Enable checks for pike and picard

A PR on nixpkgs is now open

.forgejo/workflows/build.yaml

@@ -8,7 +8,13 @@ jobs:
       - uses: actions/checkout@v4
         name: Checkout repository
       - name: Attic login
-        run: attic login nixfleet http://10.100.0.1:8081 ${{secrets.ATTIC_NIXFLEET_TOKEN}}
+        run: attic login nixfleet http://sisko.wg.aciceri.dev:8081 ${{secrets.ATTIC_NIXFLEET_TOKEN}}
+      - name: Setup SSH
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{secrets.FORGEJO_SSH_KEY}}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan github.com >> ~/.ssh/known_hosts
       - name: Build with nix
         run: nix-fast-build --no-nom --systems "x86_64-linux aarch64-linux" --attic-cache "nixfleet" --skip-cached --result-file result.json || true
       - name: Report checks

.forgejo/workflows/update-flake-lock.yaml

@@ -1,7 +1,7 @@
 name: update-flake-lock
 on:
   schedule:
-    - cron: "0 15 * * *" # daily at 15:00
+    - cron: "0 15 * * 1" # weekly on Monday at 15:00
 
 jobs:
   lockfile:

.gitignore

@@ -2,3 +2,4 @@ result
 .direnv
 .pre-commit-config.yaml
 *.qcow2
+result*

checks/default.nix

@@ -49,7 +49,7 @@
       build = _: nc: nc.config.system.build.toplevel;
     in
     {
-      x86_64-linux = lib.mapAttrs build { inherit (self.nixosConfigurations) picard; };
+      x86_64-linux = lib.mapAttrs build { inherit (self.nixosConfigurations) picard pike kirk; };
       aarch64-linux = lib.mapAttrs build {
         inherit (self.nixosConfigurations) sisko; # pbp;
       };

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1745630506,
+        "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "96e078c646b711aee04b82ba01aefbff87004ded",
         "type": "github"
       },
       "original": {
@@ -22,12 +22,15 @@
       }
     },
     "catppuccin": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1731232837,
-        "narHash": "sha256-0aIwr/RC/oe7rYkfJb47xjdEQDSNcqpFGsEa+EPlDEs=",
+        "lastModified": 1746175539,
+        "narHash": "sha256-/wjcn1CDQqOhwOoYKS8Xp0KejrdXSJZQMF1CbbrVtMw=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "32359bf226fe874d3b7a0a5753d291a4da9616fe",
+        "rev": "a5db9e41a4dccfa5ffe38e6f1841a5f9ad5c5c04",
         "type": "github"
       },
       "original": {
@@ -38,11 +41,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1730652660,
-        "narHash": "sha256-+XVYfmVXAiYA0FZT7ijHf555dxCe+AoAT5A6RU+6vSo=",
+        "lastModified": 1741481578,
+        "narHash": "sha256-JBTSyJFQdO3V8cgcL08VaBUByEU6P5kXbTJN6R0PFQo=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "a4ca93905455c07cb7e3aca95d4faf7601cba458",
+        "rev": "bb1c9567c43e4434f54e9481eb4b8e8e0d50f0b5",
         "type": "github"
       },
       "original": {
@@ -59,11 +62,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700795494,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
         "type": "github"
       },
       "original": {
@@ -80,11 +83,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731549112,
-        "narHash": "sha256-c9I3i1CwZ10SoM5npQQVnfwgvB86jAS3lT4ZqkRoSOI=",
+        "lastModified": 1745812220,
+        "narHash": "sha256-hotBG0EJ9VmAHJYF0yhWuTVZpENHvwcJ2SxvIPrXm+g=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "5fd852c4155a689098095406500d0ae3d04654a8",
+        "rev": "d0c543d740fad42fe2c035b43c9d41127e073c78",
         "type": "github"
       },
       "original": {
@@ -95,16 +98,16 @@
     },
     "dream2nix": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "purescript-overlay": "purescript-overlay",
         "pyproject-nix": "pyproject-nix"
       },
       "locked": {
-        "lastModified": 1731424167,
-        "narHash": "sha256-nKKeRwq7mxcW8cBTmPKzSg0DR/inVrtuJudVM81GISU=",
+        "lastModified": 1735160684,
+        "narHash": "sha256-n5CwhmqKxifuD4Sq4WuRP/h5LO6f23cGnSAuJemnd/4=",
         "owner": "nix-community",
         "repo": "dream2nix",
-        "rev": "44d41411686bc798876bd6d9f36a4c1143138d85",
+        "rev": "8ce6284ff58208ed8961681276f82c2f8f978ef4",
         "type": "github"
       },
       "original": {
@@ -115,15 +118,15 @@
     },
     "emacs-overlay": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1731574827,
-        "narHash": "sha256-QneOtCpfBNkgJCs32Y8LaKDpontw7W9ATQxIW4qb6qc=",
+        "lastModified": 1746240489,
+        "narHash": "sha256-DWMG7jkpxrEGzTZZerDqaxT8X983tibFGfNeoWtX1yU=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "4639038b0f5e66e7d0f3d103b8e44ded3ab7e337",
+        "rev": "66bb2d7a4df96d0c1e63648850b7aed1b2e8d683",
         "type": "github"
       },
       "original": {
@@ -167,11 +170,11 @@
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
@@ -188,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "lastModified": 1741352980,
+        "narHash": "sha256-+u2UunDA4Cl5Fci3m7S643HzKmIDAe+fiXrLqYsR2fs=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "rev": "f4330d22f1c5d2ba72d3d22df5597d123fdb60a9",
         "type": "github"
       },
       "original": {
@@ -201,87 +204,6 @@
         "type": "github"
       }
     },
-    "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "lix-eval-jobs",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nix-fast-build",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1722555600,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_4": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_2"
-      },
-      "locked": {
-        "lastModified": 1701473968,
-        "narHash": "sha256-YcVE5emp1qQ8ieHUnxt1wCZCC3ZfAS+SRRWZ2TMda7E=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "34fed993f1674c8d06d58b37ce1e0fe5eebcb9f5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_5": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixThePlanet",
-          "hercules-ci-effects",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1696343447,
-        "narHash": "sha256-B2xAZKLkkeRFG5XcHHSXXcP7To9Xzr59KXeZiRf4vdQ=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "c9afaba3dfa4085dbd2ccb38dfade5141e33d9d4",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-parts",
-        "type": "indirect"
-      }
-    },
     "flake-utils": {
       "inputs": {
         "systems": "systems_2"
@@ -323,11 +245,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "lastModified": 1743550720,
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
         "type": "github"
       },
       "original": {
@@ -357,15 +279,14 @@
         "gitignore": "gitignore",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable_2"
+        ]
       },
       "locked": {
-        "lastModified": 1731363552,
-        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "lastModified": 1742649964,
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
         "type": "github"
       },
       "original": {
@@ -417,25 +338,6 @@
         "type": "github"
       }
     },
-    "hercules-ci-effects": {
-      "inputs": {
-        "flake-parts": "flake-parts_5",
-        "nixpkgs": "nixpkgs_6"
-      },
-      "locked": {
-        "lastModified": 1701009247,
-        "narHash": "sha256-GuX16rzRze2y7CsewJLTV6qXkXWyEwp6VCZXi8HLruU=",
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "rev": "31b6cd7569191bfcd0a548575b0e2ef953ed7d09",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -444,11 +346,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703113217,
-        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
         "type": "github"
       },
       "original": {
@@ -485,11 +387,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733389730,
-        "narHash": "sha256-KZMu4ddMll5khS0rYkJsVD0hVqjMNHlhTM3PCQar0Ag=",
+        "lastModified": 1746243165,
+        "narHash": "sha256-DQycVmlyLQNLjLJ/FzpokVmbxGQ8HjQQ4zN4nyq2vII=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "65912bc6841cf420eb8c0a20e03df7cbbff5963f",
+        "rev": "c0962eeeabfb8127713f859ec8a5f0e86dead0f2",
         "type": "github"
       },
       "original": {
@@ -521,11 +423,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1731242966,
-        "narHash": "sha256-B3C3JLbGw0FtLSWCjBxU961gLNv+BOOBC6WvstKLYMw=",
+        "lastModified": 1737831083,
+        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "3ed3f0eaae9fcc0a8331e77e9319c8a4abd8a71a",
+        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
         "type": "github"
       },
       "original": {
@@ -546,11 +448,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1730739295,
-        "narHash": "sha256-aYeJ/P/9AuK6Kee63ZdsmDjEwhnksF+gIv/OyGtlBJE=",
+        "lastModified": 1745271491,
+        "narHash": "sha256-4GAHjus6JRpYHVROMIhFIz/sgLDF/klBM3UHulbSK9s=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "cef39a78679c266300874e7a7000b4da066228d4",
+        "rev": "995637eb3ab78eac33f8ee6b45cc2ecd5ede12ba",
         "type": "github"
       },
       "original": {
@@ -562,43 +464,17 @@
     "lix": {
       "flake": false,
       "locked": {
-        "lastModified": 1728951119,
-        "narHash": "sha256-vUBgL8zJBDyj2serxdEVbNqe6pBN4YgWwhtg3XP8mpQ=",
-        "rev": "f6077314fa6aff862758095bb55fe844e9162a1d",
-        "revCount": 16344,
-        "type": "git",
-        "url": "https://git@git.lix.systems/lix-project/lix"
-      },
-      "original": {
-        "rev": "f6077314fa6aff862758095bb55fe844e9162a1d",
-        "type": "git",
-        "url": "https://git@git.lix.systems/lix-project/lix"
-      }
-    },
-    "lix-eval-jobs": {
-      "inputs": {
-        "flake-parts": "flake-parts_2",
-        "lix": [
-          "lix"
-        ],
-        "nix-github-actions": "nix-github-actions",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1732351635,
-        "narHash": "sha256-H94CcQ3yamG5+RMxtxXllR02YIlxQ5WD/8PcolO9yEA=",
+        "lastModified": 1746186329,
+        "narHash": "sha256-MLz0MjeVCaqvIvf5szUwNwYEiXC/lKWL0I2VS+6V/e0=",
         "ref": "refs/heads/main",
-        "rev": "dfc286ca3dc49118c30d8d6205d6d6af76c62b7a",
-        "revCount": 617,
+        "rev": "4e84fd9a0061a04627ec6962c0ed08c2ad0b8a7f",
+        "revCount": 17824,
         "type": "git",
-        "url": "https://git.lix.systems/lix-project/nix-eval-jobs"
+        "url": "https://git@git.lix.systems/lix-project/lix"
       },
       "original": {
         "type": "git",
-        "url": "https://git.lix.systems/lix-project/nix-eval-jobs"
+        "url": "https://git@git.lix.systems/lix-project/lix"
       }
     },
     "lix-module": {
@@ -613,11 +489,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732603698,
-        "narHash": "sha256-Jw2MhzgCCrKV2MJytehG0cCLIAosBX71p8qmQ6XQlR4=",
+        "lastModified": 1742945498,
+        "narHash": "sha256-MB/b/xcDKqaVBxJIIxwb81r8ZiGLeKEcqokATRRroo8=",
         "ref": "refs/heads/main",
-        "rev": "15b999f9c958c475f71fb8c543b9fc2f36ae8730",
-        "revCount": 123,
+        "rev": "fa69ae26cc32dda178117b46487c2165c0e08316",
+        "revCount": 138,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/nixos-module"
       },
@@ -629,11 +505,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1730912712,
-        "narHash": "sha256-T5A9I6Tfh9zrv9sRWfu/ZKN6VkE670YQ6bjC5sbpTzk=",
+        "lastModified": 1743812405,
+        "narHash": "sha256-BedQ9Z3+nqtp9BRjHjJNPUeLIMVbTsP3Udbz0b1cUn0=",
         "owner": "NixOS",
         "repo": "mobile-nixos",
-        "rev": "2268e358ed407d9c0a4499ae767d105eeaeec586",
+        "rev": "6679fd7a8dd4ccf4aa538b82216723861cfe61a2",
         "type": "github"
       },
       "original": {
@@ -642,28 +518,6 @@
         "type": "github"
       }
     },
-    "nix-fast-build": {
-      "inputs": {
-        "flake-parts": "flake-parts_3",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix_2"
-      },
-      "locked": {
-        "lastModified": 1730278911,
-        "narHash": "sha256-CrbqsC+lEA3w6gLfpqfDMDEKoEta2sl4sbQK6Z/gXak=",
-        "owner": "Mic92",
-        "repo": "nix-fast-build",
-        "rev": "8e7c9d76979381441facb8888f21408312cf177a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "nix-fast-build",
-        "type": "github"
-      }
-    },
     "nix-formatter-pack": {
       "inputs": {
         "nixpkgs": [
@@ -690,32 +544,11 @@
         "type": "github"
       }
     },
-    "nix-github-actions": {
-      "inputs": {
-        "nixpkgs": [
-          "lix-eval-jobs",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1731952509,
-        "narHash": "sha256-p4gB3Rhw8R6Ak4eMl8pqjCPOLCZRqaehZxdZ/mbFClM=",
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "rev": "7b5f051df789b6b20d259924d349a9ba3319b226",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "type": "github"
-      }
-    },
     "nix-on-droid": {
       "inputs": {
         "home-manager": "home-manager_2",
         "nix-formatter-pack": "nix-formatter-pack",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
         "nixpkgs-docs": "nixpkgs-docs",
         "nixpkgs-for-bootstrap": "nixpkgs-for-bootstrap",
         "nmd": "nmd"
@@ -734,54 +567,13 @@
         "type": "github"
       }
     },
-    "nixDarwin": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_5"
-      },
-      "locked": {
-        "lastModified": 1731454423,
-        "narHash": "sha256-TtwvgFxUa0wyptLhQbKaixgNW1UXf3+TDqfX3Kp63oM=",
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "rev": "6c71c49e2448e51ad830ed211024e6d0edc50116",
-        "type": "github"
-      },
-      "original": {
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "nixThePlanet": {
-      "inputs": {
-        "flake-parts": "flake-parts_4",
-        "hercules-ci-effects": "hercules-ci-effects",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "osx-kvm": "osx-kvm"
-      },
-      "locked": {
-        "lastModified": 1731194612,
-        "narHash": "sha256-xOvzIdIFzy1LUgGLlOcimeHruZPLJpVdeEoHVOpH7sM=",
-        "owner": "MatthewCroughan",
-        "repo": "NixThePlanet",
-        "rev": "ef5fad336a55fcbb0680ad21aa58812b2f826435",
-        "type": "github"
-      },
-      "original": {
-        "owner": "MatthewCroughan",
-        "repo": "NixThePlanet",
-        "type": "github"
-      }
-    },
     "nixosHardware": {
       "locked": {
-        "lastModified": 1731403644,
-        "narHash": "sha256-T9V7CTucjRZ4Qc6pUEV/kpgNGzQbHWfGcfK6JJLfUeI=",
+        "lastModified": 1745955289,
+        "narHash": "sha256-mmV2oPhQN+YF2wmnJzXX8tqgYmUYXUj3uUUBSTmYN5o=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f6581f1c3b137086e42a08a906bdada63045f991",
+        "rev": "72081c9fbbef63765ae82bff9727ea79cc86bd5b",
         "type": "github"
       },
       "original": {
@@ -792,11 +584,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1703013332,
-        "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
+        "lastModified": 1745391562,
+        "narHash": "sha256-sPwcCYuiEopaafePqlG826tBhctuJsLx/mhKKM5Fmjo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
+        "rev": "8a2f738d9d1f1d986b5a4cd2fd2061a7127237d7",
         "type": "github"
       },
       "original": {
@@ -840,83 +632,68 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1730504152,
-        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
-      }
-    },
-    "nixpkgs-lib_2": {
-      "locked": {
-        "dir": "lib",
-        "lastModified": 1701253981,
-        "narHash": "sha256-ztaDIyZ7HrTAfEEUt9AtTDNoCYxUdSd6NrRHaYOIxtk=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e92039b55bcd58469325ded85d4f58dd5a4eaf58",
+        "lastModified": 1743296961,
+        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1746183838,
+        "narHash": "sha256-kwaaguGkAqTZ1oK0yXeQ3ayYjs8u/W7eEfrFpFfIDFA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bf3287dac860542719fe7554e21e686108716879",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgsSisko": {
+      "locked": {
+        "lastModified": 1742288794,
+        "narHash": "sha256-Txwa5uO+qpQXrNG4eumPSD+hHzzYi/CdaM80M9XRLCo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b6eaf97c6960d97350c584de1b6dcff03c9daf42",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b6eaf97c6960d97350c584de1b6dcff03c9daf42",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1744463964,
+        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
         "type": "github"
       },
       "original": {
-        "dir": "lib",
         "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1731386116,
-        "narHash": "sha256-lKA770aUmjPHdTaJWnP3yQ9OI1TigenUqVC3wweqZuI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "689fed12a013f56d4c4d3f612489634267d86529",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable_2": {
-      "locked": {
-        "lastModified": 1730741070,
-        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable_3": {
-      "locked": {
-        "lastModified": 1720386169,
-        "narHash": "sha256-NGKVY4PjzwAa4upkGtAMz1npHGoRzWotlSnVlqI40mo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "194846768975b7ad2c4988bdb82572c00222c0d7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1729850857,
         "narHash": "sha256-WvLXzNNnnw+qpFOmgaM3JUlNEH+T4s22b5i2oyyCpXE=",
@@ -932,13 +709,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
-        "lastModified": 1731319897,
-        "narHash": "sha256-PbABj4tnbWFMfBp6OcUK5iGy1QY+/Z96ZcLpooIbuEI=",
+        "lastModified": 1746141548,
+        "narHash": "sha256-IgBWhX7A2oJmZFIrpRuMnw5RAufVnfvOgHWgIdds+hc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dc460ec76cbff0e66e269457d7b728432263166c",
+        "rev": "f02fddb8acef29a8b32f10a335d44828d7825b78",
         "type": "github"
       },
       "original": {
@@ -948,7 +725,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1708172716,
         "narHash": "sha256-3M94oln0b61m3dUmLyECCA9hYAHXZEszM4saE3CmQO4=",
@@ -963,27 +740,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1718149104,
-        "narHash": "sha256-Ds1QpobBX2yoUDx9ZruqVGJ/uQPgcXoYuobBguyKEh8=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e913ae340076bbb73d9f4d3d065c2bca7caafb16",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1697723726,
-        "narHash": "sha256-SaTWPkI8a5xSHX/rrKzUe+/uVNy6zCGMXgoeMb7T9rg=",
+        "lastModified": 1746141548,
+        "narHash": "sha256-IgBWhX7A2oJmZFIrpRuMnw5RAufVnfvOgHWgIdds+hc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7c9cc5a6e5d38010801741ac830a3f8fd667a7a0",
+        "rev": "f02fddb8acef29a8b32f10a335d44828d7825b78",
         "type": "github"
       },
       "original": {
@@ -994,22 +757,6 @@
       }
     },
     "nixpkgs_7": {
-      "locked": {
-        "lastModified": 1733212471,
-        "narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_8": {
       "locked": {
         "lastModified": 1682134069,
         "narHash": "sha256-TnI/ZXSmRxQDt2sjRYK/8j8iha4B4zP2cnQCZZ3vp7k=",
@@ -1061,22 +808,6 @@
         "type": "gitlab"
       }
     },
-    "osx-kvm": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1701316418,
-        "narHash": "sha256-Sk8LYhFovoMX1ln7DWYArJQphW2a4h8Xg7/ZEZXwZv4=",
-        "owner": "kholia",
-        "repo": "OSX-KVM",
-        "rev": "09daff670a7eb9ff616073df329586c5995623a9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "kholia",
-        "repo": "OSX-KVM",
-        "type": "github"
-      }
-    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": [
@@ -1087,15 +818,14 @@
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable_3"
+        ]
       },
       "locked": {
-        "lastModified": 1730302582,
-        "narHash": "sha256-W1MIJpADXQCgosJZT8qBYLRuZls2KSiKdpnTVdKBuvU=",
+        "lastModified": 1741379162,
+        "narHash": "sha256-srpAbmJapkaqGRE3ytf3bj4XshspVR5964OX5LfjDWc=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "af8a16fe5c264f5e9e18bcee2859b40a656876cf",
+        "rev": "b5a62751225b2f62ff3147d0a334055ebadcd5cc",
         "type": "github"
       },
       "original": {
@@ -1158,16 +888,13 @@
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
         "lix": "lix",
-        "lix-eval-jobs": "lix-eval-jobs",
         "lix-module": "lix-module",
         "mobile-nixos": "mobile-nixos",
-        "nix-fast-build": "nix-fast-build",
         "nix-on-droid": "nix-on-droid",
-        "nixDarwin": "nixDarwin",
-        "nixThePlanet": "nixThePlanet",
         "nixosHardware": "nixosHardware",
-        "nixpkgs": "nixpkgs_7",
-        "treefmt-nix": "treefmt-nix_3",
+        "nixpkgs": "nixpkgs_6",
+        "nixpkgsSisko": "nixpkgsSisko",
+        "treefmt-nix": "treefmt-nix",
         "vscode-server": "vscode-server"
       }
     },
@@ -1179,11 +906,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730601085,
-        "narHash": "sha256-Sgax33jGuvVHTjl1P78IwzlhAGyOxtx5Q26inKja8S4=",
+        "lastModified": 1741573199,
+        "narHash": "sha256-A2sln1GdCf+uZ8yrERSCZUCqZ3JUlOv1WE2VFqqfaLQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "8d1b40f8dfd7539aaa3de56e207e22b3cc451825",
+        "rev": "c777dc8a1e35407b0e80ec89817fe69970f4e81a",
         "type": "github"
       },
       "original": {
@@ -1278,57 +1005,15 @@
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
-          "lix-eval-jobs",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1732292307,
-        "narHash": "sha256-5WSng844vXt8uytT5djmqBCkopyle6ciFgteuA9bJpw=",
+        "lastModified": 1746216483,
+        "narHash": "sha256-4h3s1L/kKqt3gMDcVfN8/4v2jqHrgLIe4qok4ApH5x4=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "705df92694af7093dfbb27109ce16d828a79155f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
-    "treefmt-nix_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nix-fast-build",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1723808491,
-        "narHash": "sha256-rhis3qNuGmJmYC/okT7Dkc4M8CeUuRCSvW6kC2f3hBc=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "1d07739554fdc4f8481068f1b11d6ab4c1a4167a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
-    "treefmt-nix_3": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1730321837,
-        "narHash": "sha256-vK+a09qq19QNu2MlLcvN4qcRctJbqWkX7ahgPZ/+maI=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "746901bb8dba96d154b66492a29f5db0693dbfcc",
+        "rev": "29ec5026372e0dec56f890e50dbe4f45930320fd",
         "type": "github"
       },
       "original": {
@@ -1340,7 +1025,7 @@
     "vscode-server": {
       "inputs": {
         "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_8"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
         "lastModified": 1729422940,

flake.nix

@@ -3,6 +3,7 @@
 
   inputs = {
     flakeParts.url = "github:hercules-ci/flake-parts";
+    nixpkgsSisko.url = "github:NixOS/nixpkgs/b6eaf97c6960d97350c584de1b6dcff03c9daf42";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixosHardware.url = "github:NixOS/nixos-hardware";
     homeManager = {
@@ -28,16 +29,9 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     dream2nix.url = "github:nix-community/dream2nix";
-    nixThePlanet = {
-      url = "github:MatthewCroughan/NixThePlanet/";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    nixDarwin = {
-      url = "github:LnL7/nix-darwin";
-    };
     nix-on-droid.url = "github:nix-community/nix-on-droid";
     lix = {
-      url = "git+https://git@git.lix.systems/lix-project/lix?rev=f6077314fa6aff862758095bb55fe844e9162a1d"; # FIXME update
+      url = "git+https://git@git.lix.systems/lix-project/lix"; # FIXME update
       flake = false;
     };
     lix-module = {
@@ -45,11 +39,6 @@
       inputs.lix.follows = "lix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    lix-eval-jobs = {
-      url = "git+https://git.lix.systems/lix-project/nix-eval-jobs";
-      inputs.lix.follows = "lix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     mobile-nixos = {
       url = "github:NixOS/mobile-nixos";
       flake = false;
@@ -62,10 +51,6 @@
     };
     catppuccin.url = "github:catppuccin/nix";
     emacs-overlay.url = "github:nix-community/emacs-overlay";
-    nix-fast-build = {
-      url = "github:Mic92/nix-fast-build";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs =

hmModules/chirp/default.nix

@@ -1,8 +1,4 @@
 { pkgs, ... }:
-let
-in
-# nixpkgs = builtins.getFlake "github:NixOS/nixpkgs/932fc16b263f26803d3960e4400bc13dde84a972";
-# chirp = nixpkgs.legacyPackages.${pkgs.system}.chirp;
 {
   home.packages = [ pkgs.chirp ];
 }

hmModules/cura/default.nix

@@ -1,31 +1,6 @@
 { pkgs, ... }:
 {
   home.packages = [
-    (
-      let
-        cura5 = pkgs.appimageTools.wrapType2 rec {
-          pname = "cura5";
-          version = "5.8.0";
-          src = pkgs.fetchurl {
-            url = "https://github.com/Ultimaker/Cura/releases/download/${version}/UltiMaker-Cura-${version}-linux-X64.AppImage";
-            hash = "sha256-EojVAe+o43W80ES5BY3QgGRTxztwS+B6kIOfJOtULOg=";
-          };
-        };
-      in
-      pkgs.writeScriptBin "cura" ''
-        #! ${pkgs.bash}/bin/bash
-        # AppImage version of Cura loses current working directory and treats all paths relateive to $HOME.
-        # So we convert each of the files passed as argument to an absolute path.
-        # This fixes use cases like `cd /path/to/my/files; cura mymodel.stl anothermodel.stl`.
-        args=()
-        for a in "$@"; do
-          if [ -e "$a" ]; then
-            a="$(realpath "$a")"
-          fi
-          args+=("$a")
-        done
-        QT_QPA_PLATFORM=xcb exec "${cura5}/bin/cura5" "''${args[@]}"
-      ''
-    )
+    pkgs.cura-appimage
   ];
 }

hmModules/discord/default.nix

@@ -1,6 +1,11 @@
 { pkgs, ... }:
 {
-  home.packages = [ pkgs.discord ];
+  home.packages = [
+    (pkgs.discord.override {
+      withOpenASAR = true;
+      withVencord = true;
+    })
+  ];
   home.file.".config/discord/settings.json".text = builtins.toJSON {
     SKIP_HOST_UPDATE = true;
   };

hmModules/element/default.nix

@@ -1,7 +1,6 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 {
-  # home.packages = [pkgs.schildichat-desktop];
-  home.packages = [ pkgs.element-desktop-wayland ];
+  home.packages = [ pkgs.element-desktop ];
 
   systemd.user.services.element-desktop = {
     Install.WantedBy = [ "graphical-session.target" ];
@@ -12,8 +11,7 @@
     };
 
