morn: WIP init host

.sops.yaml

@@ -1,10 +1,8 @@
 keys:
-  - &bw_recovery age146z3h3flw7spy5thznak8k5jh6yd68k9qrrehg8sdcwmyjv3vd7qvahdur
   - &host_burnham age12cgkgx8xac77q0rwakp6zrfrzp45mhk7wj6t3y8s0xurt3k879usnm66ct
   - &host_challenger age1j43eqpnq5hy6zt3gmdtzdnne2yfvccd832kpt69qavst44leec6sj2l773
   - &host_defiant age128md9emufxu35kgww3a90sw40vvc60f5xul9n9ndvw4lfnj3ndaqq44u64
-  - &host_leonard age1djj3jvt0usurh43t8jsrs74t5pvj54w77vy7qgln9ykckag233eqyth4fl
+  - &host_voyager age14jzavfeg47pgnrstea6yzvh3s3a578nj8hkk8g79vxyzpn86gslscp23qu
-  - &host_morn age14ar8q5454khxxf5ur2nxwk533nzycz2lh3635qwz35wh8yq0jpqskj2ksx
   - &user_felixalb_sisko age1phc4fkt25n4wtzg88sg3fhvmy6tv8pguyxp5c9js83ae3z374adsxfpqkl
   - &user_felixalb_worf age1nj7ju6f3jfvzw4c0sxywthjmztwp7rwqceun8xw2tlfrt7qymatser4vqf
 
@@ -13,7 +11,6 @@ creation_rules:
   - path_regex: secrets/[^/]+\.yaml$
     key_groups:
     - age:
-      - *bw_recovery
       - *user_felixalb_sisko
       - *user_felixalb_worf
 
@@ -22,7 +19,6 @@ creation_rules:
     key_groups:
     - age:
       - *host_burnham
-      - *bw_recovery
       - *user_felixalb_sisko
       - *user_felixalb_worf
 
@@ -30,7 +26,6 @@ creation_rules:
     key_groups:
     - age:
       - *host_challenger
-      - *bw_recovery
       - *user_felixalb_sisko
       - *user_felixalb_worf
 
@@ -38,22 +33,5 @@ creation_rules:
     key_groups:
     - age:
       - *host_defiant
-      - *bw_recovery
-      - *user_felixalb_sisko
-      - *user_felixalb_worf
-
-  - path_regex: secrets/leonard/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_leonard
-      - *bw_recovery
-      - *user_felixalb_sisko
-      - *user_felixalb_worf
-
-  - path_regex: secrets/morn/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_morn
-      - *bw_recovery
       - *user_felixalb_sisko
       - *user_felixalb_worf

README.md

@@ -37,9 +37,8 @@ Other installed packages and tools are described in the config files (like ./hos
 ## Networking
 
 - I use *nginx* as a web server and reverse proxy. The configuration is mostly distributed throughout the services that use it ([example](https://git.feal.no/felixalb/nixos-config/src/commit/3a05681d10a6999f73cbef59c3999742b81947a6/hosts/defiant/services/hedgedoc.nix#L98)).
-- A long time ago, I switched from Tailscale(actually [headscale](https://github.com/juanfont/headscale)) to *WireGuard*, configured [here](./hosts/defiant/services/wireguard.nix).
+- I recently switched from Tailscale(actually [headscale](https://github.com/juanfont/headscale)) to *WireGuard*, configured [here](./hosts/defiant/services/wireguard.nix) and [here](./hosts/burnham/services/wireguard.nix).
 - PiHole ([source](./hosts/defiant/services/pihole.nix)) run my internal DNS (\*.home.feal.no) and ad blocking.
-- A simple custom DynDNS thing is defined [here](./common/domeneshop-dyndns.nix) and used [here](./hosts/defiant/services/dyndns.nix).
 
 ## Monitoring
 

base.nix

@@ -6,7 +6,7 @@
 
   networking = {
     domain = lib.mkDefault "home.feal.no";
-    nameservers = lib.mkDefault [ "192.168.10.175" "192.168.10.1" ];
+    nameservers = lib.mkDefault [ "192.168.10.175" "192.168.10.1" "1.1.1.1" ];
     useDHCP = lib.mkDefault false;
   };
 
@@ -29,13 +29,19 @@
       trusted-users = [ "felixalb" ];
       builders-use-substitutes = true;
     };
+
+    registry= {
+      nixpkgs.flake = inputs.nixpkgs;
+    };
+
+    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
   };
 
   programs.zsh.enable = true;
 
   environment.systemPackages = with pkgs; [
     bottom
-    diffr
+    duf
     eza
     file
     git
@@ -45,7 +51,6 @@
     iotop
     lm_sensors
     nix-output-monitor
-    nixfmt
     p7zip
     python3
     ripgrep
@@ -56,10 +61,6 @@
     vim
     wget
     zip
-  ] ++ lib.optionals (pkgs.stdenv.isLinux) [
-    dmidecode
-    lm_sensors
-    pciutils
   ];
 
   services.openssh = {

common/auto-upgrade.nix

@@ -1,15 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  system.autoUpgrade = {
-    enable = true;
-    flake = "git+https://git.feal.no/felixalb/nixos-config.git";
-    flags = [
-      # Override nixpkgs (only). Notably does not include home-manager, sops or other utility/application flake inputs.
-      "--refresh"
-      "--override-input" "nixpkgs" "github:NixOS/nixpkgs/nixos-26.05-small"
-      "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable"
-      "--no-write-lock-file"
-    ];
-  };
-}

common/metrics-exporters.nix

@@ -17,6 +17,41 @@ in {
     '';
   };
 
-  # TODO: Configure fluent-bit or rsyslog
+  services.promtail = {
+    enable = true;
+    configuration = {
+      server = {
+        http_listen_port = 28183;
+        grpc_listen_port = 0;
+      };
+      clients = [
+        {
+          url = "http://${metricsHost}:3100/loki/api/v1/push";
+        }
+      ];
+      scrape_configs = [
+        {
+          job_name = "systemd-journal";
+          journal = {
+            max_age = "12h";
+            labels = {
+              job = "systemd-journal";
+              host = config.networking.hostName;
+            };
+          };
+          relabel_configs = [
+            {
+              source_labels = [ "__journal__systemd_unit" ];
+              target_label = "unit";
+            }
+            {
+              source_labels = [ "__journal_priority_keyword" ];
+              target_label = "level";
+            }
+          ];
+        }
+      ];
+    };
+  };
 
 }

common/oldssh.nix

@@ -1,44 +0,0 @@
-# Credit https://git.pvv.ntnu.no/oysteikt 2026
-
-{
-  openssh,
-  fetchurl,
-  lib
-}:
-
-openssh.overrideAttrs (prev: rec {
-  # Old crypto was removed in v10.0
-  version = "9.9p2";
-  src = fetchurl {
-    url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-    hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";
-  };
-
-  configureFlags = prev.configureFlags ++ [
-    "--enable-dsa-keys"
-  ];
-
-  # Broken patches, meant for 10.3p :p
-  patches = lib.filter (x: !(lib.any (suf: lib.hasSuffix suf (baseNameOf x)) [
-    "dont_create_privsep_path.patch"
-    "pkcs11-fix-pinentry.patch"
-    "pkcs11-tests-allow-module-path.patch"
-    "ssh-agent-tests-increase-timeout.patch"
-  ])) prev.patches;
-
-  # We actually needed the `dont_create_privsep_path` one :3
-  postPatch = prev.postPatch + ''
-    substituteInPlace Makefile.in \
-      --replace-fail '$(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH)' '''
-  '';
-
-  # Tihi
-  doInstallCheck = false;
-  postFixup = ''
-    rm -rf $out/libexec $out/etc
-    rm $out/bin/ssh-* $out/bin/sshd $out/bin/sftp
-    cd $out/bin
-    for filename in *; do mv {,old}"$filename"; done;
-  '';
-})
-

common/securecrt.nix

@@ -1,81 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  autoPatchelfHook,
-  dpkg,
-
-  cups,
-  gtkmm3,
-  icu74,
-  krb5,
-  makeWrapper,
-  openssl,
-  pango,
-  python312,
-  xcb-util-cursor,
-  xorg,
-}:
-
-let
-  packageId = "scrt_ubuntu2464_deb_963";
-in stdenv.mkDerivation rec {
-  pname = "securecrt";
-  version = "9.6.3";
-
-  src = fetchurl {
-    url = "https://www.vandyke.com/cgi-bin/download_1.php";
-    name = "${pname}-${version}.deb";
-    curlOpts = "-X POST --data 'pid=${packageId}&export_check=accept&country=no&su";
-    sha256 = "sha256-PsFuxJ7H0rJCWWi+rvzrlRUJlp9R4MG14d883/kl9Lo=";
-  };
-
-  unpackCmd = "dpkg -x $curSrc source";
-
-  nativeBuildInputs = [
-    dpkg
-    autoPatchelfHook
-  ];
-
-  buildInputs = [
-    cups
-    gtkmm3
-    icu74
-    krb5
-    makeWrapper
-    openssl
-    pango
-    python312
-    xcb-util-cursor
-    xorg.xcbutilkeysyms
-    xorg.xcbutilwm
-  ];
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontWrapQTApps = true;
-
-  installPhase = ''
-    runhook preInstall
-
-    mkdir -p "$out"
-    cp -R usr/* "$out/"
-    wrapProgram "$out/bin/SecureCRT" --set QT_QPA_PLATFORM_PLUGIN_PATH "$out/lib/scrt/plugins/platforms"
-
-    runhook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.vandyke.com/products/securecrt/unix.html";
-    description = "Terminal emulator for computing professionals, with advanced session management";
-    license = {
-      free = false;
-      fullName = "Unknown / Custom";
-    };
-
-    platforms = with lib.platforms; linux ++ darwin ++ windows;
-    broken = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64);
-  };
-
-  mainProgram = "SecureCRT";
-}

common/wireguard-peers.nix

@@ -1,38 +0,0 @@
-[
-  { # Worf
-    publicKey = "4buTx2yGpQMvCw6q+COySRHiS4acf1F09WryiDNQ428=";
-    allowedIPs = [
-      "10.100.0.4/32"
-    ];
-  }
-  { # Phone
-    publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
-    allowedIPs = [
-      "10.100.0.5/32"
-    ];
-  }
-  { # Riker
-    publicKey = "r715vpgH1H0zvN+Z5wcNKcOo5e6UM3fBfh9BZwTBjmA=";
-    allowedIPs = [
-      "10.100.0.6/32"
-    ];
-  }
-  { # fa-t14-2025
-    publicKey = "UPpUVWQqOKT65MFym1sFDTstNmuynDYE4LOOtbWqEng=";
-    allowedIPs = [
-      "10.100.0.7/32"
-    ];
-  }
-  { # Turtle
-    publicKey = "mDzAtRPv+O5TDHa9DGodF/KKuFXRBYwSqfPyeWfdfRI=";
-    allowedIPs = [
-      "10.100.0.8/32"
-    ];
-  }
-  { # Amalies phone
-    publicKey = "Iqoq00e5rUNygmjOKmSPzvDTzvUdpxkpwVrD6UJXG2w=";
-    allowedIPs = [
-      "10.100.0.9/32"
-    ];
-  }
-]

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "extra-config": {
       "locked": {
-        "lastModified": 1775160379,
+        "lastModified": 1729545170,
-        "narHash": "sha256-xrY3E3RTHP/c8MRKtciVbpXrgPCEnSQeNK4dCF53i9E=",
+        "narHash": "sha256-IrjXBAGiJKyIHxjVHPke1RbkqZ5yWTNHLfo8//LP9bM=",
         "ref": "refs/heads/main",
-        "rev": "66b4e90b64ecfacc1fff901f3197388f70bc53c8",
+        "rev": "7a64446cecca25a8f7df089ea04557727e5dc041",
-        "revCount": 15,
+        "revCount": 10,
         "type": "git",
         "url": "file:///home/felixalb/nix-extra-config"
       },
@@ -18,11 +18,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
+        "lastModified": 1673956053,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
         "type": "github"
       },
       "original": {
@@ -31,6 +31,42 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -38,36 +74,57 @@
         ]
       },
       "locked": {
-        "lastModified": 1782704057,
+        "lastModified": 1739757849,
-        "narHash": "sha256-G1I1gd32F7mp9LAe1DaZ4ZL7NX5gyiKwdCMwro1Vrck=",
+        "narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "868d0a692de703c2de98fab61968e4e310b7c28e",
+        "rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-26.05",
+        "ref": "release-24.11",
         "repo": "home-manager",
         "type": "github"
       }
     },
-    "matrix-synapse-next": {
+    "hyprswitch": {
       "inputs": {
+        "flake-parts": "flake-parts",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1765214213,
+        "lastModified": 1732716329,
-        "narHash": "sha256-WSk8CTdIDFFP5VMJj9beve19nPMMdTsWnkCHVXqO/3E=",
+        "narHash": "sha256-e/t8CD7HXnRziDgA+iT2eMzj2VypvFoZeTILngHFet0=",
+        "owner": "H3rmt",
+        "repo": "hyprswitch",
+        "rev": "8e1d741aa0cca12f5920c77adf3dc784f20456cc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "H3rmt",
+        "ref": "v3.1.3",
+        "repo": "hyprswitch",
+        "type": "github"
+      }
+    },
+    "matrix-synapse-next": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1717234745,
+        "narHash": "sha256-MFyKRdw4WQD6V3vRGbP6MYbtJhZp712zwzjW6YiOBYM=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "82959f612ffd523a49c92f84358a9980a851747b",
+        "rev": "d7dc42c9bbb155c5e4aa2f0985d0df75ce978456",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
+        "ref": "v0.6.0",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }
@@ -75,20 +132,20 @@
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs-darwin"
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1779036909,
+        "lastModified": 1739553546,
-        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "narHash": "sha256-L4ou3xfOr17EAe836djRoQ7auVkYOREMtiQa82wVGqU=",
-        "owner": "nix-darwin",
+        "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "56c666e108467d87d13508936aade6d567f2a501",
+        "rev": "353846417f985e74fdc060555f17939e4472ea2c",
         "type": "github"
       },
       "original": {
-        "owner": "nix-darwin",
+        "owner": "lnl7",
-        "ref": "nix-darwin-26.05",
+        "ref": "nix-darwin-24.11",
         "repo": "nix-darwin",
         "type": "github"
       }
@@ -96,17 +153,15 @@
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": [
+        "flake-utils": "flake-utils",
-          "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
-        ],
-        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1780113881,
+        "lastModified": 1734314370,
-        "narHash": "sha256-AMOOt682Odr4GZwCwZ08/Q/21/Sh3DxfmOAoiQbTKhk=",
+        "narHash": "sha256-9PhjDAAuXP4tuJg+kM1AozKwBFyHHJ8ZqhQD+peqGtg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "d9bd57f218cda7d6aac4b52546240da0df76a1f9",
+        "rev": "616634de04e87b621bc3d495af114c4e9c6ccd36",
         "type": "github"
       },
       "original": {
@@ -117,18 +172,17 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1783014552,
+        "lastModified": 1706098335,
-        "narHash": "sha256-htsCMj3F1QHmBHcadpwxA+mVcgTCvPXOZLg1M82/zdM=",
+        "narHash": "sha256-r3dWjT8P9/Ah5m5ul4WqIWD8muj5F+/gbCdjiNVBKmU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5863b64722a3967028f5ad22f79875b52ce82007",
+        "rev": "a77ab169a83a4175169d78684ddd2e54486ac651",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "id": "nixpkgs",
-        "ref": "nixos-26.05-small",
+        "ref": "nixos-23.11",
-        "repo": "nixpkgs",
+        "type": "indirect"
-        "type": "github"
       }
     },
     "nixpkgs-2211": {
@@ -143,29 +197,25 @@
         "url": "https://github.com/NixOS/nixpkgs/archive/34bfa9403e42eece93d1a3740e9d8a02fceafbca.tar.gz"
       }
     },
-    "nixpkgs-darwin": {
+    "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1782971832,
+        "lastModified": 1733096140,
-        "narHash": "sha256-/g/OtRDpNSGuQuIAP2bZL2Dlvsvxna7fAaKFAXkpsxw=",
+        "narHash": "sha256-1qRH7uAUsyQI7R1Uwl4T+XvdNv778H0Nb5njNrqvylY=",
-        "owner": "NixOS",
+        "type": "tarball",
-        "repo": "nixpkgs",
+        "url": "https://github.com/NixOS/nixpkgs/archive/5487e69da40cbd611ab2cadee0b4637225f7cfae.tar.gz"
-        "rev": "a88cc24d9d9e9a89614298fe908aba6d289654d3",
-        "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "type": "tarball",
-        "ref": "nixpkgs-26.05-darwin",
+        "url": "https://github.com/NixOS/nixpkgs/archive/5487e69da40cbd611ab2cadee0b4637225f7cfae.tar.gz"
-        "repo": "nixpkgs",
-        "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1782723713,
+        "lastModified": 1740828860,
-        "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
+        "narHash": "sha256-cjbHI+zUzK5CPsQZqMhE3npTyYFt9tJ3+ohcfaOF/WM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
+        "rev": "303bd8071377433a2d8f76e684ec773d70c5b642",
         "type": "github"
       },
       "original": {
@@ -175,76 +225,35 @@
         "type": "github"
       }
     },
-    "pwndbg": {
+    "nixpkgs_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pyproject-build-systems": "pyproject-build-systems",
-        "pyproject-nix": "pyproject-nix",
-        "uv2nix": "uv2nix"
-      },
       "locked": {
-        "lastModified": 1783022620,
+        "lastModified": 1715266358,
-        "narHash": "sha256-iPkF6wgjM5P1wUMngNV+0BEUJHs7OmcL3Phi2AaIUIs=",
+        "narHash": "sha256-doPgfj+7FFe9rfzWo1siAV2mVCasW+Bh8I1cToAXEE4=",
-        "owner": "pwndbg",
+        "owner": "nixos",
-        "repo": "pwndbg",
+        "repo": "nixpkgs",
-        "rev": "91d23aa950c48b9bbd59375b9a3af2cc365b05c4",
+        "rev": "f1010e0469db743d14519a1efd37e23f8513d714",
         "type": "github"
       },
       "original": {
-        "owner": "pwndbg",
+        "owner": "nixos",
-        "repo": "pwndbg",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "pyproject-build-systems": {
+    "nixpkgs_3": {
-      "inputs": {
-        "nixpkgs": [
-          "pwndbg",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "pwndbg",
-          "pyproject-nix"
-        ],
-        "uv2nix": [
-          "pwndbg",
-          "uv2nix"
-        ]
-      },
       "locked": {
-        "lastModified": 1763662255,
+        "lastModified": 1740865531,
-        "narHash": "sha256-4bocaOyLa3AfiS8KrWjZQYu+IAta05u3gYZzZ6zXbT0=",
+        "narHash": "sha256-h00vGIh/jxcGl8aWdfnVRD74KuLpyY3mZgMFMy7iKIc=",
-        "owner": "pyproject-nix",
+        "owner": "NixOS",
-        "repo": "build-system-pkgs",
+        "repo": "nixpkgs",
-        "rev": "042904167604c681a090c07eb6967b4dd4dae88c",
+        "rev": "5ef6c425980847c78a80d759abc476e941a9bf42",
         "type": "github"
       },
       "original": {
-        "owner": "pyproject-nix",
+        "owner": "NixOS",
-        "repo": "build-system-pkgs",
+        "ref": "nixos-24.11",
-        "type": "github"
+        "repo": "nixpkgs",
-      }
-    },
-    "pyproject-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "pwndbg",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769936401,
-        "narHash": "sha256-kwCOegKLZJM9v/e/7cqwg1p/YjjTAukKPqmxKnAZRgA=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "b0d513eeeebed6d45b4f2e874f9afba2021f7812",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
         "type": "github"
       }
     },
@@ -252,14 +261,13 @@
       "inputs": {
         "extra-config": "extra-config",
         "home-manager": "home-manager",
+        "hyprswitch": "hyprswitch",
         "matrix-synapse-next": "matrix-synapse-next",
         "nix-darwin": "nix-darwin",
         "nix-minecraft": "nix-minecraft",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-2211": "nixpkgs-2211",
-        "nixpkgs-darwin": "nixpkgs-darwin",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "pwndbg": "pwndbg",
         "sops-nix": "sops-nix"
       }
     },
@@ -270,11 +278,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
+        "lastModified": 1734546875,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "narHash": "sha256-6OvJbqQ6qPpNw3CA+W8Myo5aaLhIJY/nNFDk3zMXLfM=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "ed091321f4dd88afc28b5b4456e0a15bd8374b4d",
         "type": "github"
       },
       "original": {
@@ -297,31 +305,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "uv2nix": {
-      "inputs": {
-        "nixpkgs": [
-          "pwndbg",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "pwndbg",
-          "pyproject-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769957392,
-        "narHash": "sha256-6PkqwwYf5K2CHi2V+faI/9pqjfz/HxUkI/MVid6hlOY=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "d18bc50ae1c3d4be9c41c2d94ea765524400af75",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -2,29 +2,22 @@
   description = "Felixalb System flake";
 
