try to configure using nixosModules

doesn't seem like there's that much benefit?

.gitignore

@@ -3,7 +3,6 @@
 *.db
 **/.direnv/**
 result
-.luarc.json
 private/**
+templates/**/flake.lock
 !private/**.age
-!private/**.sha512

README.md

@@ -26,8 +26,8 @@ configuration may be difficult to translate to a non-Nix system.
 | Terminal     | [Kitty](https://sw.kovidgoyal.net/kitty/)                                        | [Link](./modules/common/applications/kitty.nix)    |
 | Shell        | [Fish](https://fishshell.com/)                                                   | [Link](./modules/common/shell/fish)                |
 | Shell Prompt | [Starship](https://starship.rs/)                                                 | [Link](./modules/common/shell/starhip.nix)         |
-| Colorscheme  | [Gruvbox](https://github.com/morhetz/gruvbox)                                    | [Link](./colorscheme/gruvbox)                      |
-| Wallpaper    | [Road](https://gitlab.com/exorcist365/wallpapers/-/blob/master/gruvbox/road.jpg) | [Link](./hosts/tempest/default.nix)
+| Colorscheme  | [Gruvbox](https://github.com/morhetz/gruvbox)                                    | [Link](./colorscheme/gruvbox/default.nix)          |
+| Wallpaper    | [Road](https://gitlab.com/exorcist365/wallpapers/-/blob/master/gruvbox/road.jpg) | [Link](./hosts/tempest/default.nix)                |
 | Text Editor  | [Neovim](https://neovim.io/)                                                     | [Link](./modules/common/neovim/config)             |
 | Browser      | [Firefox](https://www.mozilla.org/en-US/firefox/new/)                            | [Link](./modules/common/applications/firefox.nix)  |
 | E-Mail       | [Aerc](https://aerc-mail.org/)                                                   | [Link](./modules/common/mail/aerc.nix)             |

apps/neovim.nix

@@ -5,8 +5,7 @@
   program = "${
       (import ../modules/common/neovim/package {
         inherit pkgs;
-        colors =
-          import ../colorscheme/gruvbox/neovim-gruvbox.nix { inherit pkgs; };
+        colors = (import ../colorscheme/nord).dark;
       })
     }/bin/nvim";
 

colorscheme/everforest/default.nix

@@ -1,20 +1,24 @@
 {
   name = "everforest"; # dark, hard
   author = "Sainnhe Park";
-  base00 = "#2b3339"; # Default Background
-  base01 = "#323c41"; # Lighter Background
-  base02 = "#503946"; # Selection Background
-  base03 = "#868d80"; # Comments, Invisibles, Line Highlighting
-  base04 = "#d3c6aa"; # Dark Foreground (Used for status bars)
-  base05 = "#d3c6aa"; # Default Foreground, Caret, Delimiters, Operators
-  base06 = "#e9e8d2"; # Light Foreground (Not often used)
-  base07 = "#fff9e8"; # Light Background (Not often used)
-  base08 = "#7fbbb3"; # Variables, XML Tags, Markup Link Text, ...
-  base09 = "#d699b6"; # Integers, Boolean, Constants, ...
-  base0A = "#83c092"; # Classes, Markup Bold, Search Text Background
-  base0B = "#dbbc7f"; # Strings, Inherited Class, Markup Code, Diff Inserted
-  base0C = "#e69875"; # Support, Regular Expressions, Escape Characters, ...
-  base0D = "#a7c080"; # Functions, Methods, Attribute IDs, Headings
-  base0E = "#e67e80"; # Keywords, Storage, Selector, Markup Italic, Diff Changed
-  base0F = "#d699b6"; # Deprecated, Opening/Closing Embedded Language Tags, ...
+  dark = {
+    base00 = "#2b3339"; # Default Background
+    base01 = "#323c41"; # Lighter Background
+    base02 = "#503946"; # Selection Background
+    base03 = "#868d80"; # Comments, Invisibles, Line Highlighting
+    base04 = "#d3c6aa"; # Dark Foreground (Used for status bars)
+    base05 = "#d3c6aa"; # Default Foreground, Caret, Delimiters, Operators
+    base06 = "#e9e8d2"; # Light Foreground (Not often used)
+    base07 = "#fff9e8"; # Light Background (Not often used)
+    base08 = "#7fbbb3"; # Variables, XML Tags, Markup Link Text, ...
+    base09 = "#d699b6"; # Integers, Boolean, Constants, ...
+    base0A = "#83c092"; # Classes, Markup Bold, Search Text Background
+    base0B = "#dbbc7f"; # Strings, Inherited Class, Markup Code, Diff Inserted
+    base0C = "#e69875"; # Support, Regular Expressions, Escape Characters, ...
+    base0D = "#a7c080"; # Functions, Methods, Attribute IDs, Headings
+    base0E =
+      "#e67e80"; # Keywords, Storage, Selector, Markup Italic, Diff Changed
+    base0F =
+      "#d699b6"; # Deprecated, Opening/Closing Embedded Language Tags, ...
+  };
 }

colorscheme/gruvbox-dark/default.nix

@@ -0,0 +1,45 @@
+# Gruvbox with a darker background for greater contrast
+
+{
+  name = "gruvbox-dark"; # Dark, Medium
+  author =
+    "Dawid Kurek (dawikur@gmail.com), morhetz (https://github.com/morhetz/gruvbox), ElRastaOk (https://www.reddit.com/user/ElRastaOk)";
+  dark = {
+    base00 = "#1D2122"; # ---- This is the change from normal gruvbox
+    base01 = "#3c3836"; # ---
+    base02 = "#504945"; # --
+    base03 = "#665c54"; # -
+    base04 = "#bdae93"; # +
+    base05 = "#d5c4a1"; # ++
+    base06 = "#ebdbb2"; # +++
+    base07 = "#fbf1c7"; # ++++
+    base08 = "#fb4934"; # red
+    base09 = "#fe8019"; # orange
+    base0A = "#fabd2f"; # yellow
+    base0B = "#b8bb26"; # green
+    base0C = "#8ec07c"; # aqua/cyan
+    base0D = "#83a598"; # blue
+    base0E = "#d3869b"; # purple
+    base0F = "#d65d0e"; # brown
+    batTheme = "gruvbox-dark";
+  };
+  light = {
+    base00 = "#fbf1c7"; # ----
+    base01 = "#ebdbb2"; # ---
+    base02 = "#d5c4a1"; # --
+    base03 = "#bdae93"; # -
+    base04 = "#665c54"; # +
+    base05 = "#504945"; # ++
+    base06 = "#3c3836"; # +++
+    base07 = "#1D2122"; # ++++ Adjusted darker here
+    base08 = "#9d0006"; # red
+    base09 = "#af3a03"; # orange
+    base0A = "#b57614"; # yellow
+    base0B = "#79740e"; # green
+    base0C = "#427b58"; # aqua/cyan
+    base0D = "#076678"; # blue
+    base0E = "#8f3f71"; # purple
+    base0F = "#d65d0e"; # brown
+    batTheme = "gruvbox-light";
+  };
+}

colorscheme/gruvbox/default.nix

@@ -19,7 +19,6 @@
     base0D = "#83a598"; # blue
     base0E = "#d3869b"; # purple
     base0F = "#d65d0e"; # brown
-    neovimConfig = ./neovim-gruvbox.nix;
     batTheme = "gruvbox-dark";
   };
   light = {
@@ -39,7 +38,6 @@
     base0D = "#076678"; # blue
     base0E = "#8f3f71"; # purple
     base0F = "#d65d0e"; # brown
-    neovimConfig = ./neovim-gruvbox.nix;
     batTheme = "gruvbox-light";
   };
 }

colorscheme/gruvbox/neovim-gruvbox.nix

@@ -1,12 +0,0 @@
-{ pkgs, ... }: {
-
-  plugins = [ pkgs.vimPlugins.vim-gruvbox8 ];
-
-  vim.g.gruvbox_italicize_strings = 0;
-  vim.o.background = "dark";
-  vimscript = ''
-    let g:gruvbox_italicize_strings = 0
-    colorscheme gruvbox8
-  '';
-
-}

colorscheme/nord/default.nix

@@ -1,21 +1,23 @@
 {
   name = "nord";
   author = "arcticicestudio";
-  base00 = "#2E3440";
-  base01 = "#3B4252";
-  base02 = "#434C5E";
-  base03 = "#4C566A";
-  base04 = "#D8DEE9";
-  base05 = "#E5E9F0";
-  base06 = "#ECEFF4";
-  base07 = "#8FBCBB";
-  base08 = "#88C0D0";
-  base09 = "#81A1C1";
-  base0A = "#5E81AC";
-  base0B = "#BF616A";
-  base0C = "#D08770";
-  base0D = "#EBCB8B";
-  base0E = "#A3BE8C";
-  base0F = "#B48EAD";
-  neovimConfig = ./neovim.lua;
+  dark = {
+    base00 = "#2E3440";
+    base01 = "#3B4252";
+    base02 = "#434C5E";
+    base03 = "#4C566A";
+    base04 = "#D8DEE9";
+    base05 = "#E5E9F0";
+    base06 = "#ECEFF4";
+    base07 = "#8FBCBB";
+    base08 = "#88C0D0";
+    base09 = "#81A1C1";
+    base0A = "#5E81AC";
+    base0B = "#BF616A";
+    base0C = "#D08770";
+    base0D = "#EBCB8B";
+    base0E = "#A3BE8C";
+    base0F = "#B48EAD";
+    batTheme = "nord";
+  };
 }

colorscheme/nord/neovim.lua

@@ -1,13 +0,0 @@
-local M = {}
-
-M.packer = function(use)
-    use({
-        "shaunsingh/nord.nvim",
-        config = function()
-            vim.g.nord_italic = true
-            vim.cmd("colorscheme nord")
-        end,
-    })
-end
-
-return M

disks/root.nix

@@ -9,7 +9,6 @@
         partitions = [
           # Boot partition
           {
-            type = "partition";
             name = "ESP";
             start = "0";
             end = "512MiB";
@@ -24,7 +23,6 @@
           }
           # Root partition ext4
           {
-            type = "partition";
             name = "root";
             start = "512MiB";
             end = "100%";