     Service = {
-      # ExecStart = "${pkgs.schildichat-desktop}/bin/schildichat-desktop"; # TODO I preferred SchildiChat but it was removed from nixpkgs becuase unsafe
-      ExecStart = "${pkgs.element-desktop-wayland}/bin/element-desktop";
+      ExecStart = lib.getExe pkgs.element-desktop;
       Restart = "on-failure";
       RestartSec = 3;
     };

hmModules/emacs/default.nix

@@ -46,25 +46,17 @@ in
       nodejs_20
       qadwaitadecorations
       kdePackages.qtwayland
+      copilot-language-server.fhs
+      math-preview
+      emacs-lsp-booster
     ]
     ++ (with hunspellDicts; [
       en_US-large
       it_IT
     ]);
-  home.activation.cloneCcrEmacsFlake =
-    let
-      path = lib.makeBinPath (
-        with pkgs;
-        [
-          git
-          openssh
-        ]
-      );
-    in
-    lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-      PATH=$PATH:${path}
+  home.activation.linkEmacsConfig = lib.hm.dag.entryAnywhere ''
     if [ ! -d "$HOME/.config/emacs" ]; then
-        mkdir "$HOME/.config/emacs"
+      $DRY_RUN_CMD mkdir "$HOME/.config/emacs"
       $DRY_RUN_CMD ln -s "$HOME/projects/aciceri/nixfleet/hmModules/emacs/init.el" "$HOME/.config/emacs/init.el"
       $DRY_RUN_CMD ln -s "$HOME/.config/emacs" "$HOME/emacs"
     fi

hmModules/emacs/init.el

@@ -37,6 +37,10 @@
   (consult-eglot-embark-mode)
   )
 
+(use-package eglot-booster
+  :after eglot
+  :config (eglot-booster-mode))
+
 (use-package emacs
   :bind (("<mouse-4>" . scroll-down-line)
 	     ("<mouse-5>" . scroll-up-line)
@@ -48,8 +52,6 @@
   (native-comp-async-report-warnings-errors nil)
   (inhibit-startup-message t)
   (visible-bell t)
-  (scroll-conservatively 101) ;; more than 100 => redisplay doesn't recenter point)
-  (scroll-margin 3)
   (temporary-file-directory "~/.emacs-saves/")
   (backup-directory-alist `(("." . ,temporary-file-directory)))
   (auto-save-files-name-transforms `((".*" ,temporary-file-directory t)))
@@ -58,6 +60,9 @@
   (mouse-autoselect-window t)
   (treesit-font-lock-level 4)
   (custom-file "~/.config/emacs/custom.el")
+  (frame-title-format "%b - Emacs")
+  (indent-tabs-mode nil)
+  (tab-width 4)
   :config
   (set-face-background 'vertical-border (face-background 'default))
   (set-display-table-slot standard-display-table 'vertical-border (make-glyph-code ?┃))
@@ -84,6 +89,13 @@
       (async-shell-command (format "sudo nixos-rebuild --flake fleet %s -L" operation) buffer-name)))
   )
 
+(use-package ultra-scroll
+  :init
+  (setq scroll-conservatively 101 ; important!
+        scroll-margin 0)
+  :config
+  (ultra-scroll-mode 1))
+
 (use-package doc-view
   :custom
   (doc-view-scale-internally nil)
@@ -135,6 +147,12 @@
   (add-hook 'next-error-hook #'pulsar-pulse-line)
   )
 
+(use-package visual-replace
+  :defer t
+  :bind (("C-c r" . visual-replace)
+         :map isearch-mode-map
+         ("C-c r" . visual-replace-from-isearch)))
+
 (use-package clipetty
   :delight
   :hook (after-init . global-clipetty-mode))
@@ -171,6 +189,13 @@
   (indent-bars-prefer-character 't) ;; so it works also in terminal
   )
 
+(use-package copilot
+  :custom
+  (copilot-max-char -1)
+  (copilot-indent-offset-warning-disable 't)
+  :hook (prog-mode org-mode)
+  :bind (("C-<tab>" . copilot-accept-completion)))
+
 (use-package diredfl
   :config (diredfl-global-mode))
 
@@ -191,6 +216,8 @@
   :custom
   (meow-use-clipboard 't)
   :config
+  (require 'meow-tree-sitter)
+  (meow-tree-sitter-register-defaults)
   (add-hook 'after-make-frame-functions (defun ccr/meow--prepare-face (_)
 					  (meow--prepare-face)
 					  (remove-hook 'after-make-frame-functions 'ccr/meow--prepare-face)))
@@ -353,7 +380,9 @@
   (vertico-mode t)
   :bind (:map vertico-map
 	      (("DEL" . vertico-directory-delete-char)
-	       ("C-DEL" . vertico-directory-delete-word))))
+	       ("C-DEL" . vertico-directory-delete-word)
+	       ("M-q" . vertico-quick-insert)
+	       ("C-q" . vertico-quick-exit))))
 
 ;; (use-package vertico-posframe
 ;;   :after vertico
@@ -443,11 +472,10 @@
 (use-package magit-delta
   :hook (magit-mode . magit-delta-mode))
 
-;; FIXME
-;; (use-package magit-todos
-;;   :after magit
-;;   :custom (magit-todos-keyword-suffix "\\(?:([^)]+)\\)?:?")
-;;   :config (magit-todos-mode 1))
+(use-package magit-todos
+  :after magit
+  :custom (magit-todos-keyword-suffix "\\(?:([^)]+)\\)?:?")
+  :config (magit-todos-mode 1))
 
 (use-package difftastic
   :demand t
@@ -500,6 +528,9 @@
 (use-package dockerfile-ts-mode
   :mode "Dockerfile\\'")
 
+(use-package lean4-mode
+  :mode "\\.lean\\'")
+
 (use-package python-ts-mode
   :hook ((python-ts-mode . (lambda ()
 			     (require 'eglot)
@@ -508,18 +539,37 @@
 			     (eglot-ensure))))
   :mode "\\.py\\'")
 
+(use-package solidity-mode
+  :hook ((solidity-mode . (lambda ()
+			    (require 'eglot)
+			    (add-to-list 'eglot-server-programs
+					 '(solidity-mode . ("nomicfoundation-solidity-language-server" "--stdio")))
+			    (eglot-ensure))))
+  :mode "\\.sol\\'")
+
+
 (use-package typescript-ts-mode
   :hook ((typescript-ts-mode . (lambda ()
 				 (require 'eglot)
 				 (eglot-ensure))))
   :mode "\\.ts\\'")
 
+(use-package rust-mode
+  :init
+  (setq rust-mode-treesitter-derive t)
+  :hook ((rust-mode . (lambda ()
+			(require 'eglot)
+			(eglot-ensure)))))
+
 (use-package haskell-ts-mode
   :hook ((haskell--ts-mode . eglot-ensure))
   :mode "\\.hs\\'"
   :config
   (add-to-list 'eglot-server-programs
-	       '(haskell-ts-mode . ("haskell-language-server-wrapper" "--lsp"))))
+	           '(haskell-ts-mode . ("haskell-language-server" "--lsp"))))
+
+(use-package tidal
+  :custom ((tidal-interpreter "tidal")))
 
 (use-package purescript-mode
   :custom ((project-vc-extra-root-markers '("spago.dhall")))
@@ -543,9 +593,21 @@
 (use-package sh-mode
   :hook (sh-mode . bash-ts-mode))
 
+(use-package kdl-ts-mode
+  :mode "\\.kdl\\'")
+
 (use-package gptscript-mode
   :mode "\\.gpt\\'")
 
+(use-package gptscript-mode
+  :mode "\\.gpt\\'")
+
+(use-package typst-ts-mode
+  :config
+  (add-to-list 'eglot-server-programs
+	           '(typst-ts-mode . ("tinymist" "lsp")))
+  :mode "\\.typ\\'")
+
 ;; FIXME
 ;; (use-package mmm-mode
 ;;   :config
@@ -606,7 +668,6 @@
   (add-to-list 'eat-semi-char-non-bound-keys '[?\e 108]) ; M-l
   (eat-update-semi-char-mode-map)
   (eat-reload)
-  :hook (eat-mode . (lambda () (setq-local scroll-margin 0)))
   :bind (("C-c o t" . eat-project))
   ;; FIXME doesn't work well
   ;; ((eat-mode . compilation-shell-minor-mode))
@@ -618,7 +679,8 @@
   (eat-eshell-mode)
   (eat-eshell-visual-command-mode)
   :custom ((eshell-prefer-lisp-functions t)
-	   (eshell-history-size 10000))
+	   (eshell-history-size 10000)
+	   (eshell-banner-message ""))
   :config
   (defun ccr/start-eshell () ;; Used from outside Emacs by emacsclient --eval
     (eshell 'N)
@@ -644,20 +706,48 @@
 	  (defalias (car alias) (cdr alias)))
 	ccr/eshell-aliases)
 
-  :hook (eshell-mode . (lambda () (setq-local scroll-margin 0)))
+  
+  (defun ccr/eshell-get-current-input ()
+    "Restituisce l'input corrente dell'utente nella riga Eshell."
+    (when (eq major-mode 'eshell-mode)
+      (let ((start (save-excursion (eshell-bol) (point)))
+            (end (point-at-eol)))
+	(buffer-substring-no-properties start end))))
+
+  (defun ccr/eshell-replace-current-input (new-input)
+    (when (eq major-mode 'eshell-mode)
+      (let ((inhibit-read-only t))
+	(eshell-bol)
+	(delete-region (point) (point-at-eol))
+	(insert new-input)
+	(end-of-line))))
+
+  (defun ccr/eshell-history ()
+    (interactive)
+    (when (eq major-mode 'eshell-mode)
+      (let* ((current-input (ccr/eshell-get-current-input))
+             (eshell-history (when (and eshell-history-file-name
+					(file-readable-p eshell-history-file-name))
+                               (f-read-text eshell-history-file-name)))
+             (bash-history (when (file-readable-p "~/.bash_history")
+                             (f-read-text "~/.bash_history")))
+             (history (split-string (concat (or eshell-history "") "\n"
+                                            (or bash-history "")) "\n" t))
+             (selection (completing-read "History: " history nil t current-input)))
+	(ccr/eshell-replace-current-input selection))))
+  
   :bind (("C-c o e" . project-eshell)
-	 :map eshell-mode-map
-	 ("C-r" . eshell-atuin-history))) ;; i.e. just C-r in semi-char-mode
+	 (:map eshell-mode-map
+	       ("C-r" . ccr/eshell-history)
+	       ("C-<return>" . corfu-send)
+	       ))) ;; i.e. just C-r in semi-char-mode
 
 (use-package eshell-command-not-found
   :custom ((eshell-command-not-found-command "command-not-found"))
   :hook ((eshell-mode . eshell-command-not-found-mode)))
 
-(use-package eshell-atuin
-  :hook ((eshell-mode . eshell-atuin-mode)))
-
-(use-package fish-completion-mode
-  :hook ((eshell-mode . fish-completion-mode)))
+;; (use-package eshell-atuin
+;;   :hook ((eshell-mode . eshell-atuin-mode)))
 
 (use-package eshell-syntax-highlighting
   :custom
@@ -698,7 +788,7 @@
   :hook ((org-mode . variable-pitch-mode)
 	 (org-mode . visual-line-mode)
 	 (org-mode . visual-fill-column-mode))
-  :custom ((org-log-done 'time)
+  :custom ((org-log-done nil)
 	   (org-return-follows-link t)
 	   (org-hide-emphasis-markers t)
 	   (visual-fill-column-center-text t)
@@ -723,7 +813,6 @@
 	   (org-ellipsis "…")
 	   )
   :bind (("C-c o l" . org-store-link)
-	 ("C-c o a" . org-agenda)
 	 ("C-c o c" . org-capture)
 	 ("C-c b o" . org-switchb))
   :config
@@ -752,6 +841,7 @@ This is meant to be an helper to be called from the window manager."
   (add-hook 'org-attach-after-change-hook #'ccr/org-attach-save-file-list-to-property))
 
 (use-package org-agenda
+  :after org-super-agenda
   :custom
   (org-agenda-files '("~/org"))
   (org-agenda-tags-column 0)
@@ -762,7 +852,51 @@ This is meant to be an helper to be called from the window manager."
      " ┄┄┄┄┄ " "┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄"))
   (org-agenda-current-time-string
    "◀── now ─────────────────────────────────────────────────")
-  :bind (("C-c o a" . org-agenda)))
+  (org-super-agenda-groups
+   '(;; Each group has an implicit boolean OR operator between its selectors.
+     (:name "Today"		; Optionally specify section name
+            :time-grid t		; Items that appear on the time grid
+            :todo "TODAY")	; Items that have this TODO keyword
+     (:name "Important"
+            ;; Single arguments given alone
+            :tag "bills"
+            :priority "A")
+     ;; Set order of multiple groups at once
+     (:order-multi (2 (:name "Shopping in town"
+                             ;; Boolean AND group matches items that match all subgroups
+                             :and (:tag "shopping" :tag "@town"))
+                      (:name "Food-related"
+                             ;; Multiple args given in list with implicit OR
+                             :tag ("food" "dinner"))
+                      (:name "Personal"
+                             :habit t
+                             :tag "personal")
+                      (:name "Space-related (non-moon-or-planet-related)"
+                             ;; Regexps match case-insensitively on the entire entry
+                             :and (:regexp ("space" "NASA")
+					   ;; Boolean NOT also has implicit OR between selectors
+					   :not (:regexp "moon" :tag "planet")))))
+     ;; Groups supply their own section names when none are given
+     (:todo "WAITING" :order 8)	; Set order of this section
+     (:todo ("SOMEDAY" "TO-READ" "CHECK" "TO-WATCH" "WATCHING")
+            ;; Show this group at the end of the agenda (since it has the
+            ;; highest number). If you specified this group last, items
+            ;; with these todo keywords that e.g. have priority A would be
+            ;; displayed in that group instead, because items are grouped
+            ;; out in the order the groups are listed.
+            :order 9)
+     (:priority<= "B"
+		  ;; Show this section after "Today" and "Important", because
+		  ;; their order is unspecified, defaulting to 0. Sections
+		  ;; are displayed lowest-number-first.
+		  :order 1)
+     ;; After the last group, the agenda will display items that didn't
+     ;; match any of these groups, with the default order position of 99
+     ))
+  :bind (("C-c o a" . org-agenda))
+  :config
+  (org-super-agenda-mode)
+  )
 
 (use-package org-modern
   :after org
@@ -895,15 +1029,164 @@ This is meant to be an helper to be called from the window manager."
 
 (use-package gptel
   :custom
-  (gptel-api-key (lambda () (require 'f) (f-read-text (getenv "OPENAI_API_KEY_PATH"))))
-  (gptel-model 'gpt-4o)
+  (gptel-model 'google/gemini-2.5-flash-preview)
+  (gptel-backend (gptel-make-openai "OpenRouter"
+		           :host "openrouter.ai"
+		           :endpoint "/api/v1/chat/completions"
+		           :key (lambda () (require 'f) (f-read-text (getenv "OPENAI_API_KEY_PATH")))
+		           :stream t
+		           :models '(google/gemini-2.5-flash-preview))
+		         )
   (gptel-default-mode 'org-mode)
   (gptel-org-branching-context nil) ;; this is cool but I don't feel comfortable with it
+  (gptel-use-tools 't)
+  
+  :bind
+  ("C-c a a" . gptel-add)
+  ("C-c a f" . gptel-add-file)
+  ("C-c a r" . gptel-context-remove-all)
+  ("C-c a " . gptel-menu)
+
+
   :config
   (require 'gptel-curl)
 
-  (add-hook 'gptel-post-response-functions 'gptel-end-of-response)
-  (add-hook 'gptel-post-stream-hook 'gptel-auto-scroll)
+  ;; (add-hook 'gptel-post-response-functions 'gptel-end-of-response)
+  ;; (add-hook 'gptel-post-stream-hook 'gptel-auto-scroll)
+
+  (defun ccr/edit-buffer (buffer-name old-string new-string)
+    "In BUFFER-NAME, replace OLD-STRING with NEW-STRING."
+    (with-current-buffer buffer-name
+      (let ((case-fold-search nil))  ;; Case-sensitive search
+        (save-excursion
+          (goto-char (point-min))
+          (let ((count 0))
+            (while (search-forward old-string nil t)
+              (setq count (1+ count)))
+            (if (= count 0)
+                (format "Error: Could not find text to replace in buffer %s" buffer-name)
+              (if (> count 1)
+                  (format "Error: Found %d matches for the text to replace in buffer %s" count buffer-name)
+                (goto-char (point-min))
+                (search-forward old-string)
+                (replace-match new-string t t)
+                (format "Successfully edited buffer %s" buffer-name))))))))
+
+  (defun ccr/replace-buffer (buffer-name content)
+    "Completely replace contents of BUFFER-NAME with CONTENT."
+    (with-current-buffer buffer-name
+      (erase-buffer)
+      (insert content)
+      (format "Buffer replaced: %s" buffer-name)))
+  
+  (setq gptel-tools `(
+                      ,(gptel-make-tool
+                        :function (lambda (url)
+                                    (with-current-buffer (url-retrieve-synchronously url)
+                                      (goto-char (point-min))
+                                      (forward-paragraph)
+                                      (let ((dom (libxml-parse-html-region (point) (point-max))))
+                                        (run-at-time 0 nil #'kill-buffer (current-buffer))
+                                        (with-temp-buffer
+                                          (shr-insert-document dom)
+                                          (buffer-substring-no-properties (point-min) (point-max))))))
+                        :name "read_url"
+                        :description "Fetch and read the contents of a URL"
+                        :args (list '(:name "url"
+                                            :type string
+                                            :description "The URL to read"))
+                        :category "web")
+                      ,(gptel-make-tool
+                        :function (lambda (filepath)
+                                    (with-temp-buffer
+                                      (insert-file-contents (expand-file-name filepath))
+                                      (buffer-string)))
+                        :name "read_file"
+                        :description "Read and display the contents of a file"
+                        :args (list '(:name "filepath"
+                                            :type string
+                                            :description "Path to the file to read. Supports relative paths and ~."))
+                        :category "filesystem")
+                      ,(gptel-make-tool
+                        :function (lambda (directory)
+                                    (mapconcat #'identity
+                                               (directory-files directory)
+                                               "\n"))
+                        :name "list_directory"
+                        :description "List the contents of a given directory"
+                        :args (list '(:name "directory"
+                                            :type string
+                                            :description "The path to the directory to list"))
+                        :category "filesystem")
+                      ,(gptel-make-tool
+                        :function (lambda () (mapcar 'buffer-name (buffer-list)))
+                        :name "list_buffers"
+                        :description "Return a list containing all the Emacs buffers"
+                        :category "emacs")
+                      ,(gptel-make-tool
+                        :function (lambda (buffer)
+                                    (unless (buffer-live-p (get-buffer buffer))
+                                      (error "Error: buffer %s is not live." buffer))
+                                    (with-current-buffer buffer
+                                      (buffer-substring-no-properties (point-min) (point-max))))
+                        :name "read_buffer"
+                        :description "Return the contents of an Emacs buffer"
+                        :args (list '(:name "buffer"
+                                            :type string
+                                            :description "The name of the buffer whose contents are to be retrieved"))
+                        :category "emacs")
+                      ,(gptel-make-tool
+                        :function (lambda (buffer text)
+                                    (with-current-buffer (get-buffer-create buffer)
+                                      (save-excursion
+                                        (goto-char (point-max))
+                                        (insert text)))
+                                    (format "Appended text to buffer %s" buffer))
+                        :name "append_to_buffer"
+                        :description "Append text to an Emacs buffer. If the buffer does not exist, it will be created."
+                        :confirm t
+                        :args (list '(:name "buffer"
+                                            :type string
+                                            :description "The name of the buffer to append text to.")
+                                    '(:name "text"
+                                            :type string
+                                            :description "The text to append to the buffer."))
+                        :category "emacs")
+                      ,(gptel-make-tool
+                        :name "EditBuffer"
+                        :function #'ccr/edit-buffer
+                        :description "Edits Emacs buffers"
+                        :confirm t
+                        :args '((:name "buffer_name"
+                                       :type string
+                                       :description "Name of the buffer to modify"
+                                       :required t)
+                                (:name "old_string"
+                                       :type string
+                                       :description "Text to replace (must match exactly)"
+                                       :required t)
+                                (:name "new_string"
+                                       :type string
+                                       :description "Text to replace old_string with"
+                                       :required t))
+                        :category "edit")
+                      ,
+                      (gptel-make-tool
+                       :name "ReplaceBuffer"
+                       :function #'ccr/replace-buffer
+                       :description "Completely overwrites buffer contents"
+                       :confirm t
+                       :args '((:name "buffer_name"
+                                      :type string
+                                      :description "Name of the buffer to overwrite"
+                                      :required t)
+                               (:name "content"
+                                      :type string
+                                      :description "Content to write to the buffer"
+                                      :required t))
+                       :category "edit")
+                      ))
+
   
   (defun ccr/suggest-eshell-command ()
     (interactive)
@@ -932,9 +1215,7 @@ This is meant to be an helper to be called from the window manager."
   (defun ccr/start-chatgpt () ;; Used from outside Emacs by emacsclient --eval
     (display-buffer (gptel "*ChatGPT*"))
     (set-frame-name "floating")
-    ;; (delete-other-windows)
-    ;; (add-hook 'kill-buffer-hook 'delete-frame nil 't)
-    ) ;; destroy frame on exit
+    )
   )
 
 (use-package mixed-pitch
@@ -990,23 +1271,40 @@ This is meant to be an helper to be called from the window manager."
 
 ;;; Experiments, remove from here
 
-(defun ccr/test ()
-  "test"
+(defun ccr/test (niri-socket)
+  "Select a window and focus it based on `niri msg` output."
   (interactive)
+  (let* ((niri-output (ccr/niri-get-windows niri-socket))
+         (display-list (mapcar (lambda (entry)
+                                 (let ((title (cdr (assoc 'title entry)))
+                                       (app-id (cdr (assoc 'app_id entry)))
+                                       (id (cdr (assoc 'id entry))))
+                                   (cons (format "%s - %s" title app-id) id)))
+                               niri-output)))
     (with-selected-frame
-      (make-frame '((name . "emacs-run-launcher")
+        (make-frame '((name . "Emacs Selector")
                       (minibuffer . only)
-                    (fullscreen . 0) ; no fullscreen
-                    (undecorated . t) ; remove title bar
-                    ;;(auto-raise . t) ; focus on this frame
-                    ;;(tool-bar-lines . 0)
-                    ;;(menu-bar-lines . 0)
+                      (fullscreen . 0)
+                      (undecorated . t)
                       (internal-border-width . 10)
-                    (width . 80)
-                    (height . 11)))
+                      (width . 120)
+                      (height . 20)))
       (unwind-protect
-	(completing-read "ciao " '("foo" "bar") nil t "")
-      (delete-frame))))
+          (let* ((entry (completing-read "Select window: " (mapcar #'car display-list) nil t ""))
+                 (entry-id (cdr (assoc entry display-list)))  ;; Get the ID associated with the selected entry
+                 (command (format "NIRI_SOCKET=\"%s\" niri msg action focus-window --id %s" niri-socket entry-id)))
+	    (message command)
+            (shell-command command))
+        (delete-frame)))))
+
+
+(defun ccr/niri-get-windows (niri-socket)
+  "Esegue `niri msg --json windows` e parse l'output JSON in una alist."
+  (let* ((command (format "NIRI_SOCKET=\"%s\" niri msg --json windows" niri-socket))
+	 (output (shell-command-to-string command))
+	 (json-object-type 'alist)	; Usa alist per rappresentare gli oggetti JSON
+	 (parsed-json (json-read-from-string output)))
+    parsed-json))
 
 
 (provide 'init)

hmModules/firefox/default.nix

@@ -14,7 +14,10 @@ in
 {
   programs.firefox = {
     enable = true;
-    nativeMessagingHosts = [ pkgs.tridactyl-native ];
+    nativeMessagingHosts = [
+      pkgs.tridactyl-native
+      pkgs.vdhcoapp
+    ];
     policies = {
       DisableTelemetry = true;
       DisableFirefoxStudies = true;
@@ -63,7 +66,7 @@ in
     };
     profiles.default = {
       search.force = true;
-      search.default = "DuckDuckGo";
+      search.default = "google";
       search.engines = {
         "Searx" = {
           urls = [
@@ -79,7 +82,6 @@ in
           ];
         };
       };
-      bookmarks = [ ];
       extensions = [ ];
       userChrome = builtins.readFile ./userchrome.css;
     };

hmModules/gimp/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.gimp ];
+}

hmModules/git/default.nix

@@ -27,12 +27,18 @@ in
       rebase.autostash = true;
       github.user = "aciceri";
 
-      user.signingKey = "/home/${username}/.ssh/id_rsa";
+      user.signingKey = "/home/${username}/.ssh/id_ed25519";
       gpg.format = "ssh";
       commit.gpgsign = true;
 
-      credential.helper = "manager";
+      credential.helper = "libsecret";
       credential.credentialStore = "cache";
+
+      core = {
+        fsmonitor = true;
+        untrackedcache = true;
+      };
+      fetch.writeCommitGraph = true;
     };
 
     userName = config.name;
@@ -41,7 +47,8 @@ in
     extraConfig.url = {
       "ssh://git@github.com/".insteadOf = "https://github.com/";
       # Workaround for https://github.com/rust-lang/cargo/issues/3381#issuecomment-1193730972
-      "https://github.com/rust-lang/crates.io-index".insteadOf = "https://github.com/rust-lang/crates.io-index";
+      "https://github.com/rust-lang/crates.io-index".insteadOf =
+        "https://github.com/rust-lang/crates.io-index";
       "https://github.com/RustSec/advisory-db".insteadOf = "https://github.com/RustSec/advisory-db";
     };
 

hmModules/gpg/default.nix

@@ -2,24 +2,12 @@
 {
   services.gpg-agent = {
     enable = true;
-    enableSshSupport = true;
-    extraConfig =
-      let
-        pinentryRofi = pkgs.writeShellApplication {
-          name = "pinentry-rofi-with-env";
-          runtimeInputs = with pkgs; [
-            coreutils
-            rofi
-          ];
-          text = ''
-            "${pkgs.pinentry-rofi}/bin/pinentry-rofi" "$@"
-          '';
+    pinentry.package = pkgs.pinentry-rofi.override {
+      rofi = pkgs.rofi-wayland;
     };
-      in
-      ''
+    extraConfig = ''
       allow-emacs-pinentry
       allow-loopback-pinentry
-        pinentry-program ${pinentryRofi}/bin/pinentry-rofi-with-env
     '';
   };
 

hmModules/hyprland/default.nix

@@ -1,6 +1,7 @@
 {
   config,
   pkgs,
+  lib,
   ...
 }:
 let
@@ -54,7 +55,14 @@ in
 
   gtk = {
     enable = true;
-    # font.name = lib.mkForce "Sans,Symbols Nerd Font";
+    theme = {
+      name = "Catppuccin-GTK-Purple-Dark-Compact";
+      package = pkgs.magnetic-catppuccin-gtk.override {
+        accent = [ "purple" ];
+        shade = "dark";
+        size = "compact";
+      };
+    };
     iconTheme = {
       name = "Adwaita";
       package = pkgs.adwaita-icon-theme;
@@ -62,21 +70,21 @@ in
     cursorTheme = {
       name = "catppuccin-mocha-sapphire";
       package = pkgs.catppuccin-cursors;
-      size = 40;
+      size = 38;
     };
   };
 