   inputs = {
-    # Nixpkgs and friends
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05-small"; # Remember to update ./common/auto-upgrade.nix
-    nixpkgs-darwin.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
-    nixpkgs-2211.url = "https://github.com/NixOS/nixpkgs/archive/34bfa9403e42eece93d1a3740e9d8a02fceafbca.tar.gz"; # old nixpgks for e.g. remmina
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-2211.url = "https://github.com/NixOS/nixpkgs/archive/34bfa9403e42eece93d1a3740e9d8a02fceafbca.tar.gz"; # old nixpgks for e.g. remmina
 
-    nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
+    nix-darwin.url = "github:lnl7/nix-darwin/nix-darwin-24.11";
-    nix-darwin.inputs.nixpkgs.follows = "nixpkgs-darwin";
+    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
 
-    home-manager.url = "github:nix-community/home-manager/release-26.05";
+    home-manager.url = "github:nix-community/home-manager/release-24.11";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    # Other inputs
+    matrix-synapse-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
-    extra-config.url = "git+file:///home/felixalb/nix-extra-config";
-
-    matrix-synapse-next.url = "github:dali99/nixos-matrix-modules"; # TODO: Lock to release
-    matrix-synapse-next.inputs.nixpkgs.follows = "nixpkgs";
-
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
-    nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
+    hyprswitch.url = "github:H3rmt/hyprswitch/v3.1.3";
+    hyprswitch.inputs.nixpkgs.follows = "nixpkgs";
 
-    pwndbg.url = "github:pwndbg/pwndbg";
+    extra-config.url = "git+file:///home/felixalb/nix-extra-config";
-    pwndbg.inputs.nixpkgs.follows = "nixpkgs";
 
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -32,17 +25,16 @@
 
   outputs = {
     self
-    , extra-config
     , home-manager
+    , hyprswitch
     , matrix-synapse-next
-    , nix-darwin
     , nix-minecraft
+    , nix-darwin
     , nixpkgs
     , nixpkgs-2211
-    , nixpkgs-darwin
     , nixpkgs-unstable
-    , pwndbg
     , sops-nix
+    , extra-config
   , ... }@inputs:
     let
       pkgs-overlay = final: prev: {
@@ -56,24 +48,20 @@
           config.allowUnfree = true;
         };
 
-        pwndbg = pwndbg.packages."${prev.system}".default;
+        hyprswitch = hyprswitch.packages.${prev.system}.default;
-
-        securecrt = prev.callPackage ./common/securecrt.nix { };
-
-        oldssh = prev.callPackage ./common/oldssh.nix { };
       };
     in
     {
       nixosConfigurations = let
-        normalSys = name: hostConfig: nixpkgs.lib.nixosSystem {
+        normalSys = name: config: nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux"; # TODO - Handle
+          system = "x86_64-linux";
           specialArgs = {
             inherit inputs;
           };
           modules = [
             ({ config, pkgs, ... }: {
               # Make "pkgs.unstable" etc. available
-              nixpkgs.overlays = [ pkgs-overlay ] ++ hostConfig.overlays or [ ];
+              nixpkgs.overlays = [ pkgs-overlay ] ++ config.overlays or [ ];
             })
 
             ./hosts/${name}/configuration.nix
@@ -83,12 +71,19 @@
               home-manager.useUserPackages = true;
               home-manager.users = {
                 "felixalb" = import ./hosts/${name}/home.nix;
-              } // hostConfig.home-manager-users or { };
+              } // config.home-manager-users or { };
             }
-          ] ++ hostConfig.modules or [ ];
+          ] ++ config.modules or [ ];
         };
       in {
 
+        # Networking / VPN Gateway
+        burnham = normalSys "burnham" {
+          modules = [
+            ./common/domeneshop-dyndns.nix
+          ];
+        };
+
         # Media / storage server
         challenger = normalSys "challenger" {
           modules = [
@@ -104,17 +99,18 @@
           ];
         };
 
-        # Work laptop
+        # Work desktop
-        fa-t14-2025 = normalSys "fa-t14-2025" { };
+        felixalbpc = normalSys "felixalbpc" { };
 
         # Web host
-        leonard = normalSys "leonard" { };
+        malcolm = normalSys "malcolm" { };
 
         # General application server
         morn = normalSys "morn" { };
 
         # Home desktop
-        sisko = normalSys "sisko" { };
+        sisko = normalSys "sisko" {
+        };
       };
 
       # Daily driver macbook

home/amalieem/default.nix

@@ -36,6 +36,7 @@
       settings.window.opacity = 0.92;
     };
     firefox.enable = true;
+    neovim.plugins = with pkgs.vimPlugins; [ copilot-vim ];
     wofi.enable = true;
   };
 

home/base.nix

@@ -10,9 +10,11 @@
       bat
       bottom
       # ncdu
+      neofetch
       pwgen
       sshfs
       sshuttle
+      tmux
     ];
 
     sessionVariables = {
@@ -26,12 +28,10 @@
     enableZshIntegration = true;
   };
 
-  programs.fzf.enable = true;
-
   programs.git = {
     enable = true;
 
-    settings = {
+    extraConfig = {
       pull.rebase = true;
       push.autoSetupRemote = true;
       color.ui = "auto";
@@ -47,23 +47,11 @@
       };
     };
     ignores = [
-      "*.swp"
       "*~"
+      "*.swp"
       ".DS_Store"
-      ".gdb_history"
       ".vscode"
     ];
   };
 
-  programs.tmux = {
-    enable = true;
-    sensibleOnTop = true;
-
-    baseIndex = 1;
-    clock24 = true;
-    keyMode = "vi";
-    mouse = true;
-    terminal = "screen-256color";
-  };
-
 }

home/hypr/default.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.wayland.windowManager.hyprland;
-in
-{
-  imports = [
-    ./hypridle.nix
-    ./hyprland.nix
-    ./hyprlock.nix
-    ./hyprpaper.nix
-    ./keybinds.nix
-  ];
-
-  config = lib.mkIf cfg.enable {
-    systemd.user.sessionVariables = {
-      NIXOS_OZONE_WL = "1";
-      WLR_NO_HARDWARE_CURSORS = "1";
-      WLR_RENDERER_ALLOW_SOFTWARE = "1";
-      XDG_CURRENT_DESKTOP = "Hyprland";
-      XDG_SESSION_DESKTOP = "Hyprland";
-      XDG_SESSION_TYPE = "wayland";
-    };
-
-    home.packages = with pkgs; [
-      bibata-cursors
-      swaynotificationcenter
-      wl-clipboard
-    ];
-
-    home.pointerCursor = {
-      name = "Bibata-Modern-Ice";
-      package = pkgs.bibata-cursors;
-      size = 24;
-      gtk.enable = true;
-      x11 = {
-        enable = true;
-        defaultCursor = true;
-      };
-    };
-
-  };
-}

home/hypr/hypridle.nix

@@ -1,45 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.wayland.windowManager.hyprland;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.hypridle = {
-      enable = true;
-      settings = {
-        general = {
-          ignore_dbus_inhibit = false;
-          lock_cmd = "pidof hyprlock || ${config.programs.hyprlock.package}/bin/hyprlock";
-          before_sleep_cmd = "${pkgs.systemd}/bin/loginctl lock-session";
-          after_sleep_cmd = "${cfg.finalPackage}/bin/hyprctl dispatch dpms on";
-        };
-
-        listener = [
-          {
-            timeout = 8 * 60;
-            on-timeout = "${pkgs.libnotify}/bin/notify-send \"You are idle!\"";
-          }
-          {
-            timeout = 10 * 60;
-            on-timeout = "${config.programs.hyprlock.package}/bin/hyprlock";
-          }
-          {
-            timeout = 15 * 60;
-            on-timeout = "${pkgs.systemd}/bin/systemctl suspend";
-          }
-        ];
-      };
-    };
-
-    # TODO - Remove?
-    systemd.user.services.hypridle = {
-      Unit.After = lib.mkForce "graphical-session.target";
-      Service.Slice = "session.slice";
-    };
-  };
-}

home/hypr/hyprland.nix

@@ -1,180 +0,0 @@
-{
-  lib,
-  config,
-  osConfig,
-  ...
-}:
-{
-  wayland.windowManager.hyprland = {
-    systemd.enable = false; # Required for UWSM
-    systemd.enableXdgAutostart = false;
-    configType = "lua";
-
-    settings =
-      let
-        wpDir = "${config.home.homeDirectory}/Pictures/wallpapers";
-      in
-      {
-        on._args = [
-          "hyprland.start"
-          (lib.generators.mkLuaInline (
-            ''
-              function()
-            ''
-            +
-
-              lib.concatMapStringsSep "\n" (cmd: ''hl.exec_cmd("${cmd}")'') (
-                [
-                  "swaync"
-                  "hyprswitch init --size-factor 5 &"
-                  "wl-paste --type text --watch cliphist store #Stores only text data"
-                  "wl-paste --type image --watch cliphist store #Stores only image data"
-                ]
-                ++ (
-                  {
-                    # TODO: the hyprpaper hm-module still generates the old config format, use ipc temporarily
-                    "sisko" = [
-                      "hyprctl hyprpaper wallpaper 'DP-1, ${wpDir}/Ultrawide_Stray_City.png'"
-                      "hyprctl hyprpaper wallpaper 'DP-2, ${wpDir}/cyberpunk-gas-station-1.jpg'"
-                    ];
-                    "fa-t14-2025" = [
-                      "hyprctl hyprpaper wallpaper ', ${wpDir}/mktv-wallpaper-01.png'"
-                    ];
-                  }
-                  ."${osConfig.networking.hostName}"
-                )
-              )
-            + ''
-              end
-            ''
-          ))
-        ];
-
-        monitor = [
-          # Sisko
-          {
-            output = "desc:Philips Consumer Electronics Company 49M2C8900 AU42525000628";
-            mode = "highres@highrr";
-            position = "0x0";
-            scale = "1";
-            supports_hdr = 1;
-          }
-          {
-            output = "desc:LG Electronics LG ULTRAWIDE 407NTABCV312";
-            mode = "highres@highrr";
-            position = "600x-1440";
-            scale = "1";
-            supports_hdr = 1;
-          }
-
-          # fa-t14-2025
-          {
-            output = "desc:Lenovo Group Limited 0x403D";
-            mode = "highres@highrr";
-            position = "0x0";
-            scale = "1";
-            supports_hdr = 1;
-          }
-          {
-            output = "desc:Samsung Electric Company LS32D70xE HK2XC00156";
-            mode = "3840x2160@30.00";
-            position = "-3840x0";
-            scale = "1";
-          }
-          {
-            output = "desc:Samsung Electric Company C24F390 H4ZM501656";
-            mode = "1920x1080@60.00";
-            position = "-5760x0";
-            scale = "1";
-          }
-
-          # Other
-          {
-            output = "";
-            mode = "preferred";
-            position = "auto";
-            scale = "auto";
-          }
-        ];
-
-        config = {
-          general = {
-            gaps_in = 8;
-            gaps_out = 12;
-
-            border_size = 1;
-
-            "col.active_border" = {
-              colors = [
-                "rgba(33ccffee)"
-                "rgba(00ff99ee)"
-              ];
-              angle = 45;
-            };
-            "col.inactive_border" = "rgba(595959aa)";
-
-            resize_on_border = false;
-            allow_tearing = false;
-            layout = "dwindle";
-          };
-
-          decoration = {
-            rounding = 8;
-
-            active_opacity = 1.0;
-            inactive_opacity = 1.0;
-
-            shadow = {
-              enabled = true;
-              range = 4;
-              render_power = 3;
-              color = "rgba(1a1a1aee)";
-            };
-
-            blur = {
-              enabled = true;
-              size = 3;
-              passes = 1;
-
-              vibrancy = 0.1696;
-            };
-          };
-
-          animations.enabled = false; # TODO
-
-          dwindle = {
-            preserve_split = true;
-          };
-
-          master = {
-            new_status = "master";
-          };
-
-          binds = {
-            movefocus_cycles_fullscreen = 1;
-          };
-
-          misc = {
-            force_default_wallpaper = 0;
-            disable_hyprland_logo = true;
-          };
-
-          input = {
-            kb_layout = lib.mkDefault "us";
-            kb_variant = lib.mkDefault "intl";
-            kb_model = "";
-            kb_options = "ctrl:nocaps";
-            kb_rules = "";
-
-            follow_mouse = 1;
-
-            sensitivity = 0;
-
-            touchpad = {
-              natural_scroll = false;
-            };
-          };
-        };
-      };
-  };
-}

home/hypr/hyprlock.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.wayland.windowManager.hyprland;
-in
-{
-  config = lib.mkIf cfg.enable {
-    programs.hyprlock = {
-      enable = true;
-      settings = {
-        general = {
-          hide_cursor = true;
-          no_fade_in = false;
-        };
-
-        background = [
-          {
-            path = "screenshot";
-            blur_passes = 3;
-            blur_size = 8;
-          }
-        ];
-
-        input-field = [
-          {
-            size = "200, 50";
-            position = "0, -80";
-            monitor = "";
-            dots_center = true;
-            fade_on_empty = false;
-            font_color = "rgb(202, 211, 245)";
-            inner_color = "rgb(91, 96, 120)";
-            outer_color = "rgb(24, 25, 38)";
-            outline_thickness = 5;
-            placeholder_text = "Password...";
-            shadow_passes = 2;
-          }
-        ];
-
-      };
-    };
-  };
-}

home/hypr/hyprpaper.nix

@@ -1,17 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.wayland.windowManager.hyprland;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.hyprpaper = {
-      enable = true;
-      settings.ipc = true;
-    };
-
-    systemd.user.services.hyprpaper = {
-      Unit.After = lib.mkForce "graphical-session.target";
-      Service.Slice = "session.slice";
-    };
-  };
-}

home/hypr/keybinds.nix

@@ -1,291 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.wayland.windowManager.hyprland;
-in
-{
-  config = lib.mkIf cfg.enable {
-    wayland.windowManager.hyprland.settings =
-      let
-        exe = lib.getExe;
-        terminalCommand = "alacritty";
-        resizeAmount = toString 10;
-      in
-      {
-        mod._var = "SUPER";
-
-        # https://github.com/xkbcommon/libxkbcommon/blob/master/include/xkbcommon/xkbcommon-keysyms.h
-        bind =
-          let
-            lua = lib.generators.mkLuaInline;
-            mod = key: args: {
-              _args = [
-                (lua "mod .. \" + ${key}\"")
-              ]
-              ++ args;
-            };
-          in
-          [
-            # Layout actions
-
-            (mod "U" [
-              (lua "hl.dsp.layout(\"togglesplit\")")
-            ])
-
-            (mod "Y" [
-              (lua "hl.dsp.window.float({ action = \"toggle\" })")
-            ])
-
-            (mod "T" [
-              (lua "hl.dsp.window.fullscreen({ action = \"toggle\", mode = \"maximized\" })")
-            ])
-
-            (mod "C" [
-              (lua "hl.dsp.exec_cmd(\"hyprctl reload\")")
-            ])
-
-            # Left click drag
-            (mod "mouse:272" [
-              (lua "hl.dsp.window.drag()")
-              (lua "{ mouse = true }")
-            ])
-
-            # Right click drag
-            (mod "mouse:273" [
-              (lua "hl.dsp.window.resize()")
-              (lua "{ mouse = true }")
-            ])
-
-            # Scroll through workspaces on this monitor
-            (mod "mouse_up" [
-              (lua "hl.dsp.focus({ workspace = \"r+1\" })")
-            ])
-            (mod "mouse_down" [
-              (lua "hl.dsp.focus({ workspace = \"r-1\" })")
-            ])
-
-            # Window actions
-            (mod "W" [
-              (lua "hl.dsp.window.close()")
-            ])
-
-            (mod "SHIFT + W" [
-              (lua "hl.dsp.window.kill()")
-            ])
-
-            # Application launches
-            (mod "RETURN" [
-              (lua "hl.dsp.exec_cmd(\"${terminalCommand}\")")
-            ])
-
-            (mod "SPACE" [
-              (lua "hl.dsp.exec_cmd(\"rofi -show drun\")")
-            ])
-
-            (mod "A" [
-              (lua "hl.dsp.exec_cmd(\"${exe pkgs.pavucontrol}\")")
-            ])
-
-            (mod "B" [
-              (lua "hl.dsp.exec_cmd(\"rofi-rbw\")")
-            ])
-
-            (mod "N" [
-              (lua "hl.dsp.exec_cmd(\"swaync-client -t -sw\")")
-            ])
-
-            (mod "P" [
-              (lua "hl.dsp.exec_cmd(\"${terminalCommand} -e python3\")")
-            ])
-
-            (mod "V" [
-              (lua "hl.dsp.exec_cmd(\"rofi -modi clipboard:${pkgs.cliphist}/bin/cliphist-rofi-img -show clipboard\")")
-            ])
-
-            # Focus workspace
-            (mod "1" [ (lua "hl.dsp.focus({ workspace = 1 })") ])
-            (mod "2" [ (lua "hl.dsp.focus({ workspace = 2 })") ])
-            (mod "3" [ (lua "hl.dsp.focus({ workspace = 3 })") ])
-            (mod "4" [ (lua "hl.dsp.focus({ workspace = 4 })") ])
-            (mod "5" [ (lua "hl.dsp.focus({ workspace = 5 })") ])
-            (mod "6" [ (lua "hl.dsp.focus({ workspace = 6 })") ])
-            (mod "7" [ (lua "hl.dsp.focus({ workspace = 7 })") ])
-            (mod "8" [ (lua "hl.dsp.focus({ workspace = 8 })") ])
-            (mod "9" [ (lua "hl.dsp.focus({ workspace = 9 })") ])
-
-            # Move window to workspace
-            (mod "SHIFT + 1" [ (lua "hl.dsp.window.move({ workspace = 1 })") ])
-            (mod "SHIFT + 2" [ (lua "hl.dsp.window.move({ workspace = 2 })") ])
-            (mod "SHIFT + 3" [ (lua "hl.dsp.window.move({ workspace = 3 })") ])
-            (mod "SHIFT + 4" [ (lua "hl.dsp.window.move({ workspace = 4 })") ])
-            (mod "SHIFT + 5" [ (lua "hl.dsp.window.move({ workspace = 5 })") ])
-            (mod "SHIFT + 6" [ (lua "hl.dsp.window.move({ workspace = 6 })") ])
-            (mod "SHIFT + 7" [ (lua "hl.dsp.window.move({ workspace = 7 })") ])
-            (mod "SHIFT + 8" [ (lua "hl.dsp.window.move({ workspace = 8 })") ])
-            (mod "SHIFT + 9" [ (lua "hl.dsp.window.move({ workspace = 9 })") ])
-
-            # Focus window
-            (mod "LEFT" [ (lua "hl.dsp.focus({ direction=\"left\" })") ])
-            (mod "RIGHT" [ (lua "hl.dsp.focus({ direction=\"right\" })") ])
-            (mod "UP" [ (lua "hl.dsp.focus({ direction=\"up\" })") ])
-            (mod "DOWN" [ (lua "hl.dsp.focus({ direction=\"down\" })") ])
-            (mod "H" [ (lua "hl.dsp.focus({ direction=\"left\" })") ])
-            (mod "L" [ (lua "hl.dsp.focus({ direction=\"right\" })") ])
-            (mod "K" [ (lua "hl.dsp.focus({ direction=\"up\" })") ])
-            (mod "J" [ (lua "hl.dsp.focus({ direction=\"down\" })") ])
-
-            # Move window
-            (mod "SHIFT + LEFT" [ (lua "hl.dsp.window.move({ direction=\"left\" })") ])
-            (mod "SHIFT + RIGHT" [ (lua "hl.dsp.window.move({ direction=\"right\" })") ])
-            (mod "SHIFT + UP" [ (lua "hl.dsp.window.move({ direction=\"up\" })") ])
-            (mod "SHIFT + DOWN" [ (lua "hl.dsp.window.move({ direction=\"down\" })") ])
-            (mod "SHIFT + H" [ (lua "hl.dsp.window.move({ direction=\"left\" })") ])
-            (mod "SHIFT + L" [ (lua "hl.dsp.window.move({ direction=\"right\" })") ])
-            (mod "SHIFT + K" [ (lua "hl.dsp.window.move({ direction=\"up\" })") ])
-            (mod "SHIFT + J" [ (lua "hl.dsp.window.move({ direction=\"down\" })") ])
-
-            # Resize window
-            (mod "CONTROL + LEFT" [
-              (lua "hl.dsp.window.resize({ x = -${resizeAmount}, y = 0, relative = true })")
-              (lua "{ repeating = true }")
-            ])
-            (mod "CONTROL + RIGHT" [
-              (lua "hl.dsp.window.resize({ x =  ${resizeAmount}, y = 0, relative = true })")
-              (lua "{ repeating = true }")
-            ])
-            (mod "CONTROL + UP" [
-              (lua "hl.dsp.window.resize({ x = 0, y = -${resizeAmount}, relative = true })")
-              (lua "{ repeating = true }")
-            ])
-            (mod "CONTROL + DOWN" [
-              (lua "hl.dsp.window.resize({ x = 0, y =  ${resizeAmount}, relative = true })")
-              (lua "{ repeating = true }")
-            ])
-            (mod "CONTROL + H" [
-              (lua "hl.dsp.window.resize({ x = -${resizeAmount}, y = 0, relative = true })")
-              (lua "{ repeating = true }")
-            ])
-            (mod "CONTROL + L" [
-              (lua "hl.dsp.window.resize({ x =  ${resizeAmount}, y = 0, relative = true })")
-              (lua "{ repeating = true }")
-            ])
-            (mod "CONTROL + K" [
-              (lua "hl.dsp.window.resize({ x = 0, y = -${resizeAmount}, relative = true })")
-              (lua "{ repeating = true }")
-            ])
-            (mod "CONTROL + J" [
-              (lua "hl.dsp.window.resize({ x = 0, y =  ${resizeAmount}, relative = true })")
-              (lua "{ repeating = true }")
-            ])
-
-            # TODO - replace with hyprlock?
-            (mod "F1" [ (lua "hl.dsp.exec_cmd(\"${pkgs.systemd}/bin/loginctl lock-session\")") ])
-
-            # Screenshots
-            {
-              _args = [
-                (lua "\"PRINT\"")
-                (lua "hl.dsp.exec_cmd(\"${exe pkgs.hyprshot} -m output --clipboard-only\")")
-              ];
-            }
-            {
-              _args = [
-                (lua "\"CTRL + PRINT\"")
-                (lua "hl.dsp.exec_cmd(\"${exe pkgs.hyprshot} -m region --clipboard-only\")")
-              ];
-            }
-
-            {
-              _args = [
-                (lua "\"CTRL + SHIFT + PRINT\"")
-                (lua "hl.dsp.exec_cmd(\"HYPRSHOT_DIR=/home/felixalb/Pictures/screenshots ${exe pkgs.hyprshot} -m region \")")
-              ];
-            }
-
-            # Media controls
-            {
-              _args = [
-                (lua "\"XF86AudioPlay\"")
-                (lua "hl.dsp.exec_cmd(\"${exe pkgs.playerctl} play-pause\")")
-                (lua "{ locked = true }")
-              ];
-            }
-
-            {
-              _args = [
-                (lua "\"XF86AudioPause\"")
-                (lua "hl.dsp.exec_cmd(\"${exe pkgs.playerctl} play-pause\")")
-                (lua "{ locked = true }")
-              ];
-            }
-
-            {
-              _args = [
-                (lua "\"XF86AudioPrev\"")
-                (lua "hl.dsp.exec_cmd(\"${exe pkgs.playerctl} previous\")")
-                (lua "{ locked = true }")
-              ];
-            }
-
-            {
-              _args = [
-                (lua "\"XF86AudioNext\"")
-                (lua "hl.dsp.exec_cmd(\"${exe pkgs.playerctl} next\")")
-                (lua "{ locked = true }")
-              ];
-            }
-
-            {
-              _args = [
-                (lua "\"XF86AudioMute\"")
-                (lua "hl.dsp.exec_cmd(\"${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle\")")
-                (lua "{ locked = true, repeating = true }")
-              ];
-            }
-
-            {
-              _args = [
-                (lua "\"XF86AudioMicMute\"")
-                (lua "hl.dsp.exec_cmd(\"${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle\")")
-                (lua "{ locked = true, repeating = true }")
-              ];
-            }
-
-            {
-              _args = [
-                (lua "\"XF86AudioLowerVolume\"")
-                (lua "hl.dsp.exec_cmd(\"${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-\")")
-                (lua "{ locked = true, repeating = true }")
-              ];
-            }
-            {
-              _args = [
-                (lua "\"XF86AudioRaiseVolume\"")
-                (lua "hl.dsp.exec_cmd(\"${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+\")")
-                (lua "{ locked = true, repeating = true }")
-              ];
-            }
-
-            # Laptop controls
-            {
-              _args = [
-                (lua "\"XF86MonBrightnessUp\"")
-                (lua "hl.dsp.exec_cmd(\"${exe pkgs.brightnessctl} s 10%+\")")
-                (lua "{ locked = true, repeating = true }")
-              ];
-            }
-            {
-              _args = [
-                (lua "\"XF86MonBrightnessDown\"")
-                (lua "hl.dsp.exec_cmd(\"${exe pkgs.brightnessctl} s 10%-\")")
-                (lua "{ locked = true, repeating = true }")
-              ];
-            }
-          ];
-      };
-  };
-}

home/neovim.nix

@@ -24,19 +24,16 @@ in {
       nvim-treesitter
 
       coc-css
+      coc-go
       coc-html
       coc-json
       coc-nvim
 
       vim-nix
       vim-puppet
-
-      go-nvim
     ];
 
     withNodeJs = true;
-    withPython3 = true;
-    withRuby = false;
 
     extraConfig = ''
       let mapleader = ','
@@ -103,7 +100,7 @@ in {
       " Close vim is Nerdtree is the only buffer left
       autocmd bufenter * if (winnr("$") == 1 && exists("b:NERDTree") && b:NERDTree.isTabTree()) | q | endif
 
-      if empty($AERC_ACCOUNT) && empty($MOZ_APP_LAUNCHER)
+      if empty($AERC_ACCOUNT)
         autocmd VimEnter * NERDTree " Autostart nerdtree on vim startup
         autocmd VimEnter * wincmd p " Unselect nerdtree window
       endif
@@ -130,30 +127,12 @@ in {
       highlight ExtraWhitespace ctermbg=red guibg=red
       match ExtraWhitespace /\s\+$/
 
-      " Show non-ascii characters (except norwegian æøå)
-      highlight nonascii ctermbg=214 guibg=#FFA500 " orange
-      function! HighlightNonAscii()
-        " delete the old match if it exists
-        let s:matchid = get(s:, 'matchid', -1)
-        if s:matchid != -1
-          try
-            call matchdelete(s:matchid)
-          catch /E803/
-            " matchid does not exist, pass
-          endtry
-        endif
-        " Skip popups like telescope
-        if &buftype ==# ""
-          let s:matchid = matchadd('nonascii', '[^\x00-\x7FæøåÆØÅ]', 100)
-        else
-          let s:matchid = -1
-        endif
-      endfunction
-      autocmd BufEnter * call HighlightNonAscii()
-
       " Disable search highlights
       map <Leader><Space> :noh<CR>
 
+      " Start with copilot disabled
+      let g:copilot_enabled = 0
+
       " Start with Coc disabled
       " autocmd VimEnter * CocDisable
     '';

home/waybar.nix

@@ -1,264 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.programs.waybar;
-  cfgs = cfg.settings.mainBar;
-in
-{
-  programs.waybar = {
-    systemd.enable = true;
-
-    settings = {
-      mainBar = {
-        layer = "top";
-        position = "top";
-        height = 26;
-
-        modules-left = [ "hyprland/workspaces" ];
-        modules-center = [ "hyprland/window" ];
-        modules-right = [
-          "tray"
-          "network"
-          "pulseaudio"
-          "battery"
-          "clock#date"
-          "clock"
-        ];
-
-        "hyprland/workspaces" = {
-          persistent-workspaces = {
-            "*" = 8;
-          };
-        };
-
-        "hyprland/window" = {
-          "format" = "{initialTitle}";
-        };
-
-        tray = {
-          spacing = 10;
-        };
-
-        clock = {
-          "tooltip-format" = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
-          format = " {:%H:%M:%S}";
-          "format-alt" = " {:%Y-%m-%d}";
-          interval = 1;
-        };
-
-        "clock#date" = {
-          format = " {:%d.%m.%Y}";
-          "tooltip-format" = "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>";
-        };
-
-        "battery" = {
-          "states" = {
-            "warning" = 30;
-            "critical" = 15;
-          };
-          "format" = "{icon}  {capacity}%";
-          "format-charging" = " {capacity}%";
-          "format-plugged" = " {capacity}%";
-          "format-icons" = [
-            ""
-            ""
-            ""
-            ""
-            ""
-          ];
-          "on-click" = "ags -t quicksettings";
-        };
-        "pulseaudio" = {
-          "format" = "{icon}  {volume}% {format_source}";
-          "format-bluetooth" = " {icon} {volume}% {format_source}";
-          "format-bluetooth-muted" = "  {icon} {format_source}";
-          "format-muted" = " {format_source}";
-          "format-source" = "";
-          "format-source-muted" = "";
-          "format-icons" = {
-            "default" = [
-              ""
-              ""
-              ""
-            ];
-          };
-          "on-click" = "pavucontrol";
-        };
-        "network" = {
-          "format-wifi" = "  {essid}";
-          "format-ethernet" = "⬇{bandwidthDownBytes} ⬆{bandwidthUpBytes}";
-          "interval" = 3;
-          "format-linked" = "{ifname} (No IP) ";
-          "format" = "";
-          "format-disconnected" = "";
-          "on-click" = "alacritty -e nmtui";
-          "tooltip-format" = " {bandwidthUpBits}  {bandwidthDownBits}\n{ifname}\n{ipaddr}/{cidr}\n";
-          "tooltip-format-wifi" =
-            " {essid} {frequency}MHz\nStrength: {signaldBm}dBm ({signalStrength}%)\nIP: {ipaddr}/{cidr}\n {bandwidthUpBits}  {bandwidthDownBits}";
-          "min-length" = 10;
-          "max-length" = 17;
-        };
-      };
-    };
-
-    style =
-      let
-        c = config.colors.defaultColorSet;
-      in
-      ''
-        /*
-        *
-        * Catppuccin Mocha palette
-        * Maintainer: rubyowo
-        *
-        */
-
-        @define-color background #1e1e2e;
-        @define-color foreground #cdd6f4;
-        @define-color mantle #181825;
-        @define-color crust #11111b;
-
-        @define-color subtext0 #a6adc8;
-        @define-color subtext1 #bac2de;
-
-        @define-color surface0 #313244;
-        @define-color surface1 #45475a;
-        @define-color surface2 #585b70;
-
-        @define-color overlay0 #6c7086;
-        @define-color overlay1 #7f849c;
-        @define-color overlay2 #9399b2;
-
-        @define-color blue #89b4fa;
-        @define-color lavender #b4befe;
-        @define-color sapphire #74c7ec;
-        @define-color sky #89dceb;
-        @define-color teal #94e2d5;
-        @define-color green #a6e3a1;
-        @define-color yellow #f9e2af;
-        @define-color peach #fab387;
-        @define-color maroon #eba0ac;
-        @define-color red #f38ba8;
-        @define-color mauve #cba6f7;
-        @define-color pink #f5c2e7;
-        @define-color flamingo #f2cdcd;
-        @define-color rosewater #f5e0dc;
-
-        * {
-            font-family: "Hack Nerd Font";
-            font-size: 14px;
-            min-height: 0;
-            font-weight: normal;
-        }
-
-        window#waybar {
-            background: transparent;
-            background-color: @background;
-            color: @foreground;
-            transition-property: background-color;
-            transition-duration: 0.1s;
-        }
-
-        #window {
-            margin: 2;
-            padding-left: 8;
-            padding-right: 8;
-        }
-
-        button {
-            box-shadow: inset 0 -3px transparent;
-            border: none;
-            border-radius: 0;
-        }
-
-        button:hover {
-            background: inherit;
-            border-top: 2px solid @hover;
-        }
-
-        #workspaces button {
-            padding: 0 4px;
-            color: gray;
-            font-weight: 300;
-        }
-
-        #workspaces button.empty {
-            color: #404040;
-            font-weight: 100;
-        }
-
-        #workspaces button.active {
-            background-color: rgba(0, 0, 0, 0.3);
-            color: white;
-            border-top: 2px solid @blue;
-        }
-
-        #workspaces button.urgent {
-            background-color: #eb4d4b;
-        }
-
-        #pulseaudio,
-        #clock,
-        #battery,
-        #cpu,
-        #memory,
-        #disk,
-        #temperature,
-        #backlight,
-        #wireplumber,
-        #tray,
-        #mode,
-        #scratchpad {
-            margin-left: 4px;
-            margin-right: 4px;
-            padding-left: 4px;
-            padding-right: 4px;
-        }
-
-        #clock {
-            color: @maroon;
-            border-bottom: 2px solid @maroon;
-        }
-
-        #clock.date {
-            color: @mauve;
-            border-bottom: 2px solid @mauve;
-        }
-
-        #pulseaudio {
-            color: @blue;
-            border-bottom: 2px solid @blue;
-        }
-
-        #network {
-            color: @yellow;
-            border-bottom: 2px solid @yellow;
-        }
-
-        #idle_inhibitor {
-            margin-right: 12px;
-            color: #7cb342;
-        }
-
-        #idle_inhibitor.activated {
-            color: @red;
-        }
-
-        #battery.charging,
-        #battery.plugged {
-            color: @green;
-            border-bottom: 2px solid @green;
-        }
-
-        /* If workspaces is the leftmost module, omit left margin */
-        .modules-left>widget:first-child>#workspaces {
-            margin-left: 0;
-        }
-      '';
-  };
-
-  systemd.user.services.waybar = lib.mkIf (cfg.enable && cfg.systemd.enable) {
-    Service.Environment = [
-      "DISPLAY=:0"
-    ];
-  };
-}

home/zsh.nix

@@ -34,7 +34,7 @@
         ];
       };
 
-      initContent = ''
+      initExtra = ''
         # Autocomplete ../
         zstyle ':completion:*' special-dirs true
         export PATH="$HOME/.config/emacs/bin:$HOME/.cargo/bin:$PATH"

hosts/burnham/configuration.nix

@@ -0,0 +1,40 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../base.nix
+      ../../common/metrics-exporters.nix
+      ./hardware-configuration.nix
+
+      # Infrastructure
+      ./services/wireguard.nix
+
+      # Other
+      ./services/dyndns.nix
+      ./services/nginx.nix
+      ./services/thelounge.nix
+  ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+
+  networking = {
+    hostName = "burnham";
+    defaultGateway = "192.168.11.1";
+    interfaces.ens18.ipv4 = {
+      addresses = [
+        { address = "192.168.11.109"; prefixLength = 24; }
+      ];
+    };
+    hostId = "8e24f235";
+  };
+
+  sops.defaultSopsFile = ../../secrets/burnham/burnham.yaml;
+
+  environment.variables = { EDITOR = "vim"; };
+
+  system.stateVersion = "23.11";
+}
+

hosts/burnham/hardware-configuration.nix

@@ -0,0 +1,30 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/31ff6d37-52d6-43c3-a214-5d38a6c38b0e";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/cce59ee7-7c83-4165-a9b0-f950cd2e3273"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  #networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/burnham/home.nix

@@ -8,5 +8,5 @@
     zsh.shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
   };
 
-  home.stateVersion = "25.05";
+  home.stateVersion = "23.05";
 }

hosts/burnham/services/dyndns.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, lib, ... }:
+
+{
+  sops.secrets."domeneshop/netrc" = { };
+
+  services.domeneshop-dyndns = {
+    enable = true;
+    domain = "site2.feal.no";
+    netrcFile = config.sops.secrets."domeneshop/netrc".path;
+  };
+}

hosts/burnham/services/wireguard.nix

@@ -0,0 +1,62 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.networking.wireguard.interfaces."wg0";
+in {
+  networking = {
+    nat = {
+      enable = true;
+      externalInterface = "ens18";
+      internalInterfaces = [ "wg0" ];
+    };
+    firewall.allowedUDPPorts = [ cfg.listenPort ];
+
+    wireguard.interfaces."wg0" = {
+      ips = [ "10.100.0.2/24" ];
+      listenPort = 51820;
+      privateKeyFile = "/etc/wireguard/burnham.private";
+
+      postSetup = ''
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.11.0/24 -o eth0 -j MASQUERADE
+      '';
+      postShutdown = ''
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.11.0/24 -o eth0 -j MASQUERADE
+      '';
+
+      peers = [
+        { # Defiant
+          publicKey = "8/711GhmN9+NcduHF4JPkfoZPE0qsDLuwhABcPyjNxI=";
+          persistentKeepalive = 120;
+          allowedIPs = [
+            "10.100.0.1/32"
+            "192.168.10.0/24"
+          ];
+          endpoint = "site3.feal.no:51902";
+        }
+        { # Worf
+          publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So=";
+          allowedIPs = [
+            "10.100.0.4/32"
+          ];
+        }
+        { # Phone
+          publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
+          allowedIPs = [
+            "10.100.0.5/32"
+          ];
+        }
+        { # Riker
+          publicKey = "r715vpgH1H0zvN+Z5wcNKcOo5e6UM3fBfh9BZwTBjmA=";
+          allowedIPs = [
+            "10.100.0.6/32"
+          ];
+        }
+        { # Work-laptop
+          publicKey = "px4YstB16lFjgdLQkH55wz8gQRupX/LTxg8dNFijDTA=";
+          allowedIPs = [
+            "10.100.0.7/32"
+          ];
+        }
+      ];
+    };
+  };
+}

hosts/challenger/backup.nix

@@ -13,66 +13,33 @@
         "--keep-yearly 10"
       ];
     };
-    cloudJob = name: paths: {
-      inherit paths;
-      # "rsyncnet" connection details specified in /root/.ssh/config
-      repository = "sftp://rsyncnet/restic/challenger/${name}";
-      passwordFile = config.sops.secrets."restic/${name}".path;
-      initialize = true;
-      pruneOpts = [
-        # rsync.net keeps daily snapshots
-        "--keep-weekly 4"
-        "--keep-monthly 36"
-      ];
-    };
   in {
-
-    # Calibre metadata and config
-    calibre = localJob "calibre" [
-      "/var/lib/calibre-web"
-      "/var/lib/calibre-server"
-    ];
-
-    # Other system backups (NB: Large!)
-    hostBackups = localJob "hostBackups" [
-      "/tank/backup"
-    ] // {
-      pruneOpts = [ "--keep-monthly 12" ];
-    };
-
-    media = localJob "media" [
-      "/tank/media/books"
-      "/tank/media/komga"
-      "/tank/media/music"
-    ];
-    media-remote = cloudJob "media" [
-      "/tank/media/books"
-      "/tank/media/komga"
-      "/tank/media/music"
-    ] // {
-      pruneOpts = [ "--keep-monthly 12" ];
-    };
-
-    # Nextcloud config and data
-    nextcloud = localJob "nextcloud" [ "/tank/nextcloud" ];
-    nextcloud-remote = cloudJob "nextcloud" [ "/tank/nextcloud" ];
-
-    # Postgresql databases
     postgres = (localJob "postgres" [ "/var/backup/postgres" ]) // {
       timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
     };
-    postgres-remote = (cloudJob "postgres" [ "/var/backup/postgres" ]) // {
+
-      timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
+    # Transmission _metadata_
+    transmission = localJob "transmission" [ "/var/lib/transmission" ];
+
+    # Calibre metadata and books
+    calibre = localJob "calibre" [
+      "/var/lib/calibre-web"
+      "/var/lib/calibre-server"
+      "/tank/media/books"
+    ] // {
+      pruneOpts = [ "--keep-daily 1" ];
     };
 
-    # TODO: timemachine
+    # Nextcloud data
+    nextcloud = localJob "nextcloud" [ "/tank/nextcloud" ];
+
+    # TODO: timemachine, komga
   };
 
   sops.secrets."restic/calibre" = { };
-  sops.secrets."restic/hostBackups" = { };
-  sops.secrets."restic/media" = { };
   sops.secrets."restic/nextcloud" = { };
   sops.secrets."restic/postgres" = { };
+  sops.secrets."restic/transmission" = { };
 
   environment.systemPackages = with pkgs; [
     restic

hosts/challenger/configuration.nix

@@ -13,9 +13,8 @@
       ./filesystems.nix
 
       # ./services/archivebox.nix
-      ./services/audiobookshelf.nix
       ./services/calibre.nix
-      ./services/frigate.nix
+      # ./services/ersatztv.nix
       ./services/jellyfin.nix
       ./services/komga.nix
       ./services/nextcloud.nix
@@ -46,26 +45,14 @@
   virtualisation.docker.enable = true;
   virtualisation.oci-containers.backend = "docker";
 
-  security.polkit.enable = true; # Required for nextcloud
-
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
-    "nvidia-kernel-modules"
-    "nvidia-settings"
        "nvidia-x11"
+       "nvidia-settings"
   ];
 
   hardware.nvidia = {
     modesetting.enable = true;
     open = false;
-    # https://github.com/sircam-html/nixos-conf/blob/main/guides/nvidia-nixos-guide.md
-    package = config.boot.kernelPackages.nvidiaPackages.mkDriver {
-      version            = "580.142";
-      sha256_64bit       = "sha256-IJFfzz/+icNVDPk7YKBKKFRTFQ2S4kaOGRGkNiBEdWM=";
-      sha256_aarch64     = "sha256-0000000000000000000000000000000000000000000=";
-      openSha256         = "sha256-0000000000000000000000000000000000000000000=";
-      settingsSha256     = "sha256-BnrIlj5AvXTfqg/qcBt2OS9bTDDZd3uhf5jqOtTMTQM=";
-      persistencedSha256 = "sha256-0000000000000000000000000000000000000000000=";
-    };
   };
 
   hardware.graphics.enable = true;

hosts/challenger/exports.nix

@@ -4,7 +4,6 @@
     "/export/riker-backup" = {
       device = "/tank/backup/riker";
       options = [ "bind" ];
-      fsType = "none";
     };
   };
 

hosts/challenger/filesystems.nix

@@ -9,7 +9,6 @@
     zfs = {
       extraPools = [ "tank" ];
       requestEncryptionCredentials = false;
-      forceImportRoot = false;
     };
     supportedFilesystems = [ "zfs" ];
   };
@@ -32,18 +31,5 @@
         "noauto"
       ];
     };
-    "/mnt/feal-syn2/backup" = {
-      # device = "feal-syn1.home.feal.no:/volume2/backup";
-      device = "192.168.11.163:/volume1/challenger";
-      fsType = "nfs";
-      options = [
-        "defaults"
-        "noatime"
-        "rw"
-        "nfsvers=3"
-        "x-systemd.automount"
-        "noauto"
-      ];
-    };
   };
 }

hosts/challenger/services/audiobookshelf.nix

@@ -1,60 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  domain = "audiobooks.home.feal.no";
-  host = "127.0.1.2";
-  port = 5016;
-in {
-
-  fileSystems = {
-    "/var/lib/audiobookshelf" = {
-      device = "/tank/media/audiobookshelf/config";
-      depends = [ "/tank/media/audiobookshelf" ];
-      fsType = "none";
-      options = [ "bind" ];
-    };
-  };
-
-  services.audiobookshelf = {
-    enable = true;
-    dataDir = "audiobookshelf";
-    inherit host port;
-  };
-
-  systemd.services.audiobookshelf = {
-    requires = [ "var-lib-audiobookshelf.mount" ];
-    serviceConfig = {
-      # Better safe than sorry :)
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProtectClock = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      ReadWritePaths = [
-        "/var/lib/audiobookshelf"
-        "/tank/media/audiobookshelf"
-      ];
-      RemoveIPC = true;
-      RestrictSUIDSGID = true;
-      UMask = "0007";
-      RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
-      SystemCallArchitectures = "native";
-    };
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    locations."/" = {
-      proxyPass = "http://${host}:${toString port}";
-      proxyWebsockets = true;
-    };
-  };
-}

hosts/challenger/services/ersatztv.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+let
+  domain = "etv.home.feal.no";
+  bind = "127.0.0.1:8409";
+in {
+  virtualisation.oci-containers.containers.ersatztv = {
+    autoStart = true;
+    image = "jasongdove/ersatztv:latest-nvidia";
+    volumes = [
+      "/var/lib/ersatztv:/root/.local/share/ersatztv"
+      "/tank/media/other/ersatztv:/media" # Filler, watermarks, etc.
+    ];
+    ports = [
+      "${bind}:8409"
+    ];
+    environment = {
+      TZ = "Europe/Oslo";
+    };
+    extraOptions = [
+      "--device=/dev/dri"
+    ];
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    locations."/".proxyPass = "http://${bind}";
+  };
+}

hosts/challenger/services/frigate.nix

@@ -1,50 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  fileSystems = {
-    "/var/lib/frigate" = {
-      device = "/tank/nvr/frigate";
-      depends = [ "/tank/nvr/frigate" ];
-      options = [ "bind" ];
-      fsType = "none";
-    };
-  };
-
-  services.frigate = {
-    enable = true;
-    hostname = "frigate.home.feal.no";
-    vaapiDriver = "nvidia";
-    checkConfig = false;
-    settings = {
-      # auth.reset_admin_password = true;
-      motion.enabled = true;
-      record.enabled = true;
-      # snapshots.enabled = true;
-      # detect = {
-      #   enabled = true;
-      #   fps = 5;
-      # };
-
-      cameras = {
-        driveway = {
-          ffmpeg.inputs = [
-            {
-              path = "rtsp://admin:placeholder@192.168.10.40/streaming/channels/101";
-              roles = [
-                "detect"
-                "record"
-              ];
-            }
-          ];
-        };
-      };
-    };
-  };
-
-  systemd.services.frigate.serviceConfig = {
-    # Allow GPU use
-    PrivateDevices = false;
-
-    # Allow cpuinfo
-    ProcSubset = "all";
-  };
-}

hosts/challenger/services/jellyfin.nix

@@ -6,6 +6,10 @@
 
   users.users.${config.services.jellyfin.user}.extraGroups = [ "video" "render" ];
 
+  systemd.services.jellyfin.serviceConfig = {
+    DeviceAllow = lib.mkForce [ "/dev/dri/card0" "/dev/dri/card1" ];
+  };
+
   services.nginx.virtualHosts."jellyfin.home.feal.no" = {
     serverAliases = [ "jf.feal.no" ];
     locations = {

hosts/challenger/services/komga.nix

@@ -1,18 +1,16 @@
 { config, lib, pkgs, ... }:
 let
   domain = "komga.home.feal.no";
-  port = 5004;
+  cfg = config.services.komga;
 in {
   services.komga = {
     enable = true;
     stateDir = "/tank/media/komga";
-    settings.server = {
+    port = 5001;
-      inherit port;
-    };
   };
 
   services.nginx.virtualHosts.${domain} = {
-    locations."/".proxyPass = "http://127.0.0.1:${toString port}";
+    locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}";
 
     extraConfig = ''
       client_max_body_size 512M;

hosts/challenger/services/nextcloud.nix

@@ -5,7 +5,7 @@ let
 in {
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud33;
+    package = pkgs.nextcloud30;
     inherit hostName;
     home = "/tank/nextcloud";
     https = true;
@@ -46,9 +46,7 @@ in {
       oidc_login_filter_allowed_values = [ "nextcloud-user" ];
       oidc_login_disable_registration = false;
 