flake.lock

@@ -3,15 +3,16 @@
     "Comment-nvim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1678452935,
-        "narHash": "sha256-mVJJJ9fUJYgVyGZnW8e6P5QWB0K8nuhTwSWzlBvxv2M=",
+        "lastModified": 1681214440,
+        "narHash": "sha256-48hy+hiaDJLlgWqC7IeZI3dT+VwWkRo4atQbyPxu/ys=",
         "owner": "numToStr",
         "repo": "Comment.nvim",
-        "rev": "8d3aa5c22c2d45e788c7a5fe13ad77368b783c20",
+        "rev": "e51f2b142d88bb666dcaa77d93a07f4b419aca70",
         "type": "github"
       },
       "original": {
         "owner": "numToStr",
+        "ref": "v0.8.0",
         "repo": "Comment.nvim",
         "type": "github"
       }
@@ -19,15 +20,16 @@
     "bufferline-nvim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1677796018,
-        "narHash": "sha256-tuGitJQ2eXB9/SIHAyPrEVgy2n++GOlBOPLvFv3Ds4E=",
+        "lastModified": 1687763763,
+        "narHash": "sha256-wbOeylzjjScQXkrDbBU2HtrOZrp2YUK+wQ2aOkgxmRQ=",
         "owner": "akinsho",
         "repo": "bufferline.nvim",
-        "rev": "3677aceb9a72630b0613e56516c8f7151b86f95c",
+        "rev": "bf2f6b7edd0abf6b0732f5e5c0a8f30e51611c75",
         "type": "github"
       },
       "original": {
         "owner": "akinsho",
+        "ref": "v4.2.0",
         "repo": "bufferline.nvim",
         "type": "github"
       }
@@ -35,11 +37,11 @@
     "cmp-nvim-lsp-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1675708067,
-        "narHash": "sha256-DxpcPTBlvVP88PDoTheLV2fC76EXDqS2UpM5mAfj/D4=",
+        "lastModified": 1687494203,
+        "narHash": "sha256-mU0soCz79erJXMMqD/FyrJZ0mu2n6fE0deymPzQlxts=",
         "owner": "hrsh7th",
         "repo": "cmp-nvim-lsp",
-        "rev": "0e6b2ed705ddcff9738ec4ea838141654f12eeef",
+        "rev": "44b16d11215dce86f253ce0c30949813c0a90765",
         "type": "github"
       },
       "original": {
@@ -55,11 +57,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1680266963,
-        "narHash": "sha256-IW/lzbUCOcldLHWHjNSg1YoViDnZOmz0ZJL7EH9OkV8=",
+        "lastModified": 1687517837,
+        "narHash": "sha256-Ea+JTy6NSf+wWIFrgC8gnOnyt01xwmtDEn2KecvaBkg=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "99d4187d11be86b49baa3a1aec0530004072374f",
+        "rev": "6460468e7a3e1290f132fee4170ebeaa127f6f32",
         "type": "github"
       },
       "original": {
@@ -76,11 +78,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1678912468,
-        "narHash": "sha256-oUo6ZrsuqymuMLLvGfgnQ464OMKnUONv+ryea07iGrE=",
+        "lastModified": 1687598357,
+        "narHash": "sha256-70ciIe8415oQnQypawaqocEaLJcI1XtkqRNmle8vsrg=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "e8650fc36bf9d2acb411ba0047f863b8e481e3bb",
+        "rev": "1e7098ee0448dc5d33df394d040f454cd42a809c",
         "type": "github"
       },
       "original": {
@@ -91,14 +93,16 @@
     },
     "firefox-darwin": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1679446046,
-        "narHash": "sha256-CBjVE3Sj7Ls1pffxGavqPXRkaLYy1+O88NzBwNdgNcY=",
+        "lastModified": 1688605308,
+        "narHash": "sha256-B9suu7dcdX4a18loO5ul237gqIJ5/+TRuheLj8fJjwM=",
         "owner": "bandithedoge",
         "repo": "nixpkgs-firefox-darwin",
-        "rev": "1531f1477881e76c67b123a55f3d44ed7f83a4ba",
+        "rev": "78d28acf685e19d353b2ecb6c38eeb3fc624fc68",
         "type": "github"
       },
       "original": {
@@ -139,12 +143,15 @@
       }
     },
     "flake-utils_2": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1685518550,
+        "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
         "type": "github"
       },
       "original": {
@@ -154,12 +161,15 @@
       }
     },
     "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_2"
+      },
       "locked": {
-        "lastModified": 1676283394,
-        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "lastModified": 1685518550,
+        "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
         "type": "github"
       },
       "original": {
@@ -172,15 +182,14 @@
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "utils": "utils"
+        ]
       },
       "locked": {
-        "lastModified": 1680667162,
-        "narHash": "sha256-2vgxK4j42y73S3XB2cThz1dSEyK9J9tfu4mhuEfAw68=",
+        "lastModified": 1687627695,
+        "narHash": "sha256-6Pu7nWb52PRtUmihwuDNShDmsZiXgtXR0OARtH4DSik=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "440faf5ae472657ef2d8cc7756d77b6ab0ace68d",
+        "rev": "172d46d4b2677b32277d903bdf4cff77c2cc6477",
         "type": "github"
       },
       "original": {
@@ -193,7 +202,9 @@
     "nil": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "rust-overlay": "rust-overlay"
       },
       "locked": {
@@ -206,6 +217,7 @@
       },
       "original": {
         "owner": "oxalica",
+        "ref": "2023-04-03",
         "repo": "nil",
         "type": "github"
       }
@@ -218,11 +230,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1673891598,
-        "narHash": "sha256-EevceKxQtA+I0XVA8tBGKmYV1V1KbWc3gsswysMzeDk=",
+        "lastModified": 1685980282,
+        "narHash": "sha256-uQyVaoqkiocA8bXKMfrgizuKmz0hUzHye5owFoUd2AQ=",
         "owner": "gytis-ivaskevicius",
         "repo": "nix2vim",
-        "rev": "5b31eb81e2c6c74f9e8a4911660f3bf585d55158",
+        "rev": "3836a348503ae27340c7f83f0bc7bcb907f3781d",
         "type": "github"
       },
       "original": {
@@ -233,11 +245,11 @@
     },
     "nixlib": {
       "locked": {
-        "lastModified": 1677373009,
-        "narHash": "sha256-kxhz4QUP8tXa/yVSpEzDDZSEp9FvhzRqZzb+SeUaekw=",
+        "lastModified": 1687049841,
+        "narHash": "sha256-FBNZQfWtA7bb/rwk92mfiWc85x4hXta2OAouDqO5W8w=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "c9d4f2476046c6a7a2ce3c2118c48455bf0272ea",
+        "rev": "908af6d1fa3643c5818ea45aa92b21d6385fbbe5",
         "type": "github"
       },
       "original": {
@@ -254,11 +266,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1678351966,
-        "narHash": "sha256-tRFEU0lu3imZb3dtELBY+UbEhWXbb0xlBrsIlpICb+A=",
+        "lastModified": 1687398392,
+        "narHash": "sha256-T6kc3NMTpGJk1/dve8PGupeVcxboEb78xtTKhe3LL/A=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "0c043999b16caba6fb571af2d228775729829943",
+        "rev": "649171f56a45af13ba693c156207eafbbbf7edfe",
         "type": "github"
       },
       "original": {
@@ -269,43 +281,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1639237670,
-        "narHash": "sha256-RTdL4rEQcgaZGpvtDgkp3oK/V+1LM3I53n0ACPSroAQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "edfb969386ebe6c3cf8f878775a7975cd88f926d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "master",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1680487167,
-        "narHash": "sha256-9FNIqrxDZgSliGGN2XJJSvcDYmQbgOANaZA4UWnTdg4=",
+        "lastModified": 1687502512,
+        "narHash": "sha256-dBL/01TayOSZYxtY4cMXuNCBk8UMLoqRZA+94xiFpJA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "53dad94e874c9586e71decf82d972dfb640ef044",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1680758185,
-        "narHash": "sha256-sCVWwfnk7zEX8Z+OItiH+pcSklrlsLZ4TJTtnxAYREw=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "0e19daa510e47a40e06257e205965f3b96ce0ac9",
+        "rev": "3ae20aa58a6c0d1ca95c9b11f59a2d12eebc511f",
         "type": "github"
       },
       "original": {
@@ -315,13 +295,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_2": {
       "locked": {
-        "lastModified": 1677779205,
-        "narHash": "sha256-6DBjL9wjq86p2GczmwnHtFRnWPBPItc67gapWENBgX8=",
+        "lastModified": 1686929285,
+        "narHash": "sha256-WGtVzn+vGMPTXDO0DMNKVFtf+zUSqeW+KKk4Y/Ae99I=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "96e18717904dfedcd884541e5a92bf9ff632cf39",
+        "rev": "93fddcf640ceca0be331210ba3101cee9d91c13d",
         "type": "github"
       },
       "original": {
@@ -334,11 +314,11 @@
     "null-ls-nvim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1679325581,
-        "narHash": "sha256-ixhy8qgP2GEPqrMdI+GsHzeHxESwhRw6cjf5hcpwP1w=",
+        "lastModified": 1686871437,
+        "narHash": "sha256-MxIZqyRW8jStiDNXt7Bsw8peDLKpqxKEaUuIJsXkGMI=",
         "owner": "jose-elias-alvarez",
         "repo": "null-ls.nvim",
-        "rev": "13dd1fc13063681ca7e039436c88f6eca7e3e937",
+        "rev": "bbaf5a96913aa92281f154b08732be2f57021c45",
         "type": "github"
       },
       "original": {
@@ -349,11 +329,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1679482366,
-        "narHash": "sha256-88K2ABCsdsVwq6Go/uEn/fds1fUeeeoixOALjrrUI0Q=",
+        "lastModified": 1687625402,
+        "narHash": "sha256-V+vSWypmm/tGbwNXGhqzmiV7vTjV2gNCEh9N7OhNnyA=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "e9088dc6f9f289fbff984744ad04dccbd5c1f8ac",
+        "rev": "aeaf37c7538965e45700d39e6b5dc9c9a0e0749c",
         "type": "github"
       },
       "original": {
@@ -365,15 +345,16 @@
     "nvim-lspconfig-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1680847306,
-        "narHash": "sha256-oQBVjsUjAfJpxCN48c2bsL/P0tyb2goZmgAKjQH7QRs=",
+        "lastModified": 1675639052,
+        "narHash": "sha256-B8IgpypxzCACZ5VcqM6KiWyClaN+KrmemtkwMznmj5Y=",
         "owner": "neovim",
         "repo": "nvim-lspconfig",
-        "rev": "1ec6f5cbf6ffc44c84783d70039df5295ca22b4e",
+        "rev": "255e07ce2a05627d482d2de77308bba51b90470c",
         "type": "github"
       },
       "original": {
         "owner": "neovim",
+        "ref": "v0.1.6",
         "repo": "nvim-lspconfig",
         "type": "github"
       }
@@ -381,11 +362,11 @@
     "nvim-tree-lua-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1678748807,
-        "narHash": "sha256-u9ZLBL4FY/bkvl4+ofKifyEHM9+KhqeYovhr9VQYG7c=",
+        "lastModified": 1687132855,
+        "narHash": "sha256-ZRUoCDBv8rO8ZUBUMLgo33EBbqD9+ZOSET9rkFsA++E=",
         "owner": "kyazdani42",
         "repo": "nvim-tree.lua",
-        "rev": "1d79a64a88af47ddbb55f4805ab537d11d5b908e",
+        "rev": "c3c6544ee00333b0f1d6a13735d0dd302dba4f70",
         "type": "github"
       },
       "original": {
@@ -397,16 +378,16 @@
     "nvim-treesitter-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1677248832,
-        "narHash": "sha256-4TmtrufxjVpnSNfFpn6GQStEhq3KQb3JfmfMEJnSI8k=",
+        "lastModified": 1681121236,
+        "narHash": "sha256-iPsPDLhVKJ14iP1/2cCgcY9SCKK/DQz9Y0mQB1DqNiM=",
         "owner": "nvim-treesitter",
         "repo": "nvim-treesitter",
-        "rev": "b401b7423d18c78371c5ff1a5f8d3c14292b2047",
+        "rev": "cc360a9beb1b30d172438f640e2c3450358c4086",
         "type": "github"
       },
       "original": {
         "owner": "nvim-treesitter",
-        "ref": "v0.8.5.2",
+        "ref": "v0.9.0",
         "repo": "nvim-treesitter",
         "type": "github"
       }
@@ -423,7 +404,7 @@
         "nil": "nil",
         "nix2vim": "nix2vim",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs",
         "null-ls-nvim-src": "null-ls-nvim-src",
         "nur": "nur",
         "nvim-lspconfig-src": "nvim-lspconfig-src",
@@ -432,6 +413,7 @@
         "telescope-nvim-src": "telescope-nvim-src",
         "telescope-project-nvim-src": "telescope-project-nvim-src",
         "toggleterm-nvim-src": "toggleterm-nvim-src",
+        "vscode-terraform-snippets": "vscode-terraform-snippets",
         "wallpapers": "wallpapers",
         "wsl": "wsl"
       }
@@ -461,18 +443,49 @@
         "type": "github"
       }
     },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "telescope-nvim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1677414372,
-        "narHash": "sha256-QmyVJ/LZFtb/qqD5Q5fHsqAGgqaOT9XkVoLyOcqM14w=",
+        "lastModified": 1686302912,
+        "narHash": "sha256-fV3LLRwAPykVGc4ImOnUSP+WTrPp9Ad9OTfBJ6wqTMk=",
         "owner": "nvim-telescope",
         "repo": "telescope.nvim",
-        "rev": "a3f17d3baf70df58b9d3544ea30abe52a7a832c2",
+        "rev": "776b509f80dd49d8205b9b0d94485568236d1192",
         "type": "github"
       },
       "original": {
         "owner": "nvim-telescope",
+        "ref": "0.1.2",
         "repo": "telescope.nvim",
         "type": "github"
       }
@@ -480,11 +493,11 @@
     "telescope-project-nvim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1671805267,
-        "narHash": "sha256-S4SOHzQ17ux5pcwwYFpVVLzjLeC4/EJ0IFPbrfzUJC8=",
+        "lastModified": 1682606566,
+        "narHash": "sha256-H6lrPjpOUVleKHB0ziI+6dthg9ymitHhEWtcgYJTrKo=",
         "owner": "nvim-telescope",
         "repo": "telescope-project.nvim",
-        "rev": "8e8ee37b7210761502cdf2c3a82b5ba8fb5b2972",
+        "rev": "7c64b181dd4e72deddcf6f319e3bf1e95b2a2f30",
         "type": "github"
       },
       "original": {
@@ -496,31 +509,33 @@
     "toggleterm-nvim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1680290314,
-        "narHash": "sha256-862KtB9oqktx/mPI0wSauF7eJIJogqgG6wTTYlCSo9U=",
+        "lastModified": 1685434104,
+        "narHash": "sha256-oiCnBrvft6XxiQtQH8E4F842xhh348SaTpHzaeb+iDY=",
         "owner": "akinsho",
         "repo": "toggleterm.nvim",
-        "rev": "b86982429325112d2b20c6d0cc7a5c4b182ab705",
+        "rev": "95204ece0f2a54c89c4395295432f9aeedca7b5f",
         "type": "github"
       },
       "original": {
         "owner": "akinsho",
+        "ref": "v2.7.0",
         "repo": "toggleterm.nvim",
         "type": "github"
       }
     },
-    "utils": {
+    "vscode-terraform-snippets": {
+      "flake": false,
       "locked": {
-        "lastModified": 1678901627,
-        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
+        "lastModified": 1614849738,
+        "narHash": "sha256-v392tyzXV+zyBNt5OCB2NBCK7JcByrTa5Ne/nFtSCJI=",
+        "owner": "run-at-scale",
+        "repo": "vscode-terraform-doc-snippets",
+        "rev": "6ab3e44b566e660f38922cf908e6e547eaa5d4b4",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "run-at-scale",
+        "repo": "vscode-terraform-doc-snippets",
         "type": "github"
       }
     },
@@ -544,14 +559,14 @@
       "inputs": {
         "flake-compat": "flake-compat",
         "flake-utils": "flake-utils_3",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1678648312,
-        "narHash": "sha256-aY3CBNyenTUkStQhwigm30+BjXQyA8rCChGD+Z98qqE=",
+        "lastModified": 1687279045,
+        "narHash": "sha256-LR0dsXd/A07M61jclyBUW0wRojEQteWReKM35zoJXp0=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "c6f663e8583912059605b55c07583b6e96b5e690",
+        "rev": "a8486b5d191f11d571f15d80b6e265d1712d01cf",
         "type": "github"
       },
       "original": {

flake.nix

@@ -20,14 +20,17 @@
     home-manager = {
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows =
-        "nixpkgs"; # Use system packages list where available
+        "nixpkgs"; # Use system packages list for their inputs
     };
 
     # Community packages; used for Firefox extensions
     nur.url = "github:nix-community/nur";
 
     # Use official Firefox binary for macOS
-    firefox-darwin.url = "github:bandithedoge/nixpkgs-firefox-darwin";
+    firefox-darwin = {
+      url = "github:bandithedoge/nixpkgs-firefox-darwin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     # Manage disk format and partitioning
     disko = {
@@ -54,11 +57,14 @@
     };
 
     # Nix language server
-    nil.url = "github:oxalica/nil";
+    nil = {
+      url = "github:oxalica/nil/2023-04-03";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     # Neovim plugins
     nvim-lspconfig-src = {
-      url = "github:neovim/nvim-lspconfig";
+      url = "github:neovim/nvim-lspconfig/v0.1.6";
       flake = false;
     };
     cmp-nvim-lsp-src = {
@@ -70,15 +76,15 @@
       flake = false;
     };
     Comment-nvim-src = {
-      url = "github:numToStr/Comment.nvim";
+      url = "github:numToStr/Comment.nvim/v0.8.0";
       flake = false;
     };
     nvim-treesitter-src = {
-      url = "github:nvim-treesitter/nvim-treesitter/v0.8.5.2";
+      url = "github:nvim-treesitter/nvim-treesitter/v0.9.0";
       flake = false;
     };
     telescope-nvim-src = {
-      url = "github:nvim-telescope/telescope.nvim";
+      url = "github:nvim-telescope/telescope.nvim/0.1.2";
       flake = false;
     };
     telescope-project-nvim-src = {
@@ -86,26 +92,41 @@
       flake = false;
     };
     toggleterm-nvim-src = {
-      url = "github:akinsho/toggleterm.nvim";
+      url = "github:akinsho/toggleterm.nvim/v2.7.0";
       flake = false;
     };
     bufferline-nvim-src = {
-      url = "github:akinsho/bufferline.nvim";
+      url = "github:akinsho/bufferline.nvim/v4.2.0";
       flake = false;
     };
     nvim-tree-lua-src = {
       url = "github:kyazdani42/nvim-tree.lua";
       flake = false;
     };
+    vscode-terraform-snippets = {
+      url = "github:run-at-scale/vscode-terraform-doc-snippets";
+      flake = false;
+    };
 
   };
 
-  outputs = { nixpkgs, ... }@inputs:
+  outputs = { self, nixpkgs, ... }@inputs:
 
     let
 
+      # Common overlays to always use
+      overlays = [
+        inputs.nur.overlay
+        inputs.nix2vim.overlay
+        (import ./overlays/neovim-plugins.nix inputs)
+        (import ./overlays/calibre-web.nix)
+        (import ./overlays/disko.nix inputs)
+        (import ./overlays/tree-sitter.nix inputs)
+      ];
+
       # Global configuration for my systems
-      globals = rec {
+      globals = let baseName = "masu.rs";
+      in rec {
         user = "noah";
         fullName = "Noah Masur";
         gitName = fullName;
@@ -114,17 +135,19 @@
         mail.imapHost = "imap.purelymail.com";
         mail.smtpHost = "smtp.purelymail.com";
         dotfilesRepo = "git@github.com:nmasur/dotfiles";
+        nixpkgs.overlays = overlays;
+        hostnames = {
+          git = "git.${baseName}";
+          metrics = "metrics.${baseName}";
+          prometheus = "prom.${baseName}";
+          secrets = "vault.${baseName}";
+          stream = "stream.${baseName}";
+          content = "cloud.${baseName}";
+          books = "books.${baseName}";
+          download = "download.${baseName}";
+        };
       };
 
-      # Common overlays to always use
-      overlays = [
-        inputs.nur.overlay
-        inputs.nix2vim.overlay
-        (import ./overlays/neovim-plugins.nix inputs)
-        (import ./overlays/lib.nix)
-        (import ./overlays/calibre-web.nix)
-      ];
-
       # System types to support.
       supportedSystems =
         [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
@@ -134,23 +157,29 @@
 
     in rec {
 
+      nixosModules = {
+        globals = { config }: { config = globals; };
+        common = import ./modules/common;
+        nixos = import ./modules/nixos;
+        darwin = import ./modules/darwin;
+      };
+
       # Contains my full system builds, including home-manager
       # nixos-rebuild switch --flake .#tempest
       nixosConfigurations = {
-        tempest = import ./hosts/tempest { inherit inputs globals overlays; };
-        hydra = import ./hosts/hydra { inherit inputs globals overlays; };
-        flame = import ./hosts/flame { inherit inputs globals overlays; };
-        swan = import ./hosts/swan { inherit inputs globals overlays; };
+        tempest = import ./hosts/tempest { inherit self; };
+        hydra = import ./hosts/hydra { inherit self; };
+        flame = import ./hosts/flame { inherit self; };
+        swan = import ./hosts/swan { inherit self; };
       };
 
       # Contains my full Mac system builds, including home-manager
       # darwin-rebuild switch --flake .#lookingglass
       darwinConfigurations = {
-        lookingglass =
-          import ./hosts/lookingglass { inherit inputs globals overlays; };
+        lookingglass = import ./hosts/lookingglass { inherit self; };
       };
 
-      # For quickly applying local settings with:
+      # For quickly applying home-manager settings with:
       # home-manager switch --flake .#tempest
       homeConfigurations = {
         tempest =
@@ -162,41 +191,29 @@
       # Disk formatting, only used once
       diskoConfigurations = { root = import ./disks/root.nix; };
 
-      # Other packages, such as system images or programs
-      packages = forAllSystems (system: {
-
-        # Package servers into images with a generator
-        aws = {
-          "${system}" =
-            import ./generators/aws { inherit inputs globals system overlays; };
-        };
-        staff = {
-          "${system}" = import ./generators/staff {
-            inherit inputs globals system overlays;
+      packages = let
+        aws = system: import ./hosts/aws { inherit self system; };
+        staff = system: import ./hosts/staff { inherit self system; };
+        neovim = system:
+          let pkgs = import nixpkgs { inherit system overlays; };
+          in import ./modules/common/neovim/package {
+            inherit pkgs;
+            colors = (import ./colorscheme/gruvbox-dark).dark;
           };
-        };
+      in {
+        x86_64-linux.aws = aws "x86_64-linux";
+        x86_64-linux.staff = staff "x86_64-linux";
 