-  qt = {
-    enable = true;
-  };
-
   home.file.".icons/catppuccin-mocha-sapphire" = {
     source = "${pkgs.catppuccin-cursors.mochaSapphire}/share/icons/catppuccin-mocha-sapphire-cursors";
     recursive = true;
   };
 
-  wayland.windowManager.hyprland = {
+  qt = {
     enable = true;
+  };
+
+  wayland.windowManager.hyprland = {
+    enable = false;
     plugins = with pkgs.hyprlandPlugins; [
       hy3
       hyprspace

hmModules/ib-tws/default.nix

@@ -0,0 +1,4 @@
+{ fleetFlake, pkgs, ... }:
+{
+  home.packages = [ fleetFlake.packages.${pkgs.system}.ib-tws ];
+}

hmModules/jellyfin/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.jellyfin-media-player ];
+}

hmModules/niri/config.kdl

@@ -0,0 +1,580 @@
+// This config is in the KDL format: https://kdl.dev
+// "/-" comments out the following node.
+// Check the wiki for a full description of the configuration:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Overview
+
+// Input device configuration.
+// Find the full list of options on the wiki:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Input
+input {
+    keyboard {
+        xkb {
+            layout "us"
+            // options "grp:win_space_toggle,compose:ralt,ctrl:nocaps"
+        }
+    }
+
+    // Next sections include libinput settings.
+    // Omitting settings disables them, or leaves them at their default values.
+    touchpad {
+        // off
+        tap
+        dwt
+        // dwtp
+        natural-scroll
+        // accel-speed 0.2
+        // accel-profile "flat"
+        // scroll-method "two-finger"
+        // disabled-on-external-mouse
+    }
+
+    mouse {
+        // off
+        // natural-scroll
+        // accel-speed 0.2
+        // accel-profile "flat"
+        // scroll-method "no-scroll"
+    }
+
+    trackpoint {
+        // off
+        // natural-scroll
+        // accel-speed 0.2
+        // accel-profile "flat"
+        // scroll-method "on-button-down"
+        // scroll-button 273
+        // middle-emulation
+    }
+
+    // Uncomment this to make the mouse warp to the center of newly focused windows.
+    warp-mouse-to-focus
+
+    // Focus windows and outputs automatically when moving the mouse into them.
+    // Setting max-scroll-amount="0%" makes it work only on windows already fully on screen.
+    focus-follows-mouse max-scroll-amount="0%"
+}
+
+cursor {
+    xcursor-theme "catppuccin-mocha-sapphire"
+    xcursor-size 38
+    hide-when-typing
+    hide-after-inactive-ms 10000
+}
+
+spawn-at-startup "xwayland-satellite"
+
+environment {
+    QT_QPA_PLATFORM "wayland"
+    DISPLAY ":0"
+}
+
+hotkey-overlay {
+    skip-at-startup
+}
+
+// You can configure outputs by their name, which you can find
+// by running `niri msg outputs` while inside a niri instance.
+// The built-in laptop monitor is usually called "eDP-1".
+// Find more information on the wiki:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Outputs
+// Remember to uncomment the node by removing "/-"!
+output "eDP-1" {
+    // Uncomment this line to disable this output.
+    // off
+
+    // Resolution and, optionally, refresh rate of the output.
+    // The format is "<width>x<height>" or "<width>x<height>@<refresh rate>".
+    // If the refresh rate is omitted, niri will pick the highest refresh rate
+    // for the resolution.
+    // If the mode is omitted altogether or is invalid, niri will pick one automatically.
+    // Run `niri msg outputs` while inside a niri instance to list all outputs and their modes.
+    mode "1920x1080@59.999"
+
+    // You can use integer or fractional scale, for example use 1.5 for 150% scale.
+    scale 1.1
+
+    // Transform allows to rotate the output counter-clockwise, valid values are:monitor
+    // normal, 90, 180, 270, flipped, flipped-90, flipped-180 and flipped-270.
+    transform "normal"
+
+    // Position of the output in the global coordinate space.
+    // This affects directional monitor actions like "focus-monitor-left", and cursor movement.
+    // The cursor can only move between directly adjacent outputs.
+    // Output scale and rotation has to be taken into account for positioning:
+    // outputs are sized in logical, or scaled, pixels.
+    // For example, a 3840×2160 output with scale 2.0 will have a logical size of 1920×1080,
+    // so to put another output directly adjacent to it on the right, set its x to 1920.
+    // If the position is unset or results in an overlap, the output is instead placed
+    // automatically.
+    // position x=1280 y=0
+}
+
+output "Dell Inc. DELL U2515H 9X2VY5170PJL" {
+  mode "2560x1440@59.951"
+  scale 1
+  transform "normal"
+}
+
+// Settings that influence how windows are positioned and sized.
+// Find more information on the wiki:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Layout
+layout {
+    // Set gaps around windows in logical pixels.
+    gaps 16
+
+    // When to center a column when changing focus, options are:
+    // - "never", default behavior, focusing an off-screen column will keep at the left
+    //   or right edge of the screen.
+    // - "always", the focused column will always be centered.
+    // - "on-overflow", focusing a column will center it if it doesn't fit
+    //   together with the previously focused column.
+    center-focused-column "never"
+
+    // You can customize the widths that "switch-preset-column-width" (Mod+R) toggles between.
+    preset-column-widths {
+        // Proportion sets the width as a fraction of the output width, taking gaps into account.
+        // For example, you can perfectly fit four windows sized "proportion 0.25" on an output.
+        // The default preset widths are 1/3, 1/2 and 2/3 of the output.
+        proportion 0.33333
+        proportion 0.5
+        proportion 0.66667
+
+        // Fixed sets the width in logical pixels exactly.
+        // fixed 1920
+    }
+
+    // You can also customize the heights that "switch-preset-window-height" (Mod+Shift+R) toggles between.
+    // preset-window-heights { }
+
+    // You can change the default width of the new windows.
+    default-column-width { proportion 0.5; }
+    // If you leave the brackets empty, the windows themselves will decide their initial width.
+    // default-column-width {}
+
+    // By default focus ring and border are rendered as a solid background rectangle
+    // behind windows. That is, they will show up through semitransparent windows.
+    // This is because windows using client-side decorations can have an arbitrary shape.
+    //
+    // If you don't like that, you should uncomment `prefer-no-csd` below.
+    // Niri will draw focus ring and border *around* windows that agree to omit their
+    // client-side decorations.
+    //
+    // Alternatively, you can override it with a window rule called
+    // `draw-border-with-background`.
+
+    // You can change how the focus ring looks.
+    focus-ring {
+        // Uncomment this line to disable the focus ring.
+        // off
+
+        // How many logical pixels the ring extends out from the windows.
+        width 2
+
+        // Colors can be set in a variety of ways:
+        // - CSS named colors: "red"
+        // - RGB hex: "#rgb", "#rgba", "#rrggbb", "#rrggbbaa"
+        // - CSS-like notation: "rgb(255, 127, 0)", rgba(), hsl() and a few others.
+
+        // Color of the ring on the active monitor.
+        active-color "#7fc8ff"
+
+        // Color of the ring on inactive monitors.
+        inactive-color "#505050"
+
+        // You can also use gradients. They take precedence over solid colors.
+        // Gradients are rendered the same as CSS linear-gradient(angle, from, to).
+        // The angle is the same as in linear-gradient, and is optional,
+        // defaulting to 180 (top-to-bottom gradient).
+        // You can use any CSS linear-gradient tool on the web to set these up.
+        // Changing the color space is also supported, check the wiki for more info.
+        //
+        // active-gradient from="#80c8ff" to="#bbddff" angle=45
+
+        // You can also color the gradient relative to the entire view
+        // of the workspace, rather than relative to just the window itself.
+        // To do that, set relative-to="workspace-view".
+        //
+        // inactive-gradient from="#505050" to="#808080" angle=45 relative-to="workspace-view"
+    }
+
+    // You can also add a border. It's similar to the focus ring, but always visible.
+    border {
+        // The settings are the same as for the focus ring.
+        // If you enable the border, you probably want to disable the focus ring.
+        off
+
+        width 4
+        active-color "#ffc87f"
+        inactive-color "#505050"
+
+        // active-gradient from="#ffbb66" to="#ffc880" angle=45 relative-to="workspace-view"
+        // inactive-gradient from="#505050" to="#808080" angle=45 relative-to="workspace-view"
+    }
+
+    // Struts shrink the area occupied by windows, similarly to layer-shell panels.
+    // You can think of them as a kind of outer gaps. They are set in logical pixels.
+    // Left and right struts will cause the next window to the side to always be visible.
+    // Top and bottom struts will simply add outer gaps in addition to the area occupied by
+    // layer-shell panels and regular gaps.
+    struts {
+        // left 64
+        // right 64
+        // top 64
+        // bottom 64
+    }
+
+    shadow {
+        on
+    }
+}
+
+layer-rule {
+    match namespace="^rofi$"
+    shadow {
+       on
+    }
+}
+
+// Add lines like this to spawn processes at startup.
+// Note that running niri as a session supports xdg-desktop-autostart,
+// which may be more convenient to use.
+// See the binds section below for more spawn examples.
+spawn-at-startup "waypaper" "--wallpaper" "~/.config/niri/wallpaper.png"
+
+// Uncomment this line to ask the clients to omit their client-side decorations if possible.
+// If the client will specifically ask for CSD, the request will be honored.
+// Additionally, clients will be informed that they are tiled, removing some client-side rounded corners.
+// This option will also fix border/focus ring drawing behind some semitransparent windows.
+// After enabling or disabling this, you need to restart the apps for this to take effect.
+prefer-no-csd
+
+// You can change the path where screenshots are saved.
+// A ~ at the front will be expanded to the home directory.
+// The path is formatted with strftime(3) to give you the screenshot date and time.
+screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png"
+
+// You can also set this to null to disable saving screenshots to disk.
+// screenshot-path null
+
+// Animation settings.
+// The wiki explains how to configure individual animations:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Animations
+animations {
+    // Uncomment to turn off all animations.
+    // off
+
+    // Slow down all animations by this factor. Values below 1 speed them up instead.
+    // slowdown 3.0
+}
+
+// Window rules let you adjust behavior for individual windows.
+// Find more information on the wiki:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Window-Rules
+
+// Work around WezTerm's initial configure bug
+// by setting an empty default-column-width.
+window-rule {
+    // This regular expression is intentionally made as specific as possible,
+    // since this is the default config, and we want no false positives.
+    // You can get away with just app-id="wezterm" if you want.
+    match app-id=r#"^org\.wezfurlong\.wezterm$"#
+    default-column-width {}
+}
+
+// Example: block out two password managers from screen capture.
+// (This example rule is commented out with a "/-" in front.)
+/-window-rule {
+    match app-id=r#"^org\.keepassxc\.KeePassXC$"#
+    match app-id=r#"^org\.gnome\.World\.Secrets$"#
+
+    block-out-from "screen-capture"
+
+    // Use this instead if you want them visible on third-party screenshot tools.
+    // block-out-from "screencast"
+}
+
+window-rule {
+  geometry-corner-radius 4
+  clip-to-geometry true
+}
+
+window-rule {
+  match app-id=r#"^spotify$"#
+  open-maximized true
+  open-on-workspace "spotify"
+}
+
+window-rule {
+  match app-id=r#"^Slack$"#
+  open-maximized true
+}
+
+window-rule {
+  match app-id=r#"^Element"#
+  open-maximized true
+}
+
+window-rule {
+  match title=r#"^Emacs Selector$"#
+  opacity 0.95
+  open-floating true
+  open-focused true
+}
+
+window-rule {
+  match title=r#"^bTop$"#
+  opacity 0.95
+  open-floating true
+  open-focused true
+}
+
+window-rule {
+  match title=r#"^GPTel - Emacs$"#
+  opacity 0.95
+  open-floating true
+  open-focused true
+}
+
+window-rule {
+  match title=r#"^Authentication Required"#
+  open-floating true
+  open-focused true
+}
+
+
+
+binds {
+    // Keys consist of modifiers separated by + signs, followed by an XKB key name
+    // in the end. To find an XKB name for a particular key, you may use a program
+    // like wev.
+    //
+    // "Mod" is a special modifier equal to Super when running on a TTY, and to Alt
+    // when running as a winit window.
+    //
+    // Most actions that you can bind here can also be invoked programmatically with
+    // `niri msg action do-something`.
+
+    // Mod-Shift-/, which is usually the same as Mod-?,
+    // shows a list of important hotkeys.
+    Mod+Shift+Slash { show-hotkey-overlay; }
+
+    // Suggested binds for running programs: terminal, app launcher, screen locker.
+    Mod+T { spawn "footclient"; }
+    Mod+D { spawn "rofi" "-show" "drun"; }
+    Mod+W { spawn "rofi" "-show" "window"; }
+    Mod+P { spawn "rofi-pass" "--clip"; }
+    Mod+X { spawn "emacsclient" "-c"; }
+    Mod+B { spawn "firefox"; }
+    Mod+RETURN { spawn "emacsclient" "-c" "--eval" "(ccr/start-eshell)"; }
+    Mod+M { spawn "emacsclient" "-c" "--eval" "(notmuch-search \"tag:new\")"; }
+    // Mod+G { spawn "emacsclient" "-c" "--eval" "(switch-to-buffer (gptel \"*ChatGPT*\"))" "-F" "((name . \"GPTel - Emacs\") (width . $NIRI_GPTEL_COLS) (height . $NIRI_GPTEL_ROWS))'"; }
+    Mod+G { spawn "run-floating-gptel"; }
+    Mod+Shift+C { spawn "emacsclient" "-c" "--eval" "(org-roam-dailies-capture-today)"; }
+    Mod+Alt+L { spawn "swaylock"; }
+    Mod+Space { spawn "rofi" "-show" "menu" "-modi" "menu:rofi-power-menu"; }
+    // Mod+Ctrl+b { spawn "foot" "--title='bTop'" "-W" "$NIRI_BTOP_COLSx$NIRI_BTOP_ROWS" "btop";}
+    Mod+Ctrl+b { spawn "run-floating-btop"; }
+
+    // Example volume keys mappings for PipeWire & WirePlumber.
+    // The allow-when-locked=true property makes them work even when the session is locked.
+    XF86AudioRaiseVolume allow-when-locked=true { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.1+"; }
+    XF86AudioLowerVolume allow-when-locked=true { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.1-"; }
+    XF86AudioMute        allow-when-locked=true { spawn "wpctl" "set-mute" "@DEFAULT_AUDIO_SINK@" "toggle"; }
+    XF86AudioMicMute     allow-when-locked=true { spawn "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle"; }
+
+    Mod+Shift+period { spawn "brightnessctl" "s" "5%+"; }
+    Mod+Shift+comma { spawn "brightnessctl" "s" "5%-"; }
+    Mod+XF86MonBrightnessUp { spawn "brightnessctl" "s" "5%+"; }
+    Mod+XF86MonBrightnessDown { spawn "brightnessctl" "s" "5%-"; }
+
+    Mod+Q { close-window; }
+
+    Mod+Left  { focus-column-left; }
+    Mod+Down  { focus-window-down; }
+    Mod+Up    { focus-window-up; }
+    Mod+Right { focus-column-right; }
+    Mod+H     { focus-column-left; }
+    Mod+J     { focus-window-down; }
+    Mod+K     { focus-window-up; }
+    Mod+L     { focus-column-right; }
+
+    Mod+Ctrl+Left  { move-column-left; }
+    Mod+Ctrl+Down  { move-window-down; }
+    Mod+Ctrl+Up    { move-window-up; }
+    Mod+Ctrl+Right { move-column-right; }
+    Mod+Ctrl+H     { move-column-left; }
+    Mod+Ctrl+J     { move-window-down; }
+    Mod+Ctrl+K     { move-window-up; }
+    Mod+Ctrl+L     { move-column-right; }
+
+    // Alternative commands that move across workspaces when reaching
+    // the first or last window in a column.
+    // Mod+J     { focus-window-or-workspace-down; }
+    // Mod+K     { focus-window-or-workspace-up; }
+    // Mod+Ctrl+J     { move-window-down-or-to-workspace-down; }
+    // Mod+Ctrl+K     { move-window-up-or-to-workspace-up; }
+
+    Mod+Home { focus-column-first; }
+    Mod+End  { focus-column-last; }
+    Mod+Ctrl+Home { move-column-to-first; }
+    Mod+Ctrl+End  { move-column-to-last; }
+
+    Mod+Shift+Left  { focus-monitor-left; }
+    Mod+Shift+Down  { focus-monitor-down; }
+    Mod+Shift+Up    { focus-monitor-up; }
+    Mod+Shift+Right { focus-monitor-right; }
+    Mod+Shift+H     { focus-monitor-left; }
+    Mod+Shift+J     { focus-monitor-down; }
+    Mod+Shift+K     { focus-monitor-up; }
+    Mod+Shift+L     { focus-monitor-right; }
+
+    Mod+Shift+Ctrl+Left  { move-column-to-monitor-left; }
+    Mod+Shift+Ctrl+Down  { move-column-to-monitor-down; }
+    Mod+Shift+Ctrl+Up    { move-column-to-monitor-up; }
+    Mod+Shift+Ctrl+Right { move-column-to-monitor-right; }
+    Mod+Shift+Ctrl+H     { move-column-to-monitor-left; }
+    Mod+Shift+Ctrl+J     { move-column-to-monitor-down; }
+    Mod+Shift+Ctrl+K     { move-column-to-monitor-up; }
+    Mod+Shift+Ctrl+L     { move-column-to-monitor-right; }
+
+    // Alternatively, there are commands to move just a single window:
+    // Mod+Shift+Ctrl+Left  { move-window-to-monitor-left; }
+    // ...
+
+    // And you can also move a whole workspace to another monitor:
+    // Mod+Shift+Ctrl+Left  { move-workspace-to-monitor-left; }
+    // ...
+
+    Mod+Page_Down      { focus-workspace-down; }
+    Mod+Page_Up        { focus-workspace-up; }
+    Mod+U              { focus-workspace-down; }
+    Mod+I              { focus-workspace-up; }
+    Mod+Ctrl+Page_Down { move-column-to-workspace-down; }
+    Mod+Ctrl+Page_Up   { move-column-to-workspace-up; }
+    Mod+Ctrl+U         { move-column-to-workspace-down; }
+    Mod+Ctrl+I         { move-column-to-workspace-up; }
+
+    // Alternatively, there are commands to move just a single window:
+    // Mod+Ctrl+Page_Down { move-window-to-workspace-down; }
+    // ...
+
+    Mod+Shift+Page_Down { move-workspace-down; }
+    Mod+Shift+Page_Up   { move-workspace-up; }
+    Mod+Shift+U         { move-workspace-down; }
+    Mod+Shift+I         { move-workspace-up; }
+
+    // You can bind mouse wheel scroll ticks using the following syntax.
+    // These binds will change direction based on the natural-scroll setting.
+    //
+    // To avoid scrolling through workspaces really fast, you can use
+    // the cooldown-ms property. The bind will be rate-limited to this value.
+    // You can set a cooldown on any bind, but it's most useful for the wheel.
+    Mod+WheelScrollDown      cooldown-ms=150 { focus-workspace-down; }
+    Mod+WheelScrollUp        cooldown-ms=150 { focus-workspace-up; }
+    Mod+Ctrl+WheelScrollDown cooldown-ms=150 { move-column-to-workspace-down; }
+    Mod+Ctrl+WheelScrollUp   cooldown-ms=150 { move-column-to-workspace-up; }
+
+    Mod+WheelScrollRight      { focus-column-right; }
+    Mod+WheelScrollLeft       { focus-column-left; }
+    Mod+Ctrl+WheelScrollRight { move-column-right; }
+    Mod+Ctrl+WheelScrollLeft  { move-column-left; }
+
+    // Usually scrolling up and down with Shift in applications results in
+    // horizontal scrolling; these binds replicate that.
+    Mod+Shift+WheelScrollDown      { focus-column-right; }
+    Mod+Shift+WheelScrollUp        { focus-column-left; }
+    Mod+Ctrl+Shift+WheelScrollDown { move-column-right; }
+    Mod+Ctrl+Shift+WheelScrollUp   { move-column-left; }
+
+    // Similarly, you can bind touchpad scroll "ticks".
+    // Touchpad scrolling is continuous, so for these binds it is split into
+    // discrete intervals.
+    // These binds are also affected by touchpad's natural-scroll, so these
+    // example binds are "inverted", since we have natural-scroll enabled for
+    // touchpads by default.
+    // Mod+TouchpadScrollDown { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.02+"; }
+    // Mod+TouchpadScrollUp   { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.02-"; }
+
+    // You can refer to workspaces by index. However, keep in mind that
+    // niri is a dynamic workspace system, so these commands are kind of
+    // "best effort". Trying to refer to a workspace index bigger than
+    // the current workspace count will instead refer to the bottommost
+    // (empty) workspace.
+    //
+    // For example, with 2 workspaces + 1 empty, indices 3, 4, 5 and so on
+    // will all refer to the 3rd workspace.
+    Mod+1 { focus-workspace 1; }
+    Mod+2 { focus-workspace 2; }
+    Mod+3 { focus-workspace 3; }
+    Mod+4 { focus-workspace 4; }
+    Mod+5 { focus-workspace 5; }
+    Mod+6 { focus-workspace 6; }
+    Mod+7 { focus-workspace 7; }
+    Mod+8 { focus-workspace 8; }
+    Mod+9 { focus-workspace 9; }
+    Mod+Ctrl+1 { move-column-to-workspace 1; }
+    Mod+Ctrl+2 { move-column-to-workspace 2; }
+    Mod+Ctrl+3 { move-column-to-workspace 3; }
+    Mod+Ctrl+4 { move-column-to-workspace 4; }
+    Mod+Ctrl+5 { move-column-to-workspace 5; }
+    Mod+Ctrl+6 { move-column-to-workspace 6; }
+    Mod+Ctrl+7 { move-column-to-workspace 7; }
+    Mod+Ctrl+8 { move-column-to-workspace 8; }
+    Mod+Ctrl+9 { move-column-to-workspace 9; }
+
+    // Alternatively, there are commands to move just a single window:
+    // Mod+Ctrl+1 { move-window-to-workspace 1; }
+
+    // Switches focus between the current and the previous workspace.
+    // Mod+Tab { focus-workspace-previous; }
+
+    // Consume one window from the right into the focused column.
+    Mod+Comma  { consume-window-into-column; }
+    // Expel one window from the focused column to the right.
+    Mod+Period { expel-window-from-column; }
+
+    // There are also commands that consume or expel a single window to the side.
+    Mod+BracketLeft  { consume-or-expel-window-left; }
+    Mod+BracketRight { consume-or-expel-window-right; }
+
+    Mod+R { switch-preset-column-width; }
+    Mod+Shift+R { switch-preset-window-height; }
+    Mod+Ctrl+R { reset-window-height; }
+    Mod+F { maximize-column; }
+    Mod+Shift+F { fullscreen-window; }
+    Mod+C { center-column; }
+
+    // Finer width adjustments.
+    // This command can also:
+    // * set width in pixels: "1000"
+    // * adjust width in pixels: "-5" or "+5"
+    // * set width as a percentage of screen width: "25%"
+    // * adjust width as a percentage of screen width: "-10%" or "+10%"
+    // Pixel sizes use logical, or scaled, pixels. I.e. on an output with scale 2.0,
+    // set-column-width "100" will make the column occupy 200 physical screen pixels.
+    Mod+Minus { set-column-width "-10%"; }
+    Mod+Equal { set-column-width "+10%"; }
+
+    // Finer height adjustments when in column with other windows.
+    Mod+Shift+Minus { set-window-height "-10%"; }
+    Mod+Shift+Equal { set-window-height "+10%"; }
+
+    // Actions to switch layouts.
+    // Note: if you uncomment these, make sure you do NOT have
+    // a matching layout switch hotkey configured in xkb options above.
+    // Having both at once on the same hotkey will break the switching,
+    // since it will switch twice upon pressing the hotkey (once by xkb, once by niri).
+    // Mod+Space       { switch-layout "next"; }
+    // Mod+Shift+Space { switch-layout "prev"; }
+
+    Mod+S { screenshot; }
+    Mod+Ctrl+S { screenshot-window; }
+
+    // The quit action will show a confirmation dialog to avoid accidental exits.
+    Mod+Shift+E { quit; }
+    Ctrl+Alt+Delete { quit; }
+
+    // Powers off the monitors. To turn them back on, do any input like
+    // moving the mouse or pressing any other key.
+    Mod+Shift+P { power-off-monitors; }
+}

hmModules/niri/default.nix

@@ -0,0 +1,284 @@
+{
+  pkgs,
+  lib,
+  config,
+  hostname,
+  ...
+}:
+let
+  niriVars =
+    {
+      picard = {
+        floating-gptel = {
+          rows = "60";
+          cols = "150";
+        };
+        floating-btop = {
+          rows = "60";
+          cols = "210";
+        };
+      };
+      kirk = {
+        floating-gptel = {
+          rows = "40";
+          cols = "140";
+        };
+        floating-btop = {
+          rows = "40";
+          cols = "140";
+        };
+      };
+    }
+    ."${hostname}" or {
+      floating-gptel = {
+        rows = "40";
+        cols = "140";
+      };
+      floating-btop = {
+        rows = "40";
+        cols = "140";
+      };
+    };
+  run-floating-gptel =
+    with niriVars.floating-gptel;
+    pkgs.writeScriptBin "run-floating-gptel" ''
+      emacsclient -c --eval '(switch-to-buffer (gptel "*GptEl*"))' -F '((name . "GPTel - Emacs") (width . ${cols}) (height . ${rows}))'
+    '';
+  run-floating-btop =
+    with niriVars.floating-btop;
+    pkgs.writeScriptBin "run-floating-btop" ''
+      foot --title='bTop' -W ${cols}x${rows} btop
+    '';
+in
+{
+  home.packages = with pkgs; [
+    niri
+    waypaper
+    xwayland-satellite
+    run-floating-gptel
+    run-floating-btop
+  ];
+  systemd.user.targets.niri-session = {
+    Unit = {
+      Description = "Niri session";
+      BindsTo = [ "graphical-session.target" ];
+      Wants = [
+        "graphical-session-pre.target"
+        "xdg-desktop-autostart.target"
+      ];
+      After = [ "graphical-session-pre.target" ];
+      Before = [ "xdg-desktop-autostart.target" ];
+    };
+  };
+
+  home.file."${config.xdg.configHome}/niri/wallpaper.png" = {
+    source = ../hyprland/wallpaper.png;
+  };
+
+  home.activation.linkNiriConfig = lib.hm.dag.entryAnywhere ''
+    if [ ! -e "$HOME/.config/niri/config.kdl" ]; then
+      $DRY_RUN_CMD ln -s "$HOME/projects/aciceri/nixfleet/hmModules/niri/config.kdl" "$HOME/.config/niri/config.kdl"
+    fi
+  '';
+
+  home.sessionVariables = {
+    DISPLAY = ":0";
+    QT_QPA_PLATFORM = "wayland";
+  };
+
+  programs.rofi = {
+    enable = true;
+    package = pkgs.rofi-wayland;
+    theme =
+      let
+        inherit (config.lib.formats.rasi) mkLiteral;
+        cfg = config.catppuccin.fzf;
+        palette = (lib.importJSON "${config.catppuccin.sources.palette}/palette.json").${cfg.flavor}.colors;
+        selectColor = color: palette.${color}.hex;
+
+      in
+      lib.mkForce {
+        "*" = {
+          # blue = mkLiteral "#0000FF";
+          # white = mkLiteral "#FFFFFF";
+          # black = mkLiteral "#000000";
+          # grey = mkLiteral "#eeeeee";
+
+          blue = mkLiteral (selectColor "blue");
+          white = mkLiteral "#FFFFFF";
+          black = mkLiteral "#000000";
+          grey = mkLiteral "#eeeeee";
+
+          spacing = 2;
+          background-color = mkLiteral "#00000000";
+          border-color = mkLiteral "#444444FF";
+          anchor = mkLiteral "north";
+          location = mkLiteral "center";
+        };
+
+        "window" = {
+          transparency = "real";
+          background-color = mkLiteral "#00000000";
+          border = 0;
+          padding = mkLiteral "0% 0% 1em 0%";
+          x-offset = 0;
+          y-offset = mkLiteral "-10%";
+        };
+
+        "mainbox" = {
+          padding = mkLiteral "0px";
+          border = 0;
+          spacing = mkLiteral "1%";
+        };
+
+        "message" = {
+          border = 0;
+          border-radius = mkLiteral "4px";
+          padding = mkLiteral "1em";
+          background-color = mkLiteral "@white";
+          text-color = mkLiteral "@black";
+        };
+
+        "textbox normal" = {
+          text-color = mkLiteral "#002B36FF";
+          padding = 0;
+          border = 0;
+        };
+
+        "listview" = {
+          fixed-height = 1;
+          border = 0;
+          padding = mkLiteral "1em";
+          reverse = false;
+          border-radius = mkLiteral "4px";
+
+          columns = 1;
+          background-color = mkLiteral "@white";
+        };
+
+        "element" = {
+          border = 0;
+          padding = mkLiteral "2px";
+          highlight = mkLiteral "bold";
+        };
+
+        "element-text" = {
+          background-color = mkLiteral "inherit";
+          text-color = mkLiteral "inherit";
+        };
+
+        "element normal.normal" = {
+          text-color = mkLiteral "#002B36FF";
+          background-color = mkLiteral "#F5F5F500";
+        };
+
+        "element normal.urgent" = {
+          text-color = mkLiteral "#D75F00FF";
+          background-color = mkLiteral "#F5F5F5FF";
+        };
+
+        "element normal.active" = {
+          text-color = mkLiteral "#005F87FF";
+          background-color = mkLiteral "#F5F5F5FF";
+        };
+
+        "element selected.normal" = {
+          text-color = mkLiteral "#F5F5F5FF";
+          background-color = mkLiteral "#4271AEFF";
+        };
+
+        "element selected.urgent" = {
+          text-color = mkLiteral "#F5F5F5FF";
+          background-color = mkLiteral "#D75F00FF";
+        };
+
+        "element selected.active" = {
+          text-color = mkLiteral "#F5F5F5FF";
+          background-color = mkLiteral "#005F87FF";
+        };
+
+        "element alternate.normal" = {
+          text-color = mkLiteral "#002B36FF";
+          background-color = mkLiteral "#D0D0D0FF";
+        };
+
+        "element alternate.urgent" = {
+          text-color = mkLiteral "#D75F00FF";
+          background-color = mkLiteral "#D0D0D0FF";
+        };
+
+        "element alternate.active" = {
+          text-color = mkLiteral "#005F87FF";
+          background-color = mkLiteral "#D0D0D0FF";
+        };
+
+        "scrollbar" = {
+          border = 0;
+          padding = 0;
+        };
+
+        "inputbar" = {
+          spacing = 0;
+          border = 0;
+          padding = mkLiteral "0.5em 1em";
+          background-color = mkLiteral "@grey";
+          index = 0;
+
+          border-radius = mkLiteral "4px";
+
+          children = map mkLiteral [
+            "prompt"
+            "textbox-prompt-colon"
+            "entry"
+            "case-indicator"
+          ];
+        };
+
+        "inputbar normal" = {
+          foreground-color = mkLiteral "#002B36FF";
+          background-color = mkLiteral "#F5F5F500";
+        };
+
+        "mode-switcher" = {
+          border = 0;
+          padding = mkLiteral "0.5em 1em";
+          background-color = mkLiteral "@grey";
+          index = 10;
+        };
+
+        "button selected" = {
+          text-color = mkLiteral "#4271AEFF";
+        };
+
+        "textbox-prompt-colon" = {
+          expand = false;
+          str = ":";
+          margin = mkLiteral "0px 0.3em 0em 0em";
+          text-color = mkLiteral "@black";
+        };
+
+        "error-message" = {
+          border = 0;
+          border-radius = mkLiteral "4px";
+          padding = mkLiteral "1em";
+          background-color = mkLiteral "#FF8888";
+          text-color = mkLiteral "@black";
+        };
+      };
+    extraConfig = {
+      modi = "drun,window,ssh";
+      combi-modes = [
+        "drun"
+        "window"
+        "ssh"
+      ];
+    };
+    font = "Iosevka Comfy 12";
+    terminal = "footclient";
+    pass = {
+      enable = true;
+      package = pkgs.rofi-pass-wayland;
+    };
+    plugins = [ pkgs.rofi-calc ];
+  };
+}

hmModules/pantalaimon/default.nix

@@ -1,13 +1,27 @@
+{ pkgs, lib, ... }:
 {
   services.pantalaimon = {
     enable = true;
+    package = pkgs.pantalaimon.overrideAttrs {
+      pytestCheckPhase = "echo skip pytest";
+    };
     settings = {
+      Default = {
+        LogLevel = "Debug";
+        SSL = true;
+      };
       local-matrix = {
-        Homeserver = "https://nixos.dev";
-        ListenAddress = "127.0.0.1";
+        Homeserver = "https://matrix.aciceri.dev";
+        # Homeserver = "https://matrix.nixos.dev/_matrix/client";
+        # Homeserver = "https://matrix.nixos.dev";
+        ListenAddress = "localhost";
         ListenPort = 8008;
+        # SSL = false;
+        UseKeyring = false;
+        # IgnoreVerification = true;
       };
     };
   };
+
   systemd.user.services.pantalaimon.Unit.Requires = [ "dbus.socket" ];
 }

hmModules/qutebrowser/default.nix

@@ -36,7 +36,8 @@ in
         ",l" = ''config-cycle spellcheck.languages [" it-IT "] [" en-US "]'';
       };
       insert = {
-        "<Ctrl-p>" = ''spawn --userscript qute-pass --dmenu-invocation '${pkgs.fuzzel}/bin/fuzzel --background-color=253559cc --border-radius=5 --border-width=0 -d' --password-only --unfiltered'';
+        "<Ctrl-p>" =
+          ''spawn --userscript qute-pass --dmenu-invocation '${pkgs.fuzzel}/bin/fuzzel --background-color=253559cc --border-radius=5 --border-width=0 -d' --password-only --unfiltered'';
       };
     };
     settings = {

hmModules/sdrangel/default.nix

@@ -1,7 +1,8 @@
 { pkgs, ... }:
 {
   home.packages = [
-    pkgs.sdrangel
+    (builtins.getFlake "github:NixOS/nixpkgs/063dece00c5a77e4a0ea24e5e5a5bd75232806f8")
+    .legacyPackages.${pkgs.system}.sdrangel
     pkgs.kdePackages.qtlocation
   ];
 }

hmModules/shell/catppuccin_mocha.omp.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://raw.githubusercontent.com/JanDeDobbeleer/oh-my-posh/main/themes/schema.json",
+  "palette": {
+    "os": "#ACB0BE",
+    "closer": "p:os",
+    "pink": "#F5C2E7",
+    "lavender": "#B4BEFE",
+    "blue": "#89B4FA"
+  },
+  "blocks": [
+    {
+      "alignment": "left",
+      "segments": [
+        {
+          "foreground": "p:blue",
+          "style": "plain",
+          "template": "{{ .UserName }}@{{ .HostName }} ",
+          "type": "session"
+        },
+        {
+          "foreground": "p:pink",
+          "properties": {
+            "folder_icon": "..\ue5fe..",
+            "home_icon": "~",
+            "style": "agnoster_short"
+          },
+          "style": "plain",
+          "template": "{{ .Path }} ",
+          "type": "path"
+        },
+        {
+          "foreground": "p:lavender",
+          "properties": {
+            "branch_icon": "\ue725 ",
+            "cherry_pick_icon": "\ue29b ",
+            "commit_icon": "\uf417 ",
+            "fetch_status": false,
+            "fetch_upstream_icon": false,
+            "merge_icon": "\ue727 ",
+            "no_commits_icon": "\uf0c3 ",
+            "rebase_icon": "\ue728 ",
+            "revert_icon": "\uf0e2 ",
+            "tag_icon": "\uf412 "
+          },
+          "template": "{{ .HEAD }} ",
+          "style": "plain",
+          "type": "git"
+        },
+        {
+          "style": "plain",
+          "foreground": "p:closer",
+          "template": "\uf105",
+          "type": "text"
+        }
+      ],
+      "type": "prompt"
+    }
+  ],
+  "final_space": true,
+  "version": 3
+}

hmModules/shell/default.nix

@@ -34,7 +34,6 @@
 
   programs.lsd = {
     enable = true;
-    enableAliases = true;
   };
 
   programs.vim.enable = true;
@@ -56,7 +55,7 @@
   };
 
   programs.atuin = {
-    enable = true;
+    enable = false; # FIXME broken on bash: https://github.com/nix-community/home-manager/issues/5958
     settings = {
       daemon = {
         enabled = true;
@@ -64,30 +63,16 @@
       };
       auto_sync = true;
       sync_frequency = "5m";
-      sync_address = "http://sisko.fleet:8889";
+      sync_address = "http://sisko.wg.aciceri.dev:8889";
       search_mode = "fuzzy";
       style = "compact";
+      enter_accept = "true";
     };
   };
 
-  programs.fish = {
+  programs.bash = {
     enable = true;
-    plugins = [
-      # {
-      #   name = "fifc";
-      #   src = pkgs.fishPlugins.fifc.src;
-      # }
-      {
-        name = "z";
-        src = pkgs.fishPlugins.z.src;
-      }
-    ];
-    shellInit =
-      ''
-        # fish_vi_key_bindings
-        fish_default_key_bindings
-      ''
-      + lib.optionalString (builtins.hasAttr "cachix-personal-token" age.secrets) ''
+    initExtra = lib.optionalString (builtins.hasAttr "cachix-personal-token" age.secrets) ''
       export CACHIX_AUTH_TOKEN=$(cat ${age.secrets.cachix-personal-token.path})
     '';
     shellAliases = {
@@ -95,10 +80,48 @@
     };
   };
 
+  programs.zoxide.enable = true;
+  programs.thefuck.enable = true;
+  programs.oh-my-posh = {
+    enable = true;
+    # same as "captuccin_mocha" but without the OS logo
+    settings = lib.mkForce (
+      builtins.fromJSON (
+        builtins.unsafeDiscardStringContext (builtins.readFile ./catppuccin_mocha.omp.json)
+      )
+    );
+  };
+
+  programs.zellij.enableBashIntegration = false;
+
+  # programs.fish = {
+  #   enable = true;
+  #   plugins = [
+  #     # {
+  #     #   name = "fifc";
+  #     #   src = pkgs.fishPlugins.fifc.src;
+  #     # }
+  #     {
+  #       name = "z";
+  #       src = pkgs.fishPlugins.z.src;
+  #     }
+  #   ];
+  #   shellInit =
+  #     ''
+  #       # fish_vi_key_bindings
+  #       fish_default_key_bindings
+  #     ''
+  #     + lib.optionalString (builtins.hasAttr "cachix-personal-token" age.secrets) ''
+  #       export CACHIX_AUTH_TOKEN=$(cat ${age.secrets.cachix-personal-token.path})
+  #     '';
+  #   shellAliases = {
+  #     "cat" = "bat";
+  #   };
+  # };
+
   home.packages =
     with pkgs;
     [
-      thefuck
       dig.dnsutils
       lsof
       comma

hmModules/spotify/default.nix

@@ -9,18 +9,18 @@ in
 {
   home.packages = [ spotify-adblocked ];
 
-  systemd.user.services.spotify-adblocked = {
-    Install.WantedBy = [ "graphical-session.target" ];
+  # systemd.user.services.spotify-adblocked = {
+  #   Install.WantedBy = [ "graphical-session.target" ];
 
-    Unit = {
-      Description = "Spotify";
-      PartOf = [ "graphical-session.target" ];
-    };
+  #   Unit = {
+  #     Description = "Spotify";
+  #     PartOf = [ "graphical-session.target" ];
+  #   };
 
-    Service = {
-      ExecStart = lib.getExe spotify-adblocked;
-      Restart = "on-failure";
-      RestartSec = 3;
-    };
-  };
+  #   Service = {
+  #     ExecStart = lib.getExe spotify-adblocked;
+  #     Restart = "on-failure";
+  #     RestartSec = 3;
+  #   };
+  # };
 }

hmModules/sway/default.nix

@@ -110,7 +110,8 @@
               in
               lib.mkOptionDefault {
                 "${modifier}+x" = "exec emacsclient -c";
-                "${modifier}+y" = "exec ${pkgs.waypipe}/bin/waypipe --compress lz4=10 ssh mothership.fleet emacsclient -c";
+                "${modifier}+y" =
+                  "exec ${pkgs.waypipe}/bin/waypipe --compress lz4=10 ssh mothership.fleet emacsclient -c";
                 "${modifier}+b" = "exec qutebrowser";
                 "${modifier}+s" = "exec ${screenshotScript}";
                 # "${modifier}+g" = "exec ${screenrecordingScript}";  # FIXME

hmModules/swayidle/default.nix

@@ -48,10 +48,4 @@
         }
       ];
     };
-
-  # Otherwise it will start only after Sway and will not work with Hyprland
-  systemd.user.services.swayidle = {
-    Unit.PartOf = lib.mkForce [ ];
-    Install.WantedBy = lib.mkForce [ "hyprland-session.target" ];
-  };
 }

hmModules/tremotesf/default.nix

@@ -16,7 +16,10 @@
     };
 
     Service = {
-      ExecStart = "${lib.getExe pkgs.tremotesf} --minimized";
+      ExecStart = pkgs.writeShellScript "start-tremotesf.sh" ''
+        sleep 5
+        ${lib.getExe pkgs.tremotesf} --minimized
+      '';
       Restart = "on-failure";
       RestartSec = 3;
     };

hmModules/waybar/config.json

@@ -0,0 +1,78 @@
+{
+  "layer": "top",
+  "position": "left",
+  "width": 36,
+  "margin": "12 0 12 0",
+  "spacing": 2,
+  "modules-left": ["clock", "custom/sep", "niri/window"],
+  "modules-center": ["niri/workspaces"],
+  "modules-right": [
+    "tray",
+    "custom/sep",
+    "temperature",
+    "custom/sep",
+    "pulseaudio",
+    "custom/powermenu"
+  ],
+  "custom/sep": {
+    "format": "──"
+    // "format": ""
+  },
+  "custom/powermenu": {
+    "on-click": "rofi -show menu -modi menu:rofi-power-menu",
+    "format": "",
+    "tooltip": false
+  },
+  "niri/workspaces": {
+    "format": "{icon}",
+    "on-click": "activate",
+    "format-icons": {
+      "active": "",
+      "urgent": "",
+      "default": ""
+    }
+  },
+  "niri/window": {
+    "rotate": 90,
+    "rewrite": {
+      "(.*) — Mozilla Firefox": " $1",
+      "(.*) - Emacs": " $1",
+      "(.*) - Slack": " $1"
+    }
+  },
+  "clock": {
+    "tooltip": true,
+    "format": "{:%H\n%M}",
+    "tooltip-format": "{:%Y-%m-%d}"
+  },
+  "tray": {
+    "icon-size": 20,
+    "spacing": 5,
+    "show-passive-items": "false"
+  },
+  "temperature": {
+    "rotate": 90,
+    "hwmon-path": "/sys/class/hwmon/hwmon2/temp1_input",
+    "critical-threshold": 80,
+    "format": "{icon} {temperatureC}°C",
+    "format-icons": ["", "", ""]
+  },
+  "pulseaudio": {
+    "rotate": 90,
+    "format": "{icon} {volume}%",
+    "format-bluetooth": "{icon} {volume}%",
+    "format-muted": "MUTE ",
+    "format-icons": {
+      "headphones": "",
+      "handsfree": "",
+      "headset": "",
+      "phone": "",
+      "portable": "",
+      "car": "",
+      "default": ["", ""]
+    },
+    "scroll-step": 3,
+    "on-click": "pavucontrol",
+    "on-click-right": "pactl set-source-mute @DEFAULT_SOURCE@ toggle"
+  }
+}

hmModules/waybar/default.nix

@@ -7,140 +7,19 @@
   programs.waybar = {
     enable = true;
     systemd.enable = true;
-    style = builtins.readFile ./style.css;
-    settings = {
-      mainBar = {
-        ipc = true;
-        layer = "top";
-        position = "top";
-        height = 30;
-
-        modules-left = [
-          "wlr/mode"
-          "hyprland/workspaces"
-        ];
-        modules-center = [ "wlr/window" ];
-        modules-right = [
-          "network"
-          "tray"
-          "pulseaudio"
-          "cpu"
-          "memory"
-          "temperature"
-          "backlight"
-          "battery"
-          "clock"
-        ];
-
-        "hyprland/workspaces" = {
-          all-outputs = true;
-          disable-scroll-wraparound = true;
-          # format = "{icon}";
-          on-click = "activate";
-          # format-icons = {
-          #   "1" = "";
-          #   "2" = "";
-          #   "3" = "";
-          #   "9" = "ﬧ";
-          #   urgent = "";
-          # };
-          # sort-by-number = true;
   };
 
-        "wlr/mode" = {
-          tooltip = false;
-        };
+  catppuccin.waybar.enable = lib.mkForce false;
 
-        "wlr/window" = {
-          max_length = 50;
-        };
-        tray = {
-          spacing = 10;
-        };
-        battery = {
-          format = "{capacity}% {icon}";
-          format-alt = "{time} {icon}";
-          format-charging = "{capacity}% ";
-          format-icons = [
-            " "
-            " "
-            " "
-            " "
-            " "
-          ];
-          format-plugged = "{capacity}%  ";
-          states = {
-            critical = 15;
-            warning = 30;
-          };
-        };
-        clock = {
-          format-alt = "{:%Y-%m-%d}";
-          tooltip-format = "{:%Y-%m-%d | %H:%M}";
-        };
-        cpu = {
-          format = "{usage}% ";
-          tooltip = false;
-        };
-        memory = {
-          format = "{}% ";
-        };
-        network = {
-          interval = 1;
-          format-alt = "{ifname}: {ipaddr}/{cidr}";
-          format-disconnected = "Disconnected ⚠";
-          format-ethernet = "{ifname}: {ipaddr}/{cidr} 󰈀  up: {bandwidthUpBits:>4} down: {bandwidthDownBits:>4}";
-          format-linked = "{ifname} (No IP) ";
-          format-wifi = "{essid} ({signalStrength}%)   {ipaddr}/{cidr} up: {bandwidthUpBits:>4} down: {bandwidthDownBits:>4}";
-        };
-        pulseaudio = {
-          format = "{volume}% {icon} {format_source}";
-          format-bluetooth = "{volume}% {icon} {format_source}";
-          format-bluetooth-muted = " {icon} {format_source}";
-          format-icons = {
-            car = "";
-            default = [
-              " "
-              " "
-              " "
-            ];
-            handsfree = "";
-            headphones = " ";
-            headset = "";
-            phone = "";
-            portable = "";
-          };
-          format-muted = " {format_source}";
-          format-source = "{volume}% ";
-          format-source-muted = "";
-          on-click = "${pkgs.pavucontrol}/bin/pavucontrol";
-        };
-        "wlr/mode" = {
-          format = ''<span style="italic">{}</span>'';
-        };
-        temperature = {
-          critical-threshold = 80;
-          format = "{temperatureC}°C {icon}";
-          format-icons = [
-            ""
-            ""
-            ""
-          ];
-          hwmon-path = "/sys/class/hwmon/hwmon2/temp1_input"; # picard FIXME
-          # hwmon-path = "/sys/class/thermal/thermal_zone4/temp"; # thinkpad
-        };
-        backlight = {
-          device = "ddcci2";
-          format = "{percent}% {icon}";
-          format-icons = [
-            " "
-            " "
-          ];
-        };
-      };
-    };
-  };
+  home.activation.linkWaybarConfig = lib.hm.dag.entryAnywhere ''
+    if [ ! -d "$HOME/.config/waybar" ]; then
+      $DRY_RUN_CMD mkdir -p "$HOME/.config/waybar"
+      $DRY_RUN_CMD ln -s "$HOME/projects/aciceri/nixfleet/hmModules/waybar/config.json" "$HOME/.config/waybar/config"
+      $DRY_RUN_CMD ln -s "$HOME/projects/aciceri/nixfleet/hmModules/waybar/style.css" "$HOME/.config/waybar/style.css"
+    fi
+  '';
 
-  # waybar needs the hyprctl binary in PATH when started in hyprland
-  systemd.user.services.waybar.Service.Environment = "PATH=${lib.makeBinPath [ pkgs.hyprland ]}";
+  home.packages = with pkgs; [
+    rofi-power-menu
+  ];
 }

hmModules/waybar/style.css

@@ -1,54 +1,71 @@
 * {
   border: none;
-  border-radius: 0;
-  min-height: 0;
-  font-family: Fira Code;
+  font-family: "Iosevka Comfy", "FontAwesome", "Nerd Font";
+  font-size: 1.35rem;
+  font-weight: 600;
+  background: none;
 }
 
 window#waybar {
-  background: rgba(255, 255, 255, 0.05);
-  color: white;
-  font-size: 1.2rem;
+  color: #a5adcb;
+  background-color: #181926;
+
+  border-top-right-radius: 5px;
+  border-bottom-right-radius: 5px;
+}
+.modules-left,
+.modules-right,
+.modules-center {
+  padding: 12px 4px;
 }
 
-#workspaces button {
-  padding: 0 10px;
-  background: transparent;
-  color: white;
-  font-size: 2rem;
+tooltip {
+  color: #a5adcb;
+  background-color: #181926;
+  text-shadow: none;
 }
 
-#workspaces button.active {
-  box-shadow: inset 0 -5px red;
+tooltip * {
+  color: #a5adcb;
+  text-shadow: none;
 }
 
-#workspaces button.focused,
+#custom-sep {
+  color: #494d64;
+}
 #workspaces button:hover {
-  box-shadow: inset 0 -5px white;
+  box-shadow: inherit;
+  text-shadow: inherit;
+}
+#workspaces button {
+  color: #5b6078;
+  background: none;
+  padding: 0;
+}
+#workspaces button:hover {
+  color: #a6da95;
+}
+#workspaces button.active {
+  color: #f5bde6;
+}
+#temperature {
+  color: #eed49f;
+}
+#clock {
+  font-weight: 600;
+  color: #8bd5ca;
+}
+#custom-bluetooth_devices {
+  color: #8aadf4;
+}
+#pulseaudio {
+  color: #a6da95;
+}
+#pulseaudio.muted {
+  color: #ed8796;
 }
 
-#workspaces button.urgent {
-  /* background: @theme_fg_color; */
-  /* color: @theme_selected_bg_color; */
-}
-
-#mode {
-  margin: 0 4px;
-  padding: 0 4px;
-  /* background: @theme_fg_color; */
-  /* color: @unfocused_borders; */
-}
-
-#pulseaudio,
-#network,
-#cpu,
-#memory,
-#disk,
-#temperature,
-#battery,
-#language,
-#clock,
-#tray {
-  margin: 0 4px;
-  padding: 0 2px;
+#custom-powermenu {
+  margin: 12px 0 0 0;
+  color: #6e738d;
 }

hmModules/xdg/default.nix

@@ -28,6 +28,29 @@
         ];
       };
     };
+    portal = {
+      enable = true;
+      configPackages = with pkgs; [
+        # xdg-desktop-portal-wlr
+        # xdg-desktop-portal-gtk
+        # xdg-desktop-portal-hyprland
+        xdg-desktop-portal-gnome
+        # xdg-desktop-portal
+        # kdePackages.xdg-desktop-portal-kde
+        # libsForQt5.xdg-desktop-portal-kde
+        gnome-keyring
+      ];
+      extraPortals = with pkgs; [
+        # xdg-desktop-portal-wlr
+        # xdg-desktop-portal-gtk
+        # xdg-desktop-portal-hyprland
+        xdg-desktop-portal-gnome
+        # xdg-desktop-portal
+        # kdePackages.xdg-desktop-portal-kde
+        gnome-keyring
+      ];
+    };
+
   };
   home.packages = [ pkgs.xdg-utils ];
 }

hmModules/zellij/default.nix

@@ -9,7 +9,7 @@ let
     url = "https://github.com/dj95/zjstatus/releases/download/v0.17.0/zjstatus.wasm";
     hash = "sha256-IgTfSl24Eap+0zhfiwTvmdVy/dryPxfEF7LhVNVXe+U=";
   };
-  cfg = config.programs.fzf.catppuccin;
+  cfg = config.catppuccin.fzf;
   palette = (lib.importJSON "${config.catppuccin.sources.palette}/palette.json").${cfg.flavor}.colors;
   selectColor = color: palette.${color}.hex;
   color_fg = selectColor "text";
@@ -99,7 +99,6 @@ in
 {
   programs.zellij = {
     enable = true;
-    enableFishIntegration = false;
     settings = {
       default_layout = "${layout}";
       pane_frames = false;

hmModules/zoom/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.zoom-us ];
+}

hosts/default.nix

@@ -14,20 +14,22 @@
       deltaflyer = {
         nixpkgs =
           let
-            # keep in sync with https://github.com/NixOS/mobile-nixos/blob/development/pkgs.nix
-            rev = "44d0940ea560dee511026a53f0e2e2cde489b4d4";
+            # keep in sync with https://github.com/mobile-nixos/mobile-nixos/blob/development/npins/sources.json
+            rev = "d3c42f187194c26d9f0309a8ecc469d6c878ce33";
           in
           builtins.getFlake "github:NixOS/nixpkgs/${rev}";
         extraHmModules = [
-          # inputs.ccrEmacs.hmModules.default
+          inputs.catppuccin.homeModules.catppuccin
         ];
         vpn = {
           ip = "10.100.0.5";
           publicKey = "6bzmBx2b5yzMdW0aK0KapoBesNcxTv5+qdo+pGmG+jc=";
         };
-        homeManager = builtins.getFlake "github:nix-community/home-manager/670d9ecc3e46a6e3265c203c2d136031a3d3548e";
+        # homeManager = builtins.getFlake "github:nix-community/home-manager/670d9ecc3e46a6e3265c203c2d136031a3d3548e";
         extraModules = [
           (import "${inputs.mobile-nixos}/lib/configuration.nix" { device = "oneplus-fajita"; })
+          inputs.catppuccin.nixosModules.catppuccin
+          inputs.lix-module.nixosModules.default
         ];
         secrets = {
           "deltaflyer-wireguard-private-key" = { };
@@ -48,7 +50,7 @@
         ];
         extraHmModules = [
           "${inputs.homeManagerGitWorkspace}/modules/services/git-workspace.nix"
-          inputs.catppuccin.homeManagerModules.catppuccin
+          inputs.catppuccin.homeModules.catppuccin
         ];
         secrets = {
           "kirk-wireguard-private-key" = { };
@@ -67,16 +69,14 @@
         };
         extraModules = [
           inputs.disko.nixosModules.disko
-          inputs.nixThePlanet.nixosModules.macos-ventura
           inputs.lix-module.nixosModules.default
           inputs.lanzaboote.nixosModules.lanzaboote
           inputs.catppuccin.nixosModules.catppuccin
         ];
         extraHmModules = [
-          # inputs.ccrEmacs.hmModules.default
           "${inputs.homeManagerGitWorkspace}/modules/services/git-workspace.nix"
           inputs.vscode-server.nixosModules.home
-          inputs.catppuccin.homeManagerModules.catppuccin
+          inputs.catppuccin.homeModules.catppuccin
         ];
         secrets = {
           "picard-wireguard-private-key" = { };
@@ -92,6 +92,7 @@
 
       sisko = {
         system = "aarch64-linux";
+        nixpkgs = inputs.nixpkgsSisko;
         enableHomeManager = false;
         vpn = {
           ip = "10.100.0.1";
@@ -116,7 +117,33 @@
             owner = "grafana";
             group = "forgejo";
           };
+          "matrix-registration-shared-secret".owner = "matrix-synapse";
+        };
+      };
 
+      pike = {
+        vpn = {
+          ip = "10.100.0.8";
+          publicKey = "16ctjunXCXDPLSUhocstJ9z9l45/YuJFxlLkpoxChjI=";
+        };
+        extraModules = [
+          inputs.lix-module.nixosModules.default
+          inputs.catppuccin.nixosModules.catppuccin
+        ];
+        extraHmModules = [
+          "${inputs.homeManagerGitWorkspace}/modules/services/git-workspace.nix"
+          inputs.vscode-server.nixosModules.home
+          inputs.catppuccin.homeModules.catppuccin
+        ];
+        secrets = {
+          "pike-wireguard-private-key" = { };
+          "chatgpt-token".owner = "ccr";
+          "cachix-personal-token".owner = "ccr";
+          "git-workspace-tokens".owner = "ccr";
+          "autistici-password".owner = "ccr";
+          "restic-hetzner-password" = { };
+          "forgejo-runners-token".owner = "nixuser";
+          "forgejo-nix-access-tokens".owner = "nixuser";
         };
       };
 

hosts/deltaflyer/default.nix

@@ -30,6 +30,13 @@
     # INSECURE STUFF FIRST
     # Users and hardcoded passwords.
     {
+      nixpkgs.overlays = [
+        (prev: final: {
+          gcc7 = final.gcc;
+          gcc8 = final.gcc;
+        })
+      ];
+
       users.users.root.password = "nixos";
       # users.users.ccr.password = "1234";
 
@@ -66,11 +73,13 @@
           "git"
           "shell"
           "helix"
-          "hyprland"
+          # "hyprland"
+          "niri"
           "emacs"
           "firefox"
           "mpv"
           "xdg"
+          "catppuccin"
         ];
         extraGroups = [
           "dialout"
@@ -99,18 +108,18 @@
       ccr.extraModules = [
         {
           programs.fish.loginShellInit = ''
-            pgrep Hypr >/dev/null || exec dbus-run-session Hyprland
-          '';
-          wayland.windowManager.hyprland.extraConfig = lib.mkAfter ''
-            monitor = DSI-1, 1080x2340, 0x0, 2, transform, 1
-            input {
-              touchdevice {
-                transform = 1
-              }
-            }
-            bind = $mod, r, exec, rotate-screen hor
-            bind = $mod SHIFT, r, exec, rotate-screen ver
+            pgrep niri >/dev/null || exec niri-session
           '';
+          # wayland.windowManager.hyprland.extraConfig = lib.mkAfter ''
+          #   monitor = DSI-1, 1080x2340, 0x0, 2, transform, 1
+          #   input {
+          #     touchdevice {
+          #       transform = 1
+          #     }
+          #   }
+          #   bind = $mod, r, exec, rotate-screen hor
+          #   bind = $mod SHIFT, r, exec, rotate-screen ver
+          # '';
           home.packages =
             let
               rotateScript = pkgs.writeShellApplication {

hosts/deltaflyer/plasma-mobile.nix

@@ -3,6 +3,7 @@
 #
 {
   lib,
+  pkgs,
   ...
 }:
 {
@@ -16,35 +17,38 @@
 
     #   # desktopManager.plasma5.mobile.enable = true;
 
-    #   displayManager.autoLogin = {
-    #     enable = true;
-    #   };
+    displayManager.autoLogin = {
+      enable = true;
+      user = "ccr";
+    };
 
-    #   displayManager.session = [{
-    #     manage = "desktop";
-    #     name = "hyprland";
-    #     start = ''
-    #       ${pkgs.hyprland}/bin/Hyprland &
-    #       waitPID=$!
-    #     '';
-    #     }];
+    displayManager.session = [
+      {
+        manage = "desktop";
+        name = "niri";
+        start = ''
+          ${pkgs.niri}/bin/niri-session &
+          waitPID=$!
+        '';
+      }
+    ];
 
-    #   displayManager.defaultSession = "hyprland";
+    displayManager.defaultSession = "niri";
 
-    #   displayManager.lightdm = {
-    #     enable = true;
-    #     # Workaround for autologin only working at first launch.
-    #     # A logout or session crashing will show the login screen otherwise.
-    #     extraSeatDefaults = ''
-    #       session-cleanup-script=${pkgs.procps}/bin/pkill -P1 -fx ${pkgs.lightdm}/sbin/lightdm
-    #     '';
-    #   };
+    displayManager.lightdm = {
+      enable = true;
+      # Workaround for autologin only working at first launch.
+      # A logout or session crashing will show the login screen otherwise.
+      extraSeatDefaults = ''
+        session-cleanup-script=${pkgs.procps}/bin/pkill -P1 -fx ${pkgs.lightdm}/sbin/lightdm
+      '';
+    };
 
     libinput.enable = true;
   };
 
   hardware.bluetooth.enable = true;
-  hardware.pulseaudio.enable = lib.mkDefault true; # mkDefault to help out users wanting pipewire
+  hardware.pulseaudio.enable = lib.mkDefault false; # mkDefault to help out users wanting pipewire
   networking.networkmanager.enable = true;
   networking.wireless.enable = false;
   powerManagement.enable = true;

hosts/kirk/default.nix

@@ -33,8 +33,9 @@
       "adb"
       "binfmt"
       "prometheus-exporters"
-      "promtail"
+      "alloy"
       "syncthing"
+      "zerotier"
     ]
     ++ [ ./disko.nix ];
 
@@ -54,9 +55,9 @@
       "password-store"
       "slack"
       "hyprland"
+      "niri"
       "udiskie"
       "xdg"
-      "spotify"
       "lutris"
       "wine"
       "cura"
@@ -65,7 +66,6 @@
       "digikam"
       "discord"
       "remmina"
-      "zulip"
       "calibre"
       "zathura"
       "imv"
@@ -74,8 +74,11 @@
       "emacs"
       "chirp"
       "sdrangel"
+      "zmkbatx"
+      "moonlight"
+      "gimp"
     ];
-    extraGroups = [ ];
+    extraGroups = [ "plugdev" ];
     backupPaths = [ ];
   };
 

hosts/module.nix

@@ -274,11 +274,10 @@ in
                 extraHmModules = config.extraHmModules;
               in
               [
-                config.homeManager.nixosModule
+                config.homeManager.nixosModules.home-manager
                 (
                   {
                     config,
-                    pkgs,
                     ...
                   }:
                   {
@@ -287,7 +286,6 @@ in
                       _module.args = {
                         age = config.age or { };
                         fleetFlake = self;
-                        pkgsStable = inputs.nixpkgsStable.legacyPackages.${pkgs.system};
                       };
                     };
                   }

hosts/picard/default.nix

@@ -35,13 +35,13 @@
       "hass-poweroff"
       "forgejo-runners"
       "teamviewer"
-      "macos-ventura"
+      # "macos-ventura"
       "sunshine"
       "mount-sisko"
       "adb"
-      "guix"
       "prometheus-exporters"
-      "promtail"
+      "zerotier"
+      "alloy"
     ]
     ++ [ ./disko.nix ];
 
@@ -63,6 +63,7 @@
       "password-store"
       "slack"
       "hyprland"
+      "niri"
       "udiskie"
       "xdg"
       "spotify"
@@ -76,7 +77,7 @@
       "tor-browser"
       "kicad"
       "monero"
-      "zulip"
+      # "zulip"
       "teams"
       "obs-studio"
       "calibre"
@@ -92,6 +93,12 @@
       "vial"
       "chirp"
       "sdrangel"
+      "discord"
+      "ib-tws"
+      "zoom"
+      "pantalaimon"
+      "moonlight"
+      "gimp"
     ];
     extraGroups = [ "plugdev" ];
     backupPaths = [ ];
@@ -113,30 +120,21 @@
     "i2c-dev" # needed?
   ];
 
-  # https://github.com/NixOS/nixpkgs/issues/328909
   boot.extraModulePackages = [
-    (config.boot.kernelPackages.ddcci-driver.overrideAttrs (old: {
-      patches = [ ];
-      src = pkgs.fetchFromGitLab {
-        owner = "${old.pname}-linux";
-        repo = "${old.pname}-linux";
-        rev = "7853cbfc28bc62e87db79f612568b25315397dd0";
-        hash = "sha256-QImfvYzMqyrRGyrS6I7ERYmteaTijd8ZRnC6+bA9OyM=";
-      };
-    }))
+    config.boot.kernelPackages.ddcci-driver
   ];
 
-  # systemd.services.ddcci = {
-  #   script = ''
-  #     echo 'ddcci 0x37' > /sys/bus/i2c/devices/i2c-2/new_device
-  #   '';
-  #   wantedBy = [ "graphical.target" ];
-  #   restartIfChanged = false;
-  #   serviceConfig = {
-  #     Type = "oneshot";
-  #     RemainAfterExit = true;
-  #   };
-  # };
+  systemd.services.ddcci = {
+    script = ''
+      echo 'ddcci 0x37' > /sys/bus/i2c/devices/i2c-2/new_device
+    '';
+    wantedBy = [ "graphical.target" ];
+    restartIfChanged = false;
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+  };
 
   boot.loader.efi.canTouchEfiVariables = true;
   boot.loader.systemd-boot = {
@@ -167,6 +165,8 @@
     algorithm = "zstd";
   };
 
+  hardware.rtl-sdr.enable = true;
+
   # TODO move away from here (how can the interface name be retrieved programmatically?)
   networking.interfaces.enp11s0.wakeOnLan = {
     enable = true;

hosts/pike/default.nix

@@ -0,0 +1,172 @@
+{
+  fleetModules,
+  lib,
+  config,
+  ...
+}:
+{
+  imports = fleetModules [
+    "common"
+    "ssh"
+    "ccr"
+    "nix"
+    "networkmanager"
+    "bluetooth"
+    "dbus"
+    "docker"
+    "fonts"
+    "qmk-udev"
+    "mosh"
+    "udisks2"
+    "xdg"
+    "pipewire"
+    "nix-development"
+    "waydroid"
+    "virt-manager"
+    "ssh-initrd"
+    "printing"
+    "pam"
+    "wireguard-client"
+    "binfmt"
+    "greetd"
+    # "syncthing"
+    "teamviewer"
+    "sunshine"
+    "mount-sisko"
+    "adb"
+    "prometheus-exporters"
+    "alloy"
+    "zerotier"
+  ];
+
+  ccr = {
+    enable = true;
+    autologin = false;
+    modules = [
+      "git"
+      "git-workspace"
+      "helix"
+      "shell"
+      "zellij"
+      # "element"
+      "zmkbatx"
+      "tremotesf"
+      "firefox"
+      "gpg"
+      "mpv"
+      "password-store"
+      "slack"
+      "hyprland"
+      "niri"
+      "udiskie"
+      "xdg"
+      # "spotify"
+      "wine"
+      "cura"
+      "chrome"
+      "email"
+      "digikam"
+      "dolphin"
+      "tor-browser"
+      "kicad"
+      "monero"
+      "teams"
+      "obs-studio"
+      "calibre"
+      "reinstall-magisk-on-lineage"
+      "vscode-server"
+      "zk"
+      "catppuccin"
+      "freecad"
+      "zathura"
+      "imv"
+      "libreoffice"
+      "emacs"
+      "vial"
+      "chirp"
+      "sdrangel"
+      "discord"
+      "zoom"
+      "pantalaimon"
+      "gimp"
+      "jellyfin"
+    ];
+    extraGroups = [ "plugdev" ];
+    backupPaths = [ ];
+  };
+
+  boot.kernelParams = [ "ip=dhcp" ];
+  boot.initrd.kernelModules = [ "amdgpu" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "usbhid"
+    "thunderbolt"
+    "vmd"
+    "usb_storage"
+    "sd_mod"
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  fileSystems."/" = {
+    device = "zpool/root";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/nix" = {
+    device = "zpool/nix";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/var" = {
+    device = "zpool/var";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/home" = {
+    device = "zpool/home";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/4AA5-7242";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  fileSystems."/mnt/shared" = {
+    device = "/dev/nvme0n1p2";
+    fsType = "ntfs";
+    options = [ "nofail" ];
+  };
+
+  services.zfs.autoScrub.enable = true;
+
+  networking.hostId = "30fc8ed7";
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "schedutil";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.enableRedistributableFirmware = lib.mkDefault true;
+
+  services.power-profiles-daemon.enable = true;
+
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+  };
+}

hosts/sisko/default.nix

@@ -11,33 +11,38 @@
       "wireguard-server"
       "mediatomb"
       "transmission"
-      # "hercules-ci"
       "home-assistant"
       "adguard-home"
       "cloudflare-dyndns"
       "sisko-proxy"
-      "invidious"
-      "searx"
       "sisko-share"
       "forgejo"
       "prometheus"
       "grafana"
       "prometheus-exporters"
       "loki"
-      "promtail"
+      "alloy"
       "restic"
       "atuin"
       "immich"
       "paperless"
       "syncthing"
       "atticd"
+      "jellyfin"
+      "matrix"
+      "arr"
+      "zerotier"
+      "mosh"
+      "amule"
+      "adguard-home"
+      "garmin-grafana"
+      # "dump1090"
+      "arbi"
     ]
     ++ [
       ./disko.nix
     ];
 
-  boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_11;
-
   system.stateVersion = "24.05";
 
   powerManagement.cpuFreqGovernor = "schedutil";

hosts/tpol/default.nix

@@ -24,6 +24,7 @@
       "battery"
       "printing"
       "wireguard-client"
+      "alloy"
     ];
 
   boot.initrd.availableKernelModules = [

lib/default.nix

@@ -1,9 +1,10 @@
 {
   keys = {
     users = {
-      ccr-ssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzCmDCtlGscpesHuoiruVWD2IjYEFtaIl9Y2JZGiOAyf3V17KPx0MikcknfmxSHi399SxppiaXQHxo/1wjGxXkXNTTv6h1fBuqwhJE6C8+ZSV+gal81vEnXX+/9w2FQqtVgnG2/mO7oJ0e3FY+6kFpOsGEhYexoGt/UxIpAZoqIN+CWNhJIASUkneaZWtgwiL8Afb59kJQ2E7WbBu+PjYZ/s5lhPobhlkz6s8rkhItvYdiSHT0DPDKvp1oEbxsxd4E4cjJFbahyS8b089NJd9gF5gs0b74H/2lUUymnl63cV37Mp4iXB4rtE69MbjqsGEBKTPumLualmc8pOGBHqWIdhAqGdZQeBajcb6VK0E3hcU0wBB+GJgm7KUzlAHGdC3azY0KlHMrLaZN0pBrgCVR6zBNWtZz2B2qMBZ8Cw+K4vut8GuspdXZscID10U578GxQvJAB9CdxNUtrzSmKX2UtZPB1udWjjIAlejzba4MG73uXgQEdv0NcuHNwaLuCWxTUT5QQF18IwlJ23Mg8aPK8ojUW5A+kGHAu9wtgZVcX1nS5cmYKSgLzcP1LA1l9fTJ1vqBSuy38GTdUzfzz7AbnkRfGPj2ALDgyx17Rc5ommjc1k0gFoeIqiLaxEs5FzDcRyo7YvZXPsGeIqNCYwQWw3+U+yUEJby8bxGb2d/6YQ== andrea.ciceri@autistici.org";
+      ccr-ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIm9Sl/I+5G4g4f6iE4oCUJteP58v+wMIew9ZuLB+Gea";
       oneplus8t = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO8da1Mf11vXFF0kVDgxocVoGwpHHMEs9emS9T+v8hLb oneplus8t";
       hercules-ci-agent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGPupm00BiveTIYF6CNwuMijF5VvEaPDMjvt+vMlAy+N hercules-ci-agent";
+      forgejo-ci = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5mbqLoZ/0J45J7J+17XMGv/dXs3DGABJsnvDv4rgC9 forgjeo-ci";
     };
     hosts = {
       kirk = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAH49KzayIro3L1bteR7nwupMM/vKlDh05t5/DFD9/uz";
@@ -13,6 +14,7 @@
       picard = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ1+1z1IsLVJ6aGarMgzw3NbmFKcpYVgdUjl7xDsewxT";
       deltaflyer = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETMwELvGTnhKJbpK0oFs4lK8vm/kV9KdgL9wufYDDQ";
       tpol = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQxHSow2l0TDWTonBPPaGvTgVvMS/xsQOf1nHnvLSwV";
+      pike = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPx3Hy9L8w4mpr5HFcqLOr/wUk/wJeB9HjcLy2tt0U+x";
     };
   };
 }

modules/adguard-home/default.nix

@@ -1,18 +1,67 @@
+{ config, lib, ... }:
+let
+  interface = "enP4p65s0";
+in
 {
   services.adguardhome = {
     enable = true;
-    port = 3000;
     mutableSettings = true;
     settings = {
-      openFirewall = true;
+      dhcp = {
+        enabled = true;
+        interface_name = interface;
+
+        dhcpv4 = {
+          gateway_ip = "10.1.1.1";
+          range_start = "10.1.1.2";
+          range_end = "10.1.1.255";
+          subnet_mask = "255.255.255.0";
         };
       };
-  networking.firewall.allowedTCPPorts = [
-    3000
-    53
+      dns = {
+        upstream_dns = [
+          "https://dns10.quad9.net/dns-query"
         ];
-  networking.firewall.allowedUDPPorts = [ 53 ];
+
+        bind_hosts = [
+          "127.0.0.1"
+          "10.1.1.2"
+        ];
+      };
+    };
+  };
+
+  # otherwise it creates a directory in /var/lib/private which can't be easily persisted
+  systemd.services.adguardhome.serviceConfig.DynamicUser = lib.mkForce false;
+
+  networking.firewall.allowedUDPPorts = [
+    53
+    67
+  ];
+  networking.firewall.allowedTCPPorts = [ 53 ];
+
+  networking.interfaces.${interface} = {
+    ipv4.addresses = [
+      {
+        address = "10.1.1.2";
+        prefixLength = 24;
+      }
+    ];
+    useDHCP = false;
+  };
+
+  networking.defaultGateway = "10.1.1.1";
+
   environment.persistence."/persist".directories = [
     "/var/lib/AdGuardHome"
   ];
+
+  services.nginx.virtualHosts."adguard.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.adguardhome.port}";
+    };
+    serverAliases = [ "adguard.sisko.zt.aciceri.dev" ];
+  };
 }

modules/alloy/default.nix

@@ -0,0 +1,53 @@
+{ config, ... }:
+{
+  services.alloy = {
+    enable = true;
+  };
+  environment.etc."alloy/config.alloy".text = ''
+    local.file_match "local_files" {
+      path_targets = [{
+        __path__ = "/var/log/*.log",
+      }]
+      sync_period = "5s"
+    }
+
+    loki.source.journal "systemd" {
+      max_age    = "24h"
+      forward_to = [loki.write.default.receiver]
+    }
+
+    loki.source.journal "kernel" {
+      max_age = "24h"
+      forward_to = [loki.write.default.receiver]
+    }
+
+    loki.relabel "nixfleet_journal" {
+      forward_to = []
+      rule {
+      	source_labels = ["__journal__systemd_unit"]
+      	target_label = "systemd_unit"
+      }
+      rule {
+      	source_labels = ["__journal_syslog_identifier"]
+      	target_label = "syslog_identifier"
+      }
+    }
+
+    loki.source.journal "nixfleet_journal" {
+      forward_to = [loki.write.default.receiver]
+      relabel_rules = loki.relabel.nixfleet_journal.rules
+      format_as_json = true
+    }
+
+    loki.write "default" {
+      endpoint {
+        url = "http://sisko.wg.aciceri.dev:${
+          builtins.toString config.services.loki.configuration.server.http_listen_port or 3100
+        }/loki/api/v1/push"
+      }
+      external_labels = {
+        host = "${config.networking.hostName}",
+      }
+    }
+  '';
+}

modules/amarr/default.nix

@@ -0,0 +1,23 @@
+args@{ lib, pkgs, ... }:
+let
+  pkgs = builtins.getFlake "github:NixOS/nixpkgs/d278c7bfb89130ac167e80d2250f9abc0bede419";
+  amarr = pkgs.legacyPackages.${args.pkgs.system}.amarr;
+in
+{
+  systemd.services.amarr = {
+    description = "amarr";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      User = "root";
+      Type = "oneshot";
+      ExecStart = lib.getExe amarr;
+    };
+    environment = {
+      AMULE_HOST = "localhost";
+      AMULE_PORT = "4712";
+      AMULE_PASSWORD = "";
+    };
+  };
+
+}

modules/amule/default.nix

@@ -0,0 +1,46 @@
+{ config, pkgs, ... }:
+let
+  rev = "966199fe1dccc9c6c7016bdb1d9582f27797bc02";
+  amule-flake = builtins.getFlake "github:NixOS/nixpkgs/${rev}";
+  inherit (amule-flake.legacyPackages.${pkgs.system}) amule-daemon amule-web;
+in
+{
+  disabledModules = [ "services/networking/amuled.nix" ];
+  documentation.nixos.enable = false;
+
+  imports = [ "${amule-flake}/nixos/modules/services/networking/amuled.nix" ];
+
+  services.amule = {
+    enable = true;
+    package = amule-daemon;
+    amuleWebPackage = amule-web;
+    openPeerPorts = true;
+    openWebServerPort = true;
+    # TODO the service is accessible only from the VPN
+    # however better using agenix
+    ExternalConnectPasswordFile = pkgs.writeText "password" "pippo";
+    WebServerPasswordFile = pkgs.writeText "password" "pippo";
+    settings = {
+      eMule = {
+        IncomingDir = "/mnt/hd/amule";
+        TempDir = "/mnt/hd/amule/Temp";
+      };
+      WebServer = {
+        Enabled = 1;
+      };
+    };
+  };
+
+  environment.persistence."/persist".directories = [
+    config.services.amule.dataDir
+  ];
+
+  services.nginx.virtualHosts."amule.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.amule.settings.WebServer.Port}";
+    };
+    serverAliases = [ "amule.sisko.zt.aciceri.dev" ];
+  };
+}

modules/arbi/default.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, ... }:
+let
+  rev = "d531730d9640160f0519ef4b3640f8da49dd96f8";
+  arbi-flake = builtins.getFlake "git+ssh://git@github.com/aciceri/arbi.git?rev=${rev}";
+in
+{
+  imports = [ arbi-flake.nixosModules.arbi ];
+
+  services.arbi = {
+    enable = true;
+    log_level = "debug";
+    configFile = pkgs.writeText "arbi-config.kdl" ''
+      endpoint "wss://eth-mainnet.g.alchemy.com/v2/<REDACTED>"
+      pairs_file "pairs.json"
+      concurrency 4
+    '';
+  };
+
+  environment.persistence."/persist".directories = [
+    config.services.arbi.dataDir
+  ];
+}

modules/arr/default.nix

@@ -0,0 +1,56 @@
+{ lib, ... }:
+{
+  services.radarr = {
+    enable = true;
+  };
+
+  services.sonarr = {
+    enable = true;
+  };
+
+  services.prowlarr = {
+    enable = true;
+  };
+
+  systemd.services.prowlarr = {
+    serviceConfig = {
+      DynamicUser = lib.mkForce false;
+    };
+  };
+
+  users.users.radarr.extraGroups = [ "transmission" ];
+  users.users.sonarr.extraGroups = [ "transmission" ];
+
+  environment.persistence."/persist".directories = [
+    "/var/lib/radarr"
+    "/var/lib/prowlarr"
+    "/var/lib/sonarr"
+  ];
+
+  services.nginx.virtualHosts = {
+    "radarr.sisko.wg.aciceri.dev" = {
+      forceSSL = true;
+      useACMEHost = "aciceri.dev";
+      locations."/" = {
+        proxyPass = "http://localhost:7878"; # FIXME hardcoded port
+      };
+      serverAliases = [ "radarr.sisko.zt.aciceri.dev" ];
+    };
+    "prowlarr.sisko.wg.aciceri.dev" = {
+      forceSSL = true;
+      useACMEHost = "aciceri.dev";
+      locations."/" = {
+        proxyPass = "http://localhost:9696"; # FIXME hardcoded port
+      };
+      serverAliases = [ "prowlarr.sisko.zt.aciceri.dev" ];
+    };
+    "sonarr.sisko.wg.aciceri.dev" = {
+      forceSSL = true;
+      useACMEHost = "aciceri.dev";
+      locations."/" = {
+        proxyPass = "http://localhost:8989"; # FIXME hardcoded port
+      };
+      serverAliases = [ "sonarr.sisko.zt.aciceri.dev" ];
+    };
+  };
+}

modules/audio/default.nix

@@ -2,10 +2,5 @@
 {
   sound.enable = true;
 
-  hardware.pulseaudio = {
-    enable = true;
-    package = pkgs.pulseaudioFull;
-  };
-
   users.extraUsers.ccr.extraGroups = [ "audio" ];
 }

modules/bluetooth/default.nix

@@ -1,13 +1,13 @@
 {
   pkgs,
   config,
+  lib,
   ...
 }:
 {
   services.blueman.enable = true;
-  hardware.pulseaudio.enable = true;
   hardware.bluetooth = {
-    enable = true;
+    enable = lib.mkDefault true;
     settings = {
       General = {
         Name = config.networking.hostName;

modules/ccr/default.nix

@@ -28,7 +28,7 @@ in
 
     shell = lib.mkOption {
       type = lib.types.package;
-      default = pkgs.fish;
+      default = pkgs.bash;
     };
 
     modules = lib.mkOption {
@@ -70,6 +70,31 @@ in
       type = types.listOf types.str;
       default = [ ];
     };
+
+    impermanence = {
+      enable = lib.mkOption {
+        type = types.bool;
+        default = (config.environment.persistence or null) != null;
+      };
+
+      directories = lib.mkOption {
+        type = types.listOf types.anything; # TODO re-use type from the NixOS module
+        default = [
+          ".cache"
+          "Downloads"
+        ];
+      };
+
+      files = lib.mkOption {
+        type = types.listOf types.anything; # TODO re-use type from the NixOS module
+        default = [
+          ".ssh/id_ed25519.pub"
+          ".ssh/id_ed25519"
+          ".ssh/authorized_keys"
+          ".ssh/known_hosts"
+        ];
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable (
@@ -103,8 +128,6 @@ in
           openssh.authorizedKeys.keys = config.ccr.authorizedKeys;
         };
 
-        programs.fish.enable = true;
-
         services.getty.autologinUser = if config.ccr.autologin then cfg.username else null;
 
         home-manager.useGlobalPkgs = true;
@@ -122,11 +145,22 @@ in
                 };
               }
             ]
+            ++ [
+              (lib.optionalAttrs cfg.impermanence.enable {
+                home.persistence."/persist/home/${cfg.username}" = {
+                  inherit (cfg.impermanence) directories files;
+                  allowOther = true;
+                };
+              })
+            ]
             ++ cfg.extraModules;
           home.packages = cfg.packages;
           home.stateVersion = config.system.stateVersion;
         };
       }
+      (lib.mkIf cfg.impermanence.enable {
+        programs.fuse.userAllowOther = true;
+      })
     ]
   );
 }

modules/cloudflare-dyndns/default.nix

@@ -8,14 +8,10 @@
       "aciceri.dev"
       "git.aciceri.dev"
       "home.aciceri.dev"
-      "torrent.aciceri.dev"
-      "search.aciceri.dev"
-      "invidious.aciceri.dev"
-      "vpn.aciceri.dev"
       "photos.aciceri.dev"
-      "status.aciceri.dev"
-      "paper.aciceri.dev"
-      "cloud.aciceri.dev"
+      "jelly.aciceri.dev"
+      "matrix.aciceri.dev"
+      "vpn.aciceri.dev"
     ];
     apiTokenFile = config.age.secrets.cloudflare-dyndns-api-token.path;
   };

modules/common/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   fleetModules,
+  pkgs,
   ...
 }:
 {
@@ -15,4 +16,15 @@
   users.mutableUsers = false;
   i18n.defaultLocale = "en_US.UTF-8";
   nixpkgs.config.allowUnfree = true; # Forgive me Mr. Stallman :(
+  system.switch.enableNg = true;
+
+  environment.systemPackages = [
+    pkgs.btop
+    pkgs.ncdu
+  ];
+
+  # FIXME not the best place
+  nixpkgs.config.permittedInsecurePackages = [
+    "olm-3.2.16"
+  ];
 }

modules/dump1090/default.nix

@@ -0,0 +1,31 @@
+{
+  pkgs,
+  ...
+}:
+let
+  dump1090-flake = builtins.getFlake "github:NixOS/nixpkgs/541f05042033467730fb8cedb08355dc91b94c74";
+  inherit (dump1090-flake.legacyPackages.${pkgs.system}) dump1090-fa;
+in
+{
+  imports = [ "${dump1090-flake}/nixos/modules/services/misc/dump1090-fa.nix" ];
+
+  hardware.rtl-sdr.enable = true;
+
+  disabledModules = [ "services/misc/dump10190-fa.nix" ];
+  documentation.nixos.enable = false;
+
+  services.dump1090-fa = {
+    enable = true;
+    package = dump1090-fa;
+  };
+
+  services.nginx.virtualHosts."dump1090.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations = {
+      "/".alias = "${dump1090-fa}/share/dump1090/";
+      "/data/".alias = "/run/dump1090-fa/";
+    };
+    serverAliases = [ "dump1090.sisko.zt.aciceri.dev" ];
+  };
+}

modules/firefly/default.nix

@@ -0,0 +1,67 @@
+{ pkgs, config, ... }:
+let
+  domain = "firefly.aciceri.dev";
+  domainImporter = "import.firefly.aciceri.dev";
+  dbUser = config.services.firefly-iii.user;
+in
+{
+  services.firefly-iii = {
+    enable = true;
+    package = pkgs.firefly-iii;
+    virtualHost = domain;
+    enableNginx = true;
+    settings = {
+      APP_ENV = "production";
+      APP_KEY_FILE = config.age.secrets.firefly-app-key.path;
+      SITE_OWNER = "andrea.ciceri@autistici.org";
+      DB_CONNECTION = "pgsql";
+      DEFAULT_LANGUAGE = "en_US";
+      TZ = "Europe/Rome";
+    };
+  };
+
+  services.firefly-iii-data-importer = {
+    enable = true;
+    enableNginx = true;
+    virtualHost = domainImporter;
+    settings = {
+      IGNORE_DUPLICATE_ERRORS = "false";
+      APP_ENV = "production";
+      APP_DEBUG = "false";
+      LOG_CHANNEL = "stack";
+      TRUSTED_PROXIES = "**";
+      TZ = "Europe/Rome";
+      FIREFLY_III_URL = "https://${domain}";
+      VANITY_URL = "https://${domain}";
+    };
+  };
+
+  imports = [ ../nginx-base ];
+
+  services.nginx.virtualHosts = {
+    ${domain} = {
+      enableACME = true;
+      forceSSL = true;
+    };
+    ${domainImporter} = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+
+  services.postgresql = {
+    ensureUsers = [
+      {
+        name = dbUser;
+        ensureDBOwnership = true;
+        ensureClauses.login = true;
+      }
+    ];
+    ensureDatabases = [ dbUser ];
+  };
+
+  environment.persistence."/persist".directories = [
+    config.services.firefly-iii.dataDir
+    config.services.firefly-iii-data-importer.dataDir
+  ];
+}

modules/forgejo-runners/default.nix

@@ -17,6 +17,7 @@ let
         gnugrep
         gawk
         git
+        openssh
         nix
         bash
         jq
@@ -38,15 +39,6 @@ let
     cp -a "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" $out/etc/ssl/certs/ca-bundle.crt
   '';
   numInstances = 1;
-  pushToCache = pkgs.writeScript "push-to-cache.sh" ''
-    #!/bin/sh
-    set -eu
-    set -f # disable globbing
-    export IFS=' '
-
-    echo "Uploading paths" $OUT_PATHS
-    exec nix copy --to "s3://cache?profile=default&region=eu-south-1&scheme=https&endpoint=cache.aciceri.dev" $OUT_PATHS
-  '';
 in
 lib.mkMerge [
   {
@@ -80,7 +72,6 @@ lib.mkMerge [
         cat <<NIX_CONFIG > etc/nix/nix.conf
         accept-flake-config = true
         experimental-features = nix-command flakes
-        post-build-hook = ${pushToCache}
         include access-tokens
         NIX_CONFIG
 
@@ -121,22 +112,9 @@ lib.mkMerge [
     nix.settings.trusted-users = [ "nixuser" ];
   }
   {
-    # Format of the token file:
     virtualisation = {
       podman.enable = true;
     };
-
-    # virtualisation.containers.storage.settings = {
-    #   storage.driver = "zfs";
-    #   storage.graphroot = "/var/lib/containers/storage";
-    #   storage.runroot = "/run/containers/storage";
-    #   storage.options.zfs.fsname = "zroot/root/podman";
-    # };
-
-    # virtualisation.containers.containersConf.settings = {
-    #   # podman seems to not work with systemd-resolved
-    #   containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
-    # };
   }
   {
     systemd.services =

modules/forgejo/default.nix

@@ -70,7 +70,10 @@ in
       };
     };
     secrets.mailer.PASSWD = config.age.secrets.autistici-password.path;
-    dump.enable = true;
+    dump = {
+      enable = true;
+      backupDir = "/mnt/hd/forgejo-dumps";
+    };
   };
 
   environment.persistence."/persist".directories = [
@@ -83,7 +86,8 @@ in
     "git.aciceri.dev" = {
       enableACME = true;
       forceSSL = true;
-      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}";
+      locations."/".proxyPass =
+        "http://127.0.0.1:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}";
     };
   };
 }

modules/garmin-grafana/default.nix

@@ -0,0 +1,54 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  rev = "f24579d13ee035af96d4a68b765af2aa4b1018b6";
+  garmin-grafana-flake = builtins.getFlake "github:NixOS/nixpkgs/${rev}";
+  inherit (garmin-grafana-flake.legacyPackages.${pkgs.system}) garmin-grafana;
+in
+{
+  users.users.garmin-grafana = {
+    isSystemUser = true;
+    group = "garmin-grafana";
+    extraGroups = [ "garmin-grafana" ];
+    home = "/var/lib/garmin-grafana";
+  };
+
+  users.groups.garmin-grafana = { };
+
+  systemd.services.garmin-grafana = {
+    description = "garmin-grafana";
+    wantedBy = [ "multi-user.target" ];
+    environment = {
+      INFLUXDB_HOST = "localhost";
+      INFLUXDB_PORT = "8086"; # it's hardcoded in the influxdb NixOS module
+      INFLUXDB_USERNAME = "garmin-grafana";
+      INFLUXDB_PASSWORD = "password"; # FIXME terrible but the databse is not exposed at least
+      INFLUXDB_DATABASE = "garmin-stats";
+      GARMINCONNECT_IS_CN = "False";
+      USER_TIMEZONE = "Europe/Rome";
+      KEEP_FIT_FILES = "True";
+      ALWAYS_PROCESS_FIT_FILES = "True";
+      # MANUAL_START_DATE = "2024-06-01";
+      # MANUAL_END_DATE = "2025-12-31";
+    };
+    serviceConfig = {
+      ExecStart = lib.getExe garmin-grafana;
+      Group = "garmin-grafana";
+      User = "garmin-grafana";
+      WorkingDirectory = "/var/lib/garmin-grafana";
+    };
+  };
+
+  # garmin-grafana uses influxdb V1, probably it's the only software I'll ever use using the V1
+  # so I"m keeping its declaration inside this module
+  services.influxdb.enable = true;
+
+  environment.persistence."/persist".directories = [
+    "/var/lib/garmin-grafana"
+    config.services.influxdb.dataDir
+  ];
+}

modules/grafana/default.nix

@@ -7,7 +7,7 @@ in
     enable = true;
     settings = {
       server = {
-        domain = "status.aciceri.dev";
+        domain = "status.sisko.aciceri.dev";
         http_addr = "127.0.0.1";
         http_port = 2342;
         root_url = "https://${config.services.grafana.settings.server.domain}:443/";
@@ -30,10 +30,11 @@ in
   ];
 
   services.nginx.virtualHosts = {
-    "status.aciceri.dev" = {
-      enableACME = true;
+    "status.sisko.wg.aciceri.dev" = {
+      useACMEHost = "aciceri.dev";
       forceSSL = true;
       locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.settings.server.http_port}";
+      serverAliases = [ "status.sisko.zt.aciceri.dev" ];
     };
   };
 }

modules/greetd/default.nix

@@ -5,22 +5,31 @@
 }:
 let
   sessions = builtins.concatStringsSep ":" [
+    # (pkgs.writeTextFile {
+    #   name = "xorg-session.desktop";
+    #   destination = "/hyprland-session.desktop";
+    #   text = ''
+    #     [Desktop Entry]
+    #     Name=Hyprland
+    #     Exec=Hyprland
+    #   '';
+    # })
+    # (pkgs.writeTextFile {
+    #   name = "xorg-session.desktop";
+    #   destination = "/cosmic-session.desktop";
+    #   text = ''
+    #     [Desktop Entry]
+    #     Name=Cosmic
+    #     Exec=cosmic-session
+    #   '';
+    # })
     (pkgs.writeTextFile {
       name = "xorg-session.desktop";
-      destination = "/hyprland-session.desktop";
+      destination = "/niri-session.desktop";
       text = ''
         [Desktop Entry]
-        Name=Hyprland
-        Exec=Hyprland
-      '';
-    })
-    (pkgs.writeTextFile {
-      name = "xorg-session.desktop";
-      destination = "/cosmic-session.desktop";
-      text = ''
-        [Desktop Entry]
-        Name=Cosmic
-        Exec=cosmic-session
+        Name=Niri
+        Exec=${lib.getExe' pkgs.niri "niri-session"}
       '';
     })
   ];

modules/home-assistant/default.nix

@@ -80,7 +80,6 @@ in
         time_zone = "Europe/Rome";
         temperature_unit = "C";
         external_url = "https://home.aciceri.dev";
-        internal_url = "http://rock5b.fleet:8123";
       };
       logger.default = "WARNING";
       wake_on_lan = { };
@@ -89,7 +88,7 @@ in
           name = "Picard";
           platform = "wake_on_lan";
           mac = "74:56:3c:37:17:bd"; # this shouldn't be public
-          host = "picard.fleet";
+          host = "picard.wg.aciceri.dev";
           turn_off.service = "shell_command.turn_off_picard";
         }
       ];

modules/immich/default.nix

@@ -1,99 +1,25 @@
-{ ... }:
-let
-  vars = {
-    serviceConfigRoot = "/mnt/hd/immich/state";
-    mainArray = "/mnt/hd/immich/";
-    domainName = "photos.aciceri.dev";
-  };
-  directories = [
-    "${vars.serviceConfigRoot}/immich"
-    "${vars.serviceConfigRoot}/immich/postgresql"
-    "${vars.serviceConfigRoot}/immich/postgresql/data"
-    "${vars.serviceConfigRoot}/immich/config"
-    "${vars.serviceConfigRoot}/immich/machine-learning"
-    "${vars.mainArray}/Photos"
-    "${vars.mainArray}/Photos/Immich"
-    "${vars.mainArray}/Photos/S10m"
-  ];
-in
+{ config, ... }:
 {
-  systemd.tmpfiles.rules = map (x: "d ${x} 0775 root root - -") directories;
-  systemd.services = {
-    podman-immich = {
-      requires = [
-        "podman-immich-redis.service"
-        "podman-immich-postgres.service"
+  environment.persistence."/persist".directories = [
+    config.services.immich.machine-learning.environment.MACHINE_LEARNING_CACHE_FOLDER
   ];
-      after = [
-        "podman-immich-redis.service"
-        "podman-immich-postgres.service"
-      ];
-    };
-    podman-immich-postgres = {
-      requires = [ "podman-immich-redis.service" ];
-      after = [ "podman-immich-redis.service" ];
-    };
+
+  services.immich = {
+    enable = true;
+    mediaLocation = "/mnt/hd/immich";
   };
 
-  virtualisation.oci-containers.containers = {
-    immich = {
-      autoStart = true;
-      image = "ghcr.io/imagegenius/immich:latest";
-      volumes = [
-        "${vars.serviceConfigRoot}/immich/config:/config"
-        "${vars.mainArray}/Photos/Immich:/photos"
-        "${vars.mainArray}/Photos/S10m:/import:ro"
-        "${vars.serviceConfigRoot}/immich/machine-learning:/config/machine-learning"
-      ];
-      # environmentFiles = [ config.age.secrets.ariaImmichDatabase.path ];
-      environment = {
-        PUID = "994";
-        PGID = "993";
-        TZ = "Europe/Rome";
-        DB_HOSTNAME = "immich-postgres";
-        DB_USERNAME = "immich";
-        DB_DATABASE_NAME = "immich";
-        REDIS_HOSTNAME = "immich-redis";
-        DB_PASSWORD = "password";
-      };
-      extraOptions = [
-        "--pull=newer"
-        "--network=container:immich-redis"
-      ];
-    };
-
-    immich-redis = {
-      autoStart = true;
-      image = "redis";
-      extraOptions = [
-        "--pull=newer"
-        "-l=traefik.enable=true"
-        "-l=traefik.http.routers.immich.rule=Host(`photos.${vars.domainName}`)"
-        "-l=traefik.http.routers.immich.service=immich"
-        "-l=traefik.http.services.immich.loadbalancer.server.port=8080"
-      ];
-      ports = [
-        "8080:8080"
-      ];
-    };
-
-    immich-postgres = {
-      autoStart = true;
-      image = "tensorchord/pgvecto-rs:pg14-v0.2.1";
-      volumes = [
-        "${vars.serviceConfigRoot}/immich/postgresql/data:/var/lib/postgresql/data"
-      ];
-      # environmentFiles = [ config.age.secrets.ariaImmichDatabase.path ];
-      environment = {
-        POSTGRES_USER = "immich";
-        POSTGRES_DB = "immich";
-        POSTGRES_HOST_AUTH_METHOD = "trust";
-        POSTGRES_PASSWORD = "password";
-      };
-      extraOptions = [
-        "--pull=newer"
-        "--network=container:immich-redis"
-      ];
-    };
+  # The reason for this hack is quite bad
+  # Before using the NixOS module Immich was installed using Docker, for this
+  # reason the paths of the images in the database looks like `/photos/...`
+  # and after migrating to the NixOS module I kept getting 404s for all the
+  # old pictures.
+  # Frankly it seems weird that it saved the absolute paths in the DB, perhaps
+  # it saves somewhere else the media location root and then merge the paths,
+  # however, nevertheless I set `mediaLocation` it didn't work
+  fileSystems."/photos" = {
+    device = "/mnt/hd/immich/";
+    fsType = "ext4";
+    options = [ "bind" ];
   };
 }

modules/jellyfin/default.nix

@@ -1,7 +1,21 @@
+{ config, ... }:
 {
   services.jellyfin = {
     enable = true;
+    openFirewall = true;
   };
 
   users.users.jellyfin.extraGroups = [ "transmission" ];
+
+  environment.persistence."/persist".directories = [
+    config.services.jellyfin.dataDir
+  ];
+
+  services.nginx.virtualHosts = {
+    "jelly.aciceri.dev" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/".proxyPass = "http://127.0.0.1:8096"; # FIXME hardcoded port
+    };
+  };
 }

modules/matrix/default.nix

@@ -7,7 +7,6 @@
 let
   clientConfig = {
     "m.homeserver".base_url = "https://matrix.aciceri.dev";
-    "org.matrix.msc3575.proxy".url = "https://syncv3.matrix.aciceri.dev";
   };
   serverConfig."m.server" = "matrix.aciceri.dev:443";
   mkWellKnown = data: ''
@@ -21,7 +20,7 @@ in
 
   services.nginx.virtualHosts = {
     "aciceri.dev" = {
-      enableACME = true;
+      useACMEHost = "aciceri.dev";
       forceSSL = true;
       locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
       locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
@@ -29,23 +28,13 @@ in
     "matrix.aciceri.dev" = {
       forceSSL = true;
       enableACME = true;
-      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString (lib.head config.services.matrix-synapse.settings.listeners).port}";
+      locations."/".proxyPass =
+        "http://127.0.0.1:${builtins.toString (lib.head config.services.matrix-synapse.settings.listeners).port}";
       locations."/_matrix".proxyPass = "http://localhost:8008";
       locations."/_synapse/client".proxyPass = "http://localhost:8008";
     };
   };
 
-  services.postgresql = {
-    enable = true;
-    initialScript = pkgs.writeText "synapse-init.sql" ''
-      CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-      CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-        TEMPLATE template0
-        LC_COLLATE = "C"
-        LC_CTYPE = "C";
-    '';
-  };
-
   systemd.tmpfiles.rules = [
     "d ${config.services.matrix-synapse.dataDir} 770 matrix-synapse matrix-synapse"
   ];
@@ -78,28 +67,4 @@ in
     };
     extraConfigFiles = [ config.age.secrets.matrix-registration-shared-secret.path ];
   };
-
-  backup.paths = [
-    config.services.matrix-synapse.dataDir
-    "/var/backup/postgresql/matrix-synapse.sql.gz"
-  ];
-
-  services.postgresqlBackup = {
-    enable = true;
-    databases = [ "matrix-synapse" ];
-  };
-
-  services.matrix-sliding-sync = {
-    enable = true;
-    environmentFile = config.age.secrets.matrix-sliding-sync-secret.path;
-    settings = {
-      SYNCV3_SERVER = "http://localhost:8008";
-    };
-  };
-
-  services.nginx.virtualHosts."syncv3.matrix.aciceri.dev" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/".proxyPass = config.services.matrix-sliding-sync.settings.SYNCV3_SERVER;
-  };
 }

modules/mediatomb/default.nix

@@ -5,11 +5,18 @@
     serverName = "Sisko";
     mediaDirectories = [
       {
-        path = "/mnt/hd/torrent";
+        path = "/mnt/hd/movies";
+        recursive = true;
+      }
+      {
+        path = "/mnt/hd/series";
         recursive = true;
       }
     ];
   };
 
-  users.users.mediatomb.extraGroups = [ "transmission" ];
+  users.users.mediatomb.extraGroups = [
+    "radarr"
+    "sonarr"
+  ];
 }

modules/mount-sisko/default.nix

@@ -15,8 +15,8 @@
     source = "${pkgs.nfs-utils.out}/bin/mount.nfs";
   };
 
-  fileSystems."/home/${config.ccr.username}/nas" = {
-    device = "sisko.fleet:/hd";
+  fileSystems."/mnt/nas" = {
+    device = "sisko.wg.aciceri.dev:/hd";
     fsType = "nfs";
     options = [
       "x-systemd.automount"

modules/nginx-base/default.nix

@@ -1,7 +1,22 @@
+{ config, ... }:
 {
   security.acme = {
     acceptTerms = true;
     defaults.email = "andrea.ciceri@autistici.org";
+    certs = {
+      "aciceri.dev" = {
+        reloadServices = [ "nginx.service" ];
+        domain = "aciceri.dev";
+        extraDomainNames = [
+          "*.sisko.zt.aciceri.dev"
+          "*.sisko.wg.aciceri.dev"
+        ];
+        dnsProvider = "cloudflare";
+        dnsPropagationCheck = true;
+        group = config.services.nginx.group;
+        environmentFile = config.age.secrets.cloudflare-dyndns-api-token.path;
+      };
+    };
   };
 
   networking.firewall.allowedTCPPorts = [
@@ -11,6 +26,7 @@
 
   services.nginx = {
     enable = true;
+    statusPage = true;
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
     recommendedProxySettings = true;

modules/nix/default.nix

@@ -6,17 +6,6 @@
   ...
 }:
 {
-  nixpkgs.overlays = [
-    (final: _: {
-      nix-fast-build = fleetFlake.inputs.nix-fast-build.packages.${final.system}.nix-fast-build // {
-        nix = final.nix;
-      };
-      nix-eval-job = fleetFlake.inputs.lix-eval-jobs.packages.${final.system}.nix-eval-jobs // {
-        nix = final.nix;
-      };
-    })
-  ];
-
   environment.systemPackages = [ pkgs.nix-fast-build ];
 
   nix = {
@@ -92,7 +81,7 @@
     distributedBuilds = true;
     buildMachines =
       lib.lists.optional (config.networking.hostName == "picard") {
-        hostName = "sisko.fleet";
+        hostName = "sisko.wg.aciceri.dev";
         system = "aarch64-linux";
         maxJobs = 7;
         supportedFeatures = [

modules/paperless/default.nix

@@ -22,4 +22,18 @@
   environment.persistence."/persist".directories = [
     config.services.paperless.dataDir
   ];
+
+  imports = [ ../nginx-base ];
+
+  services.nginx.virtualHosts."paper.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.paperless.port}";
+    };
+    extraConfig = ''
+      client_max_body_size 50000M;
+    '';
+    serverAliases = [ "paper.sisko.zt.aciceri.dev" ];
+  };
 }

modules/pipewire/default.nix

@@ -1,8 +1,13 @@
 { lib, ... }:
 {
-  services.pipewire.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
 
-  hardware.pulseaudio = {
-    enable = lib.mkForce false;
+  services.pulseaudio = {
+    enable = false;
   };
 }

modules/prometheus-exporters/default.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 let
@@ -15,6 +16,7 @@ in
           "sisko"
           "picard"
           "kirk"
+          "pike"
         ]
         {
           enable = true;
@@ -53,6 +55,7 @@ in
           "sisko"
           "picard"
           "kirk"
+          "pike"
         ]
         {
           enable = true;
@@ -62,13 +65,17 @@ in
         [
           "picard"
           "kirk"
+          "pike"
         ]
         {
           enable = true;
         };
-    # restic = mkFor ["sisko"] {
-    #   enable = true;
-    # };
+    restic = mkFor [ "sisko" ] {
+      # https://github.com/ngosang/restic-exporter/issues/31
+      enable = false;
+      repository = config.services.restic.backups.sisko.repository;
+      passwordFile = config.age.secrets.SISKO_RESTIC_PASSWORD.path;
+    };
     postgres = mkFor [ "sisko" ] {
       enable = true;
     };
@@ -81,9 +88,12 @@ in
           "sisko"
           "picard"
           "kirk"
+          "pike"
         ]
         {
           enable = true;
         };
   };
+
+  systemd.services.prometheus-restic-exporter.path = [ pkgs.openssh ];
 }

modules/prometheus/default.nix

@@ -8,11 +8,11 @@ in
     pushgateway = {
       enable = true;
       web = {
-        listen-address = "sisko.fleet:9094";
+        listen-address = "sisko.wg.aciceri.dev:9094";
       };
     };
     checkConfig = false; # Otherwise it will fail because it cannot access bearer_token_file
-    webExternalUrl = "https://status.aciceri.dev";
+    webExternalUrl = "https://status.wg.aciceri.dev";
     globalConfig.scrape_interval = "10s";
     scrapeConfigs = [
       {
@@ -22,27 +22,28 @@ in
         static_configs = [
           {
             targets = [
-              "sisko.fleet:${builtins.toString config.services.home-assistant.config.http.server_port}"
+              "sisko.wg.aciceri.dev:${builtins.toString config.services.home-assistant.config.http.server_port}"
             ];
           }
         ];
       }
-      {
-        job_name = "pushgateway";
-        static_configs = [
-          {
-            targets = [ cfg.pushgateway.web.listen-address ];
-          }
-        ];
-      }
+      # {
+      #   job_name = "pushgateway";
+      #   static_configs = [
+      #     {
+      #       targets = [ cfg.pushgateway.web.listen-address ];
+      #     }
+      #   ];
+      # }
       {
         job_name = "node";
         static_configs = [
           {
-            targets = builtins.map (host: "${host}.fleet:9100") [
+            targets = builtins.map (host: "${host}.wg.aciceri.dev:9100") [
               "sisko"
               "picard"
               "kirk"
+              "pike"
             ];
           }
         ];
@@ -51,9 +52,10 @@ in
         job_name = "wireguard";
         static_configs = [
           {
-            targets = builtins.map (host: "${host}.fleet:9586") [
+            targets = builtins.map (host: "${host}.wg.aciceri.dev:9586") [
               "picard"
               "kirk"
+              "pike"
             ];
           }
         ];
@@ -62,9 +64,10 @@ in
         job_name = "zfs";
         static_configs = [
           {
-            targets = builtins.map (host: "${host}.fleet:9134") [
+            targets = builtins.map (host: "${host}.wg.aciceri.dev:9134") [
               "picard"
               "kirk"
+              "pike"
             ];
           }
         ];
@@ -73,7 +76,7 @@ in
         job_name = "restic";
         static_configs = [
           {
-            targets = builtins.map (host: "${host}.fleet:9753") [ "sisko" ];
+            targets = builtins.map (host: "${host}.wg.aciceri.dev:9753") [ "sisko" ];
           }
         ];
       }
@@ -81,7 +84,7 @@ in
         job_name = "postgres";
         static_configs = [
           {
-            targets = builtins.map (host: "${host}.fleet:9187") [ "sisko" ];
+            targets = builtins.map (host: "${host}.wg.aciceri.dev:9187") [ "sisko" ];
           }
         ];
       }
@@ -89,7 +92,7 @@ in
         job_name = "nginx";
         static_configs = [
           {
-            targets = builtins.map (host: "${host}.fleet:9117") [ "sisko" ];
+            targets = builtins.map (host: "${host}.wg.aciceri.dev:9117") [ "sisko" ];
           }
         ];
       }
@@ -97,16 +100,18 @@ in
         job_name = "smartctl";
         static_configs = [
           {
-            targets = builtins.map (host: "${host}.fleet:9633") [
+            targets = builtins.map (host: "${host}.wg.aciceri.dev:9633") [
               "sisko"
               "kirk"
               "picard"
+              "pike"
             ];
           }
         ];
       }
     ];
   };
+
   environment.persistence."/persist".directories = [
     "/var/lib/${cfg.stateDir}"
   ];

modules/promtail/default.nix

@@ -12,7 +12,7 @@ let
     };
     clients = [
       {
-        url = "http://sisko.fleet:${
+        url = "http://sisko.wg.aciceri.dev:${
           builtins.toString config.services.loki.configuration.server.http_listen_port or 3100
         }/loki/api/v1/push";
       }

modules/restic/default.nix

@@ -24,9 +24,8 @@ in
     };
   };
 
-  services.openssh.knownHosts."${
-    host
-  }".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
+  services.openssh.knownHosts."${host}".publicKey =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
 
   services.postgresqlBackup = {
     enable = true;

modules/sisko-proxy/default.nix

@@ -15,26 +15,17 @@
         proxy_set_header    Connection  $connection_upgrade;
       '';
     };
-    "torrent.aciceri.dev" = {
+    "home.sisko.aciceri.dev" = {
       forceSSL = true;
-      enableACME = true;
+      useACMEHost = "aciceri.dev";
       locations."/" = {
-        proxyPass = "http://localhost:${builtins.toString config.services.transmission.settings.rpc-port}";
-      };
-    };
-    "search.aciceri.dev" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://localhost:8888";
-      };
-    };
-    "invidious.aciceri.dev" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://localhost:${builtins.toString config.services.invidious.port}";
+        proxyPass = "http://localhost:${builtins.toString config.services.home-assistant.config.http.server_port}";
+        proxyWebsockets = true;
       };
+      extraConfig = ''
+        proxy_set_header    Upgrade     $http_upgrade;
+        proxy_set_header    Connection  $connection_upgrade;
+      '';
     };
     "photos.aciceri.dev" = {
       extraConfig = ''
@@ -43,17 +34,10 @@
       forceSSL = true;
       enableACME = true;
       locations."/" = {
-        proxyPass = "http://localhost:8080";
+        proxyPass = "http://localhost:${builtins.toString config.services.immich.port}";
         proxyWebsockets = true;
       };
     };
-    "paper.aciceri.dev" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://localhost:${builtins.toString config.services.paperless.port}";
-      };
-    };
     # "${config.services.nextcloud.hostName}" = {
     #   forceSSL = true;
     #   enableACME = true;

modules/sisko-share/default.nix

@@ -1,3 +1,4 @@
+{ pkgs, ... }:
 {
   systemd.tmpfiles.rules = [
     "d /export 770 nobody nogroup"
@@ -16,24 +17,81 @@
     '';
   };
 
+  systemd.services.nfs-server.preStart = ''
+    chmod -R 775 /export/hd/torrent
+  '';
+
   services.webdav = {
     enable = true;
 
     settings = {
-      address = "10.1.1.2"; # accessible only in LAN, used by Kodi installed on the TV
+      address = "0.0.0.0";
       port = 9999;
       scope = "/mnt/hd/torrent";
       modify = false;
-      auth = false; # TODO should we enable authentication? It's only reachable in LAN
+      auth = false;
       debug = true;
       users = [ ];
     };
   };
 
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+    # workgroup = "WORKGROUP";
+    # hostname = "siko";
+    # discovery = true;
+  };
+
+  services.avahi = {
+    publish.enable = true;
+    publish.userServices = true;
+    # ^^ Needed to allow samba to automatically register mDNS records (without the need for an `extraServiceFile`
+    #nssmdns4 = true;
+    # ^^ Not one hundred percent sure if this is needed- if it aint broke, don't fix it
+    enable = true;
+    openFirewall = true;
+  };
+
+  services.samba = {
+    enable = true;
+    # global.security = "user";
+    package = pkgs.samba4Full;
+    # settings.global = {
+    #   "workgroup" = "WORKGROUP";
+    #   "server string" = "sisko";
+    #   "netbios name" = "sisko";
+    #   "security" = "user";
+    #   "map to guest" = "bad user";
+    #   "vfs objects" = "recycle";
+    #   "recycle:repository" = ".recycle";
+    #   "recycle:keeptree" = "yes";
+    #   "recycle:versions" = "yes";
+    #   "hosts allow" = "10.1.1.0. 127.0.0.1 localhost";
+    # };
+    settings = {
+      torrent = {
+        path = "/mnt/hd/torrent";
+        comment = "hd";
+        "force user" = "transmission";
+        browseable = "yes";
+        writeable = "yes";
+      };
+    };
+  };
+
   users.users.webdav.extraGroups = [ "transmission" ];
 
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall = {
+    allowedTCPPorts = [
       2049
       9999
+      139
+      445
     ];
+    allowedUDPPorts = [
+      137
+      138
+    ];
+  };
 }

modules/syncthing/default.nix

@@ -3,7 +3,7 @@
   services = {
     syncthing = {
       enable = true;
-      guiAddress = "${config.networking.hostName}.fleet:8434";
+      guiAddress = "${config.networking.hostName}.wg.aciceri.dev:8434";
       # TODO Use the home-manager module instead of the following conditions
       user = if config.networking.hostName == "sisko" then "syncthing" else "ccr";
       dataDir = if config.networking.hostName == "sisko" then "/mnt/hd/syncthing" else "/home/ccr";
@@ -16,25 +16,25 @@
           picard = {
             id = "XKSCJ46-EM6GIZ7-6ABQTZZ-ZRVWVFM-MJ3QNVG-F5EWHY5-ZUNYVSL-DA77YAG";
             addresses = [
-              "tcp://picard.fleet"
+              "tcp://picard.wg.aciceri.dev"
             ];
           };
           sisko = {
-            id = "TOC7QXZ-JLB4LYP-VNIJAV5-DCKVGFN-UE45SPX-PPFJHSG-O3UHFCK-2PEMAQ6";
+            id = "QE6V7PR-VHMAHHS-GHD4ZI3-IBB7FEM-M6EQZBX-YFCWDAK-YCYL6VO-NNRMXQK";
             addresses = [
-              "tcp://sisko.fleet"
+              "tcp://sisko.wg.aciceri.dev"
             ];
           };
           kirk = {
             id = "OVPXSCE-XFKCBJ2-A4SKJRI-DYBZ6CV-U2OFNA2-ALHOPW5-PPMHOIQ-5TG2HAJ";
             addresses = [
-              "tcp://kirk.fleet"
+              "tcp://kirk.wg.aciceri.dev"
             ];
           };
           oneplus8t = {
             id = "KMB2YRF-DGTWU24-SLITU23-5TN7BMQ-6PFAQQZ-CZ7J2QL-PIGVBTU-VRFRMQV";
             addresses = [
-              "tcp://oneplus8t.fleet"
+              "tcp://oneplus8t.wg.aciceri.dev"
             ];
           };
         };

modules/transmission/default.nix

@@ -8,6 +8,8 @@
       download-dir = "/mnt/hd/torrent";
       incomplete-dir = "/mnt/hd/torrent/.incomplete";
 
+      download-queue-enabled = false;
+
       rpc-bind-address = "0.0.0.0";
       peer-port = 51413; # Forward both TCP and UDP on router traffic from router
       rpc-whitelist-enabled = false;
@@ -39,11 +41,20 @@
   ];
 
   systemd.tmpfiles.rules = [
-    "d /mnt/hd/torrent 770 transmission transmission"
-    "d /mnt/hd/torrent/.incomplete 770 transmission transmission"
+    "d /mnt/hd/torrent 774 transmission transmission"
+    "d /mnt/hd/torrent/.incomplete 774 transmission transmission"
   ];
 
   environment.persistence."/persist".directories = [
     config.services.transmission.home
   ];
+
+  services.nginx.virtualHosts."torrent.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.transmission.settings.rpc-port}";
+    };
+    serverAliases = [ "torrent.sisko.zt.aciceri.dev" ];
+  };
 }

modules/wireguard-common/default.nix

@@ -1,7 +1,5 @@
 {
-  lib,
   config,
-  vpn,
   ...
 }:
 {
@@ -24,9 +22,4 @@
     privateKeyFile = config.age.secrets."${config.networking.hostName}-wireguard-private-key".path;
     listenPort = 51820;
   };
-
-  networking.hosts = lib.mapAttrs' (hostname: vpnConfig: {
-    name = vpnConfig.ip;
-    value = [ "${hostname}.fleet" ];
-  }) vpn;
 }

modules/wireguard-server/default.nix

@@ -9,7 +9,7 @@
 
   networking.nat.enable = true;
 
-  networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg0.listenPort ]; # FIXME move this to wireguard-server
+  networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg0.listenPort ];
 
   networking.wireguard.interfaces.wg0 = {
     ips = [ "${vpn.${config.networking.hostName}.ip}/24" ];

modules/xdg/default.nix

@@ -1,20 +1,51 @@
 { pkgs, ... }:
 {
   xdg = {
+    autostart.enable = true;
+    menus.enable = true;
+    mime.enable = true;
+    icons.enable = true;
     portal = {
       enable = true;
       configPackages = with pkgs; [
-        xdg-desktop-portal-wlr
-        xdg-desktop-portal-gtk
-        xdg-desktop-portal-hyprland
+        # xdg-desktop-portal-wlr
+        # xdg-desktop-portal-gtk
+        # xdg-desktop-portal-hyprland
+        xdg-desktop-portal-gnome
+        # xdg-desktop-portal
+        # kdePackages.xdg-desktop-portal-kde
+        # libsForQt5.xdg-desktop-portal-kde
+        gnome-keyring
       ];
       extraPortals = with pkgs; [
-        xdg-desktop-portal-wlr
-        xdg-desktop-portal-gtk
-        xdg-desktop-portal-hyprland
+        # xdg-desktop-portal-wlr
+        # xdg-desktop-portal-gtk
+        # xdg-desktop-portal-hyprland
+        xdg-desktop-portal-gnome
+        # xdg-desktop-portal
+        # kdePackages.xdg-desktop-portal-kde
+        gnome-keyring
       ];
       xdgOpenUsePortal = true;
       wlr.enable = true;
     };
+
+  };
+  security.rtkit.enable = true;
+
+  security.polkit.enable = true;
+  services.gnome.gnome-keyring.enable = true;
+  systemd.user.services.niri-flake-polkit = {
+    description = "PolicyKit Authentication Agent provided by niri-flake";
+    wantedBy = [ "niri.service" ];
+    after = [ "graphical-session.target" ];
+    partOf = [ "graphical-session.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${pkgs.libsForQt5.polkit-kde-agent}/libexec/polkit-kde-authentication-agent-1";
+      Restart = "on-failure";
+      RestartSec = 1;
+      TimeoutStopSec = 10;
+    };
   };
 }

modules/zerotier/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+{
+  services.zerotierone = {
+    enable = true;
+    joinNetworks = [ "632ea29085af0cb4" ];
+  };
+  environment =
+    if (config.networking.hostName == "sisko") then
+      {
+        persistence."/persist".directories = [
+          "/var/lib/zerotier-one"
+        ];
+      }
+    else
+      { };
+}

packages/deploy/deploy.sh

@@ -2,8 +2,8 @@ host=${1-picard}
 
 nixos-rebuild switch \
   --flake ".#${host}" \
-  --target-host "root@${host}.fleet" \
-  --build-host "root@${host}.fleet" \
+  --target-host "root@${host}.wg.aciceri.dev" \
+  --build-host "root@${host}.wg.aciceri.dev" \
   --option warn-dirty false \
   --fast \
   "${@:2}"

packages/emacs/default.nix

@@ -19,7 +19,7 @@ let
       cp $f $out/"libtree-sitter-$(basename $f)"
     done
   '';
-  emacsWithoutPackages = pkgs'.emacs-git.override {
+  emacsWithoutPackages = pkgs'.emacs-unstable.override {
     withSQLite3 = true;
     withWebP = true;
     withPgtk = true;

packages/emacs/packages.nix

@@ -10,6 +10,7 @@ let
       version = args.src.rev;
       propagatedUserEnvPkgs = args.deps;
       buildInputs = args.deps;
+      postInstall = args.postInstall or "";
     };
 
   # *Attrset* containig extra emacs packages
@@ -44,6 +45,69 @@ let
       };
       deps = [ elpaPackages.heap ];
     };
+    copilot = buildEmacsPackage {
+      name = "copilot";
+      src = pkgs.fetchFromGitHub {
+        owner = "copilot-emacs";
+        repo = "copilot.el";
+        rev = "b7bff7b934837744688fd74191ecffb83b3bcc05";
+        hash = "sha256-MEsjXQIeiTI6NXN5rTW7HfFPC18IZnhAssma2BZa0ks=";
+      };
+      deps = with epkgs; [
+        s
+        dash
+        editorconfig
+        jsonrpc
+        f
+      ];
+    };
+    lean4-mode = buildEmacsPackage {
+      name = "lean4-mode";
+      src = pkgs.fetchFromGitHub {
+        owner = "leanprover-community";
+        repo = "lean4-mode";
+        rev = "76895d8939111654a472cfc617cfd43fbf5f1eb6";
+        hash = "sha256-DLgdxd0m3SmJ9heJ/pe5k8bZCfvWdaKAF0BDYEkwlMQ=";
+      };
+      deps = [
+        epkgs.dash
+        melpaPackages.magit
+        melpaPackages.lsp-mode
+      ];
+      postInstall = ''
+        cp -r $src/data $LISPDIR
+      '';
+    };
+    kdl-ts-mode = buildEmacsPackage {
+      name = "kdl-ts-mode";
+      src = pkgs.fetchFromGitHub {
+        owner = "dataphract";
+        repo = "kdl-ts-mode";
+        rev = "3dbf116cd19261d8d70f456ae3385e1d20208452";
+        hash = "sha256-4bfKUzzLhBFg4TeGQD0dClumcO4caIBU8/uRncFVVFQ=";
+      };
+      deps = [ ];
+    };
+    ultra-scroll = buildEmacsPackage {
+      name = "ultra-scroll";
+      src = pkgs.fetchFromGitHub {
+        owner = "jdtsmith";
+        repo = "ultra-scroll";
+        rev = "78ab497c6568e4a99f34a84b4c9bfe87d1a71d8c";
+        hash = "sha256-q/LGP69GRtEEbSpXi9JUoZjr/UV1QMVjQw96M6qxsZU=";
+      };
+      deps = [ ];
+    };
+    eglot-booster = buildEmacsPackage {
+      name = "eglot-booster";
+      src = pkgs.fetchFromGitHub {
+        owner = "jdtsmith";
+        repo = "eglot-booster";
+        rev = "e6daa6bcaf4aceee29c8a5a949b43eb1b89900ed";
+        hash = "sha256-PLfaXELkdX5NZcSmR1s/kgmU16ODF8bn56nfTh9g6bs=";
+      };
+      deps = [ ];
+    };
   };
 
   # *List* containing emacs packages from (M)ELPA
@@ -68,7 +132,6 @@ let
           ligature
           treemacs-nerd-icons
           eshell-syntax-highlighting
-          fish-completion # fish completion for eshell
           eshell-prompt-extras
           eshell-atuin
           eshell-command-not-found
@@ -84,7 +147,17 @@ let
           embark
           embark-consult
           magit
-          magit-delta
+          (magit-delta.override (old: {
+            # FIXME why is this needed?
+            melpaBuild =
+              args:
+              old.melpaBuild (
+                args
+                // {
+                  packageRequires = (args.packageRequires or [ ]) ++ [ dash ];
+                }
+              );
+          }))
           magit-todos
           difftastic
           with-editor
@@ -108,8 +181,10 @@ let
           markdown-mode
           haskell-mode
           terraform-mode
+          rust-mode
           diredfl
           org-modern
+          math-preview
           org-roam
           org-roam-ql
           org-roam-ui
@@ -129,6 +204,9 @@ let
           telega
           aggressive-indent
           mixed-pitch
+          visual-replace
+          org-super-agenda
+          tidal
           # org-re-reveal # FIXME very not nice hash mismatch when building
         ]
       )
@@ -145,6 +223,9 @@ let
       eat
       corfu-terminal
       haskell-ts-mode
+    ])
+    ++ (with epkgs; [
+      typst-ts-mode # why this doesn't seem to be in elpaPackages?
     ]);
 in
 mainPackages ++ (builtins.attrValues extraPackages)

packages/ffmpeg-rockchip/default.nix

@@ -0,0 +1,149 @@
+# Stolen from https://github.com/nyanmisaka/ffmpeg-rockchip
+
+{
+  ffmpeg-full,
+  fetchFromGitHub,
+  lib,
+  fetchpatch2,
+  gmp,
+  amf-headers,
+  libiec61883,
+  libavc1394,
+  meson,
+  ninja,
+  stdenv,
+  fetchurl,
+  cmake,
+  ...
+}:
+
+let
+  ffmpeg-rockchip-version = "7.1";
+
+  rga_commit = "d7a0a485ed6c201f882c20b3a8881e801f131385";
+  librga-multi = stdenv.mkDerivation {
+    pname = "librga-multi";
+    version = "1.10.0";
+
+    src = fetchurl {
+      url = "https://github.com/JeffyCN/mirrors/archive/${rga_commit}.tar.gz";
+      hash = "sha256-WjNxVfLVW8axEvNmIJ0+OCeboG4LiGWwJy6fW5Mkm5Y=";
+    };
+
+    # In Nixpkgs, meson comes with a setup hook that overrides the configure, check, and install phases.
+    # https://nixos.org/manual/nixpkgs/stable/#meson
+    nativeBuildInputs = [
+      meson
+      ninja
+    ];
+
+    patches = [
+      (fetchpatch2 {
+        name = "normalrga-cpp-add-10b-compact-endian-mode.patch";
+        url = "https://raw.githubusercontent.com/7Ji-PKGBUILDs/librga-multi/615fb730b7656ad4a0cb169bfa9a52336820f99f/normalrga-cpp-add-10b-compact-endian-mode.patch";
+        hash = "sha256-JvKZCBjWtkEsfx1Xsnysw9PjC3/60f1ni10tmR8fTHQ=";
+      })
+    ];
+
+    meta = with lib; {
+      description = "Rockchip RGA User-Space Library";
+      license = licenses.asl20;
+    };
+  };
+
+  mpp = stdenv.mkDerivation {
+    pname = "mpp";
+    version = "1.0.8";
+
+    src = fetchFromGitHub {
+      owner = "rockchip-linux";
+      repo = "mpp";
+      rev = "1.0.8";
+      hash = "sha256-y1vWGz7VjwL02klPQWwoIh5ExpvS/vsDUHcMtMznVcI=";
+    };
+
+    nativeBuildInputs = [ cmake ];
+
+    configurePhase = ''
+      cmake -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=$out
+    '';
+
+    buildPhase = ''
+      cmake --build build
+    '';
+
+    installPhase = ''
+      cmake --install build
+    '';
+
+    meta = with lib; {
+      description = "Media Process Platform (MPP)";
+      homepage = "https://github.com/rockchip-linux/mpp";
+      license = licenses.asl20;
+    };
+  };
+in
+
+(ffmpeg-full.override {
+  version = ffmpeg-rockchip-version; # Important! This sets the ABI.
+  source = fetchFromGitHub {
+    owner = "nyanmisaka";
+    repo = "ffmpeg-rockchip";
+    rev = "f5c7e0d63b52b4526b4251e2fcb2071f73367ed6";
+    hash = "sha256-JM/YCvXS49jYz4oF0Ux/aGzrRzKHrD8N/Xm99gXLcqg=";
+  };
+  withVulkan = false;
+}).overrideAttrs
+  (old: {
+    pname = "ffmpeg-rockchip";
+
+    patches = [ ];
+    # patches = old.patches ++ [
+    # (fetchpatch2
+    #   {
+    #     name = "add-av_stream_get_first_dts-for-chromium";
+    #     url = "https://raw.githubusercontent.com/7Ji-PKGBUILDs/ffmpeg-mpp-git/b32080c1992313df0e543440c6d70d351120fa36/add-av_stream_get_first_dts-for-chromium.patch";
+    #     hash = "sha256-DbH6ieJwDwTjKOdQ04xvRcSLeeLP2Z2qEmqeo8HsPr4=";
+    #   }
+    # )
+    # (fetchpatch2
+    #   {
+    #     name = "flvdec-handle-unknown";
+    #     url = "https://raw.githubusercontent.com/obsproject/obs-deps/faa110d336922831b5cdc261a9559e3a2dd5db3c/deps.ffmpeg/patches/FFmpeg/0001-flvdec-handle-unknown.patch";
+    #     hash = "sha256-WlGF9Uy89GcnY8zmh9G23bZiVJtpY32oJiec5Hl/V+8=";
+    #   }
+    # )
+    # (fetchpatch2
+    #   {
+    #     name = "libaomenc-presets";
+    #     url = "https://raw.githubusercontent.com/obsproject/obs-deps/faa110d336922831b5cdc261a9559e3a2dd5db3c/deps.ffmpeg/patches/FFmpeg/0002-libaomenc-presets.patch";
+    #     hash = "sha256-1fFBDvsx/jHo6QXsPxDMt4Qd1VlMs1kcOyBedyMv0YM=";
+    #   }
+    # )
+    # ];
+
+    configureFlags = old.configureFlags ++ [
+      "--extra-version=rockchip"
+      "--enable-gpl"
+      "--enable-version3"
+      "--enable-libdrm"
+      "--enable-rkmpp"
+      "--enable-rkrga"
+    ];
+
+    doCheck = false; # TODO remove (used to get faster builds)
+
+    buildInputs = old.buildInputs ++ [
+      gmp
+      amf-headers
+      libiec61883
+      libavc1394
+      mpp
+      librga-multi
+    ];
+
+    meta = with lib; {
+      homepage = "https://github.com/nyanmisaka/ffmpeg-rockchip";
+      license = licenses.gpl3;
+    };
+  })

packages/ib-tws/default.nix

@@ -0,0 +1,194 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  makeDesktopItem,
+  copyDesktopItems,
+  libXxf86vm,
+  libX11,
+  libXext,
+  libXtst,
+  libXi,
+  libXrender,
+  glib,
+  libxml2,
+  ffmpeg,
+  libGL,
+  freetype,
+  fontconfig,
+  gtk3,
+  pango,
+  cairo,
+  alsa-lib,
+  atk,
+  gdk-pixbuf,
+  gtk2,
+  ...
+}:
+
+let
+  rSubPaths = [
+    "lib/amd64/jli"
+    "lib/amd64/server"
+    "lib/amd64"
+  ];
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "ib-tws";
+  version = "10.33.1f";
+  etagHash = "f3ac044774c83917855f484a968c6ad2";
+
+  src = fetchurl {
+    url = "https://download2.interactivebrokers.com/installers/tws/latest-standalone/tws-latest-standalone-linux-x64.sh";
+    hash = "sha256-Iq4Bd5LTOajfK3IaomeAZL182lEXkCn7JjEO6UWgdFE=";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+    "fixupPhase"
+  ];
+
+  nativeBuildInputs = [ copyDesktopItems ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "IB Trader Workstation";
+      exec = pname;
+      icon = pname;
+      categories = [
+        "Office"
+        "Finance"
+      ];
+      startupWMClass = "jclient-LoginFrame";
+    })
+    (makeDesktopItem {
+      name = "ib-gw";
+      desktopName = "IB Gateway";
+      exec = "ib-gw";
+      icon = pname;
+      categories = [
+        "Office"
+        "Finance"
+      ];
+      startupWMClass = "ibgateway-GWClient";
+    })
+  ];
+
+  unpackPhase = ''
+    echo "Unpacking I4J sfx sh to $PWD..."
+    INSTALL4J_TEMP="$PWD" sh "$src" __i4j_extract_and_exit
+
+    # JRE
+    jrePath="$out/share/${pname}/jre"
+    echo "Unpacking JRE to $jrePath..."
+    mkdir -p "$jrePath"
+    tar -xf "$PWD/"*.dir/jre.tar.gz -C "$jrePath/"
+
+    echo "Patching JRE executables..."
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      "$jrePath/bin/java" "$jrePath/bin/unpack200"
+
+    echo "Unpacking JRE pack files..."
+    for f in "$jrePath/lib/"*.jar.pack "$jrePath/lib/ext/"*.jar.pack; do
+      jar_file=`echo "$f" | awk '{ print substr($0,1,length($0)-5) }'`
+      "$jrePath/bin/unpack200" -r "$f" "$jar_file"
+      [ $? -ne 0 ] && echo "Error unpacking $f" && exit 1
+    done
+
+    echo "Unpacking TWS payload..."
+    INSTALL4J_JAVA_HOME_OVERRIDE="$jrePath" sh "$src" -q -dir "$PWD/"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # create main startup script
+    mkdir -p "$out/bin"
+    cat<<EOF > "$out/bin/${pname}"
+    #!$SHELL
+
+    # get script name
+    PROG=\$(basename "\$0")
+
+    # Load system-wide settings and per-user overrides
+    IB_CONFIG_DIR="\$HOME/.\$PROG"
+    JAVA_GC="-Xmx4G -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:ParallelGCThreads=20 -XX:ConcGCThreads=5 -XX:InitiatingHeapOccupancyPercent=70"
+    JAVA_UI_FLAGS="-Dswing.aatext=TRUE -Dawt.useSystemAAFontSettings=on -Dsun.awt.nopixfmt=true -Dsun.java2d.noddraw=true -Dswing.boldMetal=false -Dsun.locale.formatasdefault=true"
+    JAVA_LOCALE_FLAGS="-Dsun.locale.formatasdefault=true"
+    JAVA_FLAGS="\$JAVA_GC \$JAVA_UI_FLAGS \$JAVA_LOCALE_FLAGS \$JAVA_EXTRA_FLAGS"
+    [ -f "\$HOME/.config/\$PROG.conf" ] && . "\$HOME/.config/\$PROG.conf"
+
+    CLASS="jclient.LoginFrame"
+    [ "\$PROG" = "ib-gw" ] && CLASS="ibgateway.GWClient"
+
+    cd "$out/share/${pname}/jars"
+    "$out/share/${pname}/jre/bin/java" -cp \* \$JAVA_FLAGS \$CLASS \$IB_CONFIG_DIR
+    EOF
+    chmod u+x $out/bin/${pname}
+
+    # create symlink for the gateway
+    ln -s "${pname}" "$out/bin/ib-gw"
+
+    # copy files
+    mkdir -p $out/share/${pname}
+    cp -R jars $out/share/${pname}
+    install -Dm644 .install4j/tws.png $out/share/pixmaps/${pname}.png
+
+    runHook postInstall
+  '';
+
+  dontPatchELF = true;
+  dontStrip = true;
+
+  postFixup = ''
+    rpath+="''${rpath:+:}${lib.concatStringsSep ":" (map (a: "$jrePath/${a}") rSubPaths)}"
+
+    # set all the dynamic linkers
+    find $out -type f -perm -0100 \
+      -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "$rpath" {} \;
+
+    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
+  '';
+
+  rpath = lib.strings.makeLibraryPath libraries;
+
+  libraries = [
+    stdenv.cc
+    stdenv.cc.libc
+    glib
+    libxml2
+    ffmpeg
+    libGL
+    libXxf86vm
+    alsa-lib
+    fontconfig
+    freetype
+    pango
+    gtk3
+    cairo
+    gdk-pixbuf
+    atk
+    libX11
+    libXext
+    libXtst
+    libXi
+    libXrender
+    gtk2
+  ];
+  # possibly missing libgdk-x11-2.0.so.0, from gtk2? never caused any trouble though
+
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    description = "Trader Work Station of Interactive Brokers";
+    homepage = "https://www.interactivebrokers.com";
+    # license = licenses.unfree;
+    maintainers = lib.optionals (maintainers ? k3a) [ maintainers.k3a ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

packages/mali-panthor-g610-firmware/default.nix

@@ -0,0 +1,32 @@
+# Stolen from https://github.com/qbisi/nixos-rockchip
+
+{
+  stdenv,
+  fetchurl,
+  ...
+}:
+stdenv.mkDerivation {
+  pname = "mali-panthor-g610-firmware";
+  version = "arch10_8";
+
+  src = fetchurl {
+    url = "https://gitlab.com/firefly-linux/external/libmali/-/raw/firefly/firmware/g610/mali_csffw.bin";
+    hash = "sha256-56C0b9Z3wy4IwLiBf9HFY8OsoBPax04XaR83O5cNu6s=";
+  };
+
+  dontUnpack = true;
+
+  dontPatch = true;
+
+  dontConfigure = true;
+
+  dontBuild = true;
+
+  installPhase = ''
+    install -Dm644 $src $out/lib/firmware/arm/mali/arch10.8/mali_csffw.bin
+  '';
+
+  passthru = {
+    compressFirmware = false;
+  };
+}

packages/spotify-adblocked/default.nix

@@ -15,7 +15,9 @@ let
       rev = "5a3281dee9f889afdeea7263558e7a715dcf5aab";
       hash = "sha256-UzpHAHpQx2MlmBNKm2turjeVmgp5zXKWm3nZbEo0mYE=";
     };
-    cargoHash = "sha256-wPV+ZY34OMbBrjmhvwjljbwmcUiPdWNHFU3ac7aVbIQ=";
+
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-oGpe+kBf6kBboyx/YfbQBt1vvjtXd1n2pOH6FNcbF8M=";
 
     patchPhase = ''
       substituteInPlace src/lib.rs \

secrets/aws-credentials.age

@@ -1,32 +1,19 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-LejiskurhcggIU/f+WpXpYAU+5Ct+wgO6qLU4l8Zw991t7+LQoDYdZThQt4aFDRY
-/KyNTJD5+SvobJvPpS0vwJeITL6c6wWmlBhx4WlhsCWlSKGz7jKxw4JpNZamfkDN
-fDt7RKJI9fxoDIJGVi5BjScR7GfryzpXFu5txVx+Hp8sWckl4US9sPxTGxJ/Qbc6
-0QFAO+qnm8FqtZWH1GZiJ2IAqc/sD6FHfd3aKtQ0PTuHoq11L0iSWRAJr/eW2EGJ
-nGEp/y2EUkwDd1z4FcHQHoko7j6f3friNHZH9I2SCALonw+L1SrXHiYgWRx19KAc
-xaLu+VjMUQ8LPN1zW9J8sUQWle1AA08x11EKB29hKmXE9clgY7Jx/zKp3EDgLIbU
-Pg531bppFse8I0xD6TgQ/yWDZfXTIr3y67dPWxjKf82dDxCKJk8nYW9uIAPjLTdk
-MkqWtsiVi0++HNMQoSlZMOFTiPyCGRGovmThpjpPP5GqGBUQmNDdP2hs1ZYoAmw1
-7dlj6PeGF50Pkita966qxbtAX9Ru7fsgYi+E5Mi067fgVSLg1i3Sk1CbSbxqbw5Q
-BkY1851VMgUBtmjsOGdyDTfITFThHOcjd9lzLrloPLeapOQ9Z6k/wJ7f2A5HyPL4
-zTJWZ6zcFBEbfeDtFtntwoaZ247AQAJC9unA2AC0xhM
--> ssh-rsa QHr3/A
-rSEk04k0mOPyll5cN5D9ktP9WTb39cUqFX8EGG8BhIWd9xwO7vF1xWXtCzpDOYCv
-PxfqiwCsNcCCNAd1CWYT52PY6P9zaTOV/ptk2U8nhpi8s6EDdyne3z8zR0SS1Wvz
-53Ml1fUjiTguulzANoRnZtEsaqoF0VPW03wjkTl6XUZUrNMC0Kgq6VP1tmt0kn08
-eGuD/P8BGiaaKAVN1iJK6U58O43Y4uB0od913BgALKsBjtcH4WvHcgcF359YrdNx
-qwQkiWTDjDtuOKm9djuZyuewosRAYsCZmHONmNnMGMVeZbcUipFMHsjeU3CfidaE
-pfxnAqB2G8x1M8qg9w7IiOxH5cH/qcfGk9yIxt25E0pyvaLziYCsKxzhuwnPW5sR
-ZOgIeECljKTywStX13/ze1hlWikj5ej3JerEbKn1WOD8NEV2vPP/9G9EHLJth2fT
-Si+2ZosRyWPmg1M391Dlr99Rjb/mXCtW3XBX9GeuL/puwg3I9QnGo5CQHx+GarhW
-RBcRO9SAYhoQtxba0/0mm80RxKn8Tdbe5ej6yzD7gdkywTArIRM/rMLLyKi2Im/k
-lDDDIjYp+fje0iUaQQO6K+hhW01EnG2HrELdq/VYs01tclGPdK6lI3lloeOXJ96c
-crlJfD+b5tK06w91w89w+itqUPIgZsbiq5qVFhfKyRY
--> ssh-ed25519 /WmILg RogWvabCGwzKFKQ78EVKpnpupZr5tKOXNsL6mpE1pzg
-QQcSAgC6Lb/Fk9eYG1q+o12ty/KyhFJbZyVB+3ANSxY
--> ssh-ed25519 +vdRnA jBfvf1o18lTbKfx2tKMzUJBmws8s5MMwGDlhUDHn5zY
-nZLNNbcy21SXXlTLT1tCRDfvlYOE347p6R4CLmEiWw8
---- xARfOI6GMc1FZ580lD6fGWmk2AjJVIoxsD+YETvcT0o
-mBË'ÂÚ‘ë"q
-űoŮ3»fŁôŤ˝xŇůđn_lÝëG‚'¬U5‡:?˘QźÉ§q-ržÁ
LTvÇśÓđ~'Š†iÎ{Ç…Učá8Ţ!ó±xí_8P©ąaNxd­°UŻ®€ý
+G5326/E4fSslYqgeLBn+nmuWUxw5o6219p96KM66MmIErHvoLBXgV9jgerpJfcuT
+4EevQaFwaQCvbywZT9YDSEDeM4e0RiAmpAHN8i72hj6F6dF5A8ScwDsE3LqHyNBA
+vSHoDTKi1nuS4qC9gx1LFYG3xGnCaQ2oN2UJV7O3V8KUqR5IqDCGB6+/5RDRoXmX
+Kc52VY2OOA9n4Eqz6y0aQSlSUQ1iWejzgjE53cOL/Cyb6g1GblOWknxlvnCk6uzP
+JBU4tBbUFP+WMfnDkwBEuUWj8J2gga/bXohgyFa7Zk2WWtFd+2IFNlm1MiCbKDnm
+pmXmbGcYCPH6xfc1QmVyddEqeqcYlDmVg+0ZaHOZjj4MC344p7wbBsCmfx+Ijc0D
+bhG5VWnXzvWx7HJQlZZlB7zrp2K4vDB2mI9QPmyvgEbZkx9KNO6g83M6tG19hF4Q
+garJ83QaWpMlfaClvgNfjZayuBjVTH3jNhRVf5U5p9C9lVx2zDEMaEZ5nL0ayeR4
+2pN0gSFiyjODEoRY43WUc7qvwBskdNsBpKkICxZjWcuayuO2pCTSoVeeD/YJ/m9a
+aL1RVyELvbefcUS9A3Nxk5hxMmQlkjgMKpfYGS3QVmmQfTnHcuiJXCAsVkJU3C48
+6SA5387h/shHxaOL9RyTBeC/1qklwOV6kqxwROQbSQ0
+-> ssh-ed25519 /WmILg I+1/kLgE5kycRCq+75V9rIo35aOWpsrWAkbaZDZ+elQ
+5g14cfb+Ig8g9k4mVQ9ar0aycs/8fYMYjZPJZy33fsE
+-> ssh-ed25519 +vdRnA WpaITQ02oRuz8bB+G0sVPCdBzugr9/nLPdsKQptGrjQ
+vbfFxDOlUj3FVKXyoawkXorTmPvY1Z75L4f0cP66KDk
+--- JdH2zcNZJNeRPZNA4EvSMcnbO4nMZy1QT+DyDsZsgOY
+_31ĚđeâżMH´8Uů޶á±qs˘có2‡Ú1Tçn⾯(NV¨
¶Ęr+;7<>ňweMTý<54>Ä|—OĹWö¦ćmĄ»b[Şč±őŽQ'j“€qĘrLG¤¨6a5F>µGjČ

secrets/cache-private-key.age

@@ -1,31 +1,18 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-P7Wn4/FoKxWdlxKlaSW05cajdFzxCZZaASHvHHvzJGxPsX/gmCXpsZ7nFZlJvtfV
-ENGjG0inZZhegfNue/VMiH29ovq9+hjl5o9uZlUBVDoYAU4lthej89CCbbwlbxrT
-AdKurfwWiBPp7N6WQN//TrWuLgyxnUeGV0BdWZjUeS6df20RDCWRcm34MugO4pDh
-S587curSguesGm6N6LF7QpyXyeR00OGNWvh5709EKIveDh7iwGZ+NAvucI7hjxbP
-Q7puN6G/SbBVA5dPQHwP+IAL0I5omeBNx+HLrjMM6ArTUNfMjhbii5b16eTKQQp0
-BIyXh346Dk4RD9i3az8THEOk3TGUh84jCMCTcW/rYGprz4iPaC9LNhIso8wnnGzE
-xaAiIeThrrcRrWBxU6FC1ACRgiSXrI/MgPisTHJqU5AkxcL3N/bd24dXJWj3+ZLa
-iPyhHGCfoPkoyeKLlDVdWzygVHSr5FLH4Dyxv0WOM7MrnkxVD4jQwAtXu8QsB+k8
-2E/KRS0lPmklY5vWgPXq7jnnOztk3OUCaXhJsOo+nAjLlslpJJz9WLryzEY+ojYj
-p90EHuhfnVx/H7J7BpsdWAjN38cFEOsMIC6QDPEa/P43RoejYcebM/i1hsXdz1HK
-3FcimDGmMR9jYoERUlBONZOGn2WuxjPJ292ehaQnXQ0
--> ssh-rsa QHr3/A
-ta6ztr+/tCBmQKGub2ZCB79SrN6Nna3fxStfGaLqgmEUsnM2kAh6Hp9+W3jbFEWM
-5L2mMusmoytYtXcR/JjAK8F199p/TrJifXHTnot6dmHKm428tauFRjMxsbWsaT6i
-X2rqtrIwXW6QEUFuya+WHI6t29aMZipzmhXjpTdcWyorUyGyNo9YaOt5ohRXzTPW
-f3ELf1aYVBZMxXmVC6E4cbH8dOWKlus/TPTcOirJzR0m3KjeAr5CNRct2qIVxixT
-WMViwu9xQgWjcUfra8YKO8LEBf/PaEk5BeszIHt7qwWr9sJt4v+206LNQvW8row/
-sIgdllzVklaqZtkukger7FHkxSasQXLdP1DPE9h4bwSN1H2pEMgJlAVGt8/m4n6T
-w5qUeDr2HV5kuz/kjdJl1hv6Ihf4de6yS2+7jtMN1FnICIVq67A/shsvA/JDNoOz
-kLM4WdgBVsqtGCEfmXQCRbz96yBb+ie3N8raJDKhNwWuQ4f3YJNwpVKmySrfUTly
-WFjWeuTDXv8LwHbUWtzFaXBmoS97EIlRibZqK0caOpmUU+doG03vDlJskfEfBD00
-nKBPTIiKGoQkbnhMl8YMW7uqhZVvJbPtPGUCpq2w87Um0lh5BuvBTPxNEQ26A/sJ
-XDByA5rIZqVIw29CjhBsZptR83nhFSa3OUshxoYR6xY
--> ssh-ed25519 q+UPnA Y8JxsQsN0qxfPDBVhiVuUYL3OImhUc4RyRpxr4Fff1E
-Ai1PLAYzoCrm6H9P+U/jA93IE0Mgc2B71AraDnsB6Lc
---- EAiuid1wt44o2ZGCLWO0tCcWm2ao7CuHrYdGmYx+yFQ
-ƒðE'Ú¨Jý'î”êÈT\¡ˆ…S0:#z<>
-Í×íý®Ù`¥ä˵˜àÍiaG‰…vBs“©…Ú;éÒC×ÉH=Å™‡Nu Ê©ßòR3¯×ŠBz‡Ç…ç†ïŽ»+¡×c†7­%†Z¾u›w)jÕ;ø¹iœ²:·•Ås
-KäŽi„a=#/O·)4ªï
+rWU4MBPVO+M7FPMzApYCDMs3hDRNTEH0lCTFiHHRi5GIWVtxRerOfoCh3M++FICS
+vErr1NOhTHgznXSLUi8LROC4CHtPBxJUA97yijzmWmcRRnemm5dUcI6xfsiNPRFZ
+JhMCTgT2USEjHTejVzHBl/kfggpAiFmBX8RvOVwaX1mGhZ4QEGePfl0n1l3KZfsb
+recANprjssuAzvB+Vj20NTgjtlGYV9QmFGPTs3xCy+9n9IUB3NWAdflE3omdndco
+zL8OSCOEXxvrqXaokLbESG1x/RPlT4hNRPBmNB057GJxaC94zOVYc75WwjX3iED5
+f4jczIYWRVwJcA2B1B64dQB7HhX7LOmxNARF4R/d9lao+hXE28IUcIR8e62nDO2i
+jeDV0zv2bwO3q+3FAAz04reR3nILIbPZ7r/fmPjFQNRLNxkRQ3Ba3PtrA14pOptI
+a4LFTCJo3XwMjDfRNckb1s1K84qyXun2VOhVStGBlhoHDM70KalNRykQqL51+GEH
+jZtsj8DM9ErY3oNfrmMDVS4fahb7S0LLsmj08iMLRNfxuUm1X+WO3V3oSI8HF7Y3
+br4+YtKCPPi0gsH03uH757WllNmx+VI2oZuKmt+yEqreb2EtMTywASNANazGd3k3
+jTm+L1qBNmhRWMA7abl05xG9f/nTneaxzSxkraElWIE
+-> ssh-ed25519 q+UPnA RD50yXDxXVYGmYUZ1ORy6zMVaTqBdzKmitvYNdTCXRI
+Yxi5TEquvJO1X7fRR+TkJrxbbc3R7wBKzCX6DNI/5f8
+--- ctmSdUA9UXwm2OpTPTKSOJmOQOonUZ3fJXOSRuWEwcQ
+ƒ›‡¡¶ÛÛ¯ò
+·y»¾^ó2>E
ÙËnAÇLÌÆÍ4bgÂ¥õäþë%Œ½«¨Jö»JElC"ç7/T<>?n!”'LÈI
çx6jOùèŽöV¯Ô¤=°ó–Ó‚Ù*¤{—É`ñºQšÄÖO4M.ÀÆ<C380>j±¿AQXjF-“rëëõ™÷™Z<E284A2>6÷'¸ê

secrets/cloudflare-dyndns-api-token.age

@@ -1,30 +1,17 @@
 age-encryption.org/v1
 -> ssh-rsa /AagBw
-K5GB/dRGaRFYq0dxuUFPubpdceMq6jOGSWuFuKgtRbtvC+P7qd8g56AZYTyo97jZ
-oAsl8bF3wifrPN73SzCoGba1lCmpDZLCPllNd5RZL1bcAGBj9eDAA1zihYnnO7s+
-r8L8JSJ/P76AZ3JRhylU0KjgkX1TnVSIsJ/wCQGbdw+KrTuam/3zjzLXEptn2U26
-oQ4AuzWVGWtyrAKyJfRDWQQUGDwgXMB1h+7XZMm3G1eu6Wm7vuFEQLjaocFE9tO0
-8lnU3IEzXtn1NrutmiIJSoDyGk/PeRdvu2fZWY9oKRxkCA2q0fOca9ArcAP7Wr8a
-+/2usaZ/wsc2fzqDQU2XoFutIU0qwvX6DtDmfb8RhMNrkj2HiR2MluYo+NqQqMOJ
-7kMS22yE1Z6akvpeHo1GZ15HczQatIXXSr4DFGlF7CG0ASNbjR+2Qzws+EmZ2WGX
-Ad8D9aq5DYOr9xvUdZn66NwyFyyo7FRMoXRFNL01sxJUBpu1wVkKECa8DK0GTIzz
-u+qRWtD9WxJkAodW1NmE2F08HIy//exP0L/L6laAjIrDZTle12Nrk6n9ke1UUBIo
-zU0RdY9HT+DAqScViGdbitv4Z+GYNWWkZfpW8O56S+B/0rmZZ6UQ8VB8GopUecBt
-E14rynpvnd2A6+WlUWcft2Uwl1i7jL3IARO1F3LTsS4
--> ssh-rsa QHr3/A
-Kh/yF7CW7lKTsn6JK4vX2SNyiH66JdB+oVYTFdc2efJYTXVLuj7ITK8EMP3dV267
-+D4UM3jcn8wOTeTjXIo8P01IOspGxslfC4J+Yol8K+1JA2BjB0diwzhQbkOEyxJ6
-R0uymJYXjtl8Cjx2mlyNMybG8QZYypPhdKosBRn/KELxInGsWHm4MV3XQ+w2fr9Q
-xHIKvz/8QabgzodHwFbMjp29B4MJUSIkl+uxyTULQMcoOCJ5Ip5BqA+VZsFRD8zV
-4dePanMQHPXIMnm3POZy3hq/M4FcwWkdJLvz3zyVDuW6mWdiOgA0k1AGpGIFTXeM
-bKclRUlgL9n7C/dEh5pcKLbEeh5HSf+2izn7PAA90zAQl8++2+iYMHEIQL/Ft6LH
-XnAsNR4rwnVdWu8BlyEhIPev1GgSp3wOc9eQ6TA16RO4ND1ItnLVauAmvDN4rUWI
-0wc9Utgwxy4MNhypRLnRXKc555pNpsL1aoA+vcbHfxW1MiW7zviIz2z/RXBR77ut
-x9kekkP+LEgMHWD4XCGidM2sMrKfKDDblb+YGKxRcdFlELQa0jHH1mcvU5YC4oY2
-IhYhWeEvyQOr21cP885Psu8IvSpaZVA0tOEdrEXNTa5+S495IGplp8YuxdjW6dz1
-trDcKVSXNsjqLtpl0CrPY8pSPRIEvUJgBcHUxB3+E/U
--> ssh-ed25519 +vdRnA lCY+mIpl7nNGi4wD5Z2CJPlIpqTECUyOncW+FuKzqxs
-3g0+X5fVGjo+EnETlDlO1VQl83Loi4bEBHshRz1/q0A
---- iUTAy7LeDZTABLGEMw/Bkc/qbujLcdpHdQ/TuodhmaM
-Ó¤ºþµ½;{Ö?‡®Ã`t™Ö8<C396>+—­‡þtÿý0m0Áç¾Ü¼ùì”ÊAÓ£m¨x}ÁŒZ2žóÀ„¾N±Ö2
-xå<
‡IVüæ#­W„ôúŠLÅÚ¿
+hD7PDjueXimBVI/rjcYxN77LHV2eGytKcUbmh17aSL1CNM+eriURFao3tj52Hiaz
+3VMB6FxWUk9kzgjMPvf5WZukuZ2WbpPH8xlDV+6ZH7e/IzmjIfx8Ny14Mr1IF/Rx
+TBiCIAM19/1/mR9MiIBW85bb+Bb/waWIZAgxW3N1RpqH5+vAVqx0iY3XRF5+0gOq
+blP3yEw3QaL6FuY0+a+d/TnCsrz2Gi1Rba9oCUmkzOP96TsJYdN58Ut6nrHFkURK
+mShL2xBMLmfA8Z5ep+D8ueyQbcYpeU3KHcIcRM6dRTwQKvWXAVkRt1nUGasKrO9Y
+oJT9BrcxjtqgF/xhHRjWpamjFSI3mlJnJNEbruddDwQUccrJOvEzvqZ7GK0WoFX2
+HmhdDOiocMGWFeBPAKlNtU3+QmtZvhvOIgbjKhNxmCt1A/qxfvRk7Y2IDIBo+CFo
+sKMrT1tCo4UYaJdZYl64XYNCQb3C2EfO7Exrq3d2urNidzUbr9OBx7CCI1nu375c
+Qol9Kr28fLtxRuSZlrqIe9vKVYyLDPznrRlh6TmgqmMLIW70Y8cZwMtT8L8sOkcm
+A8MoxpWFzK4BKo0Iqmw6eZ3nx/0LAzkz005ZEwrmi2W/XxOWJgBiaLmu7YwnoGq0
+gzwwvA5V5MT6Iy7FzkQpMi0h/H4MZ0mcbihKdPun85Q
+-> ssh-ed25519 +vdRnA 23Gviu8hfWCEBPHP7xYIaOx34kFsxJJgJ/BNUDlb9Cg
+ROiMY2gw/rpNBmJnlRVb7Qhi5+8TY3Velj8gEZcaedI
+--- dhmvfQoCjuRUJtvXNI/eCjH0W+IeJm8bFRvYk1JihD0
+qMCĐ,Ý<7F>˝Ôťęě‹9-\‘K<E28098>Jˇă]Á­˙J đ˝(ˇSnź°.ńQpá~Z$ó±eŘ"ęí”’\ůŁ'rS’l‰˙uÜ
+UD <äŐŤvĐÚáÓ]|
/g[†	W_“Č>-fl•›8|w­ĘŮŠČlš–˘ÜőB•[\ňá.k(W±{=w 3N}¤qGĎ-w´Mb^‰ŚQ{