-      "memories.exiftool" = pkgs.writeShellScript "exiftool-perl" ''
+      "memories.exiftool" = "${cfg.home}/store-apps/memories/bin-ext/exiftool-amd64-glibc";
-        ${lib.getExe pkgs.perl} ${cfg.home}/store-apps/memories/bin-ext/exiftool/exiftool "$@"
-      '';
       "memories.exiftool_no_local" = false;
       "memories.vod.disable" = false;
       "memories.vod.ffmpeg" = "${lib.getExe pkgs.ffmpeg-headless}";
@@ -75,7 +73,7 @@ in {
 
   environment.systemPackages = [
     cfg.occ # "occ CMD" in the docs -> "sudo -u nextcloud nextcloud-occ CMD"
-    pkgs.nodejs # For Recognize; Put /run/current-system/sw/bin/node in the "node_binary" field in the web UI -> Memories
+    pkgs.nodejs_20 # For Recognize; Put /run/current-system/sw/bin/node in the "node_binary" field in the web UI -> Memories
   ];
 
   sops.secrets."nextcloud/adminpass" = {

hosts/challenger/services/nginx.nix

@@ -11,7 +11,7 @@
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
 
-    virtualHosts."jf.feal.no".default = true;
+    virtualHosts."cloud.feal.no".default = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];

hosts/defiant/backup.nix

@@ -12,34 +12,14 @@
         "--keep-monthly 3"
       ];
     };
-    cloudJob = name: paths: {
-      inherit paths;
-      # "rsyncnet" connection details specified in /root/.ssh/config
-      repository = "sftp://rsyncnet/restic/defiant/${name}";
-      passwordFile = config.sops.secrets."restic/${name}".path;
-      initialize = true;
-      pruneOpts = [
-        # rsync.net keeps daily snapshots
-        "--keep-weekly 4"
-        "--keep-monthly 36"
-      ];
-    };
   in {
     postgres = (localJob "postgres" [ "/tank/backup/postgresql" ]) // {
       timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
     };
-    postgres-remote = (cloudJob "postgres" [ "/tank/backup/postgresql" ]) // {
-      timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
-    };
 
     gitea = (localJob "gitea" [ "/tank/services/gitea" ]);
-    gitea-remote = (cloudJob "gitea" [ "/tank/services/gitea" ]);
-
     matrix-synapse = (localJob "matrix-synapse" [ "/var/lib/matrix-synapse" ]);
-    matrix-synapse-remote = (cloudJob "matrix-synapse" [ "/var/lib/matrix-synapse" ]);
-
     vaultwarden = (localJob "vaultwarden" [ "/var/lib/bitwarden_rs" ]);
-    vaultwarden-remote = (cloudJob "vaultwarden" [ "/var/lib/bitwarden_rs" ]);
   };
 
   # TODO: home-assistant, pihole

hosts/defiant/configuration.nix

@@ -18,16 +18,18 @@
       ./services/wireguard.nix
 
       # Services
+      ./services/flame.nix
       ./services/gitea.nix
       ./services/hedgedoc.nix
       ./services/home-assistant.nix
       ./services/keycloak.nix
+      ./services/koillection.nix
       ./services/matrix
       ./services/microbin.nix
-      # ./services/minecraft/home.nix
+      ./services/minecraft/home.nix
       ./services/monitoring
-      # ./services/rtl-tcp.nix
+      ./services/rtl-tcp.nix
-      # ./services/searx.nix
+      ./services/searx.nix
       ./services/vaultwarden.nix
   ];
 

hosts/defiant/filesystems.nix

@@ -3,11 +3,7 @@
   # Boot drives are defined in ./hardware-configuration.nix
 
   boot = {
-    zfs = {
+    zfs.extraPools = [ "tank" ];
-      extraPools = [ "tank" ];
-      forceImportRoot = false;
-    };
-
     supportedFilesystems = [ "zfs" ];
   };
   services.prometheus.exporters.zfs.enable = true;
@@ -19,15 +15,13 @@
 
   fileSystems = {
     "/mnt/feal-syn1/backup" = {
-      device = "192.168.10.162:/volume2/backup";
+      device = "feal-syn1.home.feal.no:/volume2/backup";
       fsType = "nfs";
       options = [
         "defaults"
         "noatime"
         "rw"
         "nfsvers=3"
-        "x-systemd.automount"
-        "noauto"
       ];
     };
   };

hosts/defiant/libvirt.nix

@@ -11,7 +11,6 @@
   fileSystems."/var/lib/libvirt/images" = {
     device = "/tank/iso";
     options = [ "bind" ];
-    fsType = "none";
   };
 
   # On a gui-enabled machine, connect with:

hosts/defiant/services/dyndns.nix

@@ -5,7 +5,7 @@
 
   services.domeneshop-dyndns = {
     enable = true;
-    domain = "site2.feal.no";
+    domain = "site3.feal.no";
     netrcFile = config.sops.secrets."domeneshop/netrc".path;
   };
 }

hosts/defiant/services/flame.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, lib, ... }:
+let
+  domain = "flame.home.feal.no";
+  host = "127.0.1.2";
+  port = "5005";
+in {
+  # Flame - Homelab dashboard/linktree
+  virtualisation.oci-containers.containers = {
+    flame = {
+      image = "pawelmalak/flame";
+      ports = [ "${host}:${port}:5005" ];
+      volumes = [
+        "/var/lib/flame/data:/app/data/"
+      ];
+    };
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    locations."/".proxyPass = "http://${host}:${port}";
+  };
+}
+

hosts/defiant/services/home-assistant.nix

@@ -8,7 +8,7 @@ in {
 
   virtualisation.oci-containers.containers = {
     homeassistant = {
-      image = "ghcr.io/home-assistant/home-assistant:2025.5.3";
+      image = "ghcr.io/home-assistant/home-assistant:2024.1";
       extraOptions = [
         "--network=host"
         "--device=/dev/ttyUSB0" # Sonoff Zigbee 3.0 USB

hosts/defiant/services/koillection.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+let
+  domain = "koillection.home.feal.no";
+  port = 5023;
+in {
+  virtualisation.oci-containers.containers = {
+    koillection = {
+      image = "koillection/koillection";
+
+      ports = [
+        "127.0.1.2:${toString port}:80"
+      ];
+
+      environment = {
+        APP_DEBUG = "0";
+        APP_ENV = "prod";
+        HTTPS_ENABLED = "0";
+        UPLOAD_MAX_FILESIZE = "512M";
+        PHP_MEMORY_LIMIT = "512M";
+        PHP_TZ = "Europe/Oslo";
+
+        CORS_ALLOW_ORIGIN = "https?://(localhost|koillection\\.home\\.feal\\.no)(:[0-9]+)?$";
+        JWT_SECRET_KEY = "%kernel.project_dir%/config/jwt/private.pem";
+        JWT_PUBLIC_KEY = "%kernel.project_dir%/config/jwt/public.pem";
+
+        DB_DRIVER = "pdo_pgsql";
+        DB_NAME = "koillection";
+        DB_HOST = "host.docker.internal";
+        DB_USER = "koillection";
+        # DB_PASSWORD = "koillection"; # Set in sops envfile
+        DB_PORT = "5432";
+        DB_VERSION = "16";
+      };
+
+      environmentFiles = [
+        config.sops.secrets."koillection/envfile".path
+      ];
+
+      extraOptions = [
+        "--add-host=host.docker.internal:host-gateway"
+      ];
+    };
+  };
+
+  sops.secrets."koillection/envfile" = { };
+
+  services.postgresql = {
+    ensureDatabases = [ "koillection" ];
+    ensureUsers = [ {
+      name = "koillection";
+      ensureDBOwnership = true;
+    } ];
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    locations."/".proxyPass = "http://127.0.1.2:${toString port}";
+  };
+}
+

hosts/defiant/services/matrix/synapse.nix

@@ -12,6 +12,12 @@
     group = "matrix-synapse";
   };
 
+  sops.secrets."matrix/slidingsyncsecret" = {
+    restartUnits = [ "matrix-synapse.service" ];
+    owner = "matrix-synapse";
+    group = "matrix-synapse";
+  };
+
   services.matrix-synapse-next = {
     enable = true;
     enableNginx = true;
@@ -84,14 +90,10 @@
           issuer = "https://iam.feal.no/realms/feal.no";
           client_id = "matrix-synapse";
           client_secret_path = config.sops.secrets."matrix/synapse/oidcsecret".path;
-          user_mapping_provider.config = {
+          user_mapping_provicer.config = {
             localpart_template = "{{ user.preferred_username }}";
             display_name_template = "{{ user.name }}";
           };
-          attribute_requirements = [{
-            attribute = "matrix-roles";
-            value = "matrix-user";
-          }];
           backchannel_logout_enabled = true;
           enable_registration = false;
         }
@@ -99,6 +101,8 @@
     };
   };
 
+  services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/slidingsyncsecret".path;
+
   services.redis.servers."".enable = true;
 
   services.postgresqlBackup.databases = [ "matrix-synapse" ];

hosts/defiant/services/minecraft/home.nix

@@ -22,7 +22,6 @@
         simulation-distance = 16;
         enable-command-block = true;
         enable-rcon = true;
-        online-mode = false;
         "rcon.password" = "wack";
       };
 

hosts/defiant/services/monitoring/grafana.nix

@@ -9,16 +9,11 @@ in {
 
     # TODO: Migrate sqlite to postgres
 
-    settings = {
+    settings.server = {
-      server = {
       domain = "grafana.home.feal.no";
       http_port = 2342;
       http_addr = "127.0.0.1";
     };
-      security = {
-        secret_key = "SW2YcwTIb9zpOOhoPsMm"; # TODO - Rotate
-      };
-    };
 
     provision = {
       enable = true;

hosts/defiant/services/monitoring/prometheus.nix

@@ -17,12 +17,14 @@ in {
         static_configs = [
           {
             targets = [
+              "burnham.home.feal.no:9100"
               "challenger.home.feal.no:9100"
-              "constellation.home.feal.no:9100"
               "defiant.home.feal.no:9100"
-              "leonard.home.feal.no:9100"
+              "edison.home.feal.no:9100"
-              "morn.home.feal.no:9100"
+              "malcolm.home.feal.no:9100"
-              "sisko.home.feal.no:9100"
+              "mccoy.home.feal.no:9100"
+              "scotty.home.feal.no:9100"
+              "sulu.home.feal.no:9100"
             ];
           }
         ];

hosts/defiant/services/monitoring/snmp-exporter.nix

@@ -1,13 +1,12 @@
 { config, pkgs, ... }:
 
 {
-  # TODO - Fix. Broken in 26.05
+  services.prometheus.exporters.snmp = {
-  # services.prometheus.exporters.snmp = {
+    enable = true;
-  #   enable = true;
+    configurationPath = ./snmp-exporter-conf.yml;
-  #   configurationPath = ./snmp-exporter-conf.yml;
+    # snmp.yml is built from
-  #   # snmp.yml is built from
+    # https://github.com/prometheus/snmp_exporter/blob/main/snmp.yml
-  #   # https://github.com/prometheus/snmp_exporter/blob/main/snmp.yml
+    # and
-  #   # and
+    # https://global.download.synology.com/download/Document/Software/DeveloperGuide/Firmware/DSM/All/enu/Synology_DiskStation_MIB_Guide.pdf
-  #   # https://global.download.synology.com/download/Document/Software/DeveloperGuide/Firmware/DSM/All/enu/Synology_DiskStation_MIB_Guide.pdf
+  };
-  # };
 }

hosts/defiant/services/nginx.nix

@@ -31,15 +31,6 @@ in {
     defaults.email = "felix@albrigtsen.it";
   };
 
-  # security.acme.certs."domainname" = {
-  #   dnsProvider = "domeneshop";
-  #   environmentFile = config.sops.secrets."domeneshop/acme".path;
-  #   webroot = null;
-  # };
-  sops.secrets."domeneshop/acme" = {
-    group = "nginx";
-  };
-
   # Publicly exposed services:
 
   services.nginx.virtualHosts = let
@@ -64,50 +55,17 @@ in {
     } // overrides;
   in {
     "cloud.feal.no" = publicProxy "" {
-      listen = [
-        { addr = "192.168.10.175"; port = 43443; ssl = true; }
-        { addr = "192.168.10.175"; port = 43080; ssl = false; }
-        # Note: cloud.feal.no is overriden in the local DNS, to allow use through Wireguard VPN
-        { addr = "192.168.10.175"; port =   443; ssl = true; }
-        { addr = "192.168.10.175"; port =    80; ssl = false; }
-      ];
       locations."/" = {
         proxyPass = "http://challenger.home.feal.no";
         extraConfig = ''
           client_max_body_size 8G;
         '';
       };
-      extraConfig = ''
-          # Direct local traffic and NAT Hairpin
-          allow 192.168.10.0/24;
-
-          # Wireguard
-          allow 10.100.0.0/24;
-
-          # AS16185
-          allow 82.146.64.0/19;
-          allow 217.31.96.0/20;
-          allow 185.166.44.0/22;
-
-          # NTNU
-          allow 129.241.0.0/16;
-
-          deny all;
-      '';
     };
-
+    "git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" {
-    "amalie.mansaker.no" = publicProxy "http://leonard.home.feal.no/" { };
+      default = true;
-    "feal.no" = publicProxy "http://leonard.home.feal.no/" { serverAliases = [ "www.feal.no" ]; };
+    };
-    "git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" { default = true; };
-    "iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" { };
     "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" { };
-    "kinealbrigtsen.no" = publicProxy "http://leonard.home.feal.no/" { serverAliases = [ "www.kinealbrigtsen.no" ]; };
+    "iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" { };
-    "wiki.wackattack.eu" = publicProxy "http://leonard.home.feal.no/" { };
-  };
-
-  security.acme.certs."cloud.feal.no" = {
-    dnsProvider = "domeneshop";
-    environmentFile = config.sops.secrets."domeneshop/acme".path;
-    webroot = null;
   };
 }

hosts/defiant/services/pihole.nix

@@ -4,7 +4,7 @@ let
   dnsHost = "192.168.10.175";
   webuiListen = "127.0.1.2:5053";
 in {
-  # Pihole - Ad-blocking DNS recursor and authoritative DNS/DHCP
+  # Flame - Homelab dashboard/linktree
   virtualisation.oci-containers.containers = {
     pihole = {
       image = "pihole/pihole";

hosts/defiant/services/vaultwarden.nix

@@ -1,7 +1,7 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.services.vaultwarden;
-  domain = "pw.home.feal.no";
+  domain = "pw.feal.no";
   address = "127.0.1.2";
   port = 3011;
   wsPort = 3012;
@@ -43,17 +43,13 @@ in {
 
   services.postgresqlBackup.databases = [ "vaultwarden" ];
 
-  security.acme.certs."pw.home.feal.no" = {
-    dnsProvider = "domeneshop";
-    environmentFile = config.sops.secrets."domeneshop/acme".path;
-    webroot = null;
-  };
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
     enableACME = true;
+
     listen = [
-      { addr = "192.168.10.175"; port = 443; ssl = true; }
+      { addr = "192.168.10.175"; port = 43443; ssl = true; }
-      { addr = "192.168.10.175"; port = 80; ssl = false; }
+      { addr = "192.168.10.175"; port = 43080; ssl = false; }
     ];
 
     extraConfig = ''

hosts/defiant/services/wireguard.nix

@@ -16,13 +16,53 @@ in {
       privateKeyFile = "/etc/wireguard/defiant.private";
 
       postSetup = ''
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o enp3s0 -j MASQUERADE
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o eth0 -j MASQUERADE
       '';
       postShutdown = ''
-        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o enp3s0 -j MASQUERADE
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o eth0 -j MASQUERADE
       '';
 
-      peers = (import ../../../common/wireguard-peers.nix);
+      peers = [
+        { # Burnham
+          publicKey = "JcfyrMoZmnbibVLaIKuGSARAX2alFv4kwLbJaLBNbzo=";
+          persistentKeepalive = 60;
+          allowedIPs = [
+            "10.100.0.2/32"
+            "192.168.11.0/24"
+          ];
+          endpoint = "site2.feal.no:51902";
+        }
+        { # Sulu
+          publicKey = "j6YVekgGS4nhL5zUiOTeK2BVQkYGlTQaiUpwcqQyfRk=";
+          allowedIPs = [
+            "10.100.0.3/32"
+          ];
+        }
+        { # Worf
+          publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So=";
+          allowedIPs = [
+            "10.100.0.4/32"
+          ];
+        }
+        { # Phone
+          publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
+          allowedIPs = [
+            "10.100.0.5/32"
+          ];
+        }
+        { # Riker
+          publicKey = "r715vpgH1H0zvN+Z5wcNKcOo5e6UM3fBfh9BZwTBjmA=";
+          allowedIPs = [
+            "10.100.0.6/32"
+          ];
+        }
+        { # Work-laptop
+          publicKey = "px4YstB16lFjgdLQkH55wz8gQRupX/LTxg8dNFijDTA=";
+          allowedIPs = [
+            "10.100.0.7/32"
+          ];
+        }
+      ];
     };
   };
 }

hosts/fa-t14-2025/configuration.nix

@@ -1,66 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-{
-  imports = [
-    ../../base.nix
-    ./hardware-configuration.nix
-
-    ./desktop.nix
-  ];
-
-  networking = {
-    networkmanager.enable = true;
-    wireguard.enable = true;
-
-    tempAddresses = "disabled";
-    hostName = "fa-t14-2025";
-    nameservers = [ "9.9.9.9" ];
-    domain = "it.hime.no";
-    hostId = "f458d6aa";
-
-    search = [
-      "mktv.no"
-      "mktv.local"
-    ];
-  };
-
-  services.openssh.openFirewall = false;
-
-  environment.systemPackages = with pkgs; [
-    inetutils
-    wireguard-tools
-  ];
-
-  virtualisation.docker = {
-    enable = true;
-    rootless = {
-      enable = true;
-      setSocketVariable = true;
-    };
-  };
-
-  users.users.felixalb = {
-    uid = 1000;
-    openssh.authorizedKeys.keys = [ ];
-    extraGroups = [ "networkmanager" ];
-  };
-
-  console.keyMap = "no";
-
-  nixpkgs.config = {
-    allowUnfreePredicate =
-      pkg:
-      builtins.elem (lib.getName pkg) [
-        "microsoft-edge"
-        "securecrt"
-        "securefx"
-      ];
-  };
-
-  system.stateVersion = "25.05";
-}

hosts/fa-t14-2025/desktop.nix

@@ -1,58 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-  hardware.graphics.enable = true;
-  services.xserver = {
-    enable = true;
-    xkb = {
-      options = "ctrl:nocaps";
-      layout = "no";
-    };
-  };
-  services.displayManager.ly.enable = true;
-  services.gnome.gnome-keyring.enable = true;
-
-  programs.hyprland = {
-    # See configuration (through home-manager) in home/hypr
-    enable = true;
-    withUWSM = true;
-    xwayland.enable = true;
-  };
-
-  # Audio
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    pulse.enable = true;
-    jack.enable = true;
-  };
-
-  # Fonts
-  fonts = {
-    fontDir.enable = true;
-    packages = with pkgs; [
-      noto-fonts
-      noto-fonts-color-emoji
-      noto-fonts-cjk-sans
-      font-awesome
-      fira-code
-      hack-font
-      nerd-fonts.hack
-    ];
-  };
-
-  # Misc:
-  xdg.portal = {
-    enable = true;
-    wlr.enable = true;
-  };
-  location.provider = "geoclue2";
-  security.polkit.enable = true;
-  services.dbus.packages = [ pkgs.gcr ];
-  services.openssh.settings.X11Forwarding = true;
-  programs.nm-applet.enable = true;
-}

hosts/fa-t14-2025/hardware-configuration.nix

@@ -1,53 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-  boot.kernelParams = [ "resume_offset=3037184" "mem_sleep_default=deep" ];
-  boot.resumeDevice = "/dev/disk/by-uuid/75dd0e39-9411-48c9-822d-bf3c897d0f61";
-
-  powerManagement.enable = true;
-  services.power-profiles-daemon.enable = true;
-  services.logind.settings.Login = {
-    HandleLidSwitch = "suspend-then-hibernate";
-    HandleLidSwitchDocked = "ignore";
-    HandlwPowerKey = "suspend-then-hibernate";
-    HandlePowerKeyLongPress = "poweroff";
-  };
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/75dd0e39-9411-48c9-822d-bf3c897d0f61";
-      fsType = "ext4";
-    };
-
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/3ecaedab-415c-4cce-a3a9-9f3782acb682";
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/0800-59D9";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-    swapDevices = [
-      {
-        device = "/var/lib/swapfile";
-        size = 32*1024;
-      }
-    ];
-
-  networking.useDHCP = lib.mkDefault false;
-  # networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/fa-t14-2025/home.nix

@@ -1,113 +0,0 @@
-{ pkgs, lib, ... }:
-let
-  emailAddress = "felix.albrigtsen@mktv.no";
-in
-{
-  imports = [
-    ./../../home/base.nix
-    ./../../home/alacritty.nix
-    ./../../home/waybar.nix
-    ./../../home/hypr
-  ];
-
-  home.packages = with pkgs; [
-    bc
-    catimg
-    chromium
-    dig
-    element-desktop
-    gnumeric
-    hunspellDicts.en_US
-    hunspellDicts.nb_NO
-    iperf3
-    jq
-    libreoffice
-    microsoft-edge
-    mpv
-    nixpkgs-2211.remmina
-    oauth2ms
-    oldssh
-    openssl
-    openvpn
-    pavucontrol
-    pwgen
-    traceroute
-    virt-manager
-    w3m
-
-    # Window Manager Extras
-    brightnessctl
-    cliphist
-    nautilus
-    rofi-rbw-wayland
-    swaynotificationcenter
-    wl-clipboard
-
-    (python312.withPackages (
-      ps: with ps; [
-        numpy
-        pycryptodome
-        requests
-      ]
-    ))
-  ];
-
-  wayland.windowManager.hyprland = {
-    enable = true;
-    # Override settings from home/hypr/hyprland.nix
-    settings.config.input = {
-      kb_layout = "no";
-      kb_variant = "";
-    };
-  };
-
-  programs = {
-    aerc = {
-      enable = true;
-      package = pkgs.aerc;
-    };
-    firefox = {
-      enable = true;
-      configPath = ".mozilla/firefox"; # Old default before 26.05
-    };
-    git.settings.user.email = emailAddress;
-    rbw = {
-      enable = true;
-      settings = {
-        base_url = "https://vault.mktv.no";
-        email = emailAddress;
-        pinentry = pkgs.pinentry-rofi;
-        lock_timeout = 60 * 60 * 8;
-      };
-    };
-    rofi = {
-      enable = true;
-      # theme = "iggy";
-      theme = "Arc-Dark";
-    };
-    waybar.enable = true;
-    zsh = {
-      shellAliases = {
-        "kssh" = "ssh -t controlnode ssh";
-        "ossh" =
-          "oldssh -oHostKeyAlgorithms=+ssh-dss -oCiphers=+aes256-cbc -oKexAlgorithms=+diffie-hellman-group14-sha1";
-        "rebuild" = "sudo nixos-rebuild switch --flake /config";
-      };
-      prezto.pmodules = [ "ssh" ];
-    };
-  };
-
-  xdg.mimeApps = {
-    enable = true;
-
-    defaultApplications = {
-      "text/html" = "firefox.desktop";
-      "x-scheme-handler/http" = "firefox.desktop";
-      "x-scheme-handler/https" = "firefox.desktop";
-      "x-scheme-handler/about" = "firefox.desktop";
-      "x-scheme-handler/unknown" = "firefox.desktop";
-    };
-  };
-
-  home.stateVersion = "25.05";
-}

hosts/felixalbpc/configuration.nix

@@ -0,0 +1,72 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../base.nix
+      ./hardware-configuration.nix
+      ./desktop
+  ];
+
+  networking = {
+    interfaces.eno1 = {
+      useDHCP = true;
+      ipv6.addresses = [
+        { address = "2001:700:300:22::15"; prefixLength = 64; }
+      ];
+    };
+
+    tempAddresses = "disabled";
+    hostName = "felixalbpc";
+    nameservers = [ "129.241.0.200" "129.241.0.201" "2001:700:300::200" "2001:700:300::201" ];
+    domain = "it.ntnu.no";
+    hostId = "f458d6aa";
+
+    search = [
+      "it.ntnu.no"
+      "ntnu.no"
+    ];
+
+    # Allow SSH from IT and SSH gateways
+    firewall.extraCommands = ''
+      # IT VPN
+      iptables -I nixos-fw -p tcp -m tcp --dport 22 --source 129.241.117.0/24 -j nixos-fw-accept
+      ip6tables -I nixos-fw -p tcp -m tcp --dport 22 --source 2001:700:301:12::/63 -j nixos-fw-accept
+
+      # SSHGW
+      iptables -I nixos-fw -p tcp -m tcp --dport 22 --source 129.241.160.72/32 -j nixos-fw-accept
+      ip6tables -I nixos-fw -p tcp -m tcp --dport 22 --source 2001:700:300:6::72/128 -j nixos-fw-accept
+
+      # SSHGW
+      iptables -I nixos-fw -p tcp -m tcp --dport 22 --source 129.241.210.217/32 -j nixos-fw-accept
+      ip6tables -I nixos-fw -p tcp -m tcp --dport 22 --source 2001:700:300:1900::1:217/128 -j nixos-fw-accept
+    '';
+
+    firewall.extraStopCommands = ''
+      iptables -F nixos-fw
+      ip6tables -F nixos-fw
+    '';
+  };
+
+  console.keyMap = "no";
+
+  nixpkgs.config = {
+    allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+      "copilot.vim"
+      "keymapp"
+      "tlclient"
+    ];
+  };
+
+  services.openssh.openFirewall = false;
+
+  users.users.felixalb = {
+    uid = 1328256;
+    openssh.authorizedKeys.keys = [ ];
+  };
+
+  hardware.keyboard.zsa.enable = true;
+
+  system.stateVersion = "24.05";
+}
+

hosts/felixalbpc/desktop/default.nix

@@ -0,0 +1,112 @@
+{ config, pkgs, lib, ... }:
+{
+  services.xserver = {
+    enable = true;
+    # displayManager.lightdm = {
+    #   enable = true;
+    # };
+    xkb = {
+      # options = "ctrl:nocaps";
+      options = "nodeakeys";
+      variant = "altgr-intl";
+      layout = "us";
+    };
+    windowManager.qtile.enable = true;
+  };
+  services.displayManager.ly.enable = true;
+
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+  };
+
+  hardware.keyboard.zsa.enable = true;
+  environment.sessionVariables = {
+    NIXOS_OZONE_WL = "1";
+    SSH_AUTH_SOCK = "/run/user/${toString config.users.users.felixalb.uid}/keyring/ssh";
+  };
+
+  home-manager.users.felixalb = {
+    services = {
+      dunst.enable = true;
+    };
+    home.packages = with pkgs; [
+      i3lock
+      libnotify
+      pamixer
+      pavucontrol
+      picom
+      sxhkd
+      xclip
+      xss-lock
+    ];
+
+    programs.alacritty.settings = {
+      font.size = lib.mkForce 11;
+    };
+  };
+
+  services.gnome.gnome-keyring.enable = true;
+
+  hardware.graphics.enable = true;
+
+  # Audio
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+  hardware.pulseaudio.enable = false;
+
+  # Fonts
+  fonts = {
+    fontDir.enable = true;
+    packages = with pkgs; [
+      noto-fonts
+      noto-fonts-emoji
+      noto-fonts-cjk-sans
+      font-awesome
+      fira-code
+      hack-font
+      (nerdfonts.override {
+        fonts = [
+          "Hack"
+        ];
+      })
+    ];
+  };
+
+  # # Dark mode
+  # home-manager.users.felixalb = {
+  #   dconf.settings = {
+  #     "org/gnome/desktop/interface" = {
+  #       color-scheme = "prefer-dark";
+  #     };
+  #   };
+
+  #   gtk = {
+  #     enable = true;
+  #     theme = {
+  #       name = "Adwaita-dark";
+  #       package = pkgs.gnome.gnome-themes-extra;
+  #     };
+  #   };
+  # };
+
+  # qt = {
+  #   enable = true;
+  #   platformTheme = "gnome";
+  #   style = "adwaita-dark";
+  # };
+
+  # Misc:
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+  };
+  location.provider = "geoclue2";
+  security.polkit.enable = true;
+  services.dbus.packages = [ pkgs.gcr ];
+  services.openssh.settings.X11Forwarding = true;
+}

hosts/felixalbpc/hardware-configuration.nix

@@ -0,0 +1,35 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  boot.initrd.luks.devices."cryptlvm".device = "/dev/disk/by-uuid/7516ebdb-14c3-4cb5-9d06-5e9d0e34b798";
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/02ac773e-31ff-4579-ad9a-859ba74f2a9e";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/77ED-720D";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-label/swap"; }
+    ];
+
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/felixalbpc/home.nix

@@ -0,0 +1,104 @@
+{ pkgs, lib, ... }:
+let
+  emailAddress = "felix.albrigtsen@ntnu.no";
+in {
+  imports = [
+    ./../../home/base.nix
+    ./../../home/alacritty.nix
+  ];
+
+  home.packages = with pkgs; [
+    bc
+    catimg
+    chromium
+    dante
+    dig
+    element-desktop
+    hunspellDicts.en_US
+    hunspellDicts.nb_NO
+    jq
+    keymapp
+    libreoffice
+    maim
+    mpv
+    nixpkgs-2211.remmina
+    oauth2ms
+    openssl
+    puppet-lint
+    pwgen
+    rofi-rbw-x11
+    tlclient
+    traceroute
+    virt-manager
+    w3m
+
+    # Window Manager Extras
+    bibata-cursors
+    hyprcursor
+    hypridle
+    hyprlock
+    hyprpaper
+    hyprshot
+    hyprswitch
+    nautilus
+    # rofi-rbw-wayland
+    swaynotificationcenter
+    waybar
+    wl-clipboard
+    cliphist
+
+    (python311.withPackages (ps: with ps; [
+      numpy
+      pycryptodome
+      requests
+
+      python-designateclient
+      python-heatclient
+      python-magnumclient
+      python-novaclient
+      python-openstackclient
+    ]))
+  ];
+
+  programs = {
+    aerc = {
+      enable = true;
+      package = pkgs.aerc;
+    };
+    alacritty.enable = true;
+    firefox.enable = true;
+    git.extraConfig.user.email = emailAddress;
+    rbw = {
+      enable = true;
+      settings = {
+        base_url = "https://bitwarden.it.ntnu.no";
+        email = emailAddress;
+        pinentry = pkgs.pinentry-rofi;
+      };
+    };
+    rofi = {
+      enable = true;
+      theme = "iggy";
+    };
+    zsh = {
+      shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
+      prezto.pmodules = [ "ssh" ];
+    };
+
+    neovim.plugins = with pkgs.vimPlugins; [ copilot-vim ];
+  };
+
+  xdg.mimeApps = {
+    enable = true;
+
+    defaultApplications = {
+      "text/html" = "firefox.desktop";
+      "x-scheme-handler/http" = "firefox.desktop";
+      "x-scheme-handler/https" = "firefox.desktop";
+      "x-scheme-handler/about" = "firefox.desktop";
+      "x-scheme-handler/unknown" = "firefox.desktop";
+    };
+  };
+
+  home.stateVersion = "24.05";
+}

hosts/leonard/backup.nix

@@ -1,43 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  services.restic.backups = let
-    localJob = name: paths: {
-      inherit paths;
-      repository = "/mnt/feal-syn1/backup/leonard/${name}"; # TODO - Mount first
-      passwordFile = config.sops.secrets."restic/${name}".path;
-      initialize = true;
-      pruneOpts = [
-        "--keep-daily 3"
-        "--keep-weekly 4"
-        "--keep-monthly 3"
-      ];
-    };
-    cloudJob = name: paths: {
-      inherit paths;
-      # "rsyncnet" connection details specified in /root/.ssh/config
-      extraOptions = [ "rclone.program=\"ssh rsyncnet\"" ];
-      # repository = "rclone::/${name}";
-      repository = "rclone:";
-      passwordFile = config.sops.secrets."restic/${name}".path;
-      initialize = true;
-      pruneOpts = [
-        # rsync.net keeps daily snapshots
-        "--keep-weekly 4"
-        "--keep-monthly 36"
-      ];
-    };
-  in {
-    # TODO - local NAS backups
-    mysql-remote = (cloudJob "postgres" [ "/var/backup/mysql" ]) // {
-      timerConfig.OnCalendar = "01:30"; # 1h after mysqlBackup
-    };
-    # WIP
-    # postgres-remote = (cloudJob "postgres" [ "/tank/backup/postgresql" ]) // {
-    #   timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
-    # };
-
-  };
-
-  sops.secrets."restic/mysql" = { };
-  sops.secrets."restic/postgres" = { };
-}

hosts/leonard/configuration.nix

@@ -1,55 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports =
-    [
-      ../../base.nix
-      ../../common/metrics-exporters.nix
-      ../../common/auto-upgrade.nix
-      ./hardware-configuration.nix
-
-      ./backup.nix
-      ./services/mysql.nix
-      ./services/nginx.nix
-      ./services/postgresql.nix
-
-      ./services/wiki-wackattack-eu.nix
-      ./services/www-feal-no
-      ./services/www-kinealbrigtsen-no.nix
-      ./services/www-amalie-mansaker-no
-  ];
-
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/sda";
-
-  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
-
-  networking = {
-    hostName = "leonard";
-    defaultGateway = "192.168.10.1";
-    interfaces.ens18.ipv4 = {
-      addresses = [
-        { address = "192.168.10.207"; prefixLength = 24; }
-      ];
-    };
-    hostId = "b99c12d1";
-
-    # Prepend the following output rules to disallow talking to other devices on LAN
-    firewall.extraCommands = lib.strings.concatLines ([
-      "iptables -F OUTPUT"
-    ] ++ (map (addr: "iptables -A OUTPUT -p udp --dport 53 -d ${addr} -j nixos-fw-accept") config.networking.nameservers) ++ [ # Exception for DNS
-      "iptables -A OUTPUT -p tcp --dport 3100 -d 192.168.10.175 -j nixos-fw-accept" # Exception for loki logging
-      "iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
-      "iptables -A OUTPUT -d 192.168.10.0/24 -j nixos-fw-refuse"
-      "iptables -A OUTPUT -d 192.168.11.0/24 -j nixos-fw-refuse"
-    ]);
-  };
-
-  sops.defaultSopsFile = ../../secrets/leonard/leonard.yaml;
-
-  environment.variables = { EDITOR = "vim"; };
-
-  system.stateVersion = "25.05";
-}
-

hosts/leonard/services/postgresql.nix

@@ -1,20 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  services.postgresql = {
-    enable = true;
-    enableTCPIP = false;
-    authentication = pkgs.lib.mkOverride 10 ''
-      #type database  DBuser  auth-method
-      local all       all     trust
-    '';
-  };
-
-  services.postgresqlBackup = {
-    enable = true;
-    location = "/backup/postgresql/";
-    startAt = "*-*-* 03:15:00";
-    backupAll = true;
-  };
-
-  environment.systemPackages = [ config.services.postgresql.package ];
-}

hosts/leonard/services/wiki-wackattack-eu.nix

@@ -1,38 +0,0 @@
-{ config, ... }:
-let
-  bindIP = "127.0.1.2";
-  port = 5051;
-  cfg = config.services.wiki-js;
-in {
-  # sops.secrets."wikijs/envfile" = {
-  #   restartUnits = [ "wiki-js.service" ];
-  # };
-
-  services.wiki-js = {
-    enable = true;
-    # environmentFile = config.sops.secrets."wikijs/envfile".path;
-    settings = {
-      inherit bindIP port;
-      db = {
-        type = "postgres";
-        host = "/run/postgresql";
-        db = "wiki-js";
-        user = "wiki-js";
-      };
-    };
-  };
-
-  services.postgresql = {
-    ensureDatabases = [ "wiki-js" ];
-    ensureUsers = [{
-      name = "wiki-js";
-      ensureDBOwnership = true;
-    }];
-  };
-
-  services.nginx.virtualHosts."wiki.wackattack.eu" = {
-    locations."/" = {
-      proxyPass = "http://${bindIP}:${toString port}";
-    };
-  };
-}

hosts/leonard/services/www-amalie-mansaker-no/default.nix

@@ -1,11 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  services.nginx.virtualHosts."amalie.mansaker.no" = let
-    siteContent = pkgs.callPackage ./site.nix { };
-  in {
-    locations = {
-      "/".root = siteContent;
-    };
-  };
-}

hosts/leonard/services/www-amalie-mansaker-no/site.nix

@@ -1,26 +0,0 @@
-{ stdenv, fetchgit, hugo }:
-stdenv.mkDerivation {
-  name = "www-amalie-mansaker-no";
-
-  src = fetchgit {
-    url = "https://git.feal.no/amalieem/amalie.mansaker.no.git";
-    fetchSubmodules = true;
-
-    rev = "f5ff8133b9d31de0de7386be8831de0d0fab6f95";
-    hash = "sha256-fld2f9PW1vwnals6kUerXzqGP/anMs7abstaYfaXO4Q=";
-  };
-
-  nativeBuildInputs = [ hugo ];
-  buildPhase = ''
-    cp -r $src/* .
-    ${hugo}/bin/hugo
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r public/* $out/
-    runHook postInstall
-  '';
-}
-

hosts/leonard/services/www-feal-no/default.nix

@@ -1,26 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  services.nginx.virtualHosts."feal.no" = {
-    default = true;
-
-    serverAliases = [
-      "www.feal.no"
-    ];
-
-    locations = {
-      # TODO: Reinstate actual website
-      "/".return = "302 https://git.feal.no/";
-
-      "^~ /.well-known/" = {
-        alias = (toString ./well-known) + "/";
-      };
-
-      "/cc/" = {
-        alias = "${pkgs.cyberchef}/share/cyberchef/";
-        index = "index.html";
-      };
-      "= /cc".return = "302 /cc/";
-    };
-  };
-}

hosts/leonard/services/www-feal-no/well-known/matrix/client

@@ -1,5 +0,0 @@
-{
-	"m.homeserver": {
-		"base_url": "https://matrix.feal.no:443"
-	}
-}

hosts/leonard/services/www-feal-no/well-known/matrix/server

@@ -1 +0,0 @@
-{"m.server": "matrix.feal.no:443"}

hosts/malcolm/configuration.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+
+    ../../base.nix
+    ../../common/metrics-exporters.nix
+
+    ./services/mysql.nix
+    ./services/nginx.nix
+    ./services/www-kinealbrigtsen-no.nix
+  ];
+
+  networking = {
+    hostName = "malcolm";
+    bridges.br0.interfaces = [ "ens18" ];
+    interfaces.br0.useDHCP = false;
+    interfaces.br0.ipv4.addresses = [
+      { address = "192.168.11.106"; prefixLength = 24; }
+    ];
+
+    hostId = "620c42d0";
+    defaultGateway = "192.168.11.1";
+
+    # Prepend the following output rules to disallow talking to other devices on LAN
+    firewall.extraCommands = lib.strings.concatLines ([
+      "iptables -F OUTPUT"
+    ] ++ (map (addr: "iptables -A OUTPUT -p udp --dport 53 -d ${addr} -j nixos-fw-accept") config.networking.nameservers) ++ [ # Exception for DNS
+      "iptables -A OUTPUT -p tcp --dport 3100 -d 192.168.10.175 -j nixos-fw-accept" # Exception for loki logging
+      "iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
+      "iptables -A OUTPUT -d 192.168.10.0/24 -j nixos-fw-refuse"
+      "iptables -A OUTPUT -d 192.168.11.0/24 -j nixos-fw-refuse"
+    ]);
+  };
+
+  # virtualisation.oci-containers.backend = "docker";
+  # systemd.services.docker.postStart = lib.concatMapStringsSep "\n" (rule: "${pkgs.iptables}/bin/iptables ${rule}") ([
+  #   "-F DOCKER-USER"
+  # ] ++ (map (addr: "-A DOCKER-USER -p udp --dport 53 -d ${addr} -j RETURN") config.networking.nameservers) ++ [
+  #   "-A DOCKER-USER -d 192.168.10.0/24 -j REJECT"
+  #   "-A DOCKER-USER -d 192.168.11.0/24 -j REJECT"
+  #   "-A DOCKER-USER -j RETURN"
+  # ]);
+
+  system.stateVersion = "24.05";
+}

hosts/malcolm/hardware-configuration.nix

@@ -1,3 +1,6 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 
 {
@@ -11,17 +14,17 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/4a70c1d5-9d72-4581-8f75-733b91c10669";
+    { device = "/dev/disk/by-uuid/7240554f-d9d9-457a-91d5-c70c09d96595";
       fsType = "ext4";
     };
 
-  swapDevices = [ {
+  fileSystems."/boot" =
-    device = "/swapfile";
+    { device = "/dev/disk/by-uuid/88C2-BAC8";
-    size = 4*1024;
+      fsType = "vfat";
-  } ];
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
 
-  networking.useDHCP = lib.mkDefault false;
+  swapDevices = [ ];
-  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/malcolm/home.nix

@@ -0,0 +1,12 @@
+{ pkgs, lib, ... }:
+{
+  imports = [
+    ./../../home/base.nix
+  ];
+
+  programs = {
+    zsh.shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
+  };
+
+  home.stateVersion = "24.05";
+}

hosts/malcolm/services/mysql.nix

@@ -6,8 +6,5 @@
     package = pkgs.mariadb;
   };
 
-  services.mysqlBackup = {
+  # TODO: services.mysqlBackup
-    enable = true;
-    calendar = "00:30:00";
-  };
 }

hosts/malcolm/services/nginx.nix

@@ -2,18 +2,16 @@
 {
   services.nginx = {
     enable = true;
-    enableReload = true;
+
+    clientMaxBodySize = "100m";
 
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
+
+    virtualHosts."kinealbrigtsen.no".default = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "felix@albrigtsen.it";
-  };
 }

hosts/malcolm/services/www-kinealbrigtsen-no.nix

@@ -20,9 +20,6 @@
       };
     }
   ];
-  services.mysqlBackup.databases = [
-    "www_kinealbrigtsen_no"
-  ];
 
   services.phpfpm.pools.www-kinealbrigtsen-no = {
     user = "www-kinealbrigtsen-no";
@@ -86,6 +83,7 @@
       set_real_ip_from 192.168.11.0/24;
       real_ip_header X-Forwarded-For;
 
+      add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
       add_header 'Referrer-Policy' 'origin-when-cross-origin';
       add_header X-Frame-Options DENY;
       add_header X-Content-Type-Options nosniff;

hosts/morn/configuration.nix

@@ -5,14 +5,7 @@
     [
       ../../base.nix
       ../../common/metrics-exporters.nix
-      ../../common/auto-upgrade.nix
       ./hardware-configuration.nix
-
-      ./services/nginx.nix
-
-      ./services/glance
-      ./services/miniflux.nix
-      ./services/thelounge.nix
   ];
 
   networking = {
@@ -20,13 +13,13 @@
     defaultGateway = "192.168.10.1";
     interfaces.ens18.ipv4 = {
       addresses = [
-        { address = "192.168.10.203"; prefixLength = 24; }
+        { address = "192.168.10.202"; prefixLength = 24; }
       ];
     };
     hostId = "89b7722d";
   };
 
-  sops.defaultSopsFile = ../../secrets/morn/morn.yaml;
+  sops.defaultSopsFile = ../../secrets/burnham/burnham.yaml;
 
   environment.variables = { EDITOR = "vim"; };
 

hosts/morn/hardware-configuration.nix

@@ -1,6 +1,3 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 
 {
@@ -14,20 +11,13 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/93307186-cbc3-4748-859f-0013a1e36def";
+    { device = "/dev/disk/by-uuid/31ff6d37-52d6-43c3-a214-5d38a6c38b0e";
       fsType = "ext4";
     };
 
-  fileSystems."/boot" =
+  swapDevices =
-    { device = "/dev/disk/by-uuid/FFCD-993A";
+    [ { device = "/dev/disk/by-uuid/cce59ee7-7c83-4165-a9b0-f950cd2e3273"; }
-      fsType = "vfat";
+    ];
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices = [ {
-    device = "/swapfile";
-    size = 4*1024;
-  } ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
@@ -36,5 +26,5 @@
   #networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
 
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/morn/services/glance/default.nix

@@ -1,15 +0,0 @@
-{ config, values, ... }:
-{
-  services.glance = {
-    enable = true;
-    settings = import ./settings.nix;
-  };
-
-  services.nginx.virtualHosts."glance.home.feal.no" = let
-    inherit (config.services.glance.settings.server) host port;
-  in {
-    locations."/" = {
-      proxyPass = "http://${host}:${toString port}";
-    };
-  };
-}

hosts/morn/services/glance/settings.nix

@@ -1,83 +0,0 @@
-{ config, ... }:
-
-{
-  server = {
-    port = 5001;
-    host = "127.0.1.2";
-  };
-
-  pages =
-    let
-      fullCol = widgets: {
-        size = "full";
-        inherit widgets;
-      };
-    in
-    [
-      {
-        name = "Home";
-        columns = [
-          (fullCol [
-            {
-              type = "search";
-              search-engine = "http://search.home.feal.no/search?q={QUERY}";
-            }
-            {
-              type = "weather";
-              units = "metric";
-              location = "Trondheim, Norway";
-            }
-          ])
-          (fullCol [
-            {
-              type = "hacker-news";
-              limit = 20;
-              collapse-after = 5;
-            }
-            {
-              type = "monitor";
-              cache = "5m";
-              sites =
-                let
-                  site = title: url: { inherit title url; };
-                in
-                [
-                  (site "Jellyfin" "http://jellyfin.home.feal.no")
-                  (site "Gitea" "https://git.feal.no")
-                  (site "VaultWarden" "https://pw.feal.no")
-                ];
-            }
-          ])
-        ];
-      }
-
-      {
-        name = "News";
-        columns =
-          let
-            feed = title: url: { inherit title url; };
-            rss = title: feeds: {
-              type = "rss";
-              inherit title feeds;
-            };
-          in
-          [
-            (fullCol [
-              (rss "Norway" [
-                (feed "NRK" "https://www.nrk.no/toppsaker.rss")
-                (feed "Bygdeposten" "https://www.bygdeposten.no/service/rss")
-                (feed "Nidaros" "https://www.nidaros.no/service/rss")
-              ])
-            ])
-
-            (fullCol [
-              (rss "NTNU" [
-                (feed "OmegaV" "https://omegav.no/newsrss")
-                (feed "PVV" "https://www.pvv.ntnu.no/w/api.php?hidebots=1&urlversion=1&days=7&limit=50&action=feedrecentchanges&feedformat=atom")
-                (feed "IT-Varsel" "https://varsel.it.ntnu.no/subscribe/rss/")
-              ])
-            ])
-          ];
-      }
-    ];
-}

hosts/morn/services/miniflux.nix

@@ -1,23 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  domain = "rss.home.feal.no";
-  listen_addr = "127.0.1.2:5051";
-in {
-  sops.secrets."miniflux/env" = { };
-
-  services.miniflux = {
-    enable = true;
-    adminCredentialsFile = config.sops.secrets."miniflux/env".path;
-    config = {
-      CREATE_ADMIN = true;
-
-      LISTEN_ADDR = listen_addr;
-      BASE_URL = "http://${domain}";
-    };
-  };
-
-  services.nginx.virtualHosts."${domain}" = {
-    locations."/".proxyPass = "http://${listen_addr}";
-  };
-}
-

hosts/sisko/configuration.nix

@@ -1,16 +1,16 @@
 { config, pkgs, lib, ... }:
 
 {
-  imports = [
+  imports =
+    [
       ../../base.nix
       ../../common/metrics-exporters.nix
       ./hardware-configuration.nix
+      ./desktop.nix
   ];
 
-  # Networking
   networking = {
     hostName = "sisko";
-    # networkmanager.enable = true;
     defaultGateway = "192.168.10.1";
     interfaces.enp14s0 = {
       ipv4 = {
@@ -22,112 +22,30 @@
     };
     hostId = "b716d781";
   };
+
   hardware.bluetooth.enable = true;
+  sops.defaultSopsFile = ../../secrets/sisko/sisko.yaml;
+  environment.variables = { EDITOR = "vim"; };
 
-  # Video
+  programs.gamemode.enable = true;
-  hardware.graphics = {
+  programs.steam = {
-    enable = true;
-    enable32Bit = true;
-  };
-  hardware.amdgpu.opencl.enable = true;
-
-  # Audio
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    pulse.enable = true;
-    jack.enable = true;
-  };
-
-  # Other hardware / devices
-  hardware.rtl-sdr.enable = true;
-
-  users.users.felixalb.extraGroups = [
-    "dialout"
-    "libvirtd"
-    "networkmanager"
-    "plugdev"
-  ];
-
-  # Desktop
-  programs.hyprland = {
-    # See configuration (through home-manager) in home/hypr
-    enable = true;
-    withUWSM = true;
-  };
-  services.displayManager.ly.enable = true;
-  services.xserver.enable = true;
-  services.xserver.desktopManager.xfce.enable = true;
-
-  fonts = {
-    fontDir.enable = true;
-    packages = with pkgs; [
-      fira-code
-      font-awesome
-      hack-font
-      nerd-fonts.hack
-      noto-fonts
-      noto-fonts-cjk-sans
-      noto-fonts-color-emoji
-    ];
-  };
-
-
-  # Programs
-  # TODO - Move to Home-Manager
-  programs = {
-    alvr = {
-      enable = true;
-      openFirewall = true;
-    };
-
-    firefox = {
-      enable = true;
-      nativeMessagingHosts.packages = with pkgs; [ tridactyl-native ];
-    };
-
-    gamemode.enable = true;
-
-    steam = {
     enable = true;
     remotePlay.openFirewall = true;
   };
 
-    virt-manager.enable = true;
-  };
-  environment.variables = {
-    SSH_AUTH_SOCK = "/run/user/${toString config.users.users.felixalb.uid}/keyring/ssh";
-    EDITOR = "vim";
-  };
-
-  # Virtualization
-  virtualisation = {
-    libvirtd.enable = true;
-    spiceUSBRedirection.enable = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-    virtiofsd
-  ];
-
-  virtualisation.docker.enable = true;
-  virtualisation.oci-containers.backend = "docker";
-
-  # Nix / meta
   nixpkgs.config = {
     allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+      "copilot.vim"
       "discord"
       "spotify"
       "steam"
       "steam-unwrapped"
+      "tlclient"
     ];
-    permittedInsecurePackages = [
-      "openssl-1.1.1w"
-    ];
-    rocmSupport = true;
   };
 
-  sops.defaultSopsFile = ../../secrets/sisko/sisko.yaml;
+
   services.fwupd.enable = true;
   system.stateVersion = "24.11";
 }
+

hosts/sisko/desktop.nix

@@ -0,0 +1,73 @@
+{ config, pkgs, lib, ... }:
+{
+  # Video
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+  hardware.amdgpu.opencl.enable = true;
+  services.displayManager.ly.enable = true;
+  services.xserver.enable = true;
+
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+  };
+
+  # Audio
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+  hardware.pulseaudio.enable = false;
+
+  # Misc
+  fonts = {
+    fontDir.enable = true;
+    packages = with pkgs; [
+      noto-fonts
+      noto-fonts-emoji
+      noto-fonts-cjk-sans
+      font-awesome
+      fira-code
+      hack-font
+      (nerdfonts.override {
+        fonts = [
+          "Hack"
+        ];
+      })
+    ];
+  };
+
+  environment.sessionVariables = {
+    NIXOS_OZONE_WL = "1";
+    SSH_AUTH_SOCK = "/run/user/${toString config.users.users.felixalb.uid}/keyring/ssh";
+  };
+
+  services.gnome.gnome-keyring.enable = true;
+
+  # Dark mode
+  home-manager.users.felixalb = {
+    dconf.settings = {
+      "org/gnome/desktop/interface" = {
+        color-scheme = "prefer-dark";
+      };
+    };
+
+    gtk = {
+      enable = true;
+      theme = {
+        name = "Adwaita-dark";
+        package = pkgs.gnome-themes-extra;
+      };
+    };
+  };
+
+  qt = {
+    enable = true;
+    platformTheme = "gnome";
+    style = "adwaita-dark";
+  };
+}

hosts/sisko/home.nix

@@ -4,54 +4,45 @@
   imports = [
     ./../../home/base.nix
     ./../../home/alacritty.nix
-    ./../../home/hypr/default.nix
-    ./../../home/waybar.nix
   ];
 
-  wayland.windowManager.hyprland.enable = true;
-
   home.packages = with pkgs; [
     # GUI Applications
-    cantata
     chromium
     discord
     easyeffects
     element-desktop
     emacs-gtk
-    feishin
+    papers
-    gqrx
+    jellyfin-media-player
     kitty
     libreoffice
-    lutris
     mpv
     mumble
-    orca-slicer
-    papers
     pavucontrol
     picard
-    pkgsRocm.hashcat
     prismlauncher
-    restic
-    runelite
-    spotify
     swayimg
+    spotify
     thunderbird
-    tor-browser
-    bolt-launcher
-
-    exiftool
-    ghidra
-    pwndbg
-    snicat
 
     # Window Manager Extras
-    cliphist
+    bibata-cursors
+    hyprcursor
+    hypridle
+    hyprlock
+    hyprpaper
+    hyprshot
+    hyprswitch
     nautilus
     networkmanager
     rofi-rbw-wayland
+    swaynotificationcenter
+    waybar
+    wl-clipboard
+    cliphist
 
     # Misc tools
-    abcde
     bc
     catimg
     dante
@@ -65,12 +56,10 @@
     openssl
     playerctl
     pwgen
-    restic
-    rocmPackages.clang
     traceroute
     w3m
 
-    (python313.withPackages (ps: with ps; [
+    (python312.withPackages (ps: with ps; [
       numpy
       pycryptodome
       requests
@@ -86,11 +75,13 @@
       enable = true;
       settings.window.opacity = 0.92;
     };
+    firefox.enable = true;
     ncmpcpp.enable = true;
+    neovim.plugins = with pkgs.vimPlugins; [ copilot-vim ];
     rbw = {
       enable = true;
       settings = {
-        base_url = "https://pw.home.feal.no";
+        base_url = "https://pw.feal.no";
         email = "felix@albrigtsen.it";
         pinentry = pkgs.pinentry-gnome3;
       };
@@ -98,8 +89,8 @@
     rofi = {
       enable = true;
       theme = "iggy";
+      package = pkgs.rofi-wayland;
     };
-    waybar.enable = true;
     zsh = {
       shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
       prezto.pmodules = [ "ssh" ];
@@ -107,8 +98,6 @@
   };
 
   services = {
-    gnome-keyring.enable = true;
-
     mpd = let
       home = config.home.homeDirectory;
     in {
@@ -125,27 +114,15 @@
     };
   };
 
-
+  home.pointerCursor = {
-  # Dark mode
+    name = "Bibata-Modern-Ice";
-  dconf.settings = {
+    package = pkgs.bibata-cursors;
-    "org/gnome/desktop/interface" = {
+    size = 24;
-      color-scheme = "prefer-dark";
+    gtk.enable = true;
-    };
+    x11 = {
-  };
-
-  gtk = {
       enable = true;
-    theme = {
+      defaultCursor = true;
-      name = "Adwaita-dark";
-      package = pkgs.gnome-themes-extra;
     };
-    gtk4.theme = config.gtk.theme;
-  };
-
-  qt = {
-    enable = true;
-    platformTheme.name = "adwaita";
-    style.name = "adwaita-dark";
   };
 
   xdg.mimeApps = {

hosts/voyager/backup.nix

@@ -0,0 +1,47 @@
+{ config, pkgs, lib, ... }:
+{
+  services.borgbackup.jobs =
+    let
+      borgJob = name: {
+        environment.BORG_RSH = "ssh -i /root/.ssh/fealsyn1";
+        environment.BORG_REMOTE_PATH = "/usr/local/bin/borg";
+        repo = "ssh://backup@feal-syn1.home.feal.no/volume2/backup/borg/voyager/${name}";
+        compression = "auto,zstd";
+      };
+    in {
+      postgresDaily = borgJob "postgres::daily" // {
+        paths = "/var/backup/postgres";
+        startAt = "*-*-* 05:15:00"; # 2 hours after postgresqlBackup
+        extraInitArgs = "--storage-quota 10G";
+        encryption = {
+          mode = "repokey-blake2";
+          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
+        };
+      };
+
+      postgresWeekly = borgJob "postgres::weekly" // {
+        paths = "/var/backup/postgres";
+        startAt = "Mon *-*-* 05:15:00"; # 2 hours after postgresqlBackup
+        extraInitArgs = "--storage-quota 10G";
+        encryption = {
+          mode = "repokey-blake2";
+          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
+        };
+      };
+
+      transmission = borgJob "transmission::weekly" // {
+        paths = "/var/lib/transmission";
+        startAt = "weekly";
+        encryption = {
+          mode = "repokey-blake2";
+          passCommand = "cat ${config.sops.secrets."borg/transmission".path}";
+        };
+      };
+
+      # TODO: timemachine, nextcloud, komga, calibre
+
+    };
+
+  sops.secrets."borg/postgres" = { };
+  sops.secrets."borg/transmission" = { };
+}

hosts/voyager/configuration.nix

@@ -0,0 +1,51 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../base.nix
+      ../../common/metrics-exporters.nix
+      ./hardware-configuration.nix
+      ./backup.nix
+      ./exports.nix
+      ./filesystems.nix
+
+      ./services/fancontrol.nix
+      ./services/podgrab.nix
+      ./services/snappymail.nix
+      ./services/timemachine.nix
+  ];
+
+  networking = {
+    hostName = "voyager";
+    bridges.br0.interfaces = [ "eno1" ];
+    interfaces.br0.useDHCP = false;
+    interfaces.br0.ipv4.addresses = [
+      { address = "192.168.10.165"; prefixLength = 24; }
+    ];
+
+    hostId = "8e84b235";
+    defaultGateway = "192.168.10.1";
+  };
+
+  sops.defaultSopsFile = ../../secrets/voyager/voyager.yaml;
+
+  environment.variables = { EDITOR = "vim"; };
+  environment.systemPackages = with pkgs; [
+    zfs
+  ];
+
+  virtualisation.docker.enable = true;
+  virtualisation.oci-containers.backend = "docker";
+
+  users.users."amalieem" = {
+    isNormalUser = true;
+    home = "/home/amalieem";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7e+BAoXIFmTeeBYAVImQAcyx6SCoYCErA7h16OGL70 amalieem@wentworth"
+    ];
+  };
+
+  system.stateVersion = "22.11";
+}
+

hosts/voyager/exports.nix

@@ -0,0 +1,27 @@
+{ config, pkgs, lib, ... }:
+{
+  fileSystems = {
+    "/export/riker-backup" = {
+      device = "/tank/backup/riker";
+      options = [ "bind" ];
+    };
+    "/export/defiant-backup" = {
+      device = "/tank/backup/defiant";
+      options = [ "bind" ];
+    };
+  };
+
+  # Enable nfs4 only
+  services.nfs.server = {
+    enable = true;
+    exports = ''
+      /export                   192.168.10.4(rw,fsid=0,no_subtree_check) 192.168.10.5(rw,fsid=0,no_subtree_check) 192.168.10.2(rw,fsid=0,no_subtree_check) 192.168.10.175(rw,fsid=0,no_subtree_check)
+      /export/riker-backup      192.168.10.2(rw,nohide,no_subtree_check,no_root_squash)
+      /export/doyle-backup      192.168.10.2(rw,nohide,no_subtree_check,no_root_squash)
+      /export/defiant-backup    192.168.10.175(rw,nohide,no_subtree_check,async,no_root_squash)
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ 111 2049 20048 ];
+  networking.firewall.allowedUDPPorts = [ 111 20048];
+}

hosts/voyager/filesystems.nix

@@ -0,0 +1,42 @@
+{ config, pkgs, lib, ... }:
+{
+  # Boot drives are defined in ./hardware-configuration.nix
+
+  environment.systemPackages = with pkgs; [ cifs-utils ];
+
+  # Local zfs
+  boot = {
+    zfs.extraPools = [ "tank" ];
+    supportedFilesystems = [ "zfs" ];
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+  };
+  services.zfs.autoScrub = {
+    enable = true;
+    interval = "Wed *-*-8..14 00:00:00";
+  };
+
+  # Network mounts (import)
+  fileSystems = {
+    "/mnt/feal-syn1/media" = {
+      device = "feal-syn1.home.feal.no:/volume2/media";
+      fsType = "nfs";
+      options = [ "vers=3" ];
+      #options = [ "x-systemd.automount" "noauto" ];
+    };
+    "/mnt/feal-syn1/nfs_proxmox" = {
+      device = "//feal-syn1.home.feal.no/nfs_proxmox";
+      fsType = "cifs";
+      options = let
+        # this line prevents hanging on network split
+        automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+
+      in ["${automount_opts},credentials=/etc/feal-syn1-credentials"];
+    };
+
+    "/var/backup" = {
+      device = "/tank/backup/voyager";
+      options = [ "bind "];
+    };
+  };
+
+}

hosts/voyager/hardware-configuration.nix

@@ -0,0 +1,38 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "mpt3sas" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/a6465c1c-4c93-423d-84a9-e4ecb9520741";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/D0C1-97CE";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno2.useDHCP = lib.mkDefault true;
+  # networking.interfaces.idrac.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/voyager/home.nix

@@ -0,0 +1,12 @@
+{ pkgs, lib, ... }:
+{
+  imports = [
+    ./../../home/base.nix
+  ];
+
+  programs = {
+    zsh.shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
+  };
+
+  home.stateVersion = "23.05";
+}

hosts/voyager/modules/snappymail.nix

@@ -0,0 +1,102 @@
+{ config, pkgs, lib, ... }:
+
+let
+  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkOption mkPackageOption generators types;
+
+  cfg = config.services.snappymail;
+  maxUploadSize = "256M";
+in {
+  options.services.snappymail = {
+    enable = mkEnableOption "Snappymail";
+
+    package = mkPackageOption pkgs "snappymail" { };
+
+    dataDir = mkOption {
+      type = types.str;
+      default = "/var/lib/snappymail";
+      description = "State directory for snappymail";
+    };
+
+    hostname = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "mail.example.com";
+      description = "Enable nginx with this hostname, null disables nginx";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "snappymail";
+      description = "System user under which snappymail runs";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "snappymail";
+      description = "System group under which snappymail runs";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users = mkIf (cfg.user == "snappymail") {
+      snappymail = {
+        description = "Snappymail service";
+        group = cfg.group;
+        home = cfg.dataDir;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "snappymail") {
+      snappymail = {};
+    };
+
+    services.phpfpm.pools.snappymail = {
+      user = cfg.user;
+      group = cfg.group;
+      phpOptions = generators.toKeyValue {} {
+        upload_max_filesize = maxUploadSize;
+        post_max_size = maxUploadSize;
+        memory_limit = maxUploadSize;
+      };
+
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "pm" = "ondemand";
+        "pm.max_children" = 32;
+        "pm.process_idle_timeout" = "10s";
+        "pm.max_requests" = 500;
+      };
+    };
+
+    services.nginx = mkIf (cfg.hostname != null) {
+      virtualHosts."${cfg.hostname}" = {
+        locations."/".extraConfig = ''
+          index index.php;
+          autoindex on;
+          autoindex_exact_size off;
+          autoindex_localtime on;
+        '';
+        locations."^~ /data".extraConfig = ''
+          deny all;
+        '';
+        locations."~ \\.php$".extraConfig = ''
+          include ${config.services.nginx.package}/conf/fastcgi_params;
+
+          fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
+          fastcgi_pass unix:${config.services.phpfpm.pools.snappymail.socket};
+        '';
+        extraConfig = ''
+          client_max_body_size ${maxUploadSize};
+        '';
+
+        root = if (cfg.package == pkgs.snappymail) then
+          pkgs.snappymail.override {
+            dataPath = cfg.dataDir;
+          }
+        else cfg.package;
+      };
+    };
+  };
+}

hosts/voyager/services/fancontrol.nix

@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }:
+{
+  systemd.timers."fancontrol" = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar="*:0/3";
+      Unit = "fancontrol.service";
+    };
+  };
+
+  systemd.services."fancontrol" = {
+    environment = {
+      TEMP_MIN_FALLING = "50";
+      TEMP_MAX_RISING = "56";
+      TEMP_CRIT = "70";
+
+      LOW_FAN_SPEED = "0x10";
+    };
+
+    script = ''
+      SET_FAN_MANUAL="0x30 0x30 0x01 0x00" # Enable manual control
+      SET_FAN_AUTO="0x30 0x30 0x01 0x01" # Disable manual control
+
+      SET_FAN_LOW="0x30 0x30 0x02 0xff $LOW_FAN_SPEED"
+      SET_FAN_MAX="0x30 0x30 0x02 0xff 0x64" # force 100%
+
+
+      # Get all temperatures readings starting with "Temp ", find all two digit numbers followed by spaces, find the largest one, trim the trailing space
+      maxcoretemp=$(${pkgs.ipmitool}/bin/ipmitool sdr type temperature | grep '^Temp ' |  grep -Po '\d{2} ' | sort -nr | head -n1 | xargs)
+
+      # Verify that we read a valid number
+      ISNUMBER='^[0-9]+$'
+      if ! [[ $maxcoretemp =~ $ISNUMBER ]] ; then
+        echo "Error: could not read temperature" >&2
+        exit 2
+      fi
+
+      echo "Highest measured CPU temperature: '$maxcoretemp'"
+
+      if [ "$maxcoretemp" -gt "$TEMP_CRIT" ]; then
+        echo "TOO HOT, CRITICAL CPU TEMP"
+        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MANUAL
+        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MAX
+        exit 1
+      fi
+
+      if [ "$maxcoretemp" -gt "$TEMP_MAX_RISING" ]; then
+        echo "TOO HOT, switching to IDRAC fan controL"
+        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_AUTO
+        exit 0
+      fi
+
+      if [ "$maxcoretemp" -lt "$TEMP_MIN_FALLING" ]; then
+        echo "Sufficiently cooled, stepping down fans"
+        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MANUAL
+        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_LOW
+        exit 0
+      fi
+
+      echo "Temperature is between limits, doing nothing..."
+    '';
+  };
+}

hosts/voyager/services/podgrab.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.podgrab;
+  domain = "podgrab.home.feal.no";
+in {
+  sops.secrets."podgrab/password" = { };
+
+  services.podgrab = {
+    enable = true;
+    port = 5104;
+    passwordFile = config.sops.secrets."podgrab/password".path;
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    locations."/".proxyPass = "http://localhost:${toString cfg.port}";
+  };
+
+  fileSystems."/tank/media/jellyfin/Podcasts" = {
+    device = "/var/lib/podgrab/data";
+    options = [ "bind "];
+  };
+}

hosts/voyager/services/snappymail.nix

@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [ ../modules/snappymail.nix ];
+
+  services.snappymail = {
+    enable = true;
+    hostname = "mail.home.feal.no";
+  };
+  services.nginx.virtualHosts."${config.services.snappymail.hostname}" = let
+    certPath = "/etc/ssl-snakeoil/home.feal.no";
+  in {
+    addSSL = true;
+
+    sslCertificate    = "${certPath}.crt";
+    sslCertificateKey = "${certPath}.key";
+  };
+}

hosts/voyager/vms.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, lib, ... }:
+{
+  # WIP
+  security.polkit.enable = true; # Required for libvirt
+  virtualisation.libvirtd.enable = true;
+  programs.dconf.enable = true;
+  environment.systemPackages = with pkgs; [ virt-manager ];
+  users.users.felixalb.extraGroups = [ "libvirtd" ];
+}
+

hosts/worf/configuration.nix

@@ -8,8 +8,6 @@
   nixpkgs.config.allowUnfree = true;
 
   nix = {
-    enable = true;
-
     # gc = {
     #   automatic = true;
     #   options = "--delete-older-than 2d";
@@ -76,8 +74,6 @@
     };
   };
 
-  ids.gids.nixbld = 30000;
-  system.primaryUser = "felixalb";
   users.users.felixalb = {
     home = "/Users/felixalb";
     shell = pkgs.zsh;
@@ -88,11 +84,16 @@
 
 
   fonts.packages = with pkgs; [
-    fira-code
-    font-awesome
-    hack-font
-    nerd-fonts.hack
     noto-fonts
+    font-awesome
+    fira-code
+    hack-font
+
+    (nerdfonts.override {
+      fonts = [
+        "Hack"
+      ];
+    })
   ];
 
   system.defaults = {
@@ -111,6 +112,13 @@
     };
 
 
+    # firewall settings
+    alf = {
+      # 0 = disabled 1 = enabled 2 = blocks all connections except for essential services
+      globalstate = 1;
+      loggingenabled = 0;
+    };
+
     # dock settings
     dock = {
       autohide = true;
@@ -126,16 +134,14 @@
     };
   };
 
-  # firewall settings
-  networking.applicationFirewall = {
-    enable = true;
-    blockAllIncoming = true;
-  };
-
   system.keyboard = {
     enableKeyMapping = true;
     remapCapsLockToControl = true;
   };
 
+  # Auto upgrade nix package and the daemon service.
+  services.nix-daemon.enable = true;
+  nix.package = pkgs.nix;
+
   system.stateVersion = 5;
 }

hosts/worf/home.nix

@@ -11,7 +11,8 @@
   ];
 
   home.packages = with pkgs; [
-    aerc
+    prismlauncher
+    # borgbackup
     bore-cli
     catimg
     cocoapods
@@ -20,14 +21,12 @@
     gnutar
     iterm2
     mosh
-    mpv
     nix-index
     nodejs
-    prismlauncher
-    restic
-    snicat
     spotify
     tldr
+    aerc
+    snicat
     w3m
     zellij
 
@@ -39,13 +38,13 @@
   ];
 
   programs.zsh = {
-    shellAliases."rebuild" = "sudo darwin-rebuild switch --flake /Users/felixalb/nix";
+    shellAliases."rebuild" = "darwin-rebuild switch --flake /Users/felixalb/nix";
     prezto.pmodules = [ "ssh" ];
   };
 
   programs.neovim.plugins = with pkgs.vimPlugins; [
-    coc-clangd
     coc-emmet
+    copilot-vim
     emmet-vim # Ctrl+y + ,
   ];
 
@@ -61,7 +60,7 @@
         apps = pkgs.buildEnv {
           name = "home-manager-applications";
           paths = config.home.packages;
-          pathsToLink = [ "/Applications" ] ;
+          pathsToLink = "/Applications";
         };
       in
       lib.hm.dag.entryAfter [ "writeBoundary" ] ''