fix: qcow-efi requires specific filesystem label

turn on services for flame
fix hash output again for caddy
2025-07-06 17:50:15 +00:00 · 2025-07-04 22:59:40 -06:00 · 2025-07-05 01:02:46 +00:00 · 2025-07-03 23:02:36 -06:00 · 2025-07-03 23:02:28 -06:00 · 2025-07-03 22:34:50 -06:00
508 changed files with 20842 additions and 8966 deletions
--- a/.github/workflows/arrow-aws.yml
+++ b/.github/workflows/arrow-aws.yml
@ -0,0 +1,166 @@
 name: Arrow (AWS)
 run-name: Arrow (AWS) - ${{ inputs.rebuild && 'Rebuild and ' || '' }}${{ inputs.action == 'create' && 'Create' || ( inputs.action == 'destroy' && 'Destroy' || 'No Action' ) }}
 env:
  TERRAFORM_DIRECTORY: deploy/aws
  DEPLOY_IDENTITY_BASE64: ${{ secrets.DEPLOY_IDENTITY_BASE64 }}
  ARROW_IDENTITY_BASE64: ${{ secrets.ARROW_IDENTITY_BASE64 }}
  ZONE_NAME: masu.rs
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
 on:
  workflow_dispatch:
    inputs:
      rebuild:
        type: boolean
        default: false
      action:
        type: choice
        required: true
        default: create
        options:
          - create
          - destroy
          - nothing
      size:
        type: choice
        required: false
        options:
          - t3a.small # 2 GB RAM / $10
 permissions:
  id-token: write
  contents: write
 jobs:
  build-deploy:
    name: Build and Deploy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo Code
        uses: actions/checkout@v4
      - name: Free Disk Space (Ubuntu)
        if: inputs.rebuild && inputs.action != 'destroy'
        uses: jlumbroso/free-disk-space@main
        with:
          tool-cache: true
      # Enable access to KVM, required to build an image
      - name: Enable KVM group perms
        if: inputs.rebuild && inputs.action != 'destroy'
        run: |
            echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
            sudo udevadm control --reload-rules
            sudo udevadm trigger --name-match=kvm
      # Login to AWS
      - name: AWS Assume Role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::286370965832:role/github_actions_admin
          aws-region: us-east-1
      # Install Nix
      - name: Install Nix
        if: inputs.rebuild && inputs.action != 'destroy'
        uses: cachix/install-nix-action@v20
      # Build the image
      - name: Build Image
        if: inputs.rebuild && inputs.action != 'destroy'
        run: nix build .#arrow-aws
      - name: Upload Image to S3
        if: inputs.rebuild && inputs.action != 'destroy'
        run: |
          aws s3 cp \
            result/nixos-amazon-image-*.vhd \
            s3://${{ secrets.IMAGES_BUCKET }}/arrow.vhd \
      # Installs the Terraform binary and some other accessory functions.
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
      # Checks whether Terraform is formatted properly. If this fails, you
      # should install the pre-commit hook.
      - name: Check Formatting
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform fmt -no-color -check -diff -recursive
      # Connects to remote state backend and download providers.
      - name: Terraform Init
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform init \
            -backend-config="bucket=${{ secrets.TERRAFORM_STATE_BUCKET }}" \
            -backend-config="key=arrow.tfstate"
      # Deploys infrastructure or changes to infrastructure.
      - name: Terraform Apply
        if: inputs.action == 'create'
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        env:
          TF_VAR_ec2_size: ${{ inputs.size }}
          TF_VAR_images_bucket: ${{ secrets.IMAGES_BUCKET }}
        run: |
          terraform apply \
            -auto-approve \
            -input=false
      # Removes infrastructure.
      - name: Terraform Destroy
        if: inputs.action == 'destroy'
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        env:
          TF_VAR_ec2_size: ${{ inputs.size }}
          TF_VAR_images_bucket: ${{ secrets.IMAGES_BUCKET }}
        run: |
          terraform destroy \
            -auto-approve \
            -input=false
      - name: Get Host IP
        if: inputs.action == 'create'
        id: host
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: terraform output -raw host_ip
      - name: Wait on SSH
        if: inputs.action == 'create'
        run: |
          for i in $(seq 1 15); do
            if $(nc -z -w 3 ${{ steps.host.outputs.stdout }} 22); then
              exit 0
            fi
            sleep 10
          done
      - name: Write Identity Keys to Files
        if: inputs.action == 'create'
        run: |
          echo "${{ env.DEPLOY_IDENTITY_BASE64 }}" | base64 -d > deploy_ed25519
          chmod 0600 deploy_ed25519
          echo "${{ env.ARROW_IDENTITY_BASE64 }}" | base64 -d > arrow_ed25519
          chmod 0600 arrow_ed25519
      - name: Copy Identity File to Host
        if: inputs.action == 'create'
        run: |
          ssh -i deploy_ed25519 -o StrictHostKeyChecking=accept-new noah@${{ steps.host.outputs.stdout }} 'mkdir -pv .ssh'
          scp -i deploy_ed25519 arrow_ed25519 noah@${{ steps.host.outputs.stdout }}:~/.ssh/id_ed25519
      - name: Wipe Records
        if: ${{ inputs.action == 'destroy' }}
        run: |
          RECORD_ID=$(curl --request GET \
             --url https://api.cloudflare.com/client/v4/zones/${{ env.CLOUDFLARE_ZONE_ID }}/dns_records \
             --header 'Content-Type: application/json' \
             --header "Authorization: Bearer ${{ env.CLOUDFLARE_API_TOKEN }}" | jq -r '.result[] | select(.name == "n8n2.${{ env.ZONE_NAME }}") | .id')
          curl --request DELETE \
             --url https://api.cloudflare.com/client/v4/zones/${{ env.CLOUDFLARE_ZONE_ID }}/dns_records/${RECORD_ID} \
             --header 'Content-Type: application/json' \
             --header "Authorization: Bearer ${{ env.CLOUDFLARE_API_TOKEN }}"
--- a/.github/workflows/arrow.yml
+++ b/.github/workflows/arrow.yml
@ -0,0 +1,154 @@
 name: Arrow
 run-name: Arrow - ${{ inputs.rebuild && 'Rebuild and ' || '' }}${{ inputs.action == 'create' && 'Create' || ( inputs.action == 'destroy' && 'Destroy' || 'No Action' ) }}
 env:
  TERRAFORM_DIRECTORY: hosts/arrow/vultr
  DEPLOY_IDENTITY_BASE64: ${{ secrets.DEPLOY_IDENTITY_BASE64 }}
  ARROW_IDENTITY_BASE64: ${{ secrets.ARROW_IDENTITY_BASE64 }}
  CLOUDFLARE_R2_ENDPOINT: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
  AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_KEY }}
  AWS_DEFAULT_REGION: auto
  AWS_ENDPOINT_URL_S3: "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
  TF_VAR_vultr_api_key: ${{ secrets.VULTR_API_KEY }}
  ZONE_NAME: masu.rs
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
 on:
  workflow_dispatch:
    inputs:
      rebuild:
        type: boolean
        default: false
      action:
        type: choice
        required: true
        default: create
        options:
          - create
          - destroy
          - nothing
      plan:
        type: choice
        required: false
        options:
          - vc2-1c-1gb # 25 GB / $5
          - vc2-1c-2gb # 55 GB / $10 (default)
          - vc2-2c-2gb # 65 GB / $15
          - vc2-2c-4gb # 80 GB / $20
          - vc2-4c-8gb # 160 GB / $40
          - vc2-6c-16gb # 320 GB / $80
 jobs:
  build-deploy:
    name: Build and Deploy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo Code
        uses: actions/checkout@v4
      # Enable access to KVM, required to build an image
      - name: Enable KVM group perms
        if: inputs.rebuild && inputs.action != 'destroy'
        run: |
            echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
            sudo udevadm control --reload-rules
            sudo udevadm trigger --name-match=kvm
      # Install Nix
      - name: Install Nix
        if: inputs.rebuild && inputs.action != 'destroy'
        uses: cachix/install-nix-action@v17
      # Build the image
      - name: Build Image
        if: inputs.rebuild && inputs.action != 'destroy'
        run: nix build .#arrow
      - name: Upload Image to S3
        if: inputs.rebuild && inputs.action != 'destroy'
        run: |
          aws s3 cp \
            result/iso/nixos.iso \
            s3://noahmasur-arrow-images/arrow.iso \
            --endpoint-url "https://${{ env.CLOUDFLARE_R2_ENDPOINT }}"
      # Installs the Terraform binary and some other accessory functions.
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
      # Checks whether Terraform is formatted properly. If this fails, you
      # should install the pre-commit hook.
      - name: Check Formatting
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform fmt -no-color -check -diff -recursive
      # Connects to remote state backend and download providers.
      - name: Terraform Init
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: terraform init
      # Deploys infrastructure or changes to infrastructure.
      - name: Terraform Apply
        if: inputs.action == 'create'
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        env:
          TF_VAR_vultr_plan: ${{ inputs.plan }}
        run: |
          terraform apply \
            -auto-approve \
            -input=false
      # Removes infrastructure.
      - name: Terraform Destroy
        if: inputs.action == 'destroy'
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform destroy \
            -auto-approve \
            -input=false
      - name: Get Host IP
        if: inputs.action == 'create'
        id: host
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: terraform output -raw host_ip
      - name: Wait on SSH
        if: inputs.action == 'create'
        run: |
          for i in $(seq 1 15); do
            if $(nc -z -w 3 ${{ steps.host.outputs.stdout }} 22); then
              exit 0
            fi
            sleep 10
          done
      - name: Write Identity Keys to Files
        if: inputs.action == 'create'
        run: |
          echo "${{ env.DEPLOY_IDENTITY_BASE64 }}" | base64 -d > deploy_ed25519
          chmod 0600 deploy_ed25519
          echo "${{ env.ARROW_IDENTITY_BASE64 }}" | base64 -d > arrow_ed25519
          chmod 0600 arrow_ed25519
      - name: Copy Identity File to Host
        if: inputs.action == 'create'
        run: |
          ssh -i deploy_ed25519 -o StrictHostKeyChecking=accept-new noah@${{ steps.host.outputs.stdout }} 'mkdir -pv .ssh'
          scp -i deploy_ed25519 arrow_ed25519 noah@${{ steps.host.outputs.stdout }}:~/.ssh/id_ed25519
      - name: Wipe Records
        if: ${{ inputs.action == 'destroy' }}
        run: |
          RECORD_ID=$(curl --request GET \
             --url https://api.cloudflare.com/client/v4/zones/${{ env.CLOUDFLARE_ZONE_ID }}/dns_records \
             --header 'Content-Type: application/json' \
             --header "Authorization: Bearer ${{ env.CLOUDFLARE_API_TOKEN }}" | jq -r '.result[] | select(.name == "n8n2.${{ env.ZONE_NAME }}") | .id')
          curl --request DELETE \
             --url https://api.cloudflare.com/client/v4/zones/${{ env.CLOUDFLARE_ZONE_ID }}/dns_records/${RECORD_ID} \
             --header 'Content-Type: application/json' \
             --header "Authorization: Bearer ${{ env.CLOUDFLARE_API_TOKEN }}"
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@ -0,0 +1,20 @@
 name: Check Build
 on:
  workflow_dispatch: # allows manual triggering
 jobs:
  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v11
      - name: Check Nixpkgs Inputs
        uses: DeterminateSystems/flake-checker-action@v7
      - name: Add Nix Cache
        uses: DeterminateSystems/magic-nix-cache-action@v6
      - name: Check the Flake
        run: nix flake check
--- a/.github/workflows/flame.yml
+++ b/.github/workflows/flame.yml
@ -0,0 +1,200 @@
 name: Flame
 run-name: Flame - ${{ inputs.rebuild && 'Rebuild and ' || '' }}${{ inputs.action == 'create' && 'Create' || ( inputs.action == 'destroy' && 'Destroy' || 'No Action' ) }}
 env:
  TERRAFORM_DIRECTORY: deploy/oracle
  DEPLOY_IDENTITY_BASE64: ${{ secrets.DEPLOY_IDENTITY_BASE64 }}
  FLAME_IDENTITY_BASE64: ${{ secrets.FLAME_IDENTITY_BASE64 }}
  ZONE_NAME: masu.rs
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
  OCI_CLI_USER: "ocid1.user.oc1..aaaaaaaa6lro2eoxdajjypjysepvzcavq5yn4qyozjyebxdiaoqziribuqba"
  OCI_CLI_TENANCY: "ocid1.tenancy.oc1..aaaaaaaaudwr2ozedhjnrn76ofjgglgug6gexknjisd7gb7tkj3mjdp763da"
  OCI_CLI_FINGERPRINT: "dd:d0:da:6d:83:46:8b:b3:d9:45:2b:c7:56:ae:30:94"
  OCI_CLI_KEY_CONTENT: "${{ secrets.OCI_PRIVATE_KEY }}"
  TF_VAR_oci_private_key: "${{ secrets.OCI_PRIVATE_KEY }}"
  OCI_CLI_REGION: "us-ashburn-1"
 on:
  workflow_dispatch:
    inputs:
      rebuild:
        description: Rebuild Image
        type: boolean
        default: false
      action:
        description: Terraform Action
        type: choice
        required: true
        default: create
        options:
          - create
          - destroy
          - nothing
 permissions:
  id-token: write
  contents: write
 jobs:
  build-deploy:
    name: Build and Deploy
    # runs-on: ubuntu-latest
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout Repo Code
        uses: actions/checkout@v4
      # - name: Write OCI Key to File
      #   run: |
      #     echo "${{ env.OCI_PRIVATE_KEY_BASE64 }}" | base64 -d > OCI_PRIVATE_KEY
      # # Enable access to KVM, required to build an image
      # - name: Enable KVM group perms
      #   if: inputs.rebuild && inputs.action != 'destroy'
      #   run: |
      #       echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
      #       sudo udevadm control --reload-rules
      #       sudo udevadm trigger --name-match=kvm
      #       sudo apt-get install -y qemu-user-static
      # Install Nix
      - name: Install Nix
        # if: inputs.rebuild && inputs.action != 'destroy'
        uses: cachix/install-nix-action@v31.4.1
        with:
          enable_kvm: true
          extra_nix_config: |
            system = aarch64-linux
            system-features = aarch64-linux arm-linux kvm
      # Build the image
      - name: Build Image
        if: inputs.rebuild && inputs.action != 'destroy'
        run: nix build .#flame-qcow --system aarch64-linux
      - name: List Images
        if: inputs.rebuild && inputs.action != 'destroy'
        run: |
          ls -lh result/
          echo "IMAGE_NAME=$(ls result/nixos.qcow2) >> $GITHUB_ENV
      - name: Upload Image to S3
        if: inputs.rebuild && inputs.action != 'destroy'
        # env:
        #   AWS_ACCESS_KEY_ID: "<YOUR_OCI_ACCESS_KEY>"
        #   AWS_SECRET_ACCESS_KEY: "<YOUR_OCI_SECRET_KEY>"
        #   AWS_DEFAULT_REGION: "us-ashburn-1" # e.g., us-ashburn-1, us-phoenix-1
        #   AWS_ENDPOINT_URL: "https://masur.compat.objectstorage.us-ashburn-1.oraclecloud.com"
        uses: oracle-actions/run-oci-cli-command@v1.3.2
        with:
          command: |
            os object put \
              --namespace "idptr5akf9pf" \
              --bucket-name "noahmasur-images" \
              --name "nixos.qcow2" \
              --file "${IMAGE_NAME}" \
              --part-size 128 \ # Optional: Specify part size in MiB for multipart uploads, default is 128 MiB
              --parallel-upload-count 5 # Optional: Number of parallel uploads, default is 3
      # Login to AWS
      - name: AWS Assume Role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::286370965832:role/github_actions_admin
          aws-region: us-east-1
      # Installs the Terraform binary and some other accessory functions.
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
      # Checks whether Terraform is formatted properly. If this fails, you
      # should install the pre-commit hook.
      - name: Check Formatting
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform fmt -no-color -check -diff -recursive
      # Connects to remote state backend and download providers.
      - name: Terraform Init
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: terraform init -input=false
      # Deploys infrastructure or changes to infrastructure.
      - name: Terraform Apply
        if: inputs.action == 'create'
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform apply \
            -auto-approve \
            -input=false
      # Removes infrastructure.
      - name: Terraform Destroy
        if: inputs.action == 'destroy'
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform destroy \
            -auto-approve \
            -input=false
      - name: Get Host IP
        if: inputs.action == 'create'
        id: host
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: terraform output -raw host_ip
      - name: Wait on SSH
        if: inputs.action == 'create'
        run: |
          for i in $(seq 1 15); do
            if $(nc -z -w 3 ${{ steps.host.outputs.stdout }} 22); then
              exit 0
            fi
            sleep 10
          done
      - name: Write Identity Keys to Files
        if: inputs.action == 'create'
        run: |
          echo "${{ env.DEPLOY_IDENTITY_BASE64 }}" | base64 -d > deploy_ed25519
          chmod 0600 deploy_ed25519
          echo "${{ env.FLAME_IDENTITY_BASE64 }}" | base64 -d > flame_ed25519
          chmod 0600 flame_ed25519
          mkdir -pv "${HOME}/.ssh/"
          cp deploy_ed25519 "${HOME}/.ssh/id_ed25519"
      - name: Run nixos-anywhere
        if: inputs.action == 'create'
        run: |
          nix run github:nix-community/nixos-anywhere -- --flake github:nmasur/dotfiles#flame --build-on remote --no-reboot --target-host ubuntu@${{ steps.host.outputs.stdout }}
          reboot now
      - name: Wait on SSH After Reboot
        if: inputs.action == 'create'
        run: |
          for i in $(seq 1 15); do
            if $(nc -z -w 3 ${{ steps.host.outputs.stdout }} 22); then
              exit 0
            fi
            sleep 10
          done
      - name: Copy Identity File to Host
        if: inputs.action == 'create'
        run: |
          ssh -i deploy_ed25519 -o StrictHostKeyChecking=accept-new noah@${{ steps.host.outputs.stdout }} 'mkdir -pv .ssh'
          scp -i deploy_ed25519 flame_ed25519 noah@${{ steps.host.outputs.stdout }}:~/.ssh/id_ed25519
      # - name: Wipe Records
      #   if: ${{ inputs.action == 'destroy' }}
      #   run: |
      #     RECORD_ID=$(curl --request GET \
      #        --url https://api.cloudflare.com/client/v4/zones/${{ env.CLOUDFLARE_ZONE_ID }}/dns_records \
      #        --header 'Content-Type: application/json' \
      #        --header "Authorization: Bearer ${{ env.CLOUDFLARE_API_TOKEN }}" | jq -r '.result[] | select(.name == "n8n2.${{ env.ZONE_NAME }}") | .id')
      #     curl --request DELETE \
      #        --url https://api.cloudflare.com/client/v4/zones/${{ env.CLOUDFLARE_ZONE_ID }}/dns_records/${RECORD_ID} \
      #        --header 'Content-Type: application/json' \
      #        --header "Authorization: Bearer ${{ env.CLOUDFLARE_API_TOKEN }}"
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@ -0,0 +1,71 @@
 name: Update Flake
 on:
  workflow_dispatch: # allows manual triggering
  schedule:
    - cron: '33 3 * * 6' # runs weekly on Saturday at 03:33
 permissions:
  contents: write
  pull-requests: write
  checks: write
 jobs:
  lockfile:
    name: Lockfile
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v11
        with:
          nix-package-url: https://releases.nixos.org/nix/nix-2.18.4/nix-2.18.4-x86_64-linux.tar.xz
      - name: Check Nixpkgs Inputs
        uses: DeterminateSystems/flake-checker-action@v7
      - name: Add Nix Cache
        uses: DeterminateSystems/magic-nix-cache-action@v6
      - name: Update flake.lock
        uses: DeterminateSystems/update-flake-lock@v23
        id: update
        with:
          pr-title: "Update flake.lock" # Title of PR to be created
          pr-labels: |                  # Labels to be set on the PR
            dependencies
            automated
          pr-body: |
            Automated changes by the [update-flake-lock](https://github.com/DeterminateSystems/update-flake-lock) GitHub Action.
            ```
            {{ env.GIT_COMMIT_MESSAGE }}
            ```
      - name: Check the Flake
        id: check
        run: nix flake check
      - name: Update Check Status
        uses: LouisBrunner/checks-action@v1.6.1
        if: always()
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          name: Update Flake
          conclusion: ${{ job.status }}
          output: |
            {"summary":"${{ steps.check.outputs.stdout }}"}
      - name: Enable Pull Request Automerge
        if: success()
        run: |
          gh pr merge \
            --rebase \
            --auto \
            ${{ steps.update.outputs.pull-request-number }}
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Close Pull Request If Failed
        if: failure()
        run: |
          gh pr close \
            --comment "Auto-closing pull request" \
            --delete-branch \
            ${{ steps.update.outputs.pull-request-number }}
        env:
          GH_TOKEN: ${{ github.token }}
--- a/.gitignore
+++ b/.gitignore
@ -1,9 +1,9 @@
 .DS_Store
 *.bak
 *.db
 *.qcow2
 **/.direnv/**
 result
 .luarc.json
 private/**
 templates/**/flake.lock
 !private/**.age
 !private/**.sha512
--- a/README.md
+++ b/README.md
@ -6,21 +6,77 @@ hosts.
 They are organized and managed by [Nix](https://nixos.org), so some of the
 configuration may be difficult to translate to a non-Nix system.
-However, some of the configurations are easier to lift directly:
+## System Features
- [Neovim](https://github.com/nmasur/dotfiles/tree/master/modules/common/neovim/config)
+| Feature        | Program                                             | Configuration                                                                     |
- [Fish functions](https://github.com/nmasur/dotfiles/tree/master/modules/common/shell/fish/functions)
+|----------------|-----------------------------------------------------|-----------------------------------------------------------------------------------|
- [More fish aliases](https://github.com/nmasur/dotfiles/blob/master/modules/common/shell/fish/default.nix)
+| OS             | [NixOS](https://nixos.org)                          | [Link](./platforms/nixos)                                                         |
- [Git aliases](https://github.com/nmasur/dotfiles/blob/master/modules/common/shell/git.nix)
+| Display Server | [X11](https://www.x.org/wiki/)                      | [Link](./platforms/nixos/modules/nmasur/profiles/gui.nix)                         |
- [Hammerspoon](https://github.com/nmasur/dotfiles/tree/master/modules/darwin/hammerspoon)
+| Compositor     | [Picom](https://github.com/yshui/picom)             | [Link](./platforms/home-manager/modules/nmasur/presets/services/picom.nix)        |
 | Window Manager | [i3](https://i3wm.org/)                             | [Link](./platforms/home-manager/modules/nmasur/presets/services/i3.nix)           |
 | Panel          | [Polybar](https://polybar.github.io/)               | [Link](./platforms/home-manager/modules/nmasur/presets/services/polybar.nix)      |
 | Font           | [Victor Mono](https://rubjo.github.io/victor-mono/) | [Link](./platforms/home-manager/modules/nmasur/presets/fonts.nix)                 |
 | Launcher       | [Rofi](https://github.com/davatorium/rofi)          | [Link](./platforms/home-manager/modules/nmasur/presets/programs/rofi/default.nix) |
-Try out my Neovim config (requires [nix](https://nixos.org/download.html)):
+## User Features
 | Feature      | Program                                                                          | Configuration                                                                 |
 |--------------|----------------------------------------------------------------------------------|-------------------------------------------------------------------------------|
 | Dotfiles     | [Home-Manager](https://github.com/nix-community/home-manager)                    | [Link](./platforms/home-manager)                                              |
 | Terminal     | [Ghostty](https://sw.kovidgoyal.net/kitty/)                                      | [Link](./platforms/home-manager/modules/nmasur/presets/programs/ghostty.nix)  |
 | Shell        | [Fish](https://fishshell.com/)                                                   | [Link](./platforms/home-manager/modules/nmasur/presets/programs/fish.nix)     |
 | Shell Prompt | [Starship](https://starship.rs/)                                                 | [Link](./platforms/home-manager/modules/nmasur/presets/programs/starship.nix) |
 | Colorscheme  | [Gruvbox](https://github.com/morhetz/gruvbox)                                    | [Link](./colorscheme/gruvbox/default.nix)                                     |
 | Wallpaper    | [Road](https://gitlab.com/exorcist365/wallpapers/-/blob/master/gruvbox/road.jpg) | [Link](./hosts/x86_64-linux/tempest/default.nix)                              |
 | Text Editor  | [Neovim](https://neovim.io/)                                                     | [Link](./pkgs/applications/editors/neovim/nmasur/neovim/package.nix)          |
 | Browser      | [Firefox](https://www.mozilla.org/en-US/firefox/new/)                            | [Link](./platforms/home-manager/modules/nmasur/presets/programs/firefox.nix)  |
 | E-Mail       | [Aerc](https://aerc-mail.org/)                                                   | [Link](./platforms/home-manager/modules/nmasur/presets/programs/aerc.nix)     |
 | File Manager | [Nautilus](https://wiki.gnome.org/action/show/Apps/Files)                        | [Link](./platforms/home-manager/modules/nmasur/presets/programs/nautilus.nix) |
 | PDF Reader   | [Zathura](https://pwmt.org/projects/zathura/)                                    | [Link](./platforms/home-manager/modules/nmasur/presets/programs/zathura.nix)  |
 | Video Player | [mpv](https://mpv.io/)                                                           | [Link](./platforms/home-manager/modules/nmasur/presets/programs/mpv.nix)      |
 ## macOS Features
 | Feature  | Program                                     | Configuration                        |
 |----------|---------------------------------------------|--------------------------------------|
 | Keybinds | [Hammerspoon](https://www.hammerspoon.org/) | [Link](./platforms/home-manager/modules/nmasur/presets/services/hammerspoon/) |
 # Diagram
 ![Diagram](https://github.com/nmasur/dotfiles/assets/7386960/4cc22285-cea1-4831-b387-a82241184381)
 ---
 # Unique Configurations
 This repo contains a few more elaborate elements of configuration.
 - [Neovim config](./pkgs/applications/editors/neovim/nmasur/neovim/package.nix)
 generated with Nix2Vim and source-controlled plugins,
 differing based on installed LSPs, for example. - [Caddy
 JSON](./platforms/nixos/modules/nmasur/presets/services/caddy.nix) file (routes,
 etc.) based dynamically on enabled services rendered with Nix. - [Grafana
 config](./platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix)
 rendered with Nix. - Custom [secrets
 deployment](./platforms/nixos/modules/secrets.nix) similar to agenix. - Base16
 [colorschemes](./colorscheme/) applied to multiple applications, including
 Firefox userChrome.
 ---
 # Installation
 Click [here](./docs/installation.md) for detailed installation instructions.
 # Neovim
 Try out my Neovim config with nix:
 ```bash
 nix run github:nmasur/dotfiles#neovim
 ```
-Or build it as a package (requires [nix](https://nixos.org/download.html)):
+Or build it as a package:
 ```bash
 nix build github:nmasur/dotfiles#neovim
@ -30,73 +86,6 @@ If you already have a Neovim configuration, you may need to move it out of
 `~/.config/nvim` or set `XDG_CONFIG_HOME` to another value; otherwise both
 configs might conflict with each other.
 ---
 # Full Installation
 ## NixOS - From Live Disk
 Format drives and build system from any NixOS host, including the live
 installer disk:
 **This will erase your drives; use at your own risk!**
 ```bash
 lsblk # Choose the disk you want to wipe
 nix-shell -p nixVersions.stable
 nix run github:nmasur/dotfiles#installer -- nvme0n1 tempest
 ```
 ## NixOS - From Existing System
 If you're already running NixOS, you can switch to this configuration with the
 following command:
 ```bash
 nix-shell -p nixVersions.stable
 sudo nixos-rebuild switch --flake github:nmasur/dotfiles#tempest
 ```
 ## Windows - From NixOS WSL
 After [installing NixOS on
 WSL](https://xeiaso.net/blog/nix-flakes-4-wsl-2022-05-01), you can switch to
 the WSL configuration:
 ```
 nix-shell -p nixVersions.stable
 sudo nixos-rebuild switch --flake github:nmasur/dotfiles#hydra
 ```
 You should also download the
 [FiraCode](https://github.com/ryanoasis/nerd-fonts/releases/download/v2.2.2/FiraCode.zip)
 font and install it on Windows. Install [Alacritty](https://alacritty.org/) and
 move the `windows/alacritty.yml` file to
 `C:\Users\<user>\AppData\Roaming\alacritty`.
 ## macOS
 To get started on a bare macOS installation, first install Nix:
 ```bash
 sh -c "$(curl -L https://nixos.org/nix/install)"
 ```
 Then use Nix to build nix-darwin:
 ```bash
 nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer
 ./result/bin/darwin-installer
 ```
 Then switch to the macOS configuration:
 ```bash
 darwin-rebuild switch --flake github:nmasur/dotfiles#lookingglass
 ```
 ---
 # Flake Templates
 You can also use the [templates](./templates/) as flakes for starting new
--- a/apps/default.nix
+++ b/apps/default.nix
@ -1,70 +0,0 @@
 { pkgs, ... }: rec {
  default = {
    type = "app";
    program = builtins.toString (pkgs.writeShellScript "default" ''
      ${pkgs.gum}/bin/gum style --margin "1 2" --padding "0 2" --foreground "15" --background "55" "Options"
      ${pkgs.gum}/bin/gum format --type=template -- '  {{ Italic "Run with" }} {{ Color "15" "69" " nix run github:nmasur/dotfiles#" }}{{ Color "15" "62" "someoption" }}{{ Color "15" "69" " " }}.'
      echo ""
      echo ""
      ${pkgs.gum}/bin/gum format --type=template -- \
          '  • {{ Color "15" "57" " readme " }} {{ Italic "Documentation for this repository." }}' \
          '  • {{ Color "15" "57" " rebuild " }} {{ Italic "Switch to this configuration." }}' \
          '  • {{ Color "15" "57" " installer " }} {{ Italic "Format and install from nothing." }}' \
          '  • {{ Color "15" "57" " neovim " }} {{ Italic "Test out the Neovim package." }}' \
          '  • {{ Color "15" "57" " loadkey " }} {{ Italic "Load an ssh key for this machine using melt." }}' \
          '  • {{ Color "15" "57" " encrypt-secret " }} {{ Italic "Encrypt a secret for all machines." }}' \
          '  • {{ Color "15" "57" " reencrypt-secrets " }} {{ Italic "Reencrypt all secrets when new machine is added." }}' \
          '  • {{ Color "15" "57" " netdata " }} {{ Italic "Connect a machine to Netdata cloud." }}'
      echo ""
      echo ""
    '');
  };
  # Format and install from nothing
  installer = import ./installer.nix { inherit pkgs; };
  # Display the readme for this repository
  readme = import ./readme.nix { inherit pkgs; };
  # Rebuild
  rebuild = {
    type = "app";
    program = builtins.toString (pkgs.writeShellScript "rebuild" ''
      echo ${pkgs.system}
      SYSTEM=${if pkgs.stdenv.isDarwin then "darwin" else "linux"}
      if [ "$SYSTEM" == "darwin" ]; then
          darwin-rebuild switch --flake github:nmasur/dotfiles#lookingglass
      else
          nixos-rebuild switch --flake github:nmasur/dotfiles
      fi
    '');
  };
  # Load the SSH key for this machine
  loadkey = import ./loadkey.nix { inherit pkgs; };
  # Encrypt secret for all machines
  encrypt-secret = import ./encrypt-secret.nix { inherit pkgs; };
  # Re-encrypt secrets for all machines
  reencrypt-secrets = import ./reencrypt-secrets.nix { inherit pkgs; };
  # Connect machine metrics to Netdata Cloud
  netdata = import ./netdata-cloud.nix { inherit pkgs; };
  # Run neovim as an app
  neovim = {
    type = "app";
    program = "${
        (import ../modules/common/neovim/package {
          inherit pkgs;
          colors =
            import ../colorscheme/gruvbox/neovim-gruvbox.nix { inherit pkgs; };
        })
      }/bin/nvim";
  };
  nvim = neovim;
 }
--- a/apps/encrypt-secret.nix
+++ b/apps/encrypt-secret.nix
@ -1,19 +0,0 @@
 { pkgs, ... }: {
  # nix run github:nmasur/dotfiles#encrypt-secret > private/mysecret.age
  type = "app";
  program = builtins.toString (pkgs.writeShellScript "encrypt-secret" ''
    printf "\nEnter the secret data to encrypt for all hosts...\n\n" 1>&2
    read -p "Secret: " secret
    printf "\nEncrypting...\n\n" 1>&2
    tmpfile=$(mktemp)
    echo "''${secret}" > ''${tmpfile}
    ${pkgs.age}/bin/age --encrypt --armor --recipients-file ${
      builtins.toString ../public-keys
    } $tmpfile
    rm $tmpfile
  '');
 }
--- a/apps/installer.nix
+++ b/apps/installer.nix
@ -1,48 +0,0 @@
 { pkgs, ... }: {
  # Inspired by https://github.com/cleverca22/nix-tests/blob/master/kexec/justdoit.nix
  # This script will partition and format drives; use at your own risk!
  type = "app";
  program = builtins.toString (pkgs.writeShellScript "installer" ''
    set -e
    DISK=$1
    FLAKE=$2
    PARTITION_PREFIX=""
    if [ -z "$DISK" ] || [ -z "$FLAKE" ]; then
        ${pkgs.gum}/bin/gum style --width 50 --margin "1 2" --padding "2 4" \
            --foreground "#fb4934" \
            "Missing required parameter." \
            "Usage: installer -- <disk> <host>" \
            "Example: installer -- nvme0n1 desktop" \
            "Flake example: nix run github:nmasur/dotfiles#installer -- nvme0n1 desktop"
        echo "(exiting)"
        exit 1
    fi
    case "$DISK" in nvme*)
        PARTITION_PREFIX="p"
    esac
    ${pkgs.gum}/bin/gum confirm \
        "This will ERASE ALL DATA on the disk /dev/''${DISK}. Are you sure you want to continue?" \
        --default=false
    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mklabel gpt
    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart primary 512MiB 100%
    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart ESP fat32 1MiB 512MiB
    ${pkgs.parted}/bin/parted /dev/''${DISK} -- set 3 esp on
    mkfs.ext4 -L nixos /dev/''${DISK}''${PARTITION_PREFIX}1
    mkfs.fat -F 32 -n boot /dev/''${DISK}''${PARTITION_PREFIX}2
    mount /dev/disk/by-label/nixos /mnt
    mkdir --parents /mnt/boot
    mount /dev/disk/by-label/boot /mnt/boot
    ${pkgs.nixos-install-tools}/bin/nixos-install --flake github:nmasur/dotfiles#''${FLAKE}
  '');
 }
--- a/apps/loadkey.nix
+++ b/apps/loadkey.nix
@ -1,12 +0,0 @@
 { pkgs, ... }: {
  type = "app";
  program = builtins.toString (pkgs.writeShellScript "loadkey" ''
    printf "\nEnter the seed phrase for your SSH key...\n"
    printf "\nThen press ^D when complete.\n\n"
    ${pkgs.melt}/bin/melt restore ~/.ssh/id_ed25519
    printf "\n\nContinuing activation.\n\n"
  '');
 }
--- a/apps/netdata-cloud.nix
+++ b/apps/netdata-cloud.nix
@ -1,19 +0,0 @@
 { pkgs, ... }: {
  type = "app";
  program = builtins.toString (pkgs.writeShellScript "netdata-cloud" ''
    if [ "$EUID" -ne 0 ]; then
      echo "Please run as root"
      exit 1
    fi
    mkdir --parents --mode 0750 /var/lib/netdata/cloud.d
    printf "\nEnter the claim token for netdata cloud...\n\n"
    read -p "Token: " token
    echo "''${token}" > /var/lib/netdata/cloud.d/token
    chown -R netdata:netdata /var/lib/netdata
    ${pkgs.netdata}/bin/netdata-claim.sh -id=$(uuidgen)
    printf "\n\nNow restart netdata service.\n\n"
  '');
 }
--- a/apps/readme.nix
+++ b/apps/readme.nix
@ -1,9 +0,0 @@
 { pkgs, ... }: {
  type = "app";
  program = builtins.toString (pkgs.writeShellScript "readme" ''
    ${pkgs.glow}/bin/glow --pager ${builtins.toString ../README.md}
  '');
 }
--- a/apps/reencrypt-secrets.nix
+++ b/apps/reencrypt-secrets.nix
@ -1,27 +0,0 @@
 { pkgs, ... }: {
  # nix run github:nmasur/dotfiles#reencrypt-secrets ./private
  type = "app";
  program = builtins.toString (pkgs.writeShellScript "reencrypt-secrets" ''
    if [ $# -eq 0 ]; then
      echo "Must provide directory to reencrypt."
      exit 1
    fi
    encrypted=$1
    for encryptedfile in ''${1}/*; do
      tmpfile=$(mktemp)
      echo "Decrypting ''${encryptedfile}..."
      ${pkgs.age}/bin/age --decrypt \
        --identity ~/.ssh/id_ed25519 $encryptedfile > $tmpfile
      echo "Encrypting ''${encryptedfile}..."
      ${pkgs.age}/bin/age --encrypt --armor --recipients-file ${
        builtins.toString ../public-keys
      } $tmpfile > $encryptedfile
      rm $tmpfile
    done
    echo "Finished."
  '');
 }
--- a/colorscheme/README.md
+++ b/colorscheme/README.md
@ -0,0 +1,5 @@
 # Colorschemes
 Color information for different themes is found here. The colors are sourced
 and used with [base16](https://github.com/chriskempson/base16) format
 consistently across the system.
--- a/colorscheme/everforest/default.nix
+++ b/colorscheme/everforest/default.nix
@ -1,6 +1,7 @@
 {
  name = "everforest"; # dark, hard
  author = "Sainnhe Park";
  dark = {
    base00 = "#2b3339"; # Default Background
    base01 = "#323c41"; # Lighter Background
    base02 = "#503946"; # Selection Background
@ -17,4 +18,5 @@
    base0D = "#a7c080"; # Functions, Methods, Attribute IDs, Headings
    base0E = "#e67e80"; # Keywords, Storage, Selector, Markup Italic, Diff Changed
    base0F = "#d699b6"; # Deprecated, Opening/Closing Embedded Language Tags, ...
  };
 }
--- a/colorscheme/gruvbox-dark/default.nix
+++ b/colorscheme/gruvbox-dark/default.nix
@ -0,0 +1,44 @@
 # Gruvbox with a darker background for greater contrast
 {
  name = "gruvbox-dark"; # Dark, Medium
  author = "Dawid Kurek (dawikur@gmail.com), morhetz (https://github.com/morhetz/gruvbox), ElRastaOk (https://www.reddit.com/user/ElRastaOk)";
  dark = {
    base00 = "#1D2122"; # ---- This is the change from normal gruvbox
    base01 = "#3c3836"; # ---
    base02 = "#504945"; # --
    base03 = "#665c54"; # -
    base04 = "#bdae93"; # +
    base05 = "#d5c4a1"; # ++
    base06 = "#ebdbb2"; # +++
    base07 = "#fbf1c7"; # ++++
    base08 = "#fb4934"; # red
    base09 = "#fe8019"; # orange
    base0A = "#fabd2f"; # yellow
    base0B = "#b8bb26"; # green
    base0C = "#8ec07c"; # aqua/cyan
    base0D = "#83a598"; # blue
    base0E = "#d3869b"; # purple
    base0F = "#d65d0e"; # brown
    batTheme = "gruvbox-dark";
  };
  light = {
    base00 = "#fbf1c7"; # ----
    base01 = "#ebdbb2"; # ---
    base02 = "#d5c4a1"; # --
    base03 = "#bdae93"; # -
    base04 = "#665c54"; # +
    base05 = "#504945"; # ++
    base06 = "#3c3836"; # +++
    base07 = "#1D2122"; # ++++ Adjusted darker here
    base08 = "#9d0006"; # red
    base09 = "#af3a03"; # orange
    base0A = "#b57614"; # yellow
    base0B = "#79740e"; # green
    base0C = "#427b58"; # aqua/cyan
    base0D = "#076678"; # blue
    base0E = "#8f3f71"; # purple
    base0F = "#d65d0e"; # brown
    batTheme = "gruvbox-light";
  };
 }
--- a/colorscheme/gruvbox/default.nix
+++ b/colorscheme/gruvbox/default.nix
@ -1,7 +1,6 @@
 {
  name = "gruvbox"; # Dark, Medium
-  author =
+  author = "Dawid Kurek (dawikur@gmail.com), morhetz (https://github.com/morhetz/gruvbox)";
    "Dawid Kurek (dawikur@gmail.com), morhetz (https://github.com/morhetz/gruvbox)";
  dark = {
    base00 = "#282828"; # ----
    base01 = "#3c3836"; # ---
@ -19,7 +18,6 @@
    base0D = "#83a598"; # blue
    base0E = "#d3869b"; # purple
    base0F = "#d65d0e"; # brown
    neovimConfig = ./neovim-gruvbox.nix;
    batTheme = "gruvbox-dark";
  };
  light = {
@ -39,7 +37,6 @@
    base0D = "#076678"; # blue
    base0E = "#8f3f71"; # purple
    base0F = "#d65d0e"; # brown
    neovimConfig = ./neovim-gruvbox.nix;
    batTheme = "gruvbox-light";
  };
 }
--- a/colorscheme/gruvbox/neovim-gruvbox.nix
+++ b/colorscheme/gruvbox/neovim-gruvbox.nix
@ -1,12 +0,0 @@
 { pkgs, ... }: {
  plugins = [ pkgs.vimPlugins.vim-gruvbox8 ];
  vim.g.gruvbox_italicize_strings = 0;
  vim.o.background = "dark";
  vimscript = ''
    let g:gruvbox_italicize_strings = 0
    colorscheme gruvbox8
  '';
 }
--- a/colorscheme/nord/default.nix
+++ b/colorscheme/nord/default.nix
@ -1,6 +1,7 @@
 {
  name = "nord";
  author = "arcticicestudio";
  dark = {
    base00 = "#2E3440";
    base01 = "#3B4252";
    base02 = "#434C5E";
@ -17,5 +18,6 @@
    base0D = "#EBCB8B";
    base0E = "#A3BE8C";
    base0F = "#B48EAD";
-  neovimConfig = ./neovim.lua;
+    batTheme = "nord";
  };
 }
--- a/colorscheme/nord/neovim.lua
+++ b/colorscheme/nord/neovim.lua
@ -1,13 +0,0 @@
 local M = {}
 M.packer = function(use)
    use({
        "shaunsingh/nord.nvim",
        config = function()
            vim.g.nord_italic = true
            vim.cmd("colorscheme nord")
        end,
    })
 end
 return M
--- a/deploy/aws/ec2.tf
+++ b/deploy/aws/ec2.tf
@ -0,0 +1,98 @@
 resource "aws_instance" "instance" {
  ami                    = aws_ami.image.id
  iam_instance_profile   = aws_iam_instance_profile.instance.name
  instance_type          = var.ec2_size
  vpc_security_group_ids = [aws_security_group.instance.id]
  tags = {
    Name = "aws-nixos"
  }
  lifecycle {
    create_before_destroy = true
  }
 }
 resource "aws_ec2_instance_state" "instance" {
  instance_id = aws_instance.instance.id
  state       = "running"
 }
 data "aws_vpc" "vpc" {
  default = true
 }
 resource "aws_security_group" "instance" {
  name        = "aws-nixos"
  description = "Allow SSH and HTTPS"
  vpc_id      = data.aws_vpc.vpc.id
  ingress {
    description = "Ping"
    from_port   = -1
    to_port     = -1
    protocol    = "icmp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    description = "SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    description = "HTTPS"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
 }
 # Setup IAM for the instance to use SSM
 data "aws_iam_policy_document" "ec2_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
 }
 data "aws_iam_policy_document" "instance_profile" {
  statement {
    actions = [
      "s3:ListAllMyBuckets",
    ]
    resources = ["*"]
  }
 }
 resource "aws_iam_role" "instance_profile" {
  name               = "nixos"
  assume_role_policy = data.aws_iam_policy_document.ec2_assume_role.json
  inline_policy {
    name   = "instance-profile"
    policy = data.aws_iam_policy_document.instance_profile.json
  }
 }
 resource "aws_iam_role_policy_attachment" "instance_ssm" {
  role       = aws_iam_role.instance_profile.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
 }
 resource "aws_iam_instance_profile" "instance" {
  name = "nixos"
  role = aws_iam_role.instance_profile.name
 }
--- a/generators/aws/main.tf
+++ b/generators/aws/main.tf
@ -1,13 +1,23 @@
-locals {
+# locals {
-  image_file = one(fileset(path.root, "result/nixos-amazon-image-*.vhd"))
+#   image_file = one(fileset(path.root, "../../../result/nixos-amazon-image-*.vhd"))
 # }
 #
 # # Upload image to S3
 # resource "aws_s3_object" "image" {
 #   bucket = var.images_bucket
 #   key    = basename(local.image_file)
 #   source = local.image_file
 #   etag   = filemd5(local.image_file)
 # }
 # Use existing image in S3
 data "aws_s3_object" "image" {
  bucket = var.images_bucket
  key    = "arrow.vhd"
 }
-# Upload to S3
+resource "terraform_data" "image_replacement" {
-resource "aws_s3_object" "image" {
+  input = data.aws_s3_object.image.etag
  bucket = "your_bucket_name"
  key    = basename(local.image_file)
  source = local.image_file
  etag   = filemd5(local.image_file)
 }
 # Setup IAM access for the VM Importer
@ -29,8 +39,8 @@ data "aws_iam_policy_document" "vmimport" {
      "s3:ListBucket",
    ]
    resources = [
-      "arn:aws:s3:::${aws_s3_object.image.bucket}",
+      "arn:aws:s3:::${data.aws_s3_object.image.bucket}",
-      "arn:aws:s3:::${aws_s3_object.image.bucket}/*",
+      "arn:aws:s3:::${data.aws_s3_object.image.bucket}/*",
    ]
  }
  statement {
@ -58,23 +68,28 @@ resource "aws_ebs_snapshot_import" "image" {
  disk_container {
    format = "VHD"
    user_bucket {
-      s3_bucket = aws_s3_object.image.bucket
+      s3_bucket = data.aws_s3_object.image.bucket
-      s3_key    = aws_s3_object.image.key
+      s3_key    = data.aws_s3_object.image.key
    }
  }
  role_name = aws_iam_role.vmimport.name
  lifecycle {
    replace_triggered_by = [terraform_data.image_replacement]
  }
 }
 # Convert to AMI
 resource "aws_ami" "image" {
  description         = "Created with NixOS."
-  name                = replace(basename(local.image_file), "/\\.vhd$/", "")
+  name                = replace(basename(data.aws_s3_object.image.key), "/\\.vhd$/", "")
  virtualization_type = "hvm"
  root_device_name    = "/dev/xvda"
  ena_support         = true
  ebs_block_device {
    device_name = "/dev/xvda"
    snapshot_id = aws_ebs_snapshot_import.image.id
-    volume_size = 8
+    volume_size = 17
  }
 }
--- a/deploy/aws/main.tf
+++ b/deploy/aws/main.tf
@ -0,0 +1,13 @@
 terraform {
  backend "s3" {
    region         = "us-east-1"
    dynamodb_table = "terraform-state-lock"
  }
  required_version = ">= 1.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.42.0"
    }
  }
 }
--- a/deploy/aws/outputs.tf
+++ b/deploy/aws/outputs.tf
@ -0,0 +1,3 @@
 output "host_ip" {
  value = aws_instance.instance.public_ip
 }
--- a/deploy/aws/variables.tf
+++ b/deploy/aws/variables.tf
@ -0,0 +1,10 @@
 variable "ec2_size" {
  type        = string
  description = "Size of instance to launch"
  default     = "t3a.small" # 2 GB RAM ($14/mo)
 }
 variable "images_bucket" {
  description = "Name of the bucket in which to store the NixOS VM images."
  type        = string
 }
--- a/deploy/oracle/main.tf
+++ b/deploy/oracle/main.tf
@ -0,0 +1,115 @@
 terraform {
  backend "s3" {
    bucket       = "noahmasur-terraform"
    key          = "flame.tfstate"
    region       = "us-east-1"
    use_lockfile = true
  }
  required_version = ">= 1.0.0"
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "7.7.0"
    }
  }
 }
 provider "oci" {
  auth         = "APIKey"
  tenancy_ocid = var.compartment_ocid
  user_ocid    = "ocid1.user.oc1..aaaaaaaa6lro2eoxdajjypjysepvzcavq5yn4qyozjyebxdiaoqziribuqba"
  private_key  = var.oci_private_key
  fingerprint  = "dd:d0:da:6d:83:46:8b:b3:d9:45:2b:c7:56:ae:30:94"
  region       = "us-ashburn-1"
 }
 # Get the latest Ubuntu image OCID
 # We'll filter for a recent Ubuntu LTS version (e.g., 22.04 or 24.04) and pick the latest.
 # Note: Image OCIDs are region-specific. This data source helps find the correct one.
 data "oci_core_images" "ubuntu_image" {
  compartment_id   = var.compartment_ocid
  operating_system = "Canonical Ubuntu"
  # Adjust this version if you prefer a different Ubuntu LTS (e.g., "24.04")
  operating_system_version = "24.04"
  shape                    = var.instance_shape # Filter by the shape to ensure compatibility
  sort_by                  = "TIMECREATED"
  sort_order               = "DESC"
 }
 # resource "oci_core_image" "my_custom_image" {
 #   compartment_id = var.compartment_ocid
 #   display_name   = "noah-nixos"
 #   image_source_details {
 #     source_type = "objectStorageTuple" # Use this if specifying namespace, bucket, and object name
 #     # source_type  = "objectStorageUri"  # Use this if you have a pre-authenticated request URL (PAR)
 #     namespace_name = var.object_storage_namespace
 #     bucket_name    = var.object_storage_bucket_name
 #     object_name    = var.object_storage_object_name
 #     source_image_type = "QCOW2" # e.g., "QCOW2", "VMDK"
 #     # These properties help OCI understand how to launch instances from this image
 #     # Adjust based on your custom image's OS and boot mode
 #     operating_system         = "NixOS" # e.g., "CentOS", "Debian", "Windows"
 #     operating_system_version = "25.05" # e.g., "7", "11", "2019"
 #   }
 #   launch_mode = "PARAVIRTUALIZED" # Or "NATIVE", "EMULATED", "CUSTOM"
 #   # Optional: for specific launch options if your image requires them
 #   # launch_options {
 #   #   boot_volume_type = "PARAVIRTUALIZED"
 #   #   firmware         = "UEFI_64" # Or "BIOS"
 #   #   network_type     = "PARAVIRTUALIZED"
 #   # }
 #   # Time out for image import operation. Can take a while for large images.
 #   timeouts {
 #     create = "60m" # Default is 20m, often needs to be increased
 #   }
 # }
 data "oci_identity_availability_domains" "ads" {
  compartment_id = var.compartment_ocid
 }
 resource "oci_core_instance" "my_compute_instance" {
  compartment_id      = var.compartment_ocid
  availability_domain = data.oci_identity_availability_domains.ads.availability_domains[0].name
  shape               = var.instance_shape
  display_name        = var.instance_display_name
  source_details {
    source_type = "image"
    # Use the OCID of the latest Ubuntu image found by the data source
    source_id = data.oci_core_images.ubuntu_image.images[0].id
    # # Use the OCID of the newly imported custom image
    # source_id = oci_core_image.my_custom_image.id
    # Specify the boot volume size
    boot_volume_size_in_gbs = var.boot_volume_size_in_gbs
    boot_volume_vpus_per_gb = 20 # Highest free tier option
  }
  # launch_options {
  #   is_consistent_volume_naming_enabled = true              # Sets boot device path to /dev/oracleoci/oraclevda
  #   network_type                        = "PARAVIRTUALIZED" # I think this is the default?
  # }
  create_vnic_details {
    subnet_id        = oci_core_subnet.my_public_subnet.id # Use the created subnet's ID
    display_name     = "primary_vnic"
    assign_public_ip = true
    hostname_label   = "flame"
  }
  metadata = {
    ssh_authorized_keys = var.ssh_public_key
    user_data           = base64encode(var.cloud_init_script)
  }
  # Optional: For flexible shapes (e.g., VM.Standard.E4.Flex), you might need to specify OCPUs and memory
  shape_config {
    ocpus         = 4
    memory_in_gbs = 24
  }
 }
--- a/deploy/oracle/network.tf
+++ b/deploy/oracle/network.tf
@ -0,0 +1,126 @@
 resource "oci_core_vcn" "my_vpc" {
  compartment_id = var.compartment_ocid
  display_name   = "main"
  cidr_block     = "10.0.0.0/16"
  is_ipv6enabled = false
  dns_label      = "mainvcn" # Must be unique within your tenancy
 }
 resource "oci_core_internet_gateway" "my_igw" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.my_vpc.id
  display_name   = "main-igw"
  enabled        = true
 }
 resource "oci_core_route_table" "my_public_route_table" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.my_vpc.id
  display_name   = "main-public-rt"
  # Default route to the Internet Gateway
  route_rules {
    destination       = "0.0.0.0/0"
    destination_type  = "CIDR_BLOCK"
    network_entity_id = oci_core_internet_gateway.my_igw.id
  }
 }
 resource "oci_core_security_list" "my_public_security_list" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.my_vpc.id
  display_name   = "main-public-sl"
  # Egress Rules (Allow all outbound traffic)
  egress_security_rules {
    destination      = "0.0.0.0/0"
    destination_type = "CIDR_BLOCK"
    protocol         = "all"
  }
  # Ingress Rules
  ingress_security_rules {
    # SSH (TCP 22)
    protocol    = "6" # TCP
    source      = "0.0.0.0/0"
    source_type = "CIDR_BLOCK"
    tcp_options {
      min = 22
      max = 22
    }
  }
  ingress_security_rules {
    # HTTP (TCP 80)
    protocol    = "6" # TCP
    source      = "0.0.0.0/0"
    source_type = "CIDR_BLOCK"
    tcp_options {
      min = 80
      max = 80
    }
  }
  ingress_security_rules {
    # HTTPS (TCP 443)
    protocol    = "6" # TCP
    source      = "0.0.0.0/0"
    source_type = "CIDR_BLOCK"
    tcp_options {
      min = 443
      max = 443
    }
  }
  ingress_security_rules {
    # Custom Minecraft
    protocol    = "6" # TCP
    source      = "0.0.0.0/0"
    source_type = "CIDR_BLOCK"
    tcp_options {
      min = 49732
      max = 49732
    }
  }
  ingress_security_rules {
    # HTTPS (UDP 443) - For QUIC or specific UDP services
    protocol    = "17" # UDP
    source      = "0.0.0.0/0"
    source_type = "CIDR_BLOCK"
    udp_options {
      min = 443
      max = 443
    }
  }
  ingress_security_rules {
    # ICMP (Ping)
    protocol    = "1" # ICMP
    source      = "0.0.0.0/0"
    source_type = "CIDR_BLOCK"
    icmp_options {
      type = 3 # Destination Unreachable (common for connectivity checks)
      code = 4 # Fragmentation needed
    }
  }
  ingress_security_rules {
    protocol    = "1" # ICMP
    source      = "0.0.0.0/0"
    source_type = "CIDR_BLOCK"
    icmp_options {
      type = 8 # Echo Request (ping)
    }
  }
 }
 resource "oci_core_subnet" "my_public_subnet" {
  compartment_id             = var.compartment_ocid
  vcn_id                     = oci_core_vcn.my_vpc.id
  display_name               = "main-public-subnet"
  cidr_block                 = "10.0.0.0/24"
  prohibit_public_ip_on_vnic = false # Allows instances in this subnet to get public IPs
  route_table_id             = oci_core_route_table.my_public_route_table.id
  security_list_ids          = [oci_core_security_list.my_public_security_list.id]
  dns_label                  = "mainsub" # Must be unique within the VCN
 }
--- a/deploy/oracle/outputs.tf
+++ b/deploy/oracle/outputs.tf
@ -0,0 +1,19 @@
 output "host_ip" {
  description = "The public IP address of the launched instance."
  value       = oci_core_instance.my_compute_instance.public_ip
 }
 output "instance_id" {
  description = "The OCID of the launched instance."
  value       = oci_core_instance.my_compute_instance.id
 }
 output "vpc_ocid" {
  description = "The OCID of the created VCN."
  value       = oci_core_vcn.my_vpc.id
 }
 output "subnet_ocid" {
  description = "The OCID of the created public subnet."
  value       = oci_core_subnet.my_public_subnet.id
 }
--- a/deploy/oracle/variables.tf
+++ b/deploy/oracle/variables.tf
@ -0,0 +1,63 @@
 variable "boot_volume_size_in_gbs" {
  description = "The size of the boot volume in GBs."
  type        = number
  default     = 150
 }
 variable "cloud_init_script" {
  description = "A cloud-init script to run on instance launch."
  type        = string
  default     = <<-EOF
              #!/bin/bash
              echo "Hello from cloud-init!" > /home/ubuntu/cloud-init-output.txt
              EOF
 }
 variable "compartment_ocid" {
  description = "The OCID of the compartment where the instance will be created."
  type        = string
  default     = "ocid1.tenancy.oc1..aaaaaaaaudwr2ozedhjnrn76ofjgglgug6gexknjisd7gb7tkj3mjdp763da"
 }
 variable "instance_display_name" {
  description = "A user-friendly name for the instance."
  type        = string
  default     = "noah-nixos"
 }
 variable "instance_shape" {
  description = "The shape of the OCI compute instance."
  type        = string
  default     = "VM.Standard.A1.Flex" # Example shape. Choose one available in your region/AD.
 }
 variable "object_storage_namespace" {
  description = "Your OCI Object Storage namespace (usually your tenancy name)."
  type        = string
  default     = "idptr5akf9pf"
 }
 variable "object_storage_bucket_name" {
  description = "The name of the Object Storage bucket where your custom image is located."
  type        = string
  default     = "noahmasur-images"
 }
 variable "object_storage_object_name" {
  description = "The object name (file name) of your custom image in Object Storage."
  type        = string
  default     = "nixos.qcow2"
 }
 variable "oci_private_key" {
  type        = string
  description = "API private key for Oracle Cloud management"
  sensitive   = true
 }
 variable "ssh_public_key" {
  description = "Your public SSH key content."
  type        = string
  # default     = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal"
  default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKpPU2G9rSF8Q6waH62IJexDCQ6lY+8ZyVufGE3xMDGw actions-deploy"
 }
--- a/deploy/vultr/main.tf
+++ b/deploy/vultr/main.tf
@ -0,0 +1,78 @@
 terraform {
  backend "s3" {
    bucket                      = "noahmasur-terraform"
    key                         = "arrow.tfstate"
    region                      = "auto"
    skip_credentials_validation = true
    skip_metadata_api_check     = true
    skip_region_validation      = true
    skip_requesting_account_id  = true
    skip_s3_checksum            = true
    use_path_style              = true
    /*
      ENVIRONMENT VARIABLES
      ---------------------
      AWS_ACCESS_KEY_ID     - R2 token
      AWS_SECRET_ACCESS_KEY - R2 secret
      AWS_ENDPOINT_URL_S3   - R2 location: https://ACCOUNT_ID.r2.cloudflarestorage.com
    */
  }
  required_version = ">= 1.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.42.0"
    }
    vultr = {
      source  = "vultr/vultr"
      version = "2.19.0"
    }
  }
 }
 variable "vultr_api_key" {
  type        = string
  description = "API key for Vultr management"
  sensitive   = true
 }
 # https://api.vultr.com/v2/plans
 variable "vultr_plan" {
  type        = string
  description = "Size of instance to launch"
  default     = "vc2-1c-2gb" # 55 GB SSD ($10/mo)
 }
 provider "aws" {
  region                      = "auto"
  skip_credentials_validation = true
  skip_metadata_api_check     = true
  skip_region_validation      = true
  skip_requesting_account_id  = true
 }
 provider "vultr" {
  api_key = var.vultr_api_key
 }
 resource "vultr_iso_private" "image" {
  # url = "https://${var.cloudflare_account_id}.r2.cloudflarestorage.com/${data.aws_s3_bucket.images.id}/${aws_s3_object.image.key}"
  url = "https://arrow-images.masu.rs/arrow.iso"
 }
 resource "vultr_instance" "arrow" {
  plan                = var.vultr_plan
  region              = "ewr"
  iso_id              = vultr_iso_private.image.id
  label               = "arrow"
  tags                = ["arrow"]
  enable_ipv6         = false
  disable_public_ipv4 = false
  backups             = "disabled"
  ddos_protection     = false
  activation_email    = false
 }
 output "host_ip" {
  value = vultr_instance.arrow.main_ip
 }
--- a/docs/README.md
+++ b/docs/README.md
@ -0,0 +1,4 @@
 # Documentation
 Reference documents for some of the more complicated services and maintenance
 tasks.
--- a/docs/installation.md
+++ b/docs/installation.md
@ -0,0 +1,73 @@
 [Back to README](../README.md)
 ---
 # Installation
 ## NixOS - From Live Disk
 Format drives and build system from any NixOS host, including the live
 installer disk:
 **This will erase your drives; use at your own risk!**
 ```bash
 lsblk # Choose the disk you want to wipe
 nix-shell -p nixVersions.stable
 nix run github:nmasur/dotfiles#installer -- nvme0n1 tempest
 ```
 ## NixOS - From Existing System
 If you're already running NixOS, you can switch to this configuration with the
 following command:
 ```bash
 nix-shell -p nixVersions.stable
 sudo nixos-rebuild switch --flake github:nmasur/dotfiles#tempest
 ```
 ## Windows - From NixOS WSL
 After [installing NixOS on
 WSL](https://xeiaso.net/blog/nix-flakes-4-wsl-2022-05-01), you can switch to
 the WSL configuration:
 ```
 nix-shell -p nixVersions.stable
 sudo nixos-rebuild switch --flake github:nmasur/dotfiles#hydra
 ```
 You should also download the
 [FiraCode](https://github.com/ryanoasis/nerd-fonts/releases/download/v2.2.2/FiraCode.zip)
 font and install it on Windows. Install [Alacritty](https://alacritty.org/) and
 move the `windows/alacritty.yml` file to
 `C:\Users\<user>\AppData\Roaming\alacritty`.
 ## macOS
 To get started on a bare macOS installation, first install Nix:
 ```bash
 curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
 ```
 Launch a new shell. Then use Nix to switch to the macOS configuration:
 ```bash
 sudo rm /etc/bashrc
 sudo rm /etc/nix/nix.conf
 export NIX_SSL_CERT_FILE="$HOME/Documents/t2-ca-bundle.pem"
 nix \
    --extra-experimental-features flakes \
    --extra-experimental-features nix-command \
    run nix-darwin -- switch \
    --flake github:nmasur/dotfiles#lookingglass
 ```
 Once installed, you can continue to update the macOS configuration:
 ```bash
 darwin-rebuild switch --flake ~/dev/personal/dotfiles
 ```
--- a/docs/repair-nextcloud.md
+++ b/docs/repair-nextcloud.md
@ -0,0 +1,82 @@
 # Repairing Nextcloud
 You can run the maintenance commands like this:
 ```
 sudo -u nextcloud nextcloud-occ maintenance:mode --on
 sudo -u nextcloud nextcloud-occ maintenance:repair
 sudo -u nextcloud nextcloud-occ maintenance:mode --off
 ```
 ## Rescan Files
 ```
 sudo -u nextcloud nextcloud-occ files:scan --all
 ```
 ## Converting from SQLite to MySQL (mariadb)
 First: keep Nextcloud set to SQLite as its dbtype, and separately launch MySQL
 as a service by copying the configuration found
 [here](https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/web-apps/nextcloud.nix).
 No password is necessary, since the user-based auth works with UNIX sockets.
 You can connect to the MySQL instance like this:
 ```
 sudo -u nextcloud mysql -S /run/mysqld/mysqld.sock
 ```
 Create a blank database for Nextcloud:
 ```sql
 create database nextcloud;
 ```
 Now setup the [conversion](https://docs.nextcloud.com/server/17/admin_manual/configuration_database/db_conversion.html):
 ```
 sudo -u nextcloud nextcloud-occ db:convert-type mysql nextcloud localhost nextcloud
 ```
 Ignore the password prompt. Proceed with the conversion.
 Now `config.php` will be updated but the override config from NixOS will not
 be. Now update your NixOS configuration:
 - Remove the `mysql` service you created.
 - Set `dbtype` to `mysql`.
 - Set `database.createLocally` to `true`.
 Rebuild your configuration.
 Now, make sure to enable [4-byte
 support](https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/mysql_4byte_support.html)
 in the database.
 ## Backing Up MySQL Database
 Use this mysqldump command:
 ```
 sudo -u nextcloud mysqldump -S /run/mysqld/mysqld.sock --default-character-set=utf8mb4 nextcloud > backup.sql
 ```
 ## Converting to Postgres
 Same as MySQL, but run this command instead:
 ```
 sudo -u nextcloud nextcloud-occ db:convert-type pgsql nextcloud /run/postgresql/ nextcloud
 ```
 Then set the `dbtype` to `pgsql`.
 ## Backing Up Postgres Database
 Use this pg_dump command:
 ```
 sudo -u nextcloud pg_dump nextcloud > backup.sql
 ```
--- a/docs/restore-calibre.md
+++ b/docs/restore-calibre.md
@ -0,0 +1,23 @@
 # Restoring Calibre From Backup
 The `metadata.db` holds the library and `app.db` and `gdrive.db` contain the
 web/account information.
 Place books directories in `/data/books/`.
 Place `metadata.db` in `/var/lib/calibre-web-db/`.
 Symlink `metadata.db` to the library:
 ```
 sudo ln -s /var/lib/calibre-web-db/metadata.db /data/books/metadata.db
 ```
 Place `app.db` and `gdrive.db` in `/var/lib/calibre-web/`.
 Restart Calibre:
 ```
 sudo systemctl restart calibre-web.service
 ```
--- a/docs/zfs.md
+++ b/docs/zfs.md
@ -0,0 +1,45 @@
 # ZFS
 Swan runs its root on ext4. The ZFS drives are managed imperatively (this
 [disko configuration](../disks/zfs.nix) is an unused work-in-progress).
 The basic ZFS settings are managed [here](../modules/nixos/hardware/zfs.nix).
 ## Creating a New Dataset
 ```
 sudo zfs create tank/mydataset
 sudo zfs set compression=zstd tank/myzstddataset
 sudo zfs set mountpoint=/data/mydataset tank/mydataset
 ```
 ## Maintenance
 ### Get Status
 ```
 sudo zpool status
 ```
 ### Replace Disk
 ```
 sudo zdb
 sudo zpool status -g # Show by GUID
 sudo zpool offline tank <GUID>
 sudo zpool status
 # Remove old disk, insert new disk
 sudo zdb
 sudo zpool replace tank <OLD GUID> /dev/disk/by-id/<NEW PATH>
 sudo zpool status
 ```
 ## Initial Setup
 ```
 sudo zpool create tank raidz1 sda sdb sdc
 sudo zpool set ashift=12 tank
 sudo zpool set autoexpand=on tank
 sudo zpool set compression=on tank
 ```
--- a/flake.lock
+++ b/flake.lock
@ -1,50 +1,17 @@
 {
  "nodes": {
-    "Comment-nvim-src": {
+    "cl-nix-lite": {
      "flake": false,
      "locked": {
-        "lastModified": 1674040818,
+        "lastModified": 1728174978,
-        "narHash": "sha256-7UtZAE9tPlnpeHS2LLol/LGVOxptDXNKWXHNHvFBNk4=",
+        "narHash": "sha256-Grqqg+xuicANB85j0gNEXxi9SBKY7bzGeTuyi95eGcY=",
-        "owner": "numToStr",
+        "owner": "hraban",
-        "repo": "Comment.nvim",
+        "repo": "cl-nix-lite",
-        "rev": "eab2c83a0207369900e92783f56990808082eac2",
+        "rev": "31cfe6275c341eb3120a99f4b1c8516c49a29d87",
        "type": "github"
      },
      "original": {
-        "owner": "numToStr",
+        "owner": "hraban",
-        "repo": "Comment.nvim",
+        "repo": "cl-nix-lite",
        "type": "github"
      }
    },
    "bufferline-nvim-src": {
      "flake": false,
      "locked": {
        "lastModified": 1676130961,
        "narHash": "sha256-3LT45i0eSMfUV9EBrtdtzHxFKRATIhRy/faDd3lI3mA=",
        "owner": "akinsho",
        "repo": "bufferline.nvim",
        "rev": "84b0822b2af478d0b4f7b0f9249ca218855331db",
        "type": "github"
      },
      "original": {
        "owner": "akinsho",
        "repo": "bufferline.nvim",
        "type": "github"
      }
    },
    "cmp-nvim-lsp-src": {
      "flake": false,
      "locked": {
        "lastModified": 1675708067,
        "narHash": "sha256-DxpcPTBlvVP88PDoTheLV2fC76EXDqS2UpM5mAfj/D4=",
        "owner": "hrsh7th",
        "repo": "cmp-nvim-lsp",
        "rev": "0e6b2ed705ddcff9738ec4ea838141654f12eeef",
        "type": "github"
      },
      "original": {
        "owner": "hrsh7th",
        "repo": "cmp-nvim-lsp",
        "type": "github"
      }
    },
@ -55,11 +22,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1673295039,
+        "lastModified": 1751313918,
-        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "narHash": "sha256-HsJM3XLa43WpG+665aGEh8iS8AfEwOIQWk3Mke3e7nk=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "rev": "e04a388232d9a6ba56967ce5b53a8a6f713cdfcf",
        "type": "github"
      },
      "original": {
@ -69,32 +36,51 @@
        "type": "github"
      }
    },
-    "firefox-darwin": {
+    "disko": {
      "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1675471726,
+        "lastModified": 1750903843,
-        "narHash": "sha256-526iHwidfdtZZ7aAU9od1/zbyfSFBEailBTet+Gvfqg=",
+        "narHash": "sha256-Ng9+f0H5/dW+mq/XOKvB9uwvGbsuiiO6HrPdAcVglCs=",
-        "owner": "bandithedoge",
+        "owner": "nix-community",
-        "repo": "nixpkgs-firefox-darwin",
+        "repo": "disko",
-        "rev": "813d55a3e3b3c0423eb5d1fcb4bf82197c9f7796",
+        "rev": "83c4da299c1d7d300f8c6fd3a72ac46cb0d59aae",
        "type": "github"
      },
      "original": {
-        "owner": "bandithedoge",
+        "owner": "nix-community",
-        "repo": "nixpkgs-firefox-darwin",
+        "repo": "disko",
        "type": "github"
      }
    },
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1673956053,
+        "lastModified": 1730663653,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "narHash": "sha256-kFCUWettiFHDIqxCWWQ9qY8pVh+Lj+XL0Giyy/kdomg=",
        "owner": "hraban",
        "repo": "flake-compat",
        "rev": "e5b16676185cb7548581c852f51ce7f3a49bba5e",
        "type": "github"
      },
      "original": {
        "owner": "hraban",
        "ref": "fixed-output",
        "repo": "flake-compat",
        "type": "github"
      }
    },
    "flake-compat_2": {
      "flake": false,
      "locked": {
        "lastModified": 1747046372,
        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
        "type": "github"
      },
      "original": {
@ -103,28 +89,57 @@
        "type": "github"
      }
    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
          "nur",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1733312601,
        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
        "type": "github"
      },
      "original": {
        "owner": "hercules-ci",
        "repo": "flake-parts",
        "type": "github"
      }
    },
    "flake-utils": {
      "inputs": {
        "systems": [
          "mac-app-util",
          "systems"
        ]
      },
      "locked": {
-        "lastModified": 1667395993,
+        "lastModified": 1731533236,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
-        "owner": "numtide",
+        "id": "flake-utils",
-        "repo": "flake-utils",
+        "type": "indirect"
        "type": "github"
      }
    },
    "flake-utils_2": {
      "inputs": {
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1659877975,
+        "lastModified": 1705309234,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
        "type": "github"
      },
      "original": {
@ -134,12 +149,15 @@
      }
    },
    "flake-utils_3": {
      "inputs": {
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1667395993,
+        "lastModified": 1731533236,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
@ -148,19 +166,39 @@
        "type": "github"
      }
    },
-    "home-manager": {
+    "helix": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ],
-        "utils": "utils"
+        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1675935446,
+        "lastModified": 1751378814,
-        "narHash": "sha256-WajulTn7QdwC7QuXRBavrANuIXE5z+08EdxdRw1qsNs=",
+        "narHash": "sha256-pdYjEgdVYEerzxxmrM0GJAFGZ+J50NRD0rtDZ16SuTM=",
        "owner": "helix-editor",
        "repo": "helix",
        "rev": "6a090471a800b1001bdfd2b6e0b710c1cd439a4e",
        "type": "github"
      },
      "original": {
        "owner": "helix-editor",
        "repo": "helix",
        "type": "github"
      }
    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1751485527,
        "narHash": "sha256-E2AtD5UUeU50xco4gmgsCOs7tnBNsVi7+CdCZ4yQUrA=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "2dce7f1a55e785a22d61668516df62899278c9e4",
+        "rev": "25f003f8a9eae31a11938d53cb23e0b4a3c08d3a",
        "type": "github"
      },
      "original": {
@ -170,23 +208,27 @@
        "type": "github"
      }
    },
-    "nil": {
+    "mac-app-util": {
      "inputs": {
        "cl-nix-lite": "cl-nix-lite",
        "flake-compat": "flake-compat",
        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": [
-        "rust-overlay": "rust-overlay"
+          "nixpkgs"
        ],
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1676110678,
+        "lastModified": 1742156590,
-        "narHash": "sha256-hemg8rMKS2me2Wua9ZG/0aQ8fEOfytjyKB+WYcXfEKE=",
+        "narHash": "sha256-aTM/2CrNN5utdVEQGsOA+kl4UozgH7VPLBQL5OXtBrg=",
-        "owner": "oxalica",
+        "owner": "hraban",
-        "repo": "nil",
+        "repo": "mac-app-util",
-        "rev": "ce2e0b5d60fe497134050796f7d12ffb6b50eb28",
+        "rev": "341ede93f290df7957047682482c298e47291b4d",
        "type": "github"
      },
      "original": {
-        "owner": "oxalica",
+        "owner": "hraban",
-        "repo": "nil",
+        "repo": "mac-app-util",
        "type": "github"
      }
    },
@ -198,11 +240,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1673891598,
+        "lastModified": 1745846717,
-        "narHash": "sha256-EevceKxQtA+I0XVA8tBGKmYV1V1KbWc3gsswysMzeDk=",
+        "narHash": "sha256-GjwZEjCrI1/tQYylAQ+hU5JYD2hJI+rZmfICCIniWuE=",
        "owner": "gytis-ivaskevicius",
        "repo": "nix2vim",
-        "rev": "5b31eb81e2c6c74f9e8a4911660f3bf585d55158",
+        "rev": "0cd899a39b56d665115f72ffc7c37e0f4cf41dbe",
        "type": "github"
      },
      "original": {
@ -213,11 +255,11 @@
    },
    "nixlib": {
      "locked": {
-        "lastModified": 1636849918,
+        "lastModified": 1736643958,
-        "narHash": "sha256-nzUK6dPcTmNVrgTAC1EOybSMsrcx+QrVPyqRdyKLkjA=",
+        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "28a5b0557f14124608db68d3ee1f77e9329e9dd5",
+        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
        "type": "github"
      },
      "original": {
@ -234,11 +276,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1674666581,
+        "lastModified": 1747663185,
-        "narHash": "sha256-KNI2s/xrL7WOYaPJAWKBtb7cCH3335rLfsL+B+ssuGY=",
+        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "6a5dc1d3d557ea7b5c19b15ff91955124d0400fa",
+        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
        "type": "github"
      },
      "original": {
@ -249,43 +291,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1639237670,
+        "lastModified": 1751271578,
-        "narHash": "sha256-RTdL4rEQcgaZGpvtDgkp3oK/V+1LM3I53n0ACPSroAQ=",
+        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "edfb969386ebe6c3cf8f878775a7975cd88f926d",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "master",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_2": {
      "locked": {
        "lastModified": 1675309347,
        "narHash": "sha256-D3CQ6HRDT2m3XJlrzb5jKq4vNFR5xFTEFKC7iSjlFpM=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "006c3bd4dd2f5d1d2094047f307cbf9e2b73d9c5",
+        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_3": {
      "locked": {
        "lastModified": 1676973346,
        "narHash": "sha256-rft8oGMocTAhUVqG3LW6I8K/Fo9ICGmNjRqaWTJwav0=",
        "owner": "nixos",
        "repo": "nixpkgs",
        "rev": "d0d55259081f0b97c828f38559cad899d351cad1",
        "type": "github"
      },
      "original": {
@ -295,45 +305,52 @@
        "type": "github"
      }
    },
-    "nixpkgs_4": {
+    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1674868155,
+        "lastModified": 1735563628,
-        "narHash": "sha256-eFNm2h6fNbgD7ZpO4MHikCB5pSnCJ7DTmwPisjetmwc=",
+        "narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
-        "owner": "NixOS",
+        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "ce20e9ebe1903ea2ba1ab006ec63093020c761cb",
+        "rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
-        "ref": "nixos-22.11",
+        "ref": "nixos-24.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "null-ls-nvim-src": {
+    "nixpkgs_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1676246878,
+        "lastModified": 1728538411,
-        "narHash": "sha256-hAUEa2zNsYXQ+TsHYHBzcW67lCxhiD7x+uPbdOZwY8o=",
+        "narHash": "sha256-f0SBJz1eZ2yOuKUr5CA9BHULGXVSn6miBuUWdTyhUhU=",
-        "owner": "jose-elias-alvarez",
+        "owner": "NixOS",
-        "repo": "null-ls.nvim",
+        "repo": "nixpkgs",
-        "rev": "d4594231a06cecce73a78a256b0d7c7ab51f7dd5",
+        "rev": "b69de56fac8c2b6f8fd27f2eca01dcda8e0a4221",
        "type": "github"
      },
      "original": {
-        "owner": "jose-elias-alvarez",
+        "owner": "NixOS",
-        "repo": "null-ls.nvim",
+        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nur": {
      "inputs": {
        "flake-parts": "flake-parts",
        "nixpkgs": [
          "nixpkgs"
        ],
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1676251563,
+        "lastModified": 1751485261,
-        "narHash": "sha256-itLKR2Haeh5wQ6dxkuZ8L5gwp3+CAggpN+w2e7cLQPg=",
+        "narHash": "sha256-QtPZgSHeBdS6yr2E9SUjqusslh3ztxskn54vIwl3pzU=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "9a8b28a9d6611f6af9f7abb3e690fc755d6906fe",
+        "rev": "864d4a94df15802c83c212c2a9fe1d44eb6e78d5",
        "type": "github"
      },
      "original": {
@ -342,95 +359,37 @@
        "type": "github"
      }
    },
    "nvim-lspconfig-src": {
      "flake": false,
      "locked": {
        "lastModified": 1676175675,
        "narHash": "sha256-Wg3NatT4DRBMF6hCxK4C2DC+geFMpfFUFogPbqeMt6E=",
        "owner": "neovim",
        "repo": "nvim-lspconfig",
        "rev": "1712672e4da3003a0dd9f771d30389600b360f42",
        "type": "github"
      },
      "original": {
        "owner": "neovim",
        "repo": "nvim-lspconfig",
        "type": "github"
      }
    },
    "nvim-tree-lua-src": {
      "flake": false,
      "locked": {
        "lastModified": 1676244722,
        "narHash": "sha256-xoSekdZhWr59qTOM0/ihYiuKiwHiKYb42Ep5JHn65UM=",
        "owner": "kyazdani42",
        "repo": "nvim-tree.lua",
        "rev": "ba1778e061f25814bc5940be886a7f41d7d7736e",
        "type": "github"
      },
      "original": {
        "owner": "kyazdani42",
        "repo": "nvim-tree.lua",
        "type": "github"
      }
    },
    "nvim-treesitter-src": {
      "flake": false,
      "locked": {
        "lastModified": 1676240774,
        "narHash": "sha256-eRSU/9ysSvTyYxBrp9Whg0eXgAOsCdmIHMlYZK7bjRg=",
        "owner": "nvim-treesitter",
        "repo": "nvim-treesitter",
        "rev": "7eb5f1a2e3949496f26c4084b521b30f2d08137a",
        "type": "github"
      },
      "original": {
        "owner": "nvim-treesitter",
        "repo": "nvim-treesitter",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "Comment-nvim-src": "Comment-nvim-src",
        "bufferline-nvim-src": "bufferline-nvim-src",
        "cmp-nvim-lsp-src": "cmp-nvim-lsp-src",
        "darwin": "darwin",
-        "firefox-darwin": "firefox-darwin",
+        "disko": "disko",
        "helix": "helix",
        "home-manager": "home-manager",
-        "nil": "nil",
+        "mac-app-util": "mac-app-util",
        "nix2vim": "nix2vim",
        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs",
-        "null-ls-nvim-src": "null-ls-nvim-src",
+        "nixpkgs-stable": "nixpkgs-stable",
        "nur": "nur",
-        "nvim-lspconfig-src": "nvim-lspconfig-src",
+        "wsl": "wsl",
-        "nvim-tree-lua-src": "nvim-tree-lua-src",
+        "yazi": "yazi",
-        "nvim-treesitter-src": "nvim-treesitter-src",
+        "zellij-switch": "zellij-switch",
-        "telescope-nvim-src": "telescope-nvim-src",
+        "zenyd-mpv-scripts": "zenyd-mpv-scripts"
        "telescope-project-nvim-src": "telescope-project-nvim-src",
        "toggleterm-nvim-src": "toggleterm-nvim-src",
        "wallpapers": "wallpapers",
        "wsl": "wsl"
      }
    },
    "rust-overlay": {
      "inputs": {
        "flake-utils": [
          "nil",
          "flake-utils"
        ],
        "nixpkgs": [
-          "nil",
+          "helix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1675391458,
+        "lastModified": 1740623427,
-        "narHash": "sha256-ukDKZw922BnK5ohL9LhwtaDAdCsJL7L6ScNEyF1lO9w=",
+        "narHash": "sha256-3SdPQrZoa4odlScFDUHd4CUPQ/R1gtH4Mq9u8CBiK8M=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "383a4acfd11d778d5c2efcf28376cbd845eeaedf",
+        "rev": "d342e8b5fd88421ff982f383c853f0fc78a847ab",
        "type": "github"
      },
      "original": {
@ -439,97 +398,139 @@
        "type": "github"
      }
    },
-    "telescope-nvim-src": {
+    "rust-overlay_2": {
-      "flake": false,
+      "inputs": {
        "nixpkgs": [
          "yazi",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1675149856,
+        "lastModified": 1747363019,
-        "narHash": "sha256-L4Kw94CUy6N7zcyy9INuR/O0fxQ7sp0IvGd/u7fHxMA=",
+        "narHash": "sha256-N4dwkRBmpOosa4gfFkFf/LTD8oOcNkAyvZ07JvRDEf0=",
-        "owner": "nvim-telescope",
+        "owner": "oxalica",
-        "repo": "telescope.nvim",
+        "repo": "rust-overlay",
-        "rev": "203bf5609137600d73e8ed82703d6b0e320a5f36",
+        "rev": "0e624f2b1972a34be1a9b35290ed18ea4b419b6f",
        "type": "github"
      },
      "original": {
-        "owner": "nvim-telescope",
+        "owner": "oxalica",
-        "repo": "telescope.nvim",
+        "repo": "rust-overlay",
        "type": "github"
      }
    },
-    "telescope-project-nvim-src": {
+    "rust-overlay_3": {
-      "flake": false,
+      "inputs": {
        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1671805267,
+        "lastModified": 1736476219,
-        "narHash": "sha256-S4SOHzQ17ux5pcwwYFpVVLzjLeC4/EJ0IFPbrfzUJC8=",
+        "narHash": "sha256-+qyv3QqdZCdZ3cSO/cbpEY6tntyYjfe1bB12mdpNFaY=",
-        "owner": "nvim-telescope",
+        "owner": "oxalica",
-        "repo": "telescope-project.nvim",
+        "repo": "rust-overlay",
-        "rev": "8e8ee37b7210761502cdf2c3a82b5ba8fb5b2972",
+        "rev": "de30cc5963da22e9742bbbbb9a3344570ed237b9",
        "type": "github"
      },
      "original": {
-        "owner": "nvim-telescope",
+        "owner": "oxalica",
-        "repo": "telescope-project.nvim",
+        "repo": "rust-overlay",
        "type": "github"
      }
    },
-    "toggleterm-nvim-src": {
+    "systems": {
      "flake": false,
      "locked": {
-        "lastModified": 1675358836,
+        "lastModified": 1689347925,
-        "narHash": "sha256-9O7p/7tRStg51OFhMc88M5ewYquiYC9x9CV4s5veVP8=",
+        "narHash": "sha256-ozenz5bFe1UUqOn7f60HRmgc01BgTGIKZ4Xl+HbocGQ=",
-        "owner": "akinsho",
+        "owner": "nix-systems",
-        "repo": "toggleterm.nvim",
+        "repo": "default-darwin",
-        "rev": "19aad0f41f47affbba1274f05e3c067e6d718e1e",
+        "rev": "2235d7e6cc29ae99878133c95e9fe5e157661ffb",
        "type": "github"
      },
      "original": {
-        "owner": "akinsho",
+        "owner": "nix-systems",
-        "repo": "toggleterm.nvim",
+        "repo": "default-darwin",
        "type": "github"
      }
    },
-    "utils": {
+    "systems_2": {
      "locked": {
-        "lastModified": 1667395993,
+        "lastModified": 1681028828,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },
    "systems_3": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },
    "systems_4": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
          "nur",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1733222881,
        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
        "owner": "numtide",
-        "repo": "flake-utils",
+        "repo": "treefmt-nix",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
-        "repo": "flake-utils",
+        "repo": "treefmt-nix",
        "type": "github"
      }
    },
    "wallpapers": {
      "flake": false,
      "locked": {
        "lastModified": 1657544922,
        "narHash": "sha256-1c1uDz37MhksWC75myv6jao5q2mIzD8X8I+TykXXmWg=",
        "owner": "exorcist365",
        "repo": "wallpapers",
        "rev": "8d2860ac6c05cec0f78d5c9d07510f4ff5da90dc",
        "type": "gitlab"
      },
      "original": {
        "owner": "exorcist365",
        "repo": "wallpapers",
        "type": "gitlab"
      }
    },
    "wsl": {
      "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
-        "flake-utils": "flake-utils_3",
+        "nixpkgs": [
-        "nixpkgs": "nixpkgs_4"
+          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1676126384,
+        "lastModified": 1749574455,
-        "narHash": "sha256-3aAnN891Cb1pizewAgaHIo3W1WbAjXtoWuX8n3j8YoI=",
+        "narHash": "sha256-fm2/8KPOYvvIAnNVtjDlTt/My00lIbZQ+LMrfQIWVzs=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "a1c7e8bebac32cfac7aa8498bdfc60cbff13eb50",
+        "rev": "917af390377c573932d84b5e31dd9f2c1b5c0f09",
        "type": "github"
      },
      "original": {
@ -537,6 +538,66 @@
        "repo": "NixOS-WSL",
        "type": "github"
      }
    },
    "yazi": {
      "inputs": {
        "flake-utils": "flake-utils_3",
        "nixpkgs": [
          "nixpkgs"
        ],
        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
        "lastModified": 1751469973,
        "narHash": "sha256-5Y1aVAYFmV20kmkhcHEQrDDvHiJVQGyYhD1SBCp639E=",
        "owner": "sxyazi",
        "repo": "yazi",
        "rev": "c7f800ad7ecf76e3431ad1b7005fa24b53726802",
        "type": "github"
      },
      "original": {
        "owner": "sxyazi",
        "repo": "yazi",
        "type": "github"
      }
    },
    "zellij-switch": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ],
        "rust-overlay": "rust-overlay_3",
        "systems": "systems_4"
      },
      "locked": {
        "lastModified": 1742588229,
        "narHash": "sha256-IPg0pBw0ciF+xl6viq3nK+dvZoDZrfBDui7dkPLz258=",
        "owner": "mostafaqanbaryan",
        "repo": "zellij-switch",
        "rev": "0e3c303c19890ccb03589230ac5a7c4307e573e4",
        "type": "github"
      },
      "original": {
        "owner": "mostafaqanbaryan",
        "repo": "zellij-switch",
        "type": "github"
      }
    },
    "zenyd-mpv-scripts": {
      "flake": false,
      "locked": {
        "lastModified": 1707704915,
        "narHash": "sha256-9P/8q/OZXfaJMS08acQP4h3/zUA5mKRQee0JmkXcz1w=",
        "owner": "zenyd",
        "repo": "mpv-scripts",
        "rev": "9bdce0050144cb24f92475f7bdd77180e0e4c26b",
        "type": "github"
      },
      "original": {
        "owner": "zenyd",
        "repo": "mpv-scripts",
        "type": "github"
      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -1,5 +1,5 @@
 {
-  description = "My system";
+  description = "An opinionated flake containing the NixOS, nix-darwin, and home-manager configurations for multiple systems.";
  # Other flakes that we want to pull from
  inputs = {
@ -7,32 +7,43 @@
    # Used for system packages
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    # Used for specific stable packages
    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
    # Used for MacOS system config
    darwin = {
-      url = "github:/lnl7/nix-darwin/master";
+      url = "github:lnl7/nix-darwin/master";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Used for Windows Subsystem for Linux compatibility
-    wsl.url = "github:nix-community/NixOS-WSL";
+    wsl = {
      url = "github:nix-community/NixOS-WSL";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    # Used for user packages
+    # Used for user packages and dotfiles
    home-manager = {
      url = "github:nix-community/home-manager/master";
-      inputs.nixpkgs.follows =
+      inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
        "nixpkgs"; # Use system packages list where available
    };
    # Community packages; used for Firefox extensions
-    nur.url = "github:nix-community/nur";
+    nur = {
      url = "github:nix-community/nur";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    # Use official Firefox binary for macOS
+    # Better App install management in macOS
-    firefox-darwin.url = "github:bandithedoge/nixpkgs-firefox-darwin";
+    mac-app-util = {
      url = "github:hraban/mac-app-util";
      inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
    };
-    # Wallpapers
+    # Manage disk format and partitioning
-    wallpapers = {
+    disko = {
-      url = "gitlab:exorcist365/wallpapers";
+      url = "github:nix-community/disko";
-      flake = false;
+      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Used to generate NixOS images for other platforms
@ -47,180 +58,236 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    # Nix language server
+    # MPV Scripts
-    nil.url = "github:oxalica/nil";
+    zenyd-mpv-scripts = {
-
+      url = "github:zenyd/mpv-scripts";
    # Neovim plugins
    nvim-lspconfig-src = {
      url = "github:neovim/nvim-lspconfig";
      flake = false;
    };
    cmp-nvim-lsp-src = {
      url = "github:hrsh7th/cmp-nvim-lsp";
      flake = false;
    };
    null-ls-nvim-src = {
      url = "github:jose-elias-alvarez/null-ls.nvim";
      flake = false;
    };
    Comment-nvim-src = {
      url = "github:numToStr/Comment.nvim";
      flake = false;
    };
    nvim-treesitter-src = {
      url = "github:nvim-treesitter/nvim-treesitter";
      flake = false;
    };
    telescope-nvim-src = {
      url = "github:nvim-telescope/telescope.nvim";
      flake = false;
    };
    telescope-project-nvim-src = {
      url = "github:nvim-telescope/telescope-project.nvim";
      flake = false;
    };
    toggleterm-nvim-src = {
      url = "github:akinsho/toggleterm.nvim";
      flake = false;
    };
    bufferline-nvim-src = {
      url = "github:akinsho/bufferline.nvim";
      flake = false;
    };
    nvim-tree-lua-src = {
      url = "github:kyazdani42/nvim-tree.lua";
      flake = false;
    };
    # Zellij Switcher
    zellij-switch = {
      url = "github:mostafaqanbaryan/zellij-switch";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-  outputs = { nixpkgs, ... }@inputs:
+    # Text editor
    helix = {
      url = "github:helix-editor/helix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # Terminal file manager
    yazi = {
      url = "github:sxyazi/yazi";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # # Nextcloud Apps
    # nextcloud-news = {
    #   # https://github.com/nextcloud/news/releases
    #   url = "https://github.com/nextcloud/news/releases/download/25.0.0-alpha12/news.tar.gz";
    #   flake = false;
    # };
    # nextcloud-external = {
    #   # https://github.com/nextcloud-releases/external/releases
    #   url = "https://github.com/nextcloud-releases/external/releases/download/v5.5.2/external-v5.5.2.tar.gz";
    #   flake = false;
    # };
    # nextcloud-cookbook = {
    #   # https://github.com/christianlupus-nextcloud/cookbook-releases/releases/
    #   url = "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.2/cookbook-0.11.2.tar.gz";
    #   flake = false;
    # };
    # nextcloud-snappymail = {
    #   # https://github.com/the-djmaze/snappymail/releases
    #   # https://snappymail.eu/repository/nextcloud
    #   url = "https://snappymail.eu/repository/nextcloud/snappymail-2.38.2-nextcloud.tar.gz";
    #   # url = "https://github.com/nmasur/snappymail-nextcloud/releases/download/v2.36.3/snappymail-2.36.3-nextcloud.tar.gz";
    #   flake = false;
    # };
  };
  outputs =
    { nixpkgs, ... }@inputs:
    let
-
+      hostnames =
-      # Global configuration for my systems
+        let
-      globals = rec {
+          baseName = "masu.rs";
-        user = "noah";
+        in
-        fullName = "Noah Masur";
+        {
-        gitName = fullName;
+          audiobooks = "read.${baseName}";
-        gitEmail = "7386960+nmasur@users.noreply.github.com";
+          bookmarks = "keep.${baseName}";
-        mail.server = "noahmasur.com";
+          books = "books.${baseName}";
-        dotfilesRepo = "git@github.com:nmasur/dotfiles";
+          budget = "money.${baseName}";
          content = "cloud.${baseName}";
          download = "download.${baseName}";
          files = "files.${baseName}";
          git = "git.${baseName}";
          imap = "imap.purelymail.com";
          influxdb = "influxdb.${baseName}";
          irc = "irc.${baseName}";
          mail = "noahmasur.com";
          mathesar = "mathesar.${baseName}";
          metrics = "metrics.${baseName}";
          minecraft = "minecraft.${baseName}";
          n8n = "n8n.${baseName}";
          notifications = "ntfy.${baseName}";
          paperless = "paper.${baseName}";
          photos = "photos.${baseName}";
          postgresql = "pg.${baseName}";
          prometheus = "prom.${baseName}";
          secrets = "vault.${baseName}";
          smtp = "smtp.purelymail.com";
          status = "status.${baseName}";
          stream = "stream.${baseName}";
          transmission = "transmission.${baseName}";
        };
-      # Common overlays to always use
+    in
-      overlays = [
+    rec {
        inputs.nur.overlay
        inputs.nix2vim.overlay
        (import ./overlays/neovim-plugins.nix inputs)
        (import ./overlays/calibre-web.nix)
      ];
-      # System types to support.
+      lib = import ./lib inputs;
-      supportedSystems =
+      flattenAttrset = attrs: builtins.foldl' lib.mergeAttrs { } (builtins.attrValues attrs);
        [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
-      # Helper function to generate an attrset '{ x86_64-linux = f "x86_64-linux"; ... }'.
+      nixosConfigurations = flattenAttrset (
-      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+        builtins.mapAttrs (
          system: hosts:
          builtins.mapAttrs (
            name: module:
            lib.buildNixos {
              inherit system module;
              specialArgs = { inherit hostnames; };
            }
          ) hosts
        ) lib.linuxHosts
      );
-    in rec {
+      darwinConfigurations = flattenAttrset (
        builtins.mapAttrs (
          system: hosts:
          builtins.mapAttrs (
            name: module:
            lib.buildDarwin {
              inherit system module;
              specialArgs = { inherit hostnames; };
            }
          ) hosts
        ) lib.darwinHosts
      );
-      nixosConfigurations = {
+      homeModules = builtins.mapAttrs (
-        tempest = import ./hosts/tempest { inherit inputs globals overlays; };
+        system: hosts:
-        hydra = import ./hosts/hydra { inherit inputs globals overlays; };
+        builtins.mapAttrs (
-        flame = import ./hosts/flame { inherit inputs globals overlays; };
+          name: module: (builtins.head (lib.attrsToList module.home-manager.users)).value
-        swan = import ./hosts/swan { inherit inputs globals overlays; };
+        ) hosts
      ) lib.hosts;
      homeConfigurations = flattenAttrset (
        builtins.mapAttrs (
          system: hosts:
          builtins.mapAttrs (
            name: module:
            lib.buildHome {
              inherit system module;
              specialArgs = { inherit hostnames; };
            }
          ) hosts
        ) homeModules
      );
      # Disk formatting, only used once
      diskoConfigurations = {
        root = import ./hosts/x86_64-linux/swan/root.nix;
      };
-      darwinConfigurations = {
+      generators = builtins.mapAttrs (
-        lookingglass =
+        # x86_64-linux = { arrow = ...; swan = ...; }
-          import ./hosts/lookingglass { inherit inputs globals overlays; };
+        system: hosts:
        (lib.concatMapAttrs (name: module: {
          "${name}-aws" = lib.generateImage {
            inherit system module;
            format = "amazon";
            specialArgs = { inherit hostnames; };
          };
-
+          "${name}-iso" = lib.generateImage {
-      # For quickly applying local settings with:
+            inherit system module;
-      # home-manager switch --flake .#tempest
+            format = "iso";
-      homeConfigurations = {
+            specialArgs = { inherit hostnames; };
        tempest =
          nixosConfigurations.tempest.config.home-manager.users.${globals.user}.home;
        lookingglass =
          darwinConfigurations.lookingglass.config.home-manager.users."Noah.Masur".home;
          };
-
+          "${name}-qcow" = lib.generateImage {
-      # Package servers into images with a generator
+            inherit system module;
-      packages = forAllSystems (system: {
+            format = "qcow-efi";
-
+            specialArgs = { inherit hostnames; };
-        aws = {
+            # extraModules = [ "${nixpkgs}/nixos/modules/virtualisation/oci-image.nix" ];
          "${system}" =
            import ./generators/aws { inherit inputs globals system overlays; };
          };
        }) hosts)
      ) lib.linuxHosts # x86_64-linux = { arrow = ...; swan = ...; }
      ;
-        staff = {
+      # packages =
-          "${system}" = import ./generators/staff {
+      #   lib.forSystems lib.linuxSystems (
-            inherit inputs globals system overlays;
+      #     system: generateImagesForHosts system // lib.pkgsBySystem.${system}.nmasur
-          };
+      #   )
-        };
+      #   // lib.forSystems lib.darwinSystems (system: lib.pkgsBySystem.${system}.nmasur);
-        neovim = let pkgs = import nixpkgs { inherit system overlays; };
+      packages = lib.forAllSystems (
-        in import ./modules/common/neovim/package {
+        system:
-          inherit pkgs;
+        # Share the custom packages that I have placed under the nmasur namespace
-          colors =
+        lib.pkgsBySystem.${system}.nmasur
-            import ./colorscheme/gruvbox/neovim-gruvbox.nix { inherit pkgs; };
+        //
-        };
+          # Share generated images for each relevant host
          (if (lib.hasInfix "linux" system) then generators.${system} else { })
        # //
        #   # Oracle
        #   {
        #     flame-oci = nixosConfigurations.flame.config.system.build.OCIImage;
        #   }
      );
      # Development environments
      devShells = lib.forAllSystems (system: {
        default = lib.pkgsBySystem.${system}.nmasur.dotfiles-devshell;
      });
-      apps = forAllSystems (system:
+      checks = lib.forAllSystems (
-        let pkgs = import nixpkgs { inherit system overlays; };
+        system:
-        in import ./apps { inherit pkgs; });
+        let
-
+          pkgs = import nixpkgs {
-      devShells = forAllSystems (system:
+            inherit system;
-        let pkgs = import nixpkgs { inherit system overlays; };
+            overlays = lib.overlays;
        in {
          # Used to run commands and edit files in this repo
          default = pkgs.mkShell {
            buildInputs = with pkgs; [ git stylua nixfmt shfmt shellcheck ];
          };
        in
        {
          neovim =
            pkgs.runCommand "neovim-check-health" { buildInputs = [ inputs.self.packages.${system}.neovim ]; }
              ''
                mkdir -p $out
                export HOME=$TMPDIR
                nvim -c "checkhealth" -c "write $out/health.log" -c "quitall"
-          # Used for cloud and systems development and administration
+                # Check for errors inside the health log
-          devops = pkgs.mkShell {
+                if $(grep "ERROR" $out/health.log); then
-            buildInputs = with pkgs; [
+                  cat $out/health.log
-              git
+                  exit 1
-              terraform
+                fi
-              consul
+              '';
-              vault
+        }
-              awscli2
+      );
-              google-cloud-sdk
+
-              ansible
+      formatter = lib.forAllSystems (
-              kubectl
+        system:
-              kubernetes-helm
+        let
-              kustomize
+          pkgs = import nixpkgs {
-              fluxcd
+            inherit system;
-            ];
+            inherit (lib) overlays;
          };
-
+        in
-        });
+        pkgs.nixfmt-rfc-style
      );
      # Templates for starting other projects quickly
-      templates = rec {
+      templates = (import ./templates { inherit lib; });
        default = basic;
        basic = {
          path = ./templates/basic;
          description = "Basic program template";
        };
        poetry = {
          path = ./templates/poetry;
          description = "Poetry template";
        };
        python = {
          path = ./templates/python;
          description = "Legacy Python template";
        };
        haskell = {
          path = ./templates/haskell;
          description = "Haskell template";
        };
      };
    };
 }
--- a/generators/aws/default.nix
+++ b/generators/aws/default.nix
@ -1,32 +0,0 @@
 { inputs, globals, ... }:
 with inputs;
 nixos-generators.nixosGenerate {
  inherit system;
  format = "amazon";
  modules = [
    home-manager.nixosModules.home-manager
    {
      user = globals.user;
      fullName = globals.fullName;
      dotfilesRepo = globals.dotfilesRepo;
      gitName = globals.gitName;
      gitEmail = globals.gitEmail;
      networking.hostName = "sheep";
      gui.enable = false;
      colorscheme = (import ../colorscheme/gruvbox);
      passwordHash = null;
      publicKey =
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
      # AWS settings require this
      permitRootLogin = "prohibit-password";
    }
    ../../modules/common
    ../../modules/nixos
    ../../modules/common/services/sshd.nix
  ] ++ [
    # Required to fix diskSize errors during build
    ({ ... }: { amazonImage.sizeMB = 16 * 1024; })
  ];
 }
--- a/generators/aws/workflow.yml
+++ b/generators/aws/workflow.yml
@ -1,260 +0,0 @@
 name: 'Terraform'
 env:
  AWS_ACCOUNT_NUMBER: ''
  AWS_PLAN_ROLE_NAME: github_actions_plan
  AWS_APPLY_ROLE_NAME: github_actions_admin
  # Always required. Used for authenticating to AWS, but can also act as your
  # default region if you don't want to specify in the provider configuration.
  AWS_REGION: us-east-1
  # You must change these to fit your project.
  TF_VAR_project: change-me
  TF_VAR_label: change-me
  TF_VAR_owner: Your Name Here
  # If storing Terraform in a subdirectory, specify it here.
  TERRAFORM_DIRECTORY: .
  # Pinned versions of tools to use.
  # Check for new releases:
  # - https://github.com/hashicorp/terraform/releases
  # - https://github.com/fugue/regula/releases
  # - https://github.com/terraform-linters/tflint/releases
  TERRAFORM_VERSION: 1.2.6
  REGULA_VERSION: 2.9.0
  TFLINT_VERSION: 0.39.1
  # Terraform configuration options
  TERRAFORM_PARALLELISM: 10
  # These variables are passed to Terraform based on GitHub information.
  TF_VAR_repo: ${{ github.repository }}
 # This workflow is triggered in the following ways.
 on:
  # Any push or merge to these branches.
  push:
    branches:
      - dev
      - prod
  # Any pull request targeting these branches (plan only).
  pull_request:
    branches:
      - dev
      - prod
  # Any manual trigger on these branches.
  workflow_dispatch:
    branches:
      - dev
      - prod
 # -------------------------------------------------------------------
 # The rest of this workflow can operate without adjustments. Edit the
 # below content at your own risk!
 # -------------------------------------------------------------------
 # Used to connect to AWS IAM
 permissions:
  id-token: write
  contents: read
  pull-requests: write
 # Only run one workflow at a time for each Terraform state. This prevents
 # lockfile conflicts, especially during PR vs push.
 concurrency: terraform-${{ github.base_ref || github.ref }}
 jobs:
  terraform:
    name: 'Terraform'
    # Change this if you need to run your deployment on-prem.
    runs-on: ubuntu-latest
    steps:
      # Downloads the current repo code to the runner.
      - name: Checkout Repo Code
        uses: actions/checkout@v2
      # Install Nix
      - name: Install Nix
        uses: cachix/install-nix-action@v17
      # Build the image
      - name: Build Image
        run: nix build .#aws
      # Login to AWS
      - name: AWS Assume Role
        uses: aws-actions/configure-aws-credentials@v1.6.1
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}
      # Exports all GitHub Secrets as environment variables prefixed by
      # "TF_VAR_", which exposes them to Terraform. The name of each GitHub
      # Secret must match its Terraform variable name exactly.
      - name: Export Secrets to Terraform Variables
        env:
          ALL_SECRETS: ${{ toJson(secrets) }}
        run: |
          echo "$ALL_SECRETS" \
            | jq "to_entries | .[] | \"TF_VAR_\" + ( .key | ascii_downcase ) + \"=\" + .value" \
            | tr -d \" >> $GITHUB_ENV
      # Installs the Terraform binary and some other accessory functions.
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
      # Checks whether Terraform is formatted properly. If this fails, you
      # should install the pre-commit hook.
      - name: Check Formatting
        run: |
          terraform fmt -no-color -check -diff -recursive
      # Downloads a Terraform code lint test.
      - uses: terraform-linters/setup-tflint@v1
        name: Setup TFLint
        with:
          tflint_version: v${{ env.TFLINT_VERSION }}
      # Sets up linting with this codebase.
      - name: Init TFLint
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: tflint --init
      # Lints the current code.
      - name: Run TFLint
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          tflint -f compact
          find ./modules/* -type d -maxdepth 0 | xargs -I __ tflint -f compact --disable-rule=terraform_required_providers --disable-rule=terraform_required_version __
      # Connects to remote state backend and download providers.
      - name: Terraform Init
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform init \
            -backend-config="role_arn=${{ env.AWS_STATE_ROLE_ARN }}" \
            -backend-config="region=us-east-1" \
            -backend-config="workspace_key_prefix=accounts/${{ env.AWS_ACCOUNT_NUMBER }}/${{ github.repository }}" \
            -backend-config="key=state.tfstate" \
            -backend-config="dynamodb_table=global-tf-state-lock"
      # Set the Terraform Workspace to the current branch name.
      - name: Set Terraform Workspace
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        shell: bash
        run: |
          export WORKSPACE=${{ github.base_ref || github.ref_name }}
          terraform workspace select ${WORKSPACE} || terraform workspace new $WORKSPACE
          echo "TF_WORKSPACE=$(echo ${WORKSPACE} | sed 's/\//_/g')" >> $GITHUB_ENV
      # Checks differences between current code and infrastructure state.
      - name: Terraform Plan
        id: plan
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform plan \
            -input=false \
            -no-color \
            -out=tfplan \
            -parallelism=${TERRAFORM_PARALLELISM} \
            -var-file=variables-${TF_WORKSPACE}.tfvars
      # Gets the results of the plan for pull requests.
      - name: Terraform Show Plan
        id: show
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: terraform show -no-color tfplan
      # Adds the results of the plan to the pull request.
      - name: Comment Plan
        uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        env:
          STDOUT: "```terraform\n${{ steps.show.outputs.stdout }}```"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // 1. Retrieve existing bot comments for the PR
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            })
            const botComment = comments.find(comment => {
              return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
            })
            // 2. Prepare format of the comment
            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
            <details><summary>Validation Output</summary>
            \`\`\`\n
            ${{ steps.validate.outputs.stdout }}
            \`\`\`
            </details>
            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
            <details><summary>Show Plan</summary>
            \`\`\`\n
            ${process.env.PLAN}
            \`\`\`
            </details>
            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;
            // 3. If we have a comment, update it, otherwise create a new one
            if (botComment) {
              github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: output
              })
            } else {
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: output
              })
            }
      # Downloads Regula and checks whether the plan meets compliance requirements.
      - name: Regula Compliance Check
        shell: bash
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          REGULA_URL="https://github.com/fugue/regula/releases/download/v${REGULA_VERSION}/regula_${REGULA_VERSION}_Linux_x86_64.tar.gz"
          curl -sL "$REGULA_URL" -o regula.tar.gz
          tar xzf regula.tar.gz
          terraform show -json tfplan | ./regula run
      # Deploys infrastructure or changes to infrastructure.
      - name: Terraform Apply
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
        run: |
          terraform apply \
            -auto-approve \
            -input=false \
            -parallelism=${TERRAFORM_PARALLELISM} \
            tfplan
--- a/generators/staff/default.nix
+++ b/generators/staff/default.nix
@ -1,17 +0,0 @@
 # The Staff
 # ISO configuration for my USB drive
 { inputs, system, ... }:
 with inputs;
 nixos-generators.nixosGenerate {
  inherit system;
  format = "install-iso";
  modules = [{
    networking.hostName = "staff";
    users.extraUsers.root.openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"
    ];
  }];
 }
--- a/hosts/aarch64-darwin/lookingglass/default.nix
+++ b/hosts/aarch64-darwin/lookingglass/default.nix
@ -0,0 +1,41 @@
 # The Looking Glass
 # System configuration for my work Macbook
 rec {
  networking.hostName = "NYCM-NMASUR2";
  networking.computerName = "NYCM-NMASUR2";
  nmasur.settings = {
    username = "Noah.Masur";
    fullName = "Noah Masur";
  };
  nmasur.profiles = {
    base.enable = true;
    work.enable = true;
    extra.enable = true;
    gaming.enable = true;
  };
  home-manager.users."Noah.Masur" = {
    nmasur.settings = {
      username = nmasur.settings.username;
      fullName = nmasur.settings.fullName;
      host = "lookingglass";
    };
    nmasur.profiles = {
      common.enable = true;
      darwin-base.enable = true;
      power-user.enable = true;
      work.enable = true;
      experimental.enable = true;
    };
    nmasur.presets.programs.git-work.work = {
      name = "Noah-Masur_1701";
      email = "${nmasur.settings.username}@take2games.com";
    };
    home.stateVersion = "23.05";
  };
  system.stateVersion = 5;
 }
--- a/hosts/aarch64-linux/flame/cloudflared-flame.age
+++ b/hosts/aarch64-linux/flame/cloudflared-flame.age
@ -0,0 +1,19 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBYY0c1
 bldPMVdwRGhia0xzNm1mSGQ0eVVZZzFLMWVUdFhYVW1KY3QwTERJCm1UUDBqN1Jr
 VjRlSjROