawz/.config/syncthing/cert.pem";
+      };
+      "syncthing_password" = {
+        sopsFile = ../../secrets/keys.yaml;
+      };
+    };
+    services.syncthing = {
+      enable = true;
+      user = "jawz";
+      group = "users";
+      overrideDevices = true;
+      overrideFolders = true;
+      openDefaultPorts = true;
+      key = config.sops.secrets."syncthing_keys/${hostName}".path;
+      cert = config.sops.secrets."syncthing_certs/${hostName}".path;
+      guiAddress = "${config.my.ips."${hostName}"}:8384";
+      settings = {
+        options = {
+          natEnabled = false;
+          relaysEnabled = false;
+          globalAnnounceEnabled = false;
+        };
+        gui = {
+          user = "jawz";
+          password = config.sops.secrets.syncthing_password.path;
+        };
+        devices = {
+          server.id = "BG6PF7S-KATABWO-7WAZFMX-6YO7IS3-WQTMR3M-VSOSV7V-HFFMNNH-BFX2EQ4";
+          miniserver.id = "HDYEGIR-GFU7ONK-MOOJUFH-N3L3XHX-SXWN3FI-O23K6LD-BJENQK5-VIPV2AT";
+          workstation.id = "4E4KJ6M-MSTNBVF-D7CNHDW-DUTB3VR-SXKZ4NH-ZKAOMF5-V24JECJ-4STSZAA";
+          galaxy.id = "UAZ5YDV-YUFBXOY-QMS6S6R-WPIIKZI-4OPPW5L-G4OVUPO-YW5KFYY-YASRAAV";
+          phone.id = "OSOX2VZ-AO2SA3C-BFB6NKF-K6CR6WX-64TDBKW-RRKEKJ4-FKZE5CV-J2RGJAJ";
+          wg-friend1 = {
+            id = "XBIYCD4-EFKS5SK-WFF73CU-P37GXVH-OMWEIA4-6KC5F3L-U5UQWSF-SYNNRQF";
+            addresses = [ "tcp://${config.my.ips.wg-friend1}:22000" ];
+            introducer = false;
+            autoAcceptFolders = false;
+            paused = false;
+          };
+        };
+        folders = {
+          cache = mkMobile "~/Downloads/cache/";
+          friends = mkMobile "~/Pictures/artist/friends/";
+          forme = mkMobile "~/Pictures/art for me/";
+          comfy = mkMobile "~/Development/AI/ComfyUI/output/";
+          gdl = {
+            path = "~/.config/jawz/";
+            ignorePerms = false;
+            devices = [
+              "server"
+              "miniserver"
+              "workstation"
+            ];
+          };
+          librewolf = {
+            path = "~/.librewolf/";
+            ignorePerms = false;
+            copyOwnershipFromParent = true;
+            type = if isMainHost then "sendonly" else "receiveonly";
+            devices = [
+              "server"
+              "miniserver"
+              "workstation"
+            ];
+          };
+          notes = {
+            path = "~/Documents/Notes";
+            ignorePerms = false;
+            devices = [
+              "galaxy"
+              "phone"
+              "server"
+              "miniserver"
+              "workstation"
+            ];
+          };
+          friend_share = {
+            path = "~/Pictures/encrypted/friends";
+            ignorePerms = false;
+            type = "sendreceive";
+            devices = [
+              "server"
+              "workstation"
+              "wg-friend1"
+            ];
+          };
+        };
+      };
+    };
+  };
+}

modules/shell/config.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.my.shell.type = lib.mkOption {
+    type = lib.types.enum [
+      "bash"
+      "zsh"
+    ];
+    default = "bash";
+    description = "The shell to use system-wide (bash or zsh)";
+  };
+  config = {
+    users.users.jawz.shell = pkgs.${config.my.shell.type};
+    programs.zsh.enable = config.my.shell.type == "zsh";
+  };
+}

modules/shell/multimedia.nix

@@ -7,6 +7,11 @@
 {
   options.my.shell.multimedia.enable = lib.mkEnableOption "multimedia CLI tools and codecs";
   config = lib.mkIf config.my.shell.multimedia.enable {
+    sops.secrets."gallery-dl/secrets" = {
+      sopsFile = ../../secrets/gallery.yaml;
+      owner = "jawz";
+      mode = "0400";
+    };
     home-manager.users.jawz.programs = {
       yt-dlp = {
         enable = true;
@@ -21,6 +26,15 @@
         enable = true;
         settings = import ../../dotfiles/gallery-dl.nix;
       };
+      ${config.my.shell.type} = {
+        initExtra = lib.mkAfter ''
+          if [ -r "${config.sops.secrets."gallery-dl/secrets".path}" ]; then
+            set -a  # automatically export all variables
+            source "${config.sops.secrets."gallery-dl/secrets".path}"
+            set +a  # stop automatically exporting
+          fi
+        '';
+      };
     };
     users.users.jawz.packages = builtins.attrValues {
       inherit (pkgs)

modules/shell/tools.nix

@@ -5,6 +5,9 @@
   inputs,
   ...
 }:
+let
+  shellType = config.my.shell.type;
+in
 {
   options.my.shell.tools.enable = lib.mkEnableOption "shell tools and utilities";
   config = lib.mkIf config.my.shell.tools.enable {
@@ -14,29 +17,15 @@
         enable = true;
         package = pkgs.htop-vim;
       };
+      eza = {
+        enable = true;
+        git = true;
+        icons = "auto";
+      };
       zoxide = {
         enable = true;
-        enableBashIntegration = true;
-      };
-      bash = {
-        initExtra = ''
-          if command -v fzf-share >/dev/null; then
-          source "$(fzf-share)/key-bindings.bash"
-          source "$(fzf-share)/completion.bash"
-          fi
-        '';
-        shellAliases = {
-          cd = "z";
-          hh = "hstr";
-          ls = "eza --icons --group-directories-first";
-          rm = "trash";
-          b = "bat";
-          f = "fzf --multi --exact -i";
-          unique-extensions = ''
-            fd -tf | rev | cut -d. -f1 | rev |
-            tr '[:upper:]' '[:lower:]' | sort |
-            uniq --count | sort -rn'';
-        };
+        enableBashIntegration = shellType == "bash";
+        enableZshIntegration = shellType == "zsh";
       };
       bat = {
         enable = true;
@@ -67,6 +56,34 @@
           PASSWORD_STORE_SAFECONTENT = "true";
         };
       };
+      ${shellType} = {
+        shellAliases = inputs.self.lib.mergeAliases inputs.self.lib.commonAliases {
+          cd = "z";
+          hh = "hstr";
+          ls = "eza --icons --group-directories-first";
+          rm = "trash";
+          b = "bat";
+          f = "fzf --multi --exact -i";
+          unique-extensions = ''
+            fd -tf | rev | cut -d. -f1 | rev |
+            tr '[:upper:]' '[:lower:]' | sort |
+            uniq --count | sort -rn'';
+        };
+      }
+      //
+        inputs.self.lib.shellConditional shellType
+          ''
+            if command -v fzf-share >/dev/null; then
+            source "$(fzf-share)/key-bindings.bash"
+            source "$(fzf-share)/completion.bash"
+            fi
+          ''
+          ''
+            if command -v fzf-share >/dev/null; then
+            source "$(fzf-share)/key-bindings.bash"
+            source "$(fzf-share)/completion.bash"
+            fi
+          '';
     };
     programs = {
       starship.enable = true;
@@ -81,7 +98,6 @@
       inherit (pkgs)
         ripgrep # modern grep
         du-dust # rusty du similar to gdu
-        eza # like ls but with colors
         fd # modern find, faster searches
         fzf # fuzzy finder! super cool and useful
         gdu # disk-space utility checker, somewhat useful

parts/core.nix

@@ -0,0 +1,224 @@
+{ inputs, ... }:
+let
+  system = "x86_64-linux";
+  mkpkgs =
+    repo:
+    import repo {
+      inherit system;
+      config.allowUnfree = true;
+    };
+in
+{
+  systems = [ system ];
+  flake = {
+    lib = {
+      commonModules = name: [
+        ../hosts/${name}/configuration.nix
+        inputs.nur.modules.nixos.default
+        inputs.sops-nix.nixosModules.sops
+        inputs.stylix.nixosModules.stylix
+        inputs.nixtendo-switch.nixosModules.nixtendo-switch
+        {
+          nixpkgs.overlays = [
+            (import ../config/overlay.nix { inherit mkpkgs inputs; })
+            inputs.doom-emacs.overlays.default
+          ];
+        }
+        {
+          nix.registry = {
+            jawz.flake = inputs.self;
+            unstable.flake = inputs.nixpkgs-unstable;
+          };
+        }
+      ];
+      createConfig =
+        name: local-nixpkgs:
+        let
+          lib = local-nixpkgs.lib // inputs.home-manager.lib;
+        in
+        lib.nixosSystem {
+          inherit system;
+          modules = inputs.self.lib.commonModules name;
+          specialArgs = {
+            inherit inputs;
+            outputs = inputs.self;
+          };
+        };
+      langList =
+        builtins.readDir ../modules/dev
+        |> builtins.attrNames
+        |> map (file: baseNameOf file |> builtins.replaceStrings [ ".nix" ] [ "" ])
+        |> builtins.filter (name: name != "emacs");
+      autoImport =
+        dir: filterFn:
+        builtins.readDir dir
+        |> builtins.attrNames
+        |> builtins.filter (file: builtins.match ".*\\.nix" file != null && filterFn file)
+        |> map (file: dir + "/${file}");
+      mkServerOptions = name: subdomain: port: lib: {
+        enable = lib.mkEnableOption "this server service";
+        enableCron = lib.mkEnableOption "enable cronjob";
+        enableProxy = lib.mkEnableOption "enable reverse proxy";
+        port = lib.mkOption {
+          type = lib.types.int;
+          default = port;
+        };
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = name;
+        };
+        domain = lib.mkOption {
+          type = lib.types.str;
+          default = "servidos.lat";
+        };
+        host = lib.mkOption {
+          type = lib.types.str;
+          default = "${subdomain}.servidos.lat";
+        };
+        hostName = lib.mkOption {
+          type = lib.types.str;
+          default = "miniserver";
+        };
+        url = lib.mkOption {
+          type = lib.types.str;
+          default = "https://${subdomain}.servidos.lat";
+        };
+        ip = lib.mkOption {
+          type = lib.types.str;
+          default = "127.0.0.1";
+        };
+        local = lib.mkOption {
+          type = lib.types.str;
+          default = "http://127.0.0.1:${toString port}";
+        };
+        isLocal = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+        enableSocket = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+        certPath = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+        };
+      };
+      proxy = locations: {
+        inherit locations;
+        forceSSL = true;
+        enableACME = true;
+        http2 = true;
+      };
+      proxyReverse =
+        cfg:
+        inputs.self.lib.proxy {
+          "/" = {
+            proxyPass = "http://${cfg.ip}:${toString cfg.port}/";
+            proxyWebsockets = cfg.enableSocket or false;
+          };
+        };
+      proxyReverseFix =
+        cfg:
+        let
+          useLocalhost = cfg.hostName == cfg.hostName;
+          localHeaders = ''
+            proxy_set_header   Host $host;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+          '';
+        in
+        inputs.self.lib.proxyReverse cfg
+        // {
+          extraConfig = ''
+            ${if useLocalhost then localHeaders else ""}
+            proxy_set_header   X-Forwarded-Host $host;
+            proxy_set_header   Upgrade $http_upgrade;
+            proxy_set_header   Connection $http_connection;
+            proxy_redirect     off;
+            proxy_http_version 1.1;
+          '';
+        };
+      proxyReversePrivate =
+        cfg:
+        inputs.self.lib.proxyReverse cfg
+        // {
+          extraConfig = ''
+            ssl_verify_client on;
+            ssl_client_certificate ${cfg.certPath};
+            error_page 403 /403.html;
+          '';
+        };
+      commonAliases = {
+        cp = "cp -i";
+        mv = "mv -i";
+        mkdir = "mkdir -p";
+        mkcd = "(){ mkdir -p \"$1\" && cd \"$1\" }";
+        copy = "xclip -selection clipboard";
+        cdp = "pwd | copy";
+        cfp = "(){ readlink -f \"$1\" | copy }";
+        ".." = "cd ..";
+        "..." = "cd ../..";
+        ".3" = "cd ../../..";
+        ".4" = "cd ../../../..";
+        ".5" = "cd ../../../../..";
+        c = "cat";
+        sc = "systemctl --user";
+        jc = "journalctl --user -xefu";
+      };
+      xdgEnvironment =
+        let
+          XDG_DATA_HOME = "\${HOME}/.local/share";
+          XDG_CONFIG_HOME = "\${HOME}/.config";
+          XDG_CACHE_HOME = "\${HOME}/.cache";
+        in
+        {
+          inherit XDG_DATA_HOME XDG_CONFIG_HOME XDG_CACHE_HOME;
+          XDG_BIN_HOME = "\${HOME}/.local/bin";
+          XDG_STATE_HOME = "\${HOME}/.local/state";
+          PSQL_HISTORY = "${XDG_DATA_HOME}/psql_history";
+          REDISCLI_HISTFILE = "${XDG_DATA_HOME}/redis/rediscli_history";
+          WINEPREFIX = "${XDG_DATA_HOME}/wine";
+          ELECTRUMDIR = "${XDG_DATA_HOME}/electrum";
+          WGETRC = "${XDG_CONFIG_HOME}/wgetrc";
+          XCOMPOSECACHE = "${XDG_CACHE_HOME}/X11/xcompose";
+          "_JAVA_OPTIONS" = "-Djava.util.prefs.userRoot=${XDG_CONFIG_HOME}/java";
+          ORG_DEVICE = "workstation";
+          PATH = [ "\${HOME}/.local/bin" ];
+        };
+      getNixosHosts =
+        ips: hostName: lib:
+        builtins.attrNames ips
+        |> builtins.filter (
+          name: !(lib.hasPrefix "wg-" name) && name != "vps" && name != "router" && name != hostName
+        );
+      shellConditional =
+        shellType: bashContent: zshContent:
+        if shellType == "bash" then { initExtra = bashContent; } else { initContent = zshContent; };
+      mergeAliases = baseAliases: extraAliases: baseAliases // extraAliases;
+      getServicesWithNativeFirewall =
+        config: blacklist:
+        config.my.servers
+        |> builtins.attrNames
+        |> builtins.filter (
+          name:
+          (config.my.servers.${name}.enable or false)
+          && !(builtins.elem name blacklist)
+          && builtins.hasAttr name config.services
+          && (config.services.${name} ? openFirewall)
+        );
+      generateFirewallPorts =
+        config: nativeServices: lib:
+        config.my.network.firewall.staticPorts
+        ++ config.my.network.firewall.additionalPorts
+        ++ (
+          config.my.servers
+          |> lib.filterAttrs (
+            name: srv: (srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServices)
+          )
+          |> lib.attrValues
+          |> map (srv: srv.port)
+        );
+    };
+  };
+}

parts/devshells.nix

@@ -0,0 +1,12 @@
+{ inputs, ... }:
+{
+  perSystem = _: {
+    devShells =
+      inputs.self.lib.langList
+      |> map (name: {
+        inherit name;
+        value = inputs.self.nixosConfigurations.emacs.config.devShells.${name};
+      })
+      |> builtins.listToAttrs;
+  };
+}

parts/hosts.nix

@@ -0,0 +1,10 @@
+{ inputs, ... }:
+{
+  flake.nixosConfigurations = {
+    workstation = inputs.self.lib.createConfig "workstation" inputs.nixpkgs;
+    miniserver = inputs.self.lib.createConfig "miniserver" inputs.nixpkgs-small;
+    server = inputs.self.lib.createConfig "server" inputs.nixpkgs-small;
+    galaxy = inputs.self.lib.createConfig "galaxy" inputs.nixpkgs-small;
+    emacs = inputs.self.lib.createConfig "emacs" inputs.nixpkgs;
+  };
+}

parts/packages.nix

@@ -0,0 +1,18 @@
+{ inputs, ... }:
+{
+  perSystem =
+    { system, ... }:
+    {
+      packages = (inputs.jawz-scripts.packages.${system} or { }) // {
+        emacs-vm = inputs.nixos-generators.nixosGenerate {
+          inherit system;
+          modules = inputs.self.lib.commonModules "emacs";
+          format = "vm";
+          specialArgs = {
+            inherit inputs;
+            outputs = inputs.self;
+          };
+        };
+      };
+    };
+}

scripts/list-schemes.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Script to list all available schemes from schemes.nix
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+
+echo "Available schemes:"
+nix eval --raw --impure --expr "
+  let
+    pkgs = import <nixpkgs> {};
+    inputs = {};
+    utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
+  in
+  builtins.concatStringsSep \"\n\" utils.availableSchemes
+"
+
+echo -e "\nLight schemes:"
+nix eval --raw --impure --expr "
+  let
+    pkgs = import <nixpkgs> {};
+    inputs = {};
+    utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
+  in
+  builtins.concatStringsSep \"\n\" utils.lightSchemes
+"
+
+echo -e "\nDark schemes:"
+nix eval --raw --impure --expr "
+  let
+    pkgs = import <nixpkgs> {};
+    inputs = {};
+    utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
+  in
+  builtins.concatStringsSep \"\n\" utils.darkSchemes
+"
+
+echo -e "\nAvailable colors:"
+nix eval --raw --impure --expr "
+  let
+    pkgs = import <nixpkgs> {};
+    inputs = {};
+    utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
+  in
+  builtins.concatStringsSep \"\n\" utils.availableColors
+"

scripts/push-to-cache.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# Script to push NixOS builds to Atticd cache
+
+set -euo pipefail
+
+# Colors for output
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Configuration
+CACHE_NAME="servidos:nixos"
+CACHE_URL="https://cache.servidos.lat"
+
+echo -e "${BLUE}=========================================${NC}"
+echo -e "${BLUE}NixOS Build Cache Pusher${NC}"
+echo -e "${BLUE}=========================================${NC}"
+echo ""
+
+# Check if attic is available
+if ! command -v attic &> /dev/null; then
+    echo -e "${YELLOW}Error: attic is not installed or not in PATH${NC}"
+    exit 1
+fi
+
+# Check if ATTIC_TOKEN is set
+if [ -z "${ATTIC_TOKEN:-}" ]; then
+    echo -e "${YELLOW}Warning: ATTIC_TOKEN environment variable is not set${NC}"
+    echo "Please set it with: export ATTIC_TOKEN=your_token_here"
+    exit 1
+fi
+
+# Login to cache
+echo -e "${GREEN}→ Logging into cache...${NC}"
+attic login servidos "$CACHE_URL" "$ATTIC_TOKEN"
+
+# Determine what to push
+if [ $# -eq 0 ]; then
+    # No arguments - push all result* symlinks
+    if ls result* 1> /dev/null 2>&1; then
+        echo -e "${GREEN}→ Found result symlinks, pushing to cache...${NC}"
+        attic push "$CACHE_NAME" result*
+        echo -e "${GREEN}✓ Successfully pushed all results to cache!${NC}"
+    else
+        echo -e "${YELLOW}No result symlinks found. Build something first!${NC}"
+        echo ""
+        echo "Usage examples:"
+        echo "  1. Push all results:    $0"
+        echo "  2. Push specific path:  $0 /nix/store/xxxxx-nixos-system-xxx"
+        echo "  3. Push current config: $0 --current [hostname]"
+        exit 1
+    fi
+elif [ "$1" = "--current" ]; then
+    # Push current system configuration
+    HOSTNAME="${2:-$(hostname)}"
+    echo -e "${GREEN}→ Building current configuration for $HOSTNAME...${NC}"
+    nix build ".#nixosConfigurations.$HOSTNAME.config.system.build.toplevel" --print-out-paths | \
+        attic push "$CACHE_NAME" --stdin
+    echo -e "${GREEN}✓ Successfully pushed $HOSTNAME configuration to cache!${NC}"
+elif [ "$1" = "--all-schemes" ]; then
+    # Build and push all schemes
+    HOSTNAME="${2:-server}"
+    
+    # Get current directory
+    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+    
+    cd "$PROJECT_ROOT"
+    
+    # Get available schemes
+    SCHEMES=$(nix eval --raw --impure --expr '
+      let
+        pkgs = import <nixpkgs> {};
+        inputs = {};
+        utils = import ./scripts/scheme-utils.nix { inherit pkgs inputs; };
+      in
+      builtins.concatStringsSep " " utils.availableSchemes
+    ')
+    
+    echo -e "${GREEN}→ Building and pushing all schemes for $HOSTNAME...${NC}"
+    echo -e "Schemes: $SCHEMES"
+    echo ""
+    
+    # Store original scheme
+    ORIGINAL_SCHEME=$(grep -oP "scheme = schemesFile\.schemes\.\K\w+" config/stylix.nix)
+    echo -e "Original scheme: $ORIGINAL_SCHEME"
+    echo ""
+    
+    # Build and push each scheme
+    for scheme in $SCHEMES; do
+        echo -e "${BLUE}→ Processing $scheme...${NC}"
+        
+        # Update stylix.nix
+        sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$scheme;/" config/stylix.nix
+        
+        # Build and push
+        nix build ".#nixosConfigurations.$HOSTNAME.config.system.build.toplevel" \
+            --out-link "./result-$scheme"
+        attic push "$CACHE_NAME" "./result-$scheme"
+        
+        echo -e "${GREEN}✓ Completed $scheme${NC}"
+        echo ""
+    done
+    
+    # Restore original scheme
+    echo -e "${BLUE}→ Restoring original scheme: $ORIGINAL_SCHEME${NC}"
+    sed -i "s/scheme = schemesFile\.schemes\.\w\+;/scheme = schemesFile.schemes.$ORIGINAL_SCHEME;/" config/stylix.nix
+    
+    echo -e "${GREEN}✓ All schemes pushed successfully!${NC}"
+else
+    # Push specific store path(s)
+    echo -e "${GREEN}→ Pushing specified path(s) to cache...${NC}"
+    for path in "$@"; do
+        echo "  - $path"
+        echo "$path" | attic push "$CACHE_NAME" --stdin
+    done
+    echo -e "${GREEN}✓ Successfully pushed to cache!${NC}"
+fi
+
+echo ""
+echo -e "${BLUE}=========================================${NC}"
+echo -e "${GREEN}Cache push completed!${NC}"
+echo -e "${BLUE}=========================================${NC}"
+

scripts/scheme-utils.nix

@@ -0,0 +1,28 @@
+{ pkgs, inputs }:
+let
+  schemesConfig = import ../config/schemes.nix { inherit pkgs inputs; };
+  availableSchemes = builtins.attrNames schemesConfig.schemes;
+in
+{
+  inherit availableSchemes;
+  lightSchemes = builtins.filter (
+    name: schemesConfig.schemes.${name}.polarity == "light"
+  ) availableSchemes;
+  darkSchemes = builtins.filter (
+    name: schemesConfig.schemes.${name}.polarity == "dark"
+  ) availableSchemes;
+  schemesByColor =
+    color: builtins.filter (name: schemesConfig.schemes.${name}.color == color) availableSchemes;
+  getScheme = name: schemesConfig.schemes.${name};
+  isValidScheme = name: builtins.hasAttr name schemesConfig.schemes;
+  availableColors = pkgs.lib.unique (
+    builtins.filter (color: color != null) (
+      builtins.map (name: schemesConfig.schemes.${name}.color) availableSchemes
+    )
+  );
+  availableBase16Schemes = pkgs.lib.unique (
+    builtins.filter (name: name != null) (
+      builtins.map (name: schemesConfig.schemes.${name}.name) availableSchemes
+    )
+  );
+}

secrets/env.yaml

@@ -1,7 +1,3 @@
-stash:
-    password: ENC[AES256_GCM,data:DVtKQmtOQA/jS3ZncbuPKMukJyo=,iv:FSLl4Qbq58X0WNjqz8LLOW6XpBQxE5W7L9yOTBQkBOA=,tag:Qun+5Vf193Qt8n+Yp9lBJg==,type:str]
-    jwt: ENC[AES256_GCM,data:C1RcyQn3j5LaCSDGPjBAm6RYsqvVn1HIFxxBP4FNx7NVCroju4VEtkV98Ve0D6Z60L3mB1yOqi8OrEgXNJv+vw==,iv:t8pmLzXwg1g9kkiL98ql9YLaSitaXoJiiLiUf3G1cWk=,tag:D3mdFIe3m3219E4V8yhmpg==,type:str]
-    session: ENC[AES256_GCM,data:ifUXaGIO7xKPgtTVEeERx0OyBDni2eoWo7dFxazQ4W2DBrnzQfJ7Plqt8EYLhQQRP4I6e33+oEKNzpuiG+XJCw==,iv:AOI0lMcTT02GpOCQuX74hPBKth3WdFN2W2wlqKgrKJM=,tag:1I+brf4G2oKE7o2E90q/CQ==,type:str]
 gitea: ENC[AES256_GCM,data:8o+U4qFdyIhCPNlYyflQIuLHsQHtbT6G/a0OyCUeg9DtIeABXNVFhiy4iFRuIF0=,iv:AYwqDRNML1XuzwQnD4VmI4rKWYfTJjOjibrAbI5qgcA=,tag:UPL3UlETdkoFXLihEIGcSw==,type:str]
 shiori: ENC[AES256_GCM,data:tV7+1GusZvcli8dM86xOD71dc2mzcyfQwMeTh//LDb0=,iv:ED9wR6QjQgwd9Ll/UC5FK3CyYK3b0RniC/D6Y0nGEOI=,tag:X/aopMc2vhnRW2iTphFflQ==,type:str]
 flame: ENC[AES256_GCM,data:XsYRsA2xs+juWje2Od2Yl2xIvU0OS8xMrtwtcK/0NyyRrg==,iv:FR8lHsNQNCaOy4P+7BsIjNCz+H38i5RlwLYQ4fpB2+w=,tag:61EV7H04pcr1bSX4nSvlpw==,type:str]
@@ -52,7 +48,7 @@ sops:
             QXRUYWtGcWZCVW11U3VYRktuUjlCbDgKsTK4WhUza/JuoDTU3uATa6fq/8eYzxtb
             9BUK1ddzx9Mghea9XBMS17YGtGmW800OsLBomb3SINnOFvejcnKf8Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-28T03:54:20Z"
-    mac: ENC[AES256_GCM,data:nPA5SF8fw+x0t5O1aqR7bZk2dpSjf37KKWJ976vx+TjaxWDz8DQVBUNuQmy6d3uX0TT6ysmsA8S4VqjgyRKli1vdEXWXPyULyUwPv3jtR4/NS2hnFabglOn0BhjfNrcArUkdyaQBm02Y96u2XIa0LcCyPOpJauIl5SbSSHaULQs=,iv:Qh7p70oFZbp4mAzDX87hkbPW22S4SoTY/CDzJabQQ0M=,tag:2YGmN2E3y1dcqW5M8WDvUQ==,type:str]
+    lastmodified: "2025-10-02T19:58:54Z"
+    mac: ENC[AES256_GCM,data:xplk6z63m35V1IL/PpvnjNU1+bUrrplGg60SufnGV6307V520Ajo63dKkQ5yMuiGq/JQETc+sdm9GLQrmOflwhl92YwK2+/11MlMp0vMkC91mAJsobLUmNt3WXVml54CiCbvH+c8fH0T0pIaLGK3MxSRFX//hrfLjSCAvwQagsE=,iv:oE6g0WPM4Rf3YrdgkIdE8qWfiWQxbZ62Axa56ZQYWSA=,tag:QMaWvCD3sbHTv1NFctIBZA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2

secrets/gallery.yaml

@@ -0,0 +1,44 @@
+gallery-dl:
+    secrets: ENC[AES256_GCM,data:mU3qzDzrn2Q0AhMnrJAsxvpz3FECLl45RFmyvoWEMaoW52vKE62o8gUl2rWmihNrsR0YTxmjmxj2Ey0eoRHbH+SSg78GbveKxwqGS/SWxEY3Nr45p4h/rdgDFUcFBqSIOKuJxGSMLHiprAjET7h0NWbRAUL9QPVnAPT41YeZyiaZS5Y1hpvpMxlQF1XrPYgrBR35ZnraTdcYDhPf/UBnhWxQLsOLs4SKD6Bzy1OEjk6tkajhv3ZKrcbp3S1BGrirTm/WNZTEHqiTGiXQAirmY2BmF0YkkDCVWgTMCRc9o54k7KDw8WDRuZcGso7Gh6h0jkgppnjuRGyfUkFXa3bsfni47Ct0XFhUyJvzcG3juRYAAEdOj8Pgc2tF483hxmfzE19TEYC+4hxVpCfmJb//v8M01bsRLIR4eP0EMl5IkvomC7xSiUq1TqBhD6AMgmz2LthFoTIpCEgMNxzhpMf+zppxjfnDPDPZhkzed317HLEAuxAcLfzc+6ZV1gDZ+HUArR3+I3Z/dSwi5wh247c74Qi/sc41fZuhqtPTjeO6Ag2sn5zw28QF/vTkRMWyVqARiBHGkeE5MJjc24eMqZceWSGDwtxqX22kNTyU0ELUeNq94Mynqq4YcCp4bdk/2R/3eRM9ZQLGC0KvdmIizeVq5PI0t1RfdRupLHm8U0AWOpnB1Osxz1Xoab/1npOQABdEEPm+wWq3jIPyDOxtWUjW3EjrYaOnz/6GF0Wme9g7sMkfGC80Uvz3nxNVAT7eqp6bVcnlpGW/zTAbZe8UXBdmL7rjkO/CR5GhI+VOczVobzkkZPLFU5Fi4HqfPyQjXRufFWYjw5XO3hFs9T4hO3z5tl601B/TxGmV+hL0JOJQyZpYEryWxU5ScANAfHdZyPAJVoIm3udj5K1Ry4CIVBE0ltCZ489Kr4KjP4ZhvPMdb3KlNYuR6MJwwi6O85OTqaQAujeKeqk=,iv:eNSqKEW5kxINC4MKuWos1OLQ7f7821ot5JoN7fMFZXw=,tag:JkppEJr3O4aQR415MM5fqg==,type:str]
+sops:
+    age:
+        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIY05VY1FPOU5FTFFnazlQ
+            RStQVExNdWIySE5qSVMxMFd3NFM0L2VCRWxzClhleTEzNTVOaVl1cGovM1hmWEoy
+            eGNxZ2E4U1pRNlBaTDZ0ZW4wbVZjT0EKLS0tIEJ0ZXR5blBlckIxSVlmT0hxY1Bz
+            TGVGRFgzaHI5VW5GdjJvcmswUWFvaWMKQCK47p7OQUXq45aYo9BkkcGrzmPKCJOI
+            OKu/+W4xYOnfIo03GGL6f4LrbCaKr1mdtsRnuHmaFXiXdaKbZFDEhw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17jlsydpgl35qx5ahc3exu44jt8dfa63chymt6xqp9xx0r6dh347qpg55cz
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJb0MzQVZvY0ZCNlAwT2Qw
+            RnJOUXJISFg1Smt4VWdoYy9PT2hQNG1MNm5ZCmVhUFI5UGpQUkR4MTA4VktuVyt1
+            TXlVZ3haNjd4OHNYNE4rVzd2MkNGTkEKLS0tICtkZDRvODBZaGRCTmdlUkRESjMv
+            bElZc21OSXJsZnZaSHF5ZTBDSlNXaHcKixDNfM98AqYagtidcYE3lgkFM9XTIrVg
+            gbYoSOk5rL9Hi2rvP+BCEgsrRSuExGKVvdqODYltD+nNfTI1zcnTFg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15hx530yrqmhm80vsjmffyg9deq9gssj7hl5rsqdnsn3dwegj9qusv4sjf5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKZncwdllnQjYyc284RXVm
+            VVVJTHI1Z25FWXBhY3o1SmgyVW01alRlcVVVCklDNDYvMktDU1U4L0RTMVgvaU0v
+            d0NlK3pqYzZ4NFRUd3V1WHZTTkVpK00KLS0tIHVQSmRDekcrK093QUJQVHNZcUg3
+            WGVJQm5MdGhMbzd5RkNPU1VuNTZVeFkKQq/WyqLOOde86NNYnVq0Lw31YB2OcLY/
+            h/HtFN4GynmBOYcTuqIvBJ/TksXs30kWFKW2XSY0jP0JSY7Yo0BxhA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age13w4elx3x6afrte2d82lak59mwr2k25wfz3hx79tny6sfdk66lqjq989dzl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZU0zK3V6M2IyMkFOdm5U
+            UG1oVi9IMzM0SllUQUMwMlh4NkF2V2pCcWtvCk1kR0QxVWRPM1pyWmdVOE1UdWxs
+            NldjZXBOZU1uK1JELzF1blhTQy83Zm8KLS0tIFFVRjVScVVGa09sbEdBdjNXNTZR
+            d0YvYk8vNitDbzNCQ1VqS20xUWx6ZDgK+kIRATTtC0Vd7/uPf8E4pIans79Ksh6J
+            Y77+owFFw1AvQ3KvaI7QVfKW61MzxI+S1bWqI3ZNOJ19Qv4ZoVhnVg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-10-10T05:09:54Z"
+    mac: ENC[AES256_GCM,data:N/BwfrwWcnot36Kn6RFZjjpUIluzq5Upy5iVVV4XSs+/0PYdlZGytjoAB+E3gXyPsLZ93UqI0A9/5KbfXBuR2oY2F7iKsu5puzgyYWa0Gl2z9YcPnyDnk1dj7Ne77xJlqR9YquGzFKF8QdqFXFA9cdE3b/1usTFhP26oxofMXs0=,iv:Iz/LzS8yeKQgDiGchYdKNymBeekhopJtBWaQGOwRZlE=,tag:hMRwxJlKR21W7otW01GmGw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

secrets/secrets.yaml

@@ -7,11 +7,14 @@ resilio:
     user: ENC[AES256_GCM,data:31s2ihj2cN9C5Lyr2w==,iv:2MzKiRoDosawbeQ04LUKbfbSVFUUD6uUYynB6B0WNWw=,tag:GR0lXvLZAPof6WE3Verimg==,type:str]
     password: ENC[AES256_GCM,data:codFGm4O9QkI2+hbrVK3UqwFWETXyfl9y3Q5lY6UfnIRe/IqWG8Ibly1BUlh7OjKIepXm6m35e6QPioVSiUT5Ll1SIE=,iv:QWqKyKrvm2y2UM2Ir1COxjV0jgU8jTeu9ehnyeXTwCE=,tag:Xtr+r7EphaiLjGwK5gmsMQ==,type:str]
 kavita-token: ENC[AES256_GCM,data:kt3bTZNf4S7sKfbxzXc4Q+9yTPFTKzvEaR+mysBhhdnht+FuN9o9i9liqy2pKvB7WQmPnjQ/aYEYkcPSPg0NC5NwE7lNY7kUJtyHzYm2wkKqkkDIc/aI+dHhtX1SBF99ZpWEhmgnIA2HtCpYXUjkl4pUTKgNi0cn+bb1NULMY0zHyF2f7faOOKTWatQEuG1ZvBpiNIbPbsMznfdrWe9VEKrdtMg8IkK138Cn+EOSu0mCHdU=,iv:NCjegkB9/O6xq3fdWqhyVJy5YetqIpcDmD0yyBh3XXQ=,tag:IiqZY0mhqyUHJ61DRNHPlw==,type:str]
+stash:
+    password: ENC[AES256_GCM,data:ZYwrETIJ1K5RJePR9TvmPdVHpZY=,iv:nqIvm5MkSmZxgSLUpZC0Iq2QOp4lU9rh9wtE8FhO7a0=,tag:YIlj9iPGjDVewgtjq0tdag==,type:str]
+    jwt: ENC[AES256_GCM,data:qwv1UMpUPf/qYMtMpRikSCgpqtWphhM6+P+lg9FFxRwPIYXQDG/VIL4KNPwORFi9eMjSfDRhyh7kKHZFr9zs0w==,iv:bPo3oG7RIUjUlakOvI1FKnraB/jUTRWCDdP1eBHVdl8=,tag:S1WFJlxt0QeG5+pLHrprPg==,type:str]
+    session: ENC[AES256_GCM,data:R9WX7w05qb2tqh0oe2QSvzgkSgt7TxLw8yf7WQHmlavPXzTewO7M3MqDdmDPIirLhkcg13UjzlCZR6SFHd6ARg==,iv:qvtKJiady1fDlxH5LsfOtQ5gNhn2qr2DLtkRlglNwyw=,tag:iQQuwZyyzSzwIov1mSox6g==,type:str]
+unpackerr:
+    sonarr-api: ENC[AES256_GCM,data:74/aSs7Q2tcDh9hPGm88h2hIneOcJ+P9HaCqoeuL6FQ=,iv:1AOpCii7ED1EyOFNCzvgRp5tR2ic1U6oRi7yg0hUcLk=,tag:k1miUivDQPxRgBWhXi9f+w==,type:str]
+    radarr-api: ENC[AES256_GCM,data:bZiJNk/ewREIBss+z4daVwL1UyI4rt8GxVmC/bpTNvc=,iv:li2kMzOgdWtLLr4l244P082Z0jwDB2aEC6iRYt3o/HY=,tag:mi9SY/pT2qTIzR/ngp8bGg==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
           enc: |
@@ -49,8 +52,7 @@ sops:
             RmRyZldlMjUwMEdUUEpDS2JSa2tDTTAKp/pT+0cNnCuKVL+Z0fEMiw1PL9PB/nSM
             QWVTo0Mt8Y6X0Xt0EAi9G5AYxADZ/mmEWPxB7RFgVAiMKtor5Gy1zw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-29T21:27:25Z"
-    mac: ENC[AES256_GCM,data:ZmUuxDXxfr6eJcjoC0F2A/JnU+/33jWXjCRWvkWZfduxFayF8bRZNOLgTzXeV//TGNEY38ba/VsTDqOiu0YWRFE7VaQd8xk9uKmzeCi8Djv2fI+TAwXUorrZJ2bUJQ/WCCm7hOQ2OEE1c7icr6YsPTtYC652Itm10FF4PrF+VpI=,iv:vKC/B0cfODXMZ1l2wA0iUaxwZgDwjKPVBekmc/6lSvU=,tag:tE3dmwDjtEEBTPtNM01JQA==,type:str]
-    pgp: []
+    lastmodified: "2025-10-02T20:02:38Z"
+    mac: ENC[AES256_GCM,data:DnbkeF+evVTMhYTg3OU528cRQ+jBiUl7Q7JZxyGRL6USjB2OdIRxqnnCH8L36K2hSAIkKQ/kojyJs+8Pgkx5uD/qsCbGlNT9pSBU1qPdSBxqJsVPxHZmkuf/QxGtE4pgV/50xJMrVyzAetWPZuxcYVfWAPszxDZcR5XDuD+Yjk4=,iv:i2Vt6nv6etIgaaoxsbVlxEnIhIx4adOQZFeyGM/4Saw=,tag:jugPmHU78lap7Hy7RJd9pg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.10.2