         # Package Neovim config into standalone package
-        neovim = let pkgs = import nixpkgs { inherit system overlays; };
-        in import ./modules/common/neovim/package {
-          inherit pkgs;
-          colors =
-            import ./colorscheme/gruvbox/neovim-gruvbox.nix { inherit pkgs; };
-        };
-
-      });
+        x86_64-linux.neovim = neovim "x86_64-linux";
+        x86_64-darwin.neovim = neovim "x86_64-darwin";
+        aarch64-linux.neovim = neovim "aarch64-linux";
+        aarch64-darwin.neovim = neovim "aarch64-darwin";
+      };
 
       # Programs that can be run by calling this flake
       apps = forAllSystems (system:
-        let
-          pkgs = import nixpkgs {
-            inherit system;
-            overlays = overlays ++ [
-              (final: prev: {
-                disko-packaged = inputs.disko.packages.${system}.disko;
-              })
-            ];
-          };
+        let pkgs = import nixpkgs { inherit system overlays; };
         in import ./apps { inherit pkgs; });
 
       # Development environments
@@ -209,25 +226,6 @@
             buildInputs = with pkgs; [ git stylua nixfmt shfmt shellcheck ];
           };
 
-          test = pkgs.mkShell { buildInputs = with pkgs; [ age ]; };
-
-          # Used for cloud and systems development and administration
-          devops = pkgs.mkShell {
-            buildInputs = with pkgs; [
-              git
-              terraform
-              consul
-              vault
-              awscli2
-              google-cloud-sdk
-              ansible
-              kubectl
-              kubernetes-helm
-              kustomize
-              fluxcd
-            ];
-          };
-
         });
 
       # Templates for starting other projects quickly

generators/staff/default.nix

@@ -1,47 +0,0 @@
-# The Staff
-# ISO configuration for my USB drive
-
-{ inputs, system, overlays, ... }:
-
-with inputs;
-
-nixos-generators.nixosGenerate {
-  inherit system;
-  format = "install-iso";
-  modules = [{
-    nixpkgs.overlays = overlays;
-    networking.hostName = "staff";
-    users.extraUsers.root.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"
-    ];
-    services.openssh = {
-      enable = true;
-      ports = [ 22 ];
-      allowSFTP = true;
-      settings = {
-        GatewayPorts = "no";
-        X11Forwarding = false;
-        PasswordAuthentication = false;
-        PermitRootLogin = "yes";
-      };
-    };
-    environment.systemPackages =
-      let pkgs = import inputs.nixpkgs { inherit system overlays; };
-      in with pkgs; [
-        git
-        vim
-        wget
-        curl
-        (import ../../modules/common/neovim/package {
-          inherit pkgs;
-          # colors = import ../../colorscheme/gruvbox.dark.neovimConfig {
-          #   inherit pkgs;
-          # };
-        })
-      ];
-    nix.extraOptions = ''
-      experimental-features = nix-command flakes
-      warn-dirty = false
-    '';
-  }];
-}

hosts/README.md

@@ -2,9 +2,11 @@
 
 | Host                                       | Purpose             |
 | ---                                        | ---                 |
+| [aws](./aws/default.nix)                   | AWS AMI             |
+| [staff](./staff/default.nix)               | Live USB stick      |
 | [flame](./flame/default.nix)               | Oracle cloud server |
 | [hydra](./hydra/default.nix)               | WSL config          |
-| [lookingglass](./lookingglass/default.nix) | Work macOS          |
-| [swan](./swan/default.nix)                 | Home NAS and server |
-| [tempest](./tempest/default.nix)           | Desktop             |
+| [lookingglass](./lookingglass/default.nix) | Work MacBook        |
+| [swan](./swan/default.nix)                 | Home server         |
+| [tempest](./tempest/default.nix)           | Linux desktop       |
 

hosts/aws/default.nix

@@ -1,30 +1,23 @@
-{ inputs, globals, ... }:
+{ self, system, ... }:
 
-with inputs;
-
-nixos-generators.nixosGenerate {
+self.inputs.nixos-generators.nixosGenerate {
   inherit system;
   format = "amazon";
   modules = [
-    home-manager.nixosModules.home-manager
+    self.inputs.home-manager.nixosModules.home-manager
+    self.nixosModules.globals
+    self.nixosModules.common
+    self.nixosModules.nixos
     {
-      user = globals.user;
-      fullName = globals.fullName;
-      dotfilesRepo = globals.dotfilesRepo;
-      gitName = globals.gitName;
-      gitEmail = globals.gitEmail;
       networking.hostName = "sheep";
       gui.enable = false;
-      colorscheme = (import ../colorscheme/gruvbox);
+      theme.colors = (import ../../colorscheme/gruvbox).dark;
       passwordHash = null;
       publicKey =
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
       # AWS settings require this
       permitRootLogin = "prohibit-password";
     }
-    ../../modules/common
-    ../../modules/nixos
-    ../../modules/common/services/sshd.nix
   ] ++ [
     # Required to fix diskSize errors during build
     ({ ... }: { amazonImage.sizeMB = 16 * 1024; })

hosts/aws/workflow.yml

@@ -1,7 +1,6 @@
 name: 'Terraform'
 env:
 
-
   AWS_ACCOUNT_NUMBER: ''
   AWS_PLAN_ROLE_NAME: github_actions_plan
   AWS_APPLY_ROLE_NAME: github_actions_admin
@@ -82,15 +81,14 @@ jobs:
 
       # Downloads the current repo code to the runner.
       - name: Checkout Repo Code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      # Install Nix
-      - name: Install Nix
-        uses: cachix/install-nix-action@v17
-
-      # Build the image
-      - name: Build Image
-        run: nix build .#aws
+      # Enable access to KVM, required to build an image
+      - name: Enable KVM group perms
+        run: |
+            echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+            sudo udevadm control --reload-rules
+            sudo udevadm trigger --name-match=kvm
 
       # Login to AWS
       - name: AWS Assume Role
@@ -99,6 +97,28 @@ jobs:
           role-to-assume: ${{ env.AWS_ROLE_ARN }}
           aws-region: ${{ env.AWS_REGION }}
 
+      # Install Nix
+      - name: Install Nix
+        uses: cachix/install-nix-action@v17
+        with:
+          extra_nix_config: |
+            substituters = s3://insert-cache-bucket https://cache.nixos.org/
+            trusted-public-keys = insert-cache-bucket:M6PsZjHXcLvbQyPUBLICKEYGVoNwI84g1FBQzouRU= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+
+      # Build the image
+      - name: Build Image
+        run: nix build .#aws
+
+      # Copy the image to S3
+      - name: Upload Image to Cache
+        env:
+          NIX_CACHE_PRIVATE_KEY: ${{ secrets.NIX_CACHE_PRIVATE_KEY }}
+        run: |
+          echo "$NIX_CACHE_PRIVATE_KEY" > cache.key
+          nix store sign --key-file cache.key $(readlink result)
+          nix copy --to s3://t2-aws-nixos-test $(readlink result)
+          rm cache.key
+
       # Exports all GitHub Secrets as environment variables prefixed by
       # "TF_VAR_", which exposes them to Terraform. The name of each GitHub
       # Secret must match its Terraform variable name exactly.

hosts/flame/default.nix

@@ -4,42 +4,65 @@
 # How to install:
 # https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
 
-{ inputs, globals, overlays, ... }:
+{ self, ... }:
 
-with inputs;
-
-nixpkgs.lib.nixosSystem {
+self.inputs.nixpkgs.lib.nixosSystem {
   system = "aarch64-linux";
   specialArgs = { };
   modules = [
-    ./hardware-configuration.nix
-    ../../modules/common
-    ../../modules/nixos
-    (removeAttrs globals [ "mail.server" ])
-    wsl.nixosModules.wsl
-    home-manager.nixosModules.home-manager
+    self.inputs.home-manager.nixosModules.home-manager
+    self.nixosModules.globals
+    self.nixosModules.common
+    self.nixosModules.nixos
     {
+      # Hardware
       server = true;
+      networking.hostName = "flame";
+
+      imports =
+        [ (self.inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
+      boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
+
+      fileSystems."/" = {
+        device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
+        fsType = "ext4";
+      };
+
+      fileSystems."/boot" = {
+        device = "/dev/disk/by-uuid/D5CA-237A";
+        fsType = "vfat";
+      };
+
+      # Theming
       gui.enable = false;
       theme = { colors = (import ../../colorscheme/gruvbox).dark; };
-      nixpkgs.overlays = overlays;
-      wsl.enable = false;
-      caddy.enable = true;
-
-      # FQDNs for various services
-      networking.hostName = "flame";
-      bookServer = "books.masu.rs";
-      # streamServer = "stream.masu.rs";
-      nextcloudServer = "cloud.masu.rs";
-      transmissionServer = "download.masu.rs";
-      metricsServer = "metrics.masu.rs";
-      vaultwardenServer = "vault.masu.rs";
-      giteaServer = "git.masu.rs";
 
       # Disable passwords, only use SSH key
       publicKey =
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
 
+      # Programs and services
+      cloudflare.enable = true; # Proxy traffic with Cloudflare
+      dotfiles.enable = true; # Clone dotfiles
+      neovim.enable = true;
+
+      services.caddy.enable = true;
+      services.grafana.enable = true;
+      services.prometheus.enable = true;
+      services.gitea.enable = true;
+      services.vaultwarden.enable = true;
+      services.minecraft-server.enable = true; # Setup Minecraft server
+
+      cloudflareTunnel = {
+        enable = true;
+        id = "bd250ee1-ed2e-42d2-b627-039f1eb5a4d2";
+        credentialsFile = ../../private/cloudflared-flame.age;
+        ca =
+          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK/6oyVqjFGX3Uvrc3VS8J9sphxzAnRzKC85xgkHfYgR3TK6qBGXzHrknEj21xeZrr3G2y1UsGzphWJd9ZfIcdA= open-ssh-ca@cloudflareaccess.org";
+      };
+
+      giteaRunner.enable = true;
+
       # Nextcloud backup config
       backup.s3 = {
         endpoint = "s3.us-west-002.backblazeb2.com";
@@ -47,51 +70,37 @@ nixpkgs.lib.nixosSystem {
         accessKeyId = "0026b0e73b2e2c80000000005";
       };
 
-      # Grant access to Jellyfin directories from Nextcloud
-      users.users.nextcloud.extraGroups = [ "jellyfin" ];
+      # # Wireguard config for Transmission
+      # wireguard.enable = true;
+      # networking.wireguard.interfaces.wg0 = {
+      #
+      #   # The local IPs for this machine within the Wireguard network
+      #   # Any inbound traffic bound for these IPs should be kept on localhost
+      #   ips = [ "10.66.13.200/32" "fc00:bbbb:bbbb:bb01::3:dc7/128" ];
+      #
+      #   peers = [{
+      #
+      #     # Identity of Wireguard target peer (VPN)
+      #     publicKey = "bOOP5lIjqCdDx5t+mP/kEcSbHS4cZqE0rMlBI178lyY=";
+      #
+      #     # The public internet address of the target peer
+      #     endpoint = "86.106.143.132:51820";
+      #
+      #     # Which outgoing IP ranges should be sent through Wireguard
+      #     allowedIPs = [ "0.0.0.0/0" "::0/0" ];
+      #
+      #     # Send heartbeat signal within the network
+      #     persistentKeepalive = 25;
+      #
+      #   }];
+      #
+      # };
 
-      # Wireguard config for Transmission
-      wireguard.enable = true;
-      networking.wireguard.interfaces.wg0 = {
+      # # VPN port forwarding
+      # services.transmission.settings.peer-port = 57599;
 
-        # The local IPs for this machine within the Wireguard network
-        # Any inbound traffic bound for these IPs should be kept on localhost
-        ips = [ "10.66.13.200/32" "fc00:bbbb:bbbb:bb01::3:dc7/128" ];
-
-        peers = [{
-
-          # Identity of Wireguard target peer (VPN)
-          publicKey = "bOOP5lIjqCdDx5t+mP/kEcSbHS4cZqE0rMlBI178lyY=";
-
-          # The public internet address of the target peer
-          endpoint = "86.106.143.132:51820";
-
-          # Which outgoing IP ranges should be sent through Wireguard
-          allowedIPs = [ "0.0.0.0/0" "::0/0" ];
-
-          # Send heartbeat signal within the network
-          persistentKeepalive = 25;
-
-        }];
-
-      };
-
-      # VPN port forwarding
-      services.transmission.settings.peer-port = 57599;
-
-      # Grant access to Transmission directories from Jellyfin
-      users.users.jellyfin.extraGroups = [ "transmission" ];
-
-      # Proxy traffic with Cloudflare
-      cloudflare.enable = true;
-
-      # Setup Minecraft server
-      gaming.minecraft-server.enable = true;
-
-      # Clone dotfiles
-      dotfiles.enable = true;
-
-      neovim.enable = true;
+      # # Grant access to Transmission directories from Jellyfin
+      # users.users.jellyfin.extraGroups = [ "transmission" ];
 
     }
   ];

hosts/flame/hardware-configuration.nix

@@ -1,34 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ lib, modulesPath, ... }:
-
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/D5CA-237A";
-    fsType = "vfat";
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
-}

hosts/hydra/default.nix

@@ -1,31 +1,27 @@
 # The Hydra
 # System configuration for WSL
 
-{ inputs, globals, overlays, ... }:
+{ self, ... }:
 
-with inputs;
-
-nixpkgs.lib.nixosSystem {
+self.inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
   specialArgs = { };
   modules = [
-    ../../modules/common
-    ../../modules/nixos
-    globals
-    wsl.nixosModules.wsl
-    home-manager.nixosModules.home-manager
+    self.inputs.wsl.nixosModules.wsl
+    self.inputs.home-manager.nixosModules.home-manager
+    self.nixosModules.globals
+    self.nixosModules.common
+    self.nixosModules.nixos
+    self.nixosModules.wsl
     {
       networking.hostName = "hydra";
-      nixpkgs.overlays = overlays;
-      # Set registry to flake packages, used for nix X commands
-      nix.registry.nixpkgs.flake = nixpkgs;
       identityFile = "/home/${globals.user}/.ssh/id_ed25519";
       gui.enable = false;
       theme = {
         colors = (import ../../colorscheme/gruvbox).dark;
         dark = true;
       };
-      passwordHash = nixpkgs.lib.fileContents ../../password.sha512;
+      passwordHash = inputs.nixpkgs.lib.fileContents ../../password.sha512;
       wsl = {
         enable = true;
         wslConf.automount.root = "/mnt";

hosts/lookingglass/default.nix

@@ -1,50 +1,46 @@
 # The Looking Glass
 # System configuration for my work Macbook
 
-{ inputs, globals, overlays, ... }:
+{ self, ... }:
 
-with inputs;
-
-darwin.lib.darwinSystem {
+self.inputs.darwin.lib.darwinSystem {
   system = "x86_64-darwin";
   specialArgs = { };
   modules = [
-    ../../modules/common
-    ../../modules/darwin
-    (globals // rec {
-      user = "Noah.Masur";
-      gitName = "Noah-Masur_1701";
-      gitEmail = "${user}@take2games.com";
-    })
-    home-manager.darwinModules.home-manager
-    {
-      networking.hostName = "lookingglass";
-      identityFile = "/Users/Noah.Masur/.ssh/id_ed25519";
-      gui.enable = true;
-      theme = {
-        colors = (import ../../colorscheme/gruvbox).dark;
-        dark = true;
+    self.inputs.home-manager.darwinModules.home-manager
+    self.nixosModules.common
+    self.nixosModules.darwin
+    ({ config, lib, ... }: {
+      config = rec {
+        user = lib.mkForce "Noah.Masur";
+        gitName = lib.mkForce "Noah-Masur_1701";
+        gitEmail = lib.mkForce "${user}@take2games.com";
+        nixpkgs.overlays = [ self.inputs.firefox-darwin.overlay ];
+        networking.hostName = "lookingglass";
+        identityFile = "/Users/${user}/.ssh/id_ed25519";
+        gui.enable = true;
+        theme = {
+          colors = (import ../../colorscheme/gruvbox-dark).dark;
+          dark = true;
+        };
+        mail.user = globals.user;
+        charm.enable = true;
+        neovim.enable = true;
+        mail.enable = true;
+        mail.aerc.enable = true;
+        mail.himalaya.enable = false;
+        kitty.enable = true;
+        discord.enable = true;
+        firefox.enable = true;
+        dotfiles.enable = true;
+        nixlang.enable = true;
+        terraform.enable = true;
+        python.enable = true;
+        lua.enable = true;
+        kubernetes.enable = true;
+        _1password.enable = true;
+        slack.enable = true;
       };
-      mail.user = globals.user;
-      nixpkgs.overlays = [ firefox-darwin.overlay ] ++ overlays;
-      # Set registry to flake packages, used for nix X commands
-      nix.registry.nixpkgs.flake = nixpkgs;
-      charm.enable = true;
-      neovim.enable = true;
-      mail.enable = true;
-      mail.aerc.enable = true;
-      mail.himalaya.enable = true;
-      kitty.enable = true;
-      discord.enable = true;
-      firefox.enable = true;
-      dotfiles.enable = true;
-      nixlang.enable = true;
-      terraform.enable = true;
-      python.enable = true;
-      lua.enable = true;
-      kubernetes.enable = true;
-      _1password.enable = true;
-      slack.enable = true;
-    }
+    })
   ];
 }

hosts/staff/default.nix

@@ -0,0 +1,45 @@
+# The Staff
+# ISO configuration for my USB drive
+
+{ self, system, ... }:
+
+self.inputs.nixos-generators.nixosGenerate {
+  inherit system;
+  format = "install-iso";
+  modules = [
+    self.nixosModules.global
+    self.nixosModules.common
+    self.nixosModules.nixos
+    ({ config, pkgs, ... }: {
+      networking.hostName = "staff";
+      users.extraUsers.root.openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"
+      ];
+      services.openssh = {
+        enable = true;
+        ports = [ 22 ];
+        allowSFTP = true;
+        settings = {
+          GatewayPorts = "no";
+          X11Forwarding = false;
+          PasswordAuthentication = false;
+          PermitRootLogin = "yes";
+        };
+      };
+      environment.systemPackages = with pkgs; [
+        git
+        vim
+        wget
+        curl
+        (import ../../modules/common/neovim/package {
+          inherit pkgs;
+          colors = (import ../../colorscheme/gruvbox).dark;
+        })
+      ];
+      nix.extraOptions = ''
+        experimental-features = nix-command flakes
+        warn-dirty = false
+      '';
+    })
+  ];
+}

hosts/swan/default.nix

@@ -1,49 +1,70 @@
 # The Swan
 # System configuration for my home NAS server
 
-{ inputs, globals, overlays, ... }:
+{ self, ... }:
 
-with inputs;
-
-nixpkgs.lib.nixosSystem {
+self.inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
   specialArgs = { };
   modules = [
-    ./hardware-configuration.nix
-    ../../modules/common
-    ../../modules/nixos
-    globals
-    wsl.nixosModules.wsl
-    home-manager.nixosModules.home-manager
-    disko.nixosModules.disko
+    self.inputs.home-manager.nixosModules.home-manager
+    self.inputs.disko.nixosModules.disko
+    self.nixosModules.globals
+    self.nixosModules.common
+    self.nixosModules.nixos
     {
+      # Hardware
       server = true;
       networking.hostName = "swan";
 
-      # head -c 8 /etc/machine-id
-      networking.hostId = "600279f4"; # Random ID required for ZFS
+      boot.initrd.availableKernelModules =
+        [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
 
+      # Required for transcoding
+      boot.initrd.kernelModules = [ "amdgpu" ];
+      boot.kernelParams = [
+        "radeon.si_support=0"
+        "amdgpu.si_support=1"
+        "radeon.cik_support=0"
+        "amdgpu.cik_support=1"
+        "amdgpu.dc=1"
+      ];
+      hardware.enableRedistributableFirmware = true;
+
+      powerManagement.cpuFreqGovernor = "powersave";
+      hardware.cpu.intel.updateMicrocode = true;
+
+      # ZFS
       zfs.enable = true;
+      # Generated with: head -c 8 /etc/machine-id
+      networking.hostId = "600279f4"; # Random ID required for ZFS
       disko = {
         enableConfig = true;
         devices = (import ../../disks/root.nix { disk = "/dev/nvme0n1"; });
-        # // (import ../../disks/zfs.nix {
-        #   pool = "tank";
-        #   disks = [ "/dev/sda" "/dev/sdb" "/dev/sdc" ];
-        # });
       };
       boot.zfs.extraPools = [ "tank" ];
 
       gui.enable = false;
       theme = { colors = (import ../../colorscheme/gruvbox).dark; };
-      nixpkgs.overlays = overlays;
       neovim.enable = true;
-      caddy.enable = true;
-      streamServer = "stream.masu.rs";
-      nextcloudServer = "cloud.masu.rs";
-      bookServer = "books.masu.rs";
-      arrServer = "download.masu.rs";
-      samba.enable = true;
+      cloudflare.enable = true;
+      dotfiles.enable = true;
+      arrs.enable = true;
+
+      services.caddy.enable = true;
+      services.jellyfin.enable = true;
+      services.nextcloud.enable = true;
+      services.calibre-web.enable = true;
+      services.prometheus.enable = true;
+      services.samba.enable = true;
+
+      cloudflareTunnel = {
+        enable = true;
+        id = "646754ac-2149-4a58-b51a-e1d0a1f3ade2";
+        credentialsFile = ../../private/cloudflared-swan.age;
+        ca =
+          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org";
+      };
 
       backup.s3 = {
         endpoint = "s3.us-west-002.backblazeb2.com";
@@ -54,12 +75,6 @@ nixpkgs.lib.nixosSystem {
       # Disable passwords, only use SSH key
       publicKey =
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
-
-      # Clone dotfiles
-      dotfiles.enable = true;
-
-      # services.nfs.server.enable = true;
-
     }
   ];
 }

hosts/swan/hardware-configuration.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules =
-    [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  # fileSystems."/" = {
-  #   device = "/dev/disk/by-label/nixos";
-  #   fsType = "ext4";
-  # };
-  #
-  # fileSystems."/boot" = {
-  #   device = "/dev/disk/by-label/boot";
-  #   fsType = "vfat";
-  # };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-  hardware.cpu.intel.updateMicrocode =
-    lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/tempest/default.nix

@@ -1,41 +1,72 @@
 # The Tempest
 # System configuration for my desktop
 
-{ inputs, globals, overlays, ... }:
+{ self, ... }:
 
-with inputs;
-
-nixpkgs.lib.nixosSystem {
+self.inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
-  specialArgs = { };
   modules = [
-    ./hardware-configuration.nix
-    ../../modules/common
-    ../../modules/nixos
-    globals
-    wsl.nixosModules.wsl
-    home-manager.nixosModules.home-manager
+    self.inputs.home-manager.nixosModules.home-manager
+    self.nixosModules.globals
+    self.nixosModules.common
+    self.nixosModules.nixos
     {
+      # Hardware
       physical = true;
       networking.hostName = "tempest";
-      nixpkgs.overlays = [ nur.overlay ] ++ overlays;
-      # Set registry to flake packages, used for nix X commands
-      nix.registry.nixpkgs.flake = nixpkgs;
+
+      boot.initrd.availableKernelModules =
+        [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+      boot.initrd.kernelModules = [ "amdgpu" ];
+      boot.kernelModules = [ "kvm-amd" ];
+      services.xserver.videoDrivers = [ "amdgpu" ];
+      hardware.enableRedistributableFirmware = true;
+      powerManagement.cpuFreqGovernor = "performance";
+      hardware.cpu.amd.updateMicrocode = true;
+      hardware.fancontrol.enable = true;
+      hardware.fancontrol.config = ''
+        # Configuration file generated by pwmconfig, changes will be lost
+        INTERVAL=10
+        DEVPATH=hwmon0=devices/pci0000:00/0000:00:03.1/0000:06:00.0/0000:07:00.0/0000:08:00.0
+        DEVNAME=hwmon0=amdgpu
+        FCTEMPS=hwmon0/pwm1=hwmon0/temp1_input
+        FCFANS= hwmon0/pwm1=hwmon0/fan1_input
+        MINTEMP=hwmon0/pwm1=50
+        MAXTEMP=hwmon0/pwm1=70
+        MINSTART=hwmon0/pwm1=100
+        MINSTOP=hwmon0/pwm1=10
+        MINPWM=hwmon0/pwm1=10
+        MAXPWM=hwmon0/pwm1=240
+      '';
+
+      fileSystems."/" = {
+        device = "/dev/disk/by-label/nixos";
+        fsType = "ext4";
+      };
+
+      fileSystems."/boot" = {
+        device = "/dev/disk/by-label/boot";
+        fsType = "vfat";
+      };
+
+      # Must be prepared ahead
       identityFile = "/home/${globals.user}/.ssh/id_ed25519";
+      passwordHash = self.inputs.nixpkgs.lib.fileContents ../../password.sha512;
+
+      # Theming
       gui.enable = true;
       theme = {
-        colors = (import ../../colorscheme/gruvbox).dark;
+        colors = (import ../../colorscheme/gruvbox-dark).dark;
         dark = true;
       };
-      wallpaper = "${wallpapers}/gruvbox/road.jpg";
-      gtk.theme.name = nixpkgs.lib.mkDefault "Adwaita-dark";
-      passwordHash = nixpkgs.lib.fileContents ../../password.sha512;
-      wsl.enable = false;
-      publicKey = null;
+      wallpaper = "${self.inputs.wallpapers}/gruvbox/road.jpg";
+      gtk.theme.name = self.inputs.nixpkgs.lib.mkDefault "Adwaita-dark";
 
+      # Programs and services
       charm.enable = true;
       neovim.enable = true;
       media.enable = true;
+      dotfiles.enable = true;
       firefox.enable = true;
       kitty.enable = true;
       _1password.enable = true;
@@ -46,17 +77,25 @@ nixpkgs.lib.nixosSystem {
       mail.aerc.enable = true;
       mail.himalaya.enable = true;
       keybase.enable = true;
-      # mullvad.enable = true;
+      mullvad.enable = false;
       nixlang.enable = true;
-      dotfiles.enable = true;
       yt-dlp.enable = true;
-
       gaming = {
+        dwarf-fortress.enable = true;
         enable = true;
         steam.enable = true;
         legendary.enable = true;
         lutris.enable = true;
         leagueoflegends.enable = true;
+        ryujinx.enable = true;
+      };
+
+      cloudflareTunnel = {
+        enable = true;
+        id = "ac133a82-31fb-480c-942a-cdbcd4c58173";
+        credentialsFile = ../../private/cloudflared-tempest.age;
+        ca =
+          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPY6C0HmdFCaxYtJxFr3qV4/1X4Q8KrYQ1hlme3u1hJXK+xW+lc9Y9glWHrhiTKilB7carYTB80US0O47gI5yU4= open-ssh-ca@cloudflareaccess.org";
       };
 
     }

hosts/tempest/hardware-configuration.nix

@@ -1,56 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
-
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules =
-    [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ "amdgpu" ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  services.xserver.videoDrivers = [ "amdgpu" ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-label/boot";
-    fsType = "vfat";
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true;
-
-  powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
-  hardware.cpu.amd.updateMicrocode =
-    lib.mkDefault config.hardware.enableRedistributableFirmware;
-
-  hardware.fancontrol.enable = true;
-  hardware.fancontrol.config = ''
-    # Configuration file generated by pwmconfig, changes will be lost
-    INTERVAL=10
-    DEVPATH=hwmon0=devices/pci0000:00/0000:00:03.1/0000:06:00.0/0000:07:00.0/0000:08:00.0
-    DEVNAME=hwmon0=amdgpu
-    FCTEMPS=hwmon0/pwm1=hwmon0/temp1_input
-    FCFANS= hwmon0/pwm1=hwmon0/fan1_input
-    MINTEMP=hwmon0/pwm1=50
-    MAXTEMP=hwmon0/pwm1=70
-    MINSTART=hwmon0/pwm1=100
-    MINSTOP=hwmon0/pwm1=10
-    MINPWM=hwmon0/pwm1=10
-    MAXPWM=hwmon0/pwm1=240
-  '';
-}

modules/common/applications/default.nix

@@ -7,7 +7,6 @@
     ./firefox.nix
     ./kitty.nix
     ./media.nix
-    ./nautilus.nix
     ./obsidian.nix
     ./qbittorrent.nix
     ./slack.nix

modules/common/applications/firefox.nix

@@ -33,7 +33,6 @@
             vimium
             multi-account-containers
             facebook-container
-            temporary-containers
             (lib.mkIf config._1password.enable onepassword-password-manager)
             okta-browser-plugin
             sponsorblock
@@ -71,6 +70,9 @@
             "layout.css.color-mix.enabled" = true;
             "ui.systemUsesDarkTheme" =
               if config.theme.dark == true then 1 else 0;
+            "media.ffmpeg.vaapi.enabled" =
+              true; # Enable hardware video acceleration
+            "cookiebanners.ui.desktop.enabled" = true; # Reject cookie popups
           };
           userChrome = ''
             :root {

modules/common/applications/kitty.nix

@@ -85,8 +85,7 @@
           # Scrollback
           scrolling_lines = 10000;
           scrollback_pager_history_size = 10; # MB
-          scrollback_pager = ''
-            ${pkgs.neovim}/bin/nvim -c 'setlocal nonumber nolist showtabline=0 foldcolumn=0|Man!' -c "autocmd VimEnter * normal G" -'';
+          scrollback_pager = "${pkgs.neovim}/bin/nvim -c 'normal G'";
 
           # Window
           window_padding_width = 6;

modules/common/applications/media.nix

@@ -21,7 +21,10 @@
       programs.mpv = {
         enable = true;
         bindings = { };
-        config = { image-display-duration = 2; };
+        config = {
+          image-display-duration = 2;
+          hwdec = "auto-safe";
+        };
         scripts = [
 
           # Automatically load playlist entries before and after current file

modules/common/applications/obsidian.nix

@@ -14,6 +14,10 @@
     home-manager.users.${config.user} = {
       home.packages = with pkgs; [ obsidian ];
     };
+
+    # Broken on 2023-04-16
+    nixpkgs.config.permittedInsecurePackages = [ "electron-21.4.0" ];
+
   };
 
 }

modules/common/default.nix

@@ -66,6 +66,40 @@
       description = "List of unfree packages to allow.";
       default = [ ];
     };
+    hostnames = {
+      git = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for git server (Gitea).";
+      };
+      metrics = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for metrics server.";
+      };
+      prometheus = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for Prometheus server.";
+      };
+      secrets = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for passwords and secrets (Vaultwarden).";
+      };
+      stream = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for video/media library (Jellyfin).";
+      };
+      content = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for personal content system (Nextcloud).";
+      };
+      books = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for books library (Calibre-Web).";
+      };
+      download = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for download services.";
+      };
+    };
   };
 
   config = let stateVersion = "23.05";
@@ -79,9 +113,16 @@
         warn-dirty = false
       '';
 
+      gc = {
+        automatic = true;
+        options = "--delete-older-than 7d";
+      };
+
       settings = {
 
         # Add community Cachix to binary cache
+        # Don't use with macOS because blocked by corporate firewall
+        builders-use-substitutes = true;
         substituters = lib.mkIf (!pkgs.stdenv.isDarwin)
           [ "https://nix-community.cachix.org" ];
         trusted-public-keys = lib.mkIf (!pkgs.stdenv.isDarwin) [

modules/common/mail/aerc.nix

@@ -154,20 +154,16 @@
           general.unsafe-accounts-conf = true;
           viewer = { pager = "${pkgs.less}/bin/less -R"; };
           filters = {
-            "text/plain" =
-              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
+            "text/plain" = "${pkgs.aerc}/libexec/aerc/filters/colorize";
             "text/calendar" =
-              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/calendar";
+              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/libexec/aerc/filters/calendar";
             "text/html" =
-              "${pkgs.aerc}/share/aerc/filters/html"; # Requires w3m, dante
-            # "text/html" =
-            #   "${pkgs.aerc}/share/aerc/filters/html | ${pkgs.aerc}/share/aerc/filters/colorize";
+              "${pkgs.aerc}/libexec/aerc/filters/html | ${pkgs.aerc}/libexec/aerc/filters/colorize"; # Requires w3m, dante
             # "text/*" =
             #   ''${pkgs.bat}/bin/bat -fP --file-name="$AERC_FILENAME "'';
             "message/delivery-status" =
-              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
-            "message/rfc822" =
-              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
+              "${pkgs.aerc}/libexec/aerc/filters/colorize";
+            "message/rfc822" = "${pkgs.aerc}/libexec/aerc/filters/colorize";
             "application/x-sh" = "${pkgs.bat}/bin/bat -fP -l sh";
             "application/pdf" = "${pkgs.zathura}/bin/zathura -";
             "audio/*" = "${pkgs.mpv}/bin/mpv -";

modules/common/mail/default.nix

@@ -32,7 +32,7 @@
         frequency = "*:0/5";
         postExec = "${pkgs.notmuch}/bin/notmuch new";
       };
-      services.imapnotify.enable = pkgs.stdenv.isLinux && config.physical;
+      services.imapnotify.enable = pkgs.stdenv.isLinux;
       programs.notmuch.enable = true;
       accounts.email = {
         maildirBasePath = "${config.homePath}/mail";
@@ -50,8 +50,6 @@
             ];
             alot = { };
             flavor = "plain";
-            folders = { };
-            getmail = { };
             imap = {
               host = config.mail.imapHost;
               port = 993;
@@ -61,7 +59,8 @@
               enable = true;
               boxes = [ "Inbox" ];
               onNotify = "${pkgs.isync}/bin/mbsync -a";
-              onNotifyPost =
+              onNotifyPost = lib.mkIf
+                config.home-manager.users.${config.user}.services.dunst.enable
                 "${pkgs.libnotify}/bin/notify-send 'New mail arrived'";
             };
             maildir = { path = "main"; };
@@ -75,11 +74,11 @@
                 CopyArrivalDate = "yes"; # Sync time of original message
               };
             };
-            mu.enable = false;
             notmuch.enable = true;
             passwordCommand =
               "${pkgs.age}/bin/age --decrypt --identity ${config.identityFile} ${
-                builtins.toString ../../../private/mailpass.age
+                pkgs.writeText "mailpass.age"
+                (builtins.readFile ../../../private/mailpass.age)
               }";
             smtp = {
               host = config.mail.smtpHost;

modules/common/neovim/config/colors.nix

@@ -0,0 +1,20 @@
+{ pkgs, lib, config, ... }: {
+
+  options.colors = lib.mkOption {
+    type = lib.types.attrsOf lib.types.str;
+    description = "Attrset of base16 colorscheme key value pairs.";
+  };
+
+  config = {
+    plugins = [ pkgs.vimPlugins.nvim-base16 ];
+    setup.base16-colorscheme = config.colors;
+
+    # Telescope isn't working, shut off for now
+    lua = ''
+      require('base16-colorscheme').with_config {
+          telescope = false,
+      }
+    '';
+  };
+
+}

modules/common/neovim/config/completion.nix

@@ -135,6 +135,13 @@
   };
 
   lua = ''
+    -- Load snippets
+    -- Check status: :lua require("luasnip").log.open()
+    require("luasnip.loaders.from_vscode").lazy_load()
+    require("luasnip.loaders.from_vscode").lazy_load({ paths = { "${
+      builtins.toString pkgs.vscode-terraform-snippets
+    }" } })
+
     -- Use buffer source for `/`
     require('cmp').setup.cmdline("/", {
         sources = {

modules/common/neovim/config/lsp.nix

@@ -29,11 +29,14 @@
   lua = ''
     ${builtins.readFile ./lsp.lua}
 
+    -- Prevent infinite log size (change this when debugging)
+    vim.lsp.set_log_level("off")
+
     require("null-ls").setup({
         sources = {
             require("null-ls").builtins.formatting.stylua.with({ command = "${pkgs.stylua}/bin/stylua" }),
             require("null-ls").builtins.formatting.black.with({ command = "${pkgs.black}/bin/black" }),
-            require("null-ls").builtins.diagnostics.flake8.with({ command = "${pkgs.python310Packages.flake8}/bin/flake8" }),
+            require("null-ls").builtins.diagnostics.ruff.with({ command = "${pkgs.ruff}/bin/ruff" }),
             require("null-ls").builtins.formatting.fish_indent.with({ command = "${pkgs.fish}/bin/fish_indent" }),
             require("null-ls").builtins.formatting.nixfmt.with({ command = "${pkgs.nixfmt}/bin/nixfmt" }),
             require("null-ls").builtins.formatting.rustfmt.with({ command = "${pkgs.rustfmt}/bin/rustfmt" }),
@@ -50,6 +53,7 @@
 
         on_attach = function(client, bufnr)
             if client.supports_method("textDocument/formatting") then
+                -- Auto-format on save
                 vim.api.nvim_clear_autocmds({ group = augroup, buffer = bufnr })
                 vim.api.nvim_create_autocmd("BufWritePre", {
                     group = augroup,
@@ -58,6 +62,12 @@
                         vim.lsp.buf.format({ bufnr = bufnr })
                     end,
                 })
+                -- Use internal formatting for bindings like gq.
+                vim.api.nvim_create_autocmd("LspAttach", {
+                    callback = function(args)
+                        vim.bo[args.buf].formatexpr = nil
+                    end,
+                })
             end
         end,
     })

modules/common/neovim/config/misc.nix

@@ -5,13 +5,13 @@
     pkgs.vimPlugins.vim-fugitive # Git commands
     pkgs.vimPlugins.vim-repeat # Better repeat using .
     pkgs.vimPlugins.comment-nvim # Smart comment commands
-    pkgs.vimPlugins.impatient-nvim # Faster load times
     pkgs.vimPlugins.glow-nvim # Markdown preview popup
     pkgs.vimPlugins.nvim-colorizer-lua # Hex color previews
   ];
 
   setup.Comment = { };
   setup.colorizer = { };
+  setup.glow = { };
 
   vim.o = {
     termguicolors = true; # Set to truecolor
@@ -51,7 +51,7 @@
   vim.opt.completeopt = [ "menu" "menuone" "noselect" ];
 
   lua = lib.mkBefore ''
-    require("impatient")
+    vim.loader.enable()
     ${builtins.readFile ../lua/keybinds.lua};
     ${builtins.readFile ../lua/settings.lua};
   '';

modules/common/neovim/config/statusline.nix

@@ -2,7 +2,7 @@
   plugins = [ pkgs.vimPlugins.lualine-nvim ];
   setup.lualine = {
     options = {
-      theme = "gruvbox";
+      theme = "base16";
       icons_enabled = true;
     };
   };

modules/common/neovim/config/syntax.nix

@@ -1,16 +1,38 @@
-{ pkgs, ... }: {
+{ pkgs, lib, ... }: {
 
   plugins = [
-    pkgs.vimPlugins.nvim-treesitter.withAllGrammars
+    (pkgs.vimPlugins.nvim-treesitter.withPlugins (_plugins:
+      with pkgs.tree-sitter-grammars; [
+        tree-sitter-bash
+        tree-sitter-fish
+        tree-sitter-hcl
+        tree-sitter-ini
+        tree-sitter-json
+        tree-sitter-lua
+        tree-sitter-markdown
+        tree-sitter-markdown-inline
+        tree-sitter-nix
+        tree-sitter-puppet
+        tree-sitter-python
+        tree-sitter-rasi
+        tree-sitter-toml
+        tree-sitter-yaml
+      ]))
     pkgs.vimPlugins.vim-matchup # Better % jumping in languages
+    pkgs.vimPlugins.playground # Tree-sitter experimenting
     pkgs.vimPlugins.nginx-vim
     pkgs.vimPlugins.vim-helm
-    pkgs.vimPlugins.vim-puppet
+    (pkgs.vimUtils.buildVimPluginFrom2Nix {
+      pname = "nmasur";
+      version = "0.1";
+      src = ../plugin;
+    })
   ];
 
   setup."nvim-treesitter.configs" = {
     highlight = { enable = true; };
     indent = { enable = true; };
+    matchup = { enable = true; }; # Uses vim-matchup
 
     textobjects = {
       select = {
@@ -39,4 +61,10 @@
     };
   };
 
+  # Use mkAfter to ensure tree-sitter is already loaded
+  lua = lib.mkAfter ''
+    -- Use HCL parser with .tf files
+    vim.treesitter.language.register('hcl', 'terraform')
+  '';
+
 }

modules/common/neovim/config/telescope.lua

@@ -13,6 +13,7 @@ vim.keymap.set("n", "<Leader>gf", telescope.git_bcommits)
 vim.keymap.set("n", "<Leader>gb", telescope.git_branches)
 vim.keymap.set("n", "<Leader>gs", telescope.git_status)
 vim.keymap.set("n", "<Leader>s", telescope.current_buffer_fuzzy_find)
+vim.keymap.set("n", "<Leader>rr", telescope.resume)
 
 vim.keymap.set("n", "<Leader>N", function()
     local opts = {

modules/common/neovim/config/tree.nix

@@ -43,30 +43,25 @@
         };
       };
     };
+    on_attach = dsl.rawLua ''
+      function (bufnr)
+        local api = require('nvim-tree.api')
+        local function opts(desc)
+          return { desc = 'nvim-tree: ' .. desc, buffer = bufnr, noremap = true, silent = true, nowait = true }
+        end
+        api.config.mappings.default_on_attach(bufnr)
+
+        vim.keymap.set('n', 'l', api.node.open.edit, opts('Open'))
+        vim.keymap.set('n', '<CR>', api.node.open.edit, opts('Open'))
+        vim.keymap.set('n', 'o', api.node.open.edit, opts('Open'))
+        vim.keymap.set('n', 'h', api.node.navigate.parent_close, opts('Close Directory'))
+        vim.keymap.set('n', 'v', api.node.open.vertical, opts('Open: Vertical Split'))
+      end
+    '';
     view = {
       width = 30;
       hide_root_folder = false;
       side = "left";
-      mappings = {
-        custom_only = false;
-        list = [
-          {
-            key = [ "l" "<CR>" "o" ];
-            cb = dsl.rawLua
-              "require('nvim-tree.config').nvim_tree_callback('edit')";
-          }
-          {
-            key = "h";
-            cb = dsl.rawLua
-              "require('nvim-tree.config').nvim_tree_callback('close_node')";
-          }
-          {
-            key = "v";
-            cb = dsl.rawLua
-              "require('nvim-tree.config').nvim_tree_callback('vsplit')";
-          }
-        ];
-      };
       number = false;
       relativenumber = false;
     };

modules/common/neovim/default.nix

@@ -4,7 +4,7 @@ let
 
   neovim = import ./package {
     inherit pkgs;
-    colors = import config.theme.colors.neovimConfig { inherit pkgs; };
+    colors = config.theme.colors;
   };
 
 in {

modules/common/neovim/lua/keybinds.lua

@@ -48,11 +48,6 @@ key("n", "<Leader>wv", ":vsplit<CR>")
 key("n", "<Leader>wh", ":split<CR>")
 key("n", "<Leader>wm", ":only<CR>")
 
--- Vimrc editing
-key("n", "<Leader>rr", ":luafile $HOME/.config/nvim/init.lua<CR>")
-key("n", "<Leader>rp", ":luafile $HOME/.config/nvim/init.lua<CR>:PackerInstall<CR>:")
-key("n", "<Leader>rc", ":luafile $HOME/.config/nvim/init.lua<CR>:PackerCompile<CR>")
-
 -- Keep cursor in place
 key("n", "n", "nzz")
 key("n", "N", "Nzz")
@@ -71,8 +66,8 @@ key("n", "<C-Left>", ":vertical resize -2<CR>", { silent = true })
 key("n", "<C-Right>", ":vertical resize +2<CR>", { silent = true })
 
 -- Other
-key("n", "<A-CR>", ":noh<CR>", { silent = true }) --- Clear search in VimWiki
-key("n", "Y", "y$") --- Copy to end of line
+key("n", "<A-CR>", ":noh<CR>", { silent = true })           --- Clear search in VimWiki
+key("n", "Y", "y$")                                         --- Copy to end of line
 key("v", "<C-r>", "y<Esc>:%s/<C-r>+//gc<left><left><left>") --- Substitute selected
-key("v", "D", "y'>gp") --- Duplicate selected
-key("x", "<Leader>p", '"_dP') --- Paste but keep register
+key("v", "D", "y'>gp")                                      --- Duplicate selected
+key("x", "<Leader>p", '"_dP')                               --- Paste but keep register

modules/common/neovim/lua/settings.lua

@@ -4,8 +4,9 @@
 
 vim.filetype.add({
     pattern = {
-        [".*%.tfvars"] = "hcl",
-        -- [".*%.tf"] = "hcl",
+        [".*%.tfvars"] = "terraform",
+        [".*%.tf"] = "terraform",
+        [".*%.rasi"] = "rasi",
     },
 })
 

modules/common/neovim/package/default.nix

@@ -26,13 +26,17 @@
 #   ] ++ extraConfig;
 # }
 
-{ pkgs, colors ? { }, ... }:
+{ pkgs, colors, ... }:
 
+# Comes from nix2vim overlay:
+# https://github.com/gytis-ivaskevicius/nix2vim/blob/master/lib/neovim-builder.nix
 pkgs.neovimBuilder {
   package = pkgs.neovim-unwrapped;
+  inherit colors;
   imports = [
     ../config/align.nix
     ../config/bufferline.nix
+    ../config/colors.nix
     ../config/completion.nix
     ../config/gitsigns.nix
     ../config/lsp.nix
@@ -42,6 +46,5 @@ pkgs.neovimBuilder {
     ../config/telescope.nix
     ../config/toggleterm.nix
     ../config/tree.nix
-    colors
   ];
 }

modules/common/neovim/plugin/after/queries/nix/injections.scm

@@ -0,0 +1,8 @@
+expression: (apply_expression
+  function: (apply_expression
+    function: (select_expression
+      attrpath: (attrpath) @writeshell (#match? @writeshell "^writeShell.*$")
+      )
+    )
+  (indented_string_expression) @bash
+)

modules/common/shell/fish/default.nix

@@ -12,6 +12,7 @@
     programs.fish = {
       enable = true;
       shellAliases = {
+        bash = "${pkgs.bashInteractive}/bin/bash";
         ls = "exa";
         trash = lib.mkIf pkgs.stdenv.isLinux "${pkgs.trash-cli}/bin/trash-put";
       };

modules/common/shell/fish/functions/fish_user_key_bindings.fish

@@ -14,7 +14,7 @@ bind -M insert \cp projects
 bind -M default \cp projects
 bind -M insert \x1F accept-autosuggestion
 bind -M default \x1F accept-autosuggestion
-bind -M insert \cn 'commandline -r "nix run nixpkgs#"'
-bind -M default \cn 'commandline -r "nix run nixpkgs#"'
+bind -M insert \cn 'commandline -r "nix shell nixpkgs#"'
+bind -M default \cn 'commandline -r "nix shell nixpkgs#"'
 bind -M insert \x11F nix-fzf
 bind -M default \x11F nix-fzf

modules/common/shell/fish/functions/git-push-upstream.fish

@@ -1,4 +0,0 @@
-set -l branch (git branch 2>/dev/null | grep '^\*' | colrm 1 2)
-and set -l command "git push --set-upstream origin $branch"
-and commandline -r $command
-and commandline -f execute

modules/common/shell/git.nix

@@ -31,6 +31,7 @@ in {
           pager = { branch = "false"; };
           safe = { directory = config.dotfilesPath; };
           pull = { ff = "only"; };
+          push = { autoSetupRemote = "true"; };
           init = { defaultBranch = "master"; };
         };
         ignores = [ ".direnv/**" "result" ];
@@ -50,7 +51,6 @@ in {
         gcae = "git commit --amend";
         gu = "git pull";
         gp = "git push";
-        gpp = "git-push-upstream";
         gl = "git log --graph --decorate --oneline -20";
         gll = "git log --graph --decorate --oneline";
         gco = "git checkout";
@@ -113,10 +113,6 @@ in {
           git-history = {
             body = builtins.readFile ./fish/functions/git-history.fish;
           };
-          git-push-upstream = {
-            description = "Create upstream branch";
-            body = builtins.readFile ./fish/functions/git-push-upstream.fish;
-          };
           uncommitted = {
             description = "Find uncommitted git repos";
             body = builtins.readFile ./fish/functions/uncommitted.fish;

modules/common/shell/nixpkgs.nix

@@ -67,6 +67,12 @@
     # Set channel to flake packages, used for nix-shell commands
     nixPath = [ "nixpkgs=${pkgs.path}" ];
 
+    # Set registry to this flake's packages, used for nix X commands
+    registry.nixpkgs.to = {
+      type = "path";
+      path = builtins.toString pkgs.path;
+    };
+
   };
 
 }

modules/common/shell/utilities.nix

@@ -46,7 +46,10 @@ in {
 
       programs.bat = {
         enable = true; # cat replacement
-        config = { theme = config.theme.colors.batTheme; };
+        config = {
+          theme = config.theme.colors.batTheme;
+          pager = "less -R"; # Don't auto-exit if one screen
+        };
       };
 
       programs.fish.shellAbbrs = {

modules/darwin/hammerspoon/Spoons/Launcher.spoon/init.lua

@@ -62,24 +62,15 @@ function obj:init()
     self.launcher:bind("", "C", function()
         self:switch("Calendar.app")
     end)
-    self.launcher:bind("", "D", function()
-        self:switch("@discord@")
-    end)
     self.launcher:bind("", "E", function()
         self:switch("Mail.app")
     end)
-    self.launcher:bind("", "U", function()
-        self:switch("Music.app")
-    end)
     self.launcher:bind("", "F", function()
         self:switch("@firefox@")
     end)
     self.launcher:bind("", "H", function()
         self:switch("Hammerspoon.app")
     end)
-    self.launcher:bind("", "G", function()
-        self:switch("Mimestream.app")
-    end)
     self.launcher:bind("", "M", function()
         self:switch("Messages.app")
     end)

modules/darwin/homebrew.nix

@@ -39,7 +39,6 @@
         "keybase" # GUI on Nix not available for macOS
         "logitech-g-hub" # Mouse and keyboard management
         "meetingbar" # Show meetings in menu bar
-        "mimestream" # Gmail client
         "obsidian" # Obsidian packaging on Nix is not available for macOS
         "scroll-reverser" # Different scroll style for mouse vs. trackpad
         "steam" # Not packaged for Nix

modules/darwin/system.nix

@@ -4,6 +4,13 @@
 
     services.nix-daemon.enable = true;
 
+    # This setting only applies to Darwin, different on NixOS
+    nix.gc.interval = {
+      Hour = 12;
+      Minute = 15;
+      Day = 1;
+    };
+
     environment.shells = [ pkgs.fish ];
 
     security.pam.enableSudoTouchIdAuth = true;
@@ -171,7 +178,6 @@
             "$(__dock_item ${pkgs.firefox-bin}/Applications/Firefox.app)" \
             "$(__dock_item /System/Applications/Messages.app)" \
             "$(__dock_item /System/Applications/Mail.app)" \
-            "$(__dock_item /Applications/Mimestream.app)" \
             "$(__dock_item /Applications/zoom.us.app)" \
             "$(__dock_item ${pkgs.discord}/Applications/Discord.app)" \
             "$(__dock_item /Applications/Obsidian.app)" \

modules/darwin/utilities.nix

@@ -19,10 +19,10 @@
       consul
       noti # Create notifications programmatically
       ipcalc # Make IP network calculations
-      (pkgs.extraLib.mkScript {
+      (writeShellApplication {
         name = "ocr";
-        file = ../../modules/common/shell/bash/scripts/ocr.sh;
-        env = [ tesseract ];
+        runtimeInputs = [ tesseract ];
+        text = builtins.readFile ../../modules/common/shell/bash/scripts/ocr.sh;
       })
     ];
 

modules/nixos/applications/default.nix

@@ -1,5 +1,5 @@
 { ... }: {
 
-  imports = [ ./calibre.nix ];
+  imports = [ ./calibre.nix ./nautilus.nix ];
 
 }

modules/nixos/applications/nautilus.nix

@@ -11,11 +11,12 @@
 
   # Install Nautilus file manager
   config = lib.mkIf (config.gui.enable && config.nautilus.enable) {
+
+    # Quick preview with spacebar
+    services.gnome.sushi.enable = true;
+    environment.systemPackages = [ pkgs.gnome.nautilus ];
+
     home-manager.users.${config.user} = {
-      home.packages = with pkgs; [
-        gnome.nautilus
-        gnome.sushi # Quick preview with spacebar
-      ];
 
       xsession.windowManager.i3.config.keybindings = {
         "${

modules/nixos/default.nix

@@ -1,13 +1,6 @@
 { ... }: {
 
-  imports = [
-    ./applications
-    ./gaming
-    ./graphical
-    ./hardware
-    ./services
-    ./system
-    ./wsl
-  ];
+  imports =
+    [ ./applications ./gaming ./graphical ./hardware ./services ./system ];
 
 }

modules/nixos/gaming/chiaki.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, lib, ... }: {
+
+  options.gaming.chiaki.enable =
+    lib.mkEnableOption "Chiaki PlayStation remote play client.";
+
+  config = lib.mkIf config.gaming.chiaki.enable {
+    environment.systemPackages = with pkgs; [ chiaki ];
+  };
+
+}

modules/nixos/gaming/default.nix

@@ -1,10 +1,13 @@
 { config, pkgs, lib, ... }: {
 
   imports = [
+    ./chiaki.nix
+    ./dwarf-fortress.nix
     ./leagueoflegends.nix
     ./legendary.nix
     ./lutris.nix
     ./minecraft-server.nix
+    ./ryujinx.nix
     ./steam.nix
   ];
 

modules/nixos/gaming/dwarf-fortress.nix

@@ -0,0 +1,29 @@
+{ config, pkgs, lib, ... }: {
+
+  options.gaming.dwarf-fortress.enable =
+    lib.mkEnableOption "Dwarf Fortress free edition.";
+
+  config = lib.mkIf config.gaming.dwarf-fortress.enable {
+    unfreePackages = [ "dwarf-fortress" ];
+    environment.systemPackages = let
+      dfDesktopItem = pkgs.makeDesktopItem {
+        name = "dwarf-fortress";
+        desktopName = "Dwarf Fortress";
+        exec = "${pkgs.dwarf-fortress-packages.dwarf-fortress-full}/bin/dfhack";
+        terminal = false;
+      };
+      dtDesktopItem = pkgs.makeDesktopItem {
+        name = "dwarftherapist";
+        desktopName = "Dwarf Therapist";
+        exec =
+          "${pkgs.dwarf-fortress-packages.dwarf-fortress-full}/bin/dwarftherapist";
+        terminal = false;
+      };
+    in [
+      pkgs.dwarf-fortress-packages.dwarf-fortress-full
+      dfDesktopItem
+      dtDesktopItem
+    ];
+  };
+
+}

modules/nixos/gaming/minecraft-server.nix

@@ -9,15 +9,11 @@ let
 
 in {
 
-  options.gaming.minecraft-server.enable =
-    lib.mkEnableOption "Minecraft Server.";
-
-  config = lib.mkIf config.gaming.minecraft-server.enable {
+  config = lib.mkIf config.services.minecraft-server.enable {
 
     unfreePackages = [ "minecraft-server" ];
 
     services.minecraft-server = {
-      enable = true;
       eula = true;
       declarative = true;
       whitelist = { };

modules/nixos/gaming/ryujinx.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, lib, ... }: {
+
+  options.gaming.ryujinx.enable =
+    lib.mkEnableOption "Ryujinx Nintendo Switch application.";
+
+  config = lib.mkIf config.gaming.ryujinx.enable {
+    environment.systemPackages = with pkgs; [ ryujinx ];
+
+    home-manager.users.${config.user}.xdg.desktopEntries.ryujinx =
+      lib.mkIf pkgs.stdenv.isLinux {
+        name = "Ryujinx";
+        exec =
+          "env DOTNET_EnableAlternateStackCheck=1 Ryujinx -r /home/${config.user}/media/games/ryujinx/ %f";
+      };
+  };
+
+}

modules/nixos/gaming/steam.nix

@@ -17,6 +17,9 @@
       steamPackages.steamcmd
       steam-tui
 
+      # Allow downloading of GE-Proton and other versions
+      protonup-qt
+
     ];
 
   };

modules/nixos/graphical/default.nix

@@ -32,6 +32,10 @@
       type = lib.types.str;
       description = "Command to use for adjusting brightness";
     };
+    calculatorCommand = lib.mkOption {
+      type = lib.types.str;
+      description = "Command to use for quick calculations";
+    };
     toggleBarCommand = lib.mkOption {
       type = lib.types.str;
       description = "Command to hide and show the status bar.";

modules/nixos/graphical/dunst.nix

@@ -5,7 +5,7 @@
   config = {
 
     home-manager.users.${config.user}.services.dunst = {
-      enable = true;
+      enable = false;
       settings = {
         global = {
           width = 300;

modules/nixos/graphical/i3.nix

@@ -123,15 +123,17 @@ in {
               "exec --no-startup-id ${config.powerCommand}";
             "${modifier}+Shift+m" =
               "exec --no-startup-id ${config.brightnessCommand}";
+            "${modifier}+c" =
+              "exec --no-startup-id ${config.calculatorCommand}";
             "${modifier}+Shift+c" = "reload";
             "${modifier}+Shift+r" = "restart";
             "${modifier}+Shift+q" = ''
               exec "i3-nagbar -t warning -m 'You pressed the exit shortcut. Do you really want to exit i3? This will end your X session.' -B 'Yes, exit i3' 'i3-msg exit'"'';
             "${modifier}+Shift+x" = "exec ${lockCmd}";
             "${modifier}+Mod1+h" =
-              "exec --no-startup-id kitty sh -c '${pkgs.home-manager}/bin/home-manager switch --flake ${config.dotfilesPath}#${config.networking.hostName} && ${pkgs.libnotify}/bin/notify-send --transient --expire-time 3000 \"Rebuilt home.\" || read'";
+              "exec --no-startup-id kitty sh -c '${pkgs.home-manager}/bin/home-manager switch --flake ${config.dotfilesPath}#${config.networking.hostName} || read'";
             "${modifier}+Mod1+r" =
-              "exec --no-startup-id kitty sh -c 'doas nixos-rebuild switch --flake ${config.dotfilesPath}#${config.networking.hostName} && ${pkgs.libnotify}/bin/notify-send --transient --expire-time 3000 \"Rebuilt NixOS.\" || read'";
+              "exec --no-startup-id kitty sh -c 'doas nixos-rebuild switch --flake ${config.dotfilesPath}#${config.networking.hostName} || read'";
 
             # Window options
             "${modifier}+q" = "kill";

modules/nixos/graphical/polybar.nix

@@ -107,9 +107,9 @@
             format = "<label>";
             exec = builtins.toString (pkgs.writeShellScript "mailcount.sh" ''
               ${pkgs.notmuch}/bin/notmuch new > /dev/null
-              UNREAD=$(${pkgs.notmuch}/bin/notmuch count is:inbox and is:unread)
+              UNREAD=$(${pkgs.notmuch}/bin/notmuch count is:inbox and is:unread and folder:main/Inbox)
               if [ $UNREAD = "0" ]; then
-                echo "%{T3}%{T-} "
+                echo ""
               else
                 echo "%{T2}%{T-} $UNREAD "
               fi

modules/nixos/graphical/rofi.nix

@@ -165,11 +165,12 @@ in {
       ${rofi}/bin/rofi -modes drun -show drun -theme-str '@import "launcher.rasi"' '';
     systemdSearch = "${pkgs.rofi-systemd}/bin/rofi-systemd";
     altTabCommand = "${rofi}/bin/rofi -show window -modi window";
+    calculatorCommand = "${rofi}/bin/rofi -modes calc -show calc";
     audioSwitchCommand = "${
-        (pkgs.extraLib.mkScript {
+        (pkgs.writeShellApplication {
           name = "switch-audio";
-          file = ./rofi/pulse-sink.sh;
-          env = [ pkgs.ponymix rofi ];
+          runtimeInputs = [ pkgs.ponymix rofi ];
+          text = builtins.readFile ./rofi/pulse-sink.sh;
         })
       }/bin/switch-audio";
   };

modules/nixos/graphical/rofi/brightness.nix

@@ -11,9 +11,9 @@ in {
   config.brightnessCommand = builtins.toString
     (pkgs.writeShellScript "brightness" ''
 
-      dimmer=""
-      medium=""
-      brighter=""
+      dimmer="󰃝"
+      medium="󰃟"
+      brighter="󰃠"
 
       chosen=$(printf '%s;%s;%s\n' \
           "$dimmer" \

modules/nixos/graphical/rofi/power.nix

@@ -13,7 +13,7 @@ in {
     power_off=''
     reboot=''
     lock=''
-    suspend='鈴'
+    suspend='󰒲'
     log_out=''
 
     chosen=$(printf '%s;%s;%s;%s;%s\n' \

modules/nixos/hardware/boot.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }: {
 
-  boot.loader = lib.mkIf (config.physical && pkgs.stdenv.isLinux) {
+  boot.loader = lib.mkIf config.physical {
     grub = {
       enable = true;
 
@@ -40,8 +40,7 @@
   };
 
   # Allow reading from Windows drives
-  boot.supportedFilesystems =
-    lib.mkIf (config.physical && pkgs.stdenv.isLinux) [ "ntfs" ];
+  boot.supportedFilesystems = lib.mkIf config.physical [ "ntfs" ];
 
   # Use latest released Linux kernel by default
   boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;

modules/nixos/hardware/keyboard.nix

@@ -10,9 +10,12 @@
       autoRepeatDelay = 250;
       autoRepeatInterval = 40;
 
-      # Swap escape key with caps lock key
-      xkbOptions = "eurosign:e,caps:swapescape";
+    };
 
+    # Use capslock as escape and/or control
+    services.keyd = {
+      enable = true;
+      settings = { main = { capslock = "overload(control, esc)"; }; };
     };
 
     # Enable num lock on login

modules/nixos/hardware/monitors.nix

@@ -1,51 +1,50 @@
 { config, pkgs, lib, ... }: {
 
-  config =
-    lib.mkIf (config.gui.enable && config.physical && pkgs.stdenv.isLinux) {
+  config = lib.mkIf config.gui.enable {
 
-      environment.systemPackages = with pkgs;
-        [
-          ddcutil # Monitor brightness control
-        ];
+    environment.systemPackages = with pkgs;
+      [
+        ddcutil # Monitor brightness control
+      ];
 
-      # Reduce blue light at night
-      services.redshift = {
-        enable = true;
-        brightness = {
-          day = "1.0";
-          night = "1.0";
-        };
+    # Reduce blue light at night
+    services.redshift = {
+      enable = true;
+      brightness = {
+        day = "1.0";
+        night = "1.0";
       };
-
-      # Detect monitors (brightness) for ddcutil
-      hardware.i2c.enable = true;
-
-      # Grant main user access to external monitors
-      users.users.${config.user}.extraGroups = [ "i2c" ];
-
-      services.xserver.displayManager = {
-
-        # Put the login screen on the left monitor
-        lightdm.greeters.gtk.extraConfig = ''
-          active-monitor=0
-        '';
-
-        # Set up screen position and rotation
-        setupCommands = ''
-          ${pkgs.xorg.xrandr}/bin/xrandr --output DisplayPort-1 \
-                                              --mode 1920x1200 \
-                                              --pos 1920x0 \
-                                              --rotate left \
-                                          --output HDMI-A-0 \
-                                              --primary \
-                                              --mode 1920x1080 \
-                                              --pos 0x560 \
-                                              --rotate normal \
-                                          --output DVI-0 --off \
-                                          --output DVI-1 --off \
-        '';
-      };
-
     };
 
+    # Detect monitors (brightness) for ddcutil
+    hardware.i2c.enable = true;
+
+    # Grant main user access to external monitors
+    users.users.${config.user}.extraGroups = [ "i2c" ];
+
+    services.xserver.displayManager = {
+
+      # Put the login screen on the left monitor
+      lightdm.greeters.gtk.extraConfig = ''
+        active-monitor=0
+      '';
+
+      # Set up screen position and rotation
+      setupCommands = ''
+        ${pkgs.xorg.xrandr}/bin/xrandr --output DisplayPort-1 \
+                                            --mode 1920x1200 \
+                                            --pos 1920x0 \
+                                            --rotate left \
+                                        --output HDMI-A-0 \
+                                            --primary \
+                                            --mode 1920x1080 \
+                                            --pos 0x560 \
+                                            --rotate normal \
+                                        --output DVI-0 --off \
+                                        --output DVI-1 --off \
+      '';
+    };
+
+  };
+
 }

modules/nixos/hardware/mouse.nix

@@ -1,22 +1,21 @@
 { config, pkgs, lib, ... }: {
 
-  config =
-    lib.mkIf (config.gui.enable && config.physical && pkgs.stdenv.isLinux) {
+  config = lib.mkIf config.gui.enable {
 
-      # Mouse customization
-      services.ratbagd.enable = true;
+    # Mouse customization
+    services.ratbagd.enable = true;
 
-      environment.systemPackages = with pkgs; [
-        libratbag # Mouse adjustments
-        piper # Mouse adjustments GUI
-      ];
-
-      services.xserver.libinput.mouse = {
-        # Disable mouse acceleration
-        accelProfile = "flat";
-        accelSpeed = "1.15";
-      };
+    environment.systemPackages = with pkgs; [
+      libratbag # Mouse adjustments
+      piper # Mouse adjustments GUI
+    ];
 
+    services.xserver.libinput.mouse = {
+      # Disable mouse acceleration
+      accelProfile = "flat";
+      accelSpeed = "1.15";
     };
 
+  };
+
 }

modules/nixos/hardware/networking.nix

@@ -1,6 +1,6 @@
-{ config, pkgs, lib, ... }: {
+{ config, lib, ... }: {
 
-  config = lib.mkIf (config.physical && pkgs.stdenv.isLinux) {
+  config = lib.mkIf config.physical {
 
     # The global useDHCP flag is deprecated, therefore explicitly set to false here.
     # Per-interface useDHCP will be mandatory in the future, so this generated config
@@ -10,11 +10,22 @@
     networking.interfaces.wlp4s0.useDHCP = true;
 
     networking.firewall.allowPing = lib.mkIf config.server true;
-    networking.hosts = {
-      "192.168.0.120" = [ "tempest" ];
-      "192.168.0.218" = [ "swan" ];
+
+    # DNS service discovery
+    services.avahi = {
+      enable = true;
+      domainName = "local";
+      publish = {
+        enable = true;
+        addresses = true;
+        domain = true;
+        workstation = true;
+      };
     };
 
+    # Resolve local hostnames using Avahi DNS
+    services.avahi.nssmdns = true;
+
   };
 
 }

modules/nixos/hardware/sleep.nix

@@ -1,17 +1,19 @@
 { config, pkgs, lib, ... }: {
 
-  config = lib.mkIf (config.physical && pkgs.stdenv.isLinux) {
+  config = lib.mkIf config.physical {
 
     # Prevent wake from keyboard
     powerManagement.powerDownCommands = ''
       set +e
 
-      for power in /sys/bus/i2c/devices/i2c-*/device/power; do echo disabled > ''${power}/wakeup || true; done
-      for power in /sys/bus/usb/devices/1-*/power; do echo disabled > ''${power}/wakeup || true; done
-
       # Fix for Gigabyte motherboard
       # /r/archlinux/comments/y7b97e/my_computer_wakes_up_immediately_after_i_suspend/isu99sr/
-      echo GPP0 > /proc/acpi/wakeup
+      # Disable if enabled
+      if (grep "GPP0.*enabled" /proc/acpi/wakeup >/dev/null); then
+          echo GPP0 | ${pkgs.doas}/bin/doas tee /proc/acpi/wakeup
+      fi
+
+      sleep 2
 
       set -e
     '';

modules/nixos/services/arr.nix

@@ -1,24 +1,36 @@
 { config, lib, ... }: {
 
-  options = {
-    arrServer = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      description = "Hostname for arr services";
-      default = null;
+  options = { arrs.enable = lib.mkEnableOption "Arr services"; };
+
+  config = lib.mkIf config.arrs.enable {
+
+    services = {
+      bazarr = {
+        enable = true;
+        group = "media";
+      };
+      jellyseerr.enable = true;
+      prowlarr.enable = true;
+      sabnzbd = {
+        enable = true;
+        group = "media";
+        configFile = "/data/downloads/sabnzbd/sabnzbd.ini";
+      };
+      sonarr = {
+        enable = true;
+        group = "media";
+      };
+      radarr = {
+        enable = true;
+        group = "media";
+      };
     };
-  };
 
-  config = lib.mkIf (config.arrServer != null) {
+    users.groups.media = { };
+    users.users.${config.user}.extraGroups = [ "media" ];
+    users.users.sabnzbd.homeMode = "0770";
 
-    services.sonarr.enable = true;
-    services.radarr.enable = true;
-    services.bazarr.enable = true;
-    services.prowlarr.enable = true;
-
-    # Grant users access to destination directories
-    users.users.sonarr.extraGroups = [ "jellyfin" ];
-    users.users.radarr.extraGroups = [ "jellyfin" ];
-    users.users.bazarr.extraGroups = [ "jellyfin" ];
+    unfreePackages = [ "unrar" ]; # Required for sabnzbd
 
     # Requires updating the base_url config value in each service
     # If you try to rewrite the URL, the service won't redirect properly
@@ -26,7 +38,7 @@
       {
         group = "download";
         match = [{
-          host = [ config.arrServer ];
+          host = [ config.hostnames.download ];
           path = [ "/sonarr*" ];
         }];
         handle = [{
@@ -37,7 +49,7 @@
       {
         group = "download";
         match = [{
-          host = [ config.arrServer ];
+          host = [ config.hostnames.download ];
           path = [ "/radarr*" ];
         }];
         handle = [{
@@ -48,7 +60,7 @@
       {
         group = "download";
         match = [{
-          host = [ config.arrServer ];
+          host = [ config.hostnames.download ];
           path = [ "/prowlarr*" ];
         }];
         handle = [{
@@ -59,7 +71,7 @@
       {
         group = "download";
         match = [{
-          host = [ config.arrServer ];
+          host = [ config.hostnames.download ];
           path = [ "/bazarr*" ];
         }];
         handle = [{
@@ -67,6 +79,25 @@
           upstreams = [{ dial = "localhost:6767"; }];
         }];
       }
+      {
+        group = "download";
+        match = [{
+          host = [ config.hostnames.download ];
+          path = [ "/sabnzbd*" ];
+        }];
+        handle = [{
+          handler = "reverse_proxy";
+          upstreams = [{ dial = "localhost:8085"; }];
+        }];
+      }
+      {
+        group = "download";
+        match = [{ host = [ config.hostnames.download ]; }];
+        handle = [{
+          handler = "reverse_proxy";
+          upstreams = [{ dial = "localhost:5055"; }];
+        }];
+      }
     ];
 
   };

modules/nixos/services/caddy.nix

@@ -1,7 +1,11 @@
 { config, pkgs, lib, ... }: {
 
   options = {
-    caddy.enable = lib.mkEnableOption "Caddy reverse proxy.";
+    caddy.tlsPolicies = lib.mkOption {
+      type = lib.types.listOf lib.types.attrs;
+      description = "Caddy JSON TLS policies";
+      default = [ ];
+    };
     caddy.routes = lib.mkOption {
       type = lib.types.listOf lib.types.attrs;
       description = "Caddy JSON routes for http servers";
@@ -14,34 +18,35 @@
     };
   };
 
-  config = lib.mkIf (config.caddy.enable && config.caddy.routes != [ ]) {
+  config =
+    lib.mkIf (config.services.caddy.enable && config.caddy.routes != [ ]) {
 
-    services.caddy = {
-      enable = true;
-      adapter = "''"; # Required to enable JSON
-      configFile = pkgs.writeText "Caddyfile" (builtins.toJSON {
-        apps.http.servers.main = {
-          listen = [ ":443" ];
-          routes = config.caddy.routes;
-          errors.routes = config.caddy.blocks;
-          # logs = { }; # Uncomment to collect access logs
-        };
-        logging.logs.main = {
-          encoder = { format = "console"; };
-          writer = {
-            output = "file";
-            filename = "${config.services.caddy.logDir}/caddy.log";
-            roll = true;
+      services.caddy = {
+        adapter = "''"; # Required to enable JSON
+        configFile = pkgs.writeText "Caddyfile" (builtins.toJSON {
+          apps.http.servers.main = {
+            listen = [ ":443" ];
+            routes = config.caddy.routes;
+            errors.routes = config.caddy.blocks;
+            # logs = { }; # Uncomment to collect access logs
           };
-          level = "INFO";
-        };
-      });
+          apps.tls.automation.policies = config.caddy.tlsPolicies;
+          logging.logs.main = {
+            encoder = { format = "console"; };
+            writer = {
+              output = "file";
+              filename = "${config.services.caddy.logDir}/caddy.log";
+              roll = true;
+            };
+            level = "INFO";
+          };
+        });
+
+      };
+
+      networking.firewall.allowedTCPPorts = [ 80 443 ];
+      networking.firewall.allowedUDPPorts = [ 443 ];
 
     };
 
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
-    networking.firewall.allowedUDPPorts = [ 443 ];
-
-  };
-
 }

modules/nixos/services/calibre.nix

@@ -7,11 +7,6 @@ let
 in {
 
   options = {
-    bookServer = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      description = "Hostname for Calibre library";
-      default = null;
-    };
     backups.calibre = lib.mkOption {
       type = lib.types.bool;
       description = "Whether to backup Calibre library";
@@ -19,10 +14,9 @@ in {
     };
   };
 
-  config = lib.mkIf (config.bookServer != null) {
+  config = lib.mkIf config.services.calibre-web.enable {
 
     services.calibre-web = {
-      enable = true;
       openFirewall = true;
       options = {
         reverseProxyAuth.enable = false;
@@ -33,7 +27,7 @@ in {
     };
 
     caddy.routes = [{
-      match = [{ host = [ config.bookServer ]; }];
+      match = [{ host = [ config.hostnames.books ]; }];
       handle = [{
         handler = "reverse_proxy";
         upstreams = [{ dial = "localhost:8083"; }];

modules/nixos/services/cloudflare-tunnel.nix

@@ -0,0 +1,87 @@
+{ config, lib, ... }:
+
+# First time setup:
+
+# nix-shell -p cloudflared
+# cloudflared tunnel login
+# cloudflared tunnel create <host>
+# nix run github:nmasur/dotfiles#encrypt-secret > private/cloudflared-<host>.age
+# Paste ~/.cloudflared/<id>.json
+# Set tunnel.id = "<id>"
+# Remove ~/.cloudflared/
+
+# For SSH access:
+# Cloudflare Zero Trust -> Access -> Applications -> Create Application
+# Service Auth -> SSH -> Select Application -> Generate Certificate
+# Set ca = "<public key>"
+
+{
+
+  options.cloudflareTunnel = {
+    enable = lib.mkEnableOption "Use Cloudflare Tunnel";
+    id = lib.mkOption {
+      type = lib.types.str;
+      description = "Cloudflare tunnel ID";
+    };
+    credentialsFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Cloudflare tunnel credentials file (age-encrypted)";
+    };
+    ca = lib.mkOption {
+      type = lib.types.str;
+      description = "Cloudflare tunnel CA public key";
+    };
+  };
+
+  config = lib.mkIf config.cloudflareTunnel.enable {
+
+    services.cloudflared = {
+      enable = true;
+      tunnels = {
+        "${config.cloudflareTunnel.id}" = {
+          credentialsFile = config.secrets.cloudflared.dest;
+          default = "http_status:404";
+          ingress = { "*.masu.rs" = "ssh://localhost:22"; };
+        };
+      };
+    };
+
+    environment.etc = {
+      "ssh/ca.pub".text = ''
+        ${config.cloudflareTunnel.ca}
+      '';
+
+      # Must match the username of the email address in Cloudflare Access
+      "ssh/authorized_principals".text = ''
+        ${config.user}
+      '';
+    };
+
+    services.openssh.extraConfig = ''
+      PubkeyAuthentication yes
+      TrustedUserCAKeys /etc/ssh/ca.pub
+      Match User '${config.user}'
+        AuthorizedPrincipalsFile /etc/ssh/authorized_principals
+        # if there is no existing AuthenticationMethods
+        AuthenticationMethods publickey
+    '';
+    services.openssh.settings.Macs =
+      [ "hmac-sha2-512" ]; # Fix for failure to find matching mac
+
+    # Create credentials file for Cloudflare
+    secrets.cloudflared = {
+      source = config.cloudflareTunnel.credentialsFile;
+      dest = "${config.secretsDirectory}/cloudflared";
+      owner = "cloudflared";
+      group = "cloudflared";
+      permissions = "0440";
+    };
+    systemd.services.cloudflared-secret = {
+      requiredBy =
+        [ "cloudflared-tunnel-${config.cloudflareTunnel.id}.service" ];
+      before = [ "cloudflared-tunnel-${config.cloudflareTunnel.id}.service" ];
+    };
+
+  };
+
+}

modules/nixos/services/cloudflare.nix

@@ -1,6 +1,6 @@
 # This module is necessary for hosts that are serving through Cloudflare.
 
-{ config, lib, ... }:
+{ config, pkgs, lib, ... }:
 
 let
 
@@ -49,6 +49,38 @@ in {
       }];
     }];
 
+    # Tell Caddy to use Cloudflare DNS for ACME challenge validation
+    services.caddy.package = (pkgs.callPackage ../../../overlays/caddy.nix {
+      plugins = [ "github.com/caddy-dns/cloudflare" ];
+      # vendorSha256 = "sha256-K9HPZnr+hMcK5aEd1H4gEg6PXAaNrNWFvaHYm5m62JY=";
+    });
+    caddy.tlsPolicies = [{
+      issuers = [{
+        module = "acme";
+        challenges = {
+          dns = {
+            provider = {
+              name = "cloudflare";
+              api_token = "{env.CF_API_TOKEN}";
+            };
+            resolvers = [ "1.1.1.1" ];
+          };
+        };
+      }];
+    }];
+    systemd.services.caddy.serviceConfig.EnvironmentFile =
+      config.secrets.cloudflareApi.dest;
+    systemd.services.caddy.serviceConfig.AmbientCapabilities =
+      "CAP_NET_BIND_SERVICE";
+
+    # API key must have access to modify Cloudflare DNS records
+    secrets.cloudflareApi = {
+      source = ../../../private/cloudflare-api.age;
+      dest = "${config.secretsDirectory}/cloudflare-api";
+      owner = "caddy";
+      group = "caddy";
+    };
+
     # Allows Nextcloud to trust Cloudflare IPs
     services.nextcloud.config.trustedProxies = cloudflareIpRanges;
 

modules/nixos/services/default.nix

@@ -5,9 +5,12 @@
     ./backups.nix
     ./caddy.nix
     ./calibre.nix
+    ./cloudflare-tunnel.nix
     ./cloudflare.nix
+    ./gitea-runner.nix
     ./gitea.nix
     ./gnupg.nix
+    ./grafana.nix
     ./honeypot.nix
     ./jellyfin.nix
     ./keybase.nix

modules/nixos/services/gitea-runner.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, lib, ... }:
+
+{
+  options.giteaRunner.enable =
+    lib.mkEnableOption "Enable Gitea Actions runner.";
+
+  config = lib.mkIf config.giteaRunner.enable {
+
+    services.gitea-actions-runner.instances.${config.networking.hostName} = {
+      enable = true;
+      labels = [
+        # Provide a Debian base with NodeJS for actions
+        "debian-latest:docker://node:18-bullseye"
+        # Fake the Ubuntu name, because Node provides no Ubuntu builds
+        "ubuntu-latest:docker://node:18-bullseye"
+        # Provide native execution on the host using below packages
+        "native:host"
+      ];
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        gnused
+        nodejs
+        wget
+      ];
+      name = config.networking.hostName;
+      url = "https://${config.hostnames.git}";
+      tokenFile = config.secrets.giteaRunnerToken.dest;
+    };
+
+  };
+
+}

modules/nixos/services/gitea.nix

@@ -1,36 +1,26 @@
-{ config, lib, ... }:
+{ config, pkgs, lib, ... }:
 
 let giteaPath = "/var/lib/gitea"; # Default service directory
 
 in {
 
-  options = {
-
-    giteaServer = lib.mkOption {
-      description = "Hostname for Gitea.";
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-    };
-
-  };
-
-  config = lib.mkIf (config.giteaServer != null) {
+  config = lib.mkIf config.services.gitea.enable {
     services.gitea = {
-      enable = true;
-      httpPort = 3001;
-      httpAddress = "127.0.0.1";
-      rootUrl = "https://${config.giteaServer}/";
       database.type = "sqlite3";
       settings = {
+        actions.ENABLED = true;
         repository = {
           DEFAULT_PUSH_CREATE_PRIVATE = true;
           DISABLE_HTTP_GIT = false;
-          ACCESS_CONTROL_ALLOW_ORIGIN = config.giteaServer;
+          ACCESS_CONTROL_ALLOW_ORIGIN = config.hostnames.git;
           ENABLE_PUSH_CREATE_USER = true;
           ENABLE_PUSH_CREATE_ORG = true;
           DEFAULT_BRANCH = "main";
         };
         server = {
+          HTTP_PORT = 3001;
+          HTTP_ADDRESS = "127.0.0.1";
+          ROOT_URL = "https://${config.hostnames.git}/";
           SSH_PORT = 22;
           START_SSH_SERVER = false; # Use sshd instead
           DISABLE_SSH = false;
@@ -45,9 +35,10 @@ in {
     };
 
     networking.firewall.allowedTCPPorts = [ 122 ];
+    users.users.${config.user}.extraGroups = [ "gitea" ];
 
     caddy.routes = [{
-      match = [{ host = [ config.giteaServer ]; }];
+      match = [{ host = [ config.hostnames.git ]; }];
       handle = [{
         handler = "reverse_proxy";
         upstreams = [{ dial = "localhost:3001"; }];
@@ -59,10 +50,8 @@ in {
     # Open to groups, allowing for backups
     systemd.services.gitea.serviceConfig.StateDirectoryMode =
       lib.mkForce "0770";
-    systemd.tmpfiles.rules = [
-      "d ${giteaPath}/data 0775 gitea gitea"
-      "f ${giteaPath}/data/gitea.db 0660 gitea gitea"
-    ];
+    systemd.tmpfiles.rules =
+      [ "f ${giteaPath}/data/gitea.db 0660 gitea gitea" ];
 
     # Allow litestream and gitea to share a sqlite database
     users.users.litestream.extraGroups = [ "gitea" ];
@@ -87,6 +76,34 @@ in {
       requires = [ "gitea.service" ];
     };
 
+    # Run a repository file backup on a schedule
+    systemd.timers.gitea-backup = lib.mkIf (config.backup.s3.endpoint != null) {
+      timerConfig = {
+        OnCalendar = "*-*-* 00:00:00"; # Once per day
+        Unit = "gitea-backup.service";
+      };
+      wantedBy = [ "timers.target" ];
+    };
+
+    # Backup Gitea repos to object storage
+    systemd.services.gitea-backup =
+      lib.mkIf (config.backup.s3.endpoint != null) {
+        description = "Backup Gitea data";
+        environment.AWS_ACCESS_KEY_ID = config.backup.s3.accessKeyId;
+        serviceConfig = {
+          Type = "oneshot";
+          User = "gitea";
+          Group = "backup";
+          EnvironmentFile = config.secrets.backup.dest;
+        };
+        script = ''
+          ${pkgs.awscli2}/bin/aws s3 sync --exclude */gitea.db* \
+              ${giteaPath}/ \
+              s3://${config.backup.s3.bucket}/gitea-data/ \
+              --endpoint-url=https://${config.backup.s3.endpoint}
+        '';
+      };
+
   };
 
 }

modules/nixos/services/grafana.nix

@@ -0,0 +1,22 @@
+{ config, lib, ... }: {
+
+  config = lib.mkIf config.services.grafana.enable {
+
+    services.grafana.settings.server = {
+      domain = config.hostnames.metrics;
+      http_addr = "127.0.0.1";
+      http_port = 3000;
+      protocol = "http";
+    };
+
+    caddy.routes = [{
+      match = [{ host = [ config.hostnames.metrics ]; }];
+      handle = [{
+        handler = "reverse_proxy";
+        upstreams = [{ dial = "localhost:3000"; }];
+      }];
+    }];
+
+  };
+
+}

modules/nixos/services/jellyfin.nix

@@ -1,34 +1,40 @@
-{ config, lib, ... }: {
+{ config, pkgs, lib, ... }: {
 
-  options = {
-    streamServer = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      description = "Hostname for Jellyfin library";
-      default = null;
-    };
-  };
+  config = lib.mkIf config.services.jellyfin.enable {
 
-  config = lib.mkIf (config.streamServer != null) {
-
-    services.jellyfin.enable = true;
+    services.jellyfin.group = "media";
+    users.users.jellyfin = { isSystemUser = true; };
 
     caddy.routes = [{
-      match = [{ host = [ config.streamServer ]; }];
+      match = [{ host = [ config.hostnames.stream ]; }];
       handle = [{
         handler = "reverse_proxy";
         upstreams = [{ dial = "localhost:8096"; }];
       }];
     }];
 
-    # Grant user access to Jellyfin directories
-    users.users.${config.user}.extraGroups = [ "jellyfin" ];
-
     # Create videos directory, allow anyone in Jellyfin group to manage it
     systemd.tmpfiles.rules = [
-      "d /var/lib/jellyfin 0775 jellyfin jellyfin"
-      "d /var/lib/jellyfin/library 0775 jellyfin jellyfin"
+      "d /var/lib/jellyfin 0775 jellyfin media"
+      "d /var/lib/jellyfin/library 0775 jellyfin media"
     ];
 
+    # Enable VA-API for hardware transcoding
+    hardware.opengl = {
+      enable = true;
+      driSupport = true;
+      extraPackages = [ pkgs.libva ];
+    };
+    environment.systemPackages = [ pkgs.libva-utils ];
+    environment.variables = {
+      # VAAPI and VDPAU config for accelerated video.
+      # See https://wiki.archlinux.org/index.php/Hardware_video_acceleration
+      "VDPAU_DRIVER" = "radeonsi";
+      "LIBVA_DRIVER_NAME" = "radeonsi";
+    };
+    users.users.jellyfin.extraGroups =
+      [ "render" "video" ]; # Access to /dev/dri
+
   };
 
 }

modules/nixos/services/nextcloud.nix

@@ -1,27 +1,16 @@
 { config, pkgs, lib, ... }: {
 
-  options = {
-
-    nextcloudServer = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      description = "Hostname for Nextcloud";
-      default = null;
-    };
-
-  };
-
-  config = lib.mkIf (config.nextcloudServer != null) {
+  config = lib.mkIf config.services.nextcloud.enable {
 
     services.nextcloud = {
-      enable = true;
-      package = pkgs.nextcloud25; # Required to specify
+      package = pkgs.nextcloud26; # Required to specify
       datadir = "/data/nextcloud";
       https = true;
       hostName = "localhost";
       maxUploadSize = "50G";
       config = {
         adminpassFile = config.secrets.nextcloud.dest;
-        extraTrustedDomains = [ config.nextcloudServer ];
+        extraTrustedDomains = [ config.hostnames.content ];
       };
     };
 
@@ -33,7 +22,7 @@
 
     # Point Caddy to Nginx
     caddy.routes = [{
-      match = [{ host = [ config.nextcloudServer ]; }];
+      match = [{ host = [ config.hostnames.content ]; }];
       handle = [{
         handler = "reverse_proxy";
         upstreams = [{ dial = "localhost:8080"; }];

modules/nixos/services/prometheus.nix

@@ -1,32 +1,60 @@
-{ config, lib, ... }: {
+{ config, pkgs, lib, ... }: {
 
-  options.metricsServer = lib.mkOption {
-    type = lib.types.nullOr lib.types.str;
-    description = "Hostname of the Grafana server.";
-    default = null;
-  };
+  config = let
 
-  config = lib.mkIf (config.metricsServer != null) {
+    # If hosting Grafana, host local Prometheus and listen for inbound jobs. If
+    # not hosting Grafana, send remote Prometheus writes to primary host.
+    isServer = config.services.grafana.enable;
 
-    services.grafana.enable = true;
-
-    # Required to fix error in latest nixpkgs
-    services.grafana.settings = { };
+  in lib.mkIf config.services.prometheus.enable {
 
     services.prometheus = {
-      enable = true;
       exporters.node.enable = true;
       scrapeConfigs = [{
         job_name = "local";
         static_configs = [{ targets = [ "127.0.0.1:9100" ]; }];
       }];
+      webExternalUrl =
+        lib.mkIf isServer "https://${config.hostnames.prometheus}";
+      # Web config file: https://prometheus.io/docs/prometheus/latest/configuration/https/
+      webConfigFile = lib.mkIf isServer
+        ((pkgs.formats.yaml { }).generate "webconfig.yml" {
+          basic_auth_users = {
+            # Generate password: htpasswd -nBC 10 "" | tr -d ':\n'
+            # Encrypt and place in private/prometheus.age
+            "prometheus" =
+              "$2y$10$r7FWHLHTGPAY312PdhkPEuvb05aGn9Nk1IO7qtUUUjmaDl35l6sLa";
+          };
+        });
+      remoteWrite = lib.mkIf (!isServer) [{
+        name = config.networking.hostName;
+        url = "https://${config.hostnames.prometheus}";
+        basic_auth = {
+          # Uses password hashed with bcrypt above
+          username = "prometheus";
+          password_file = config.secrets.prometheus.dest;
+        };
+      }];
     };
 
-    caddy.routes = [{
-      match = [{ host = [ config.metricsServer ]; }];
+    # Create credentials file for remote Prometheus push
+    secrets.prometheus = lib.mkIf (!isServer) {
+      source = ../../../private/prometheus.age;
+      dest = "${config.secretsDirectory}/prometheus";
+      owner = "prometheus";
+      group = "prometheus";
+      permissions = "0440";
+    };
+    systemd.services.prometheus-secret = lib.mkIf (!isServer) {
+      requiredBy = [ "prometheus.service" ];
+      before = [ "prometheus.service" ];
+    };
+
+    caddy.routes = lib.mkIf isServer [{
+      match = [{ host = [ config.hostnames.prometheus ]; }];
       handle = [{
         handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:3000"; }];
+        upstreams = [{ dial = "localhost:9090"; }];
       }];
     }];
 

modules/nixos/services/samba.nix

@@ -1,11 +1,8 @@
 { config, lib, ... }: {
 
-  options = { samba.enable = lib.mkEnableOption "Enable Samba sharing."; };
-
   config = {
 
-    services.samba = lib.mkIf (config.samba.enable) {
-      enable = true;
+    services.samba = lib.mkIf config.services.samba.enable {
       openFirewall = true;
       shares.data = {
         path = "/data";

modules/nixos/services/secrets.nix

@@ -47,7 +47,7 @@
 
   };
 
-  config = lib.mkIf (pkgs.stdenv.isLinux && !config.wsl.enable) {
+  config = lib.mkIf pkgs.stdenv.isLinux {
 
     # Create a default directory to place secrets
 

modules/nixos/services/sshd.nix

@@ -1,9 +1,10 @@
-{ config, pkgs, lib, ... }: {
+{ config, lib, ... }: {
 
   options = {
     publicKey = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       description = "Public SSH key authorized for this system.";
+      default = null;
     };
     permitRootLogin = lib.mkOption {
       type = lib.types.str;
@@ -12,28 +13,27 @@
     };
   };
 
-  config = lib.mkIf
-    (pkgs.stdenv.isLinux && !config.wsl.enable && config.publicKey != null) {
-      services.openssh = {
-        enable = true;
-        ports = [ 22 ];
-        allowSFTP = true;
-        settings = {
-          GatewayPorts = "no";
-          X11Forwarding = false;
-          PasswordAuthentication = false;
-          PermitRootLogin = config.permitRootLogin;
-        };
+  config = lib.mkIf (config.publicKey != null) {
+    services.openssh = {
+      enable = true;
+      ports = [ 22 ];
+      allowSFTP = true;
+      settings = {
+        GatewayPorts = "no";
+        X11Forwarding = false;
+        PasswordAuthentication = false;
+        PermitRootLogin = config.permitRootLogin;
       };
-
-      users.users.${config.user}.openssh.authorizedKeys.keys =
-        [ config.publicKey ];
-
-      # Implement a simple fail2ban service for sshd
-      services.sshguard.enable = true;
-
-      # Add terminfo for SSH from popular terminal emulators
-      environment.enableAllTerminfo = true;
     };
 
+    users.users.${config.user}.openssh.authorizedKeys.keys =
+      [ config.publicKey ];
+
+    # Implement a simple fail2ban service for sshd
+    services.sshguard.enable = true;
+
+    # Add terminfo for SSH from popular terminal emulators
+    environment.enableAllTerminfo = true;
+  };
+
 }

modules/nixos/services/transmission.nix

@@ -2,7 +2,7 @@
 
   options = {
     transmissionServer = lib.mkOption {
-      type = lib.types.str;
+      type = lib.types.nullOr lib.types.str;
       description = "Hostname for Transmission";
       default = null;
     };
@@ -12,7 +12,7 @@
     namespace = config.networking.wireguard.interfaces.wg0.interfaceNamespace;
     vpnIp = lib.strings.removeSuffix "/32"
       (builtins.head config.networking.wireguard.interfaces.wg0.ips);
-  in lib.mkIf (config.wireguard.enable && config.transmissionServer != null) {
+  in lib.mkIf (config.transmissionServer != null) {
 
     # Setup transmission
     services.transmission = {
@@ -26,13 +26,13 @@
         rpc-host-whitelist = config.transmissionServer;
         rpc-host-whitelist-enabled = true;
         rpc-whitelist = "127.0.0.1,${vpnIp}";
-        rpc-whitelist-enabled = true;
+        rpc-whitelist-enabled = config.wireguard.enable;
       };
       credentialsFile = config.secrets.transmission.dest;
     };
 
     # Bind transmission to wireguard namespace
-    systemd.services.transmission = {
+    systemd.services.transmission = lib.mkIf config.wireguard.enable {
       bindsTo = [ "netns@${namespace}.service" ];
       requires = [ "network-online.target" "transmission-secret.service" ];
       after = [ "wireguard-wg0.service" "transmission-secret.service" ];
@@ -42,9 +42,14 @@
 
     # Create reverse proxy for web UI
     caddy.routes = lib.mkAfter [{
-      group =
-        lib.mkIf (config.arrServer == config.transmissionServer) "download";
-      match = [{ host = [ config.transmissionServer ]; }];
+      group = if (config.hostnames.download == config.transmissionServer) then
+        "download"
+      else
+        "transmission";
+      match = [{
+        host = [ config.transmissionServer ];
+        path = [ "/transmission*" ];
+      }];
       handle = [{
         handler = "reverse_proxy";
         upstreams = [{ dial = "localhost:9091"; }];
@@ -56,7 +61,7 @@
     boot.kernel.sysctl."net.core.rmem_max" = 4194304;
 
     # Allow inbound connections to reach namespace
-    systemd.services.transmission-web-netns = {
+    systemd.services.transmission-web-netns = lib.mkIf config.wireguard.enable {
       description = "Forward to transmission in wireguard namespace";
       requires = [ "transmission.service" ];
       after = [ "transmission.service" ];
@@ -73,7 +78,7 @@
 
     # Create credentials file for transmission
     secrets.transmission = {
-      source = ../../private/transmission.json.age;
+      source = ../../../private/transmission.json.age;
       dest = "${config.secretsDirectory}/transmission.json";
       owner = "transmission";
       group = "transmission";

modules/nixos/services/vaultwarden.nix

@@ -4,21 +4,10 @@ let vaultwardenPath = "/var/lib/bitwarden_rs"; # Default service directory
 
 in {
 
-  options = {
-
-    vaultwardenServer = lib.mkOption {
-      description = "Hostname for Vaultwarden.";
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-    };
-
-  };
-
-  config = lib.mkIf (config.vaultwardenServer != null) {
+  config = lib.mkIf config.services.vaultwarden.enable {
     services.vaultwarden = {
-      enable = true;
       config = {
-        DOMAIN = "https://${config.vaultwardenServer}";
+        DOMAIN = "https://${config.hostnames.secrets}";
         SIGNUPS_ALLOWED = false;
         SIGNUPS_VERIFY = true;
         INVITATIONS_ALLOWED = true;
@@ -38,7 +27,7 @@ in {
     };
 
     secrets.vaultwarden = {
-      source = ../../private/vaultwarden.age;
+      source = ../../../private/vaultwarden.age;
       dest = "${config.secretsDirectory}/vaultwarden";
       owner = "vaultwarden";
       group = "vaultwarden";
@@ -47,7 +36,7 @@ in {
     networking.firewall.allowedTCPPorts = [ 3012 ];
 
     caddy.routes = [{
-      match = [{ host = [ config.vaultwardenServer ]; }];
+      match = [{ host = [ config.hostnames.secrets ]; }];
       handle = [{
         handler = "reverse_proxy";
         upstreams = [{ dial = "localhost:8222"; }];

modules/nixos/services/wireguard.nix

@@ -2,13 +2,16 @@
 
   options.wireguard.enable = lib.mkEnableOption "Wireguard VPN setup.";
 
-  config = lib.mkIf (pkgs.stdenv.isLinux && config.wireguard.enable) {
+  config = lib.mkIf (pkgs.stdenv.isLinux) {
 
     networking.wireguard = {
-      enable = true;
+      enable = config.wireguard.enable;
       interfaces = {
         wg0 = {
 
+          # Something to use as a default value
+          ips = lib.mkDefault [ "127.0.0.1/32" ];
+
           # Establishes identity of this machine
           generatePrivateKeyFile = false;
           privateKeyFile = config.secrets.wireguard.dest;
@@ -23,6 +26,7 @@
     # Create namespace for Wireguard
     # This allows us to isolate specific programs to Wireguard
     systemd.services."netns@" = {
+      enable = config.wireguard.enable;
       description = "%I network namespace";
       before = [ "network.target" ];
       serviceConfig = {
@@ -35,7 +39,7 @@
 
     # Create private key file for wireguard
     secrets.wireguard = {
-      source = ../../private/wireguard.age;
+      source = ../../../private/wireguard.age;
       dest = "${config.secretsDirectory}/wireguard";
     };
 

modules/nixos/system/default.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }: {
 
-  imports = [ ./user.nix ./timezone.nix ./doas.nix ];
+  imports = [ ./doas.nix ./journald.nix ./user.nix ./timezone.nix ];
 
   config = lib.mkIf pkgs.stdenv.isLinux {
 
@@ -8,6 +8,13 @@
     system.stateVersion =
       config.home-manager.users.${config.user}.home.stateVersion;
 
+    # This setting only applies to NixOS, different on Darwin
+    nix.gc.dates = "weekly";
+
+    systemd.timers.nix-gc.timerConfig = { WakeSystem = true; };
+    systemd.services.nix-gc.postStop =
+      lib.mkIf (!config.server) "systemctl suspend";
+
   };
 
 }

modules/nixos/system/journald.nix

@@ -0,0 +1,10 @@
+{ ... }: {
+
+  # How long to keep journalctl entries
+  services.journald.extraConfig = ''
+    SystemMaxUse=100M
+    MaxFileSec=1month
+    MaxRetentionSec=2month
+  '';
+
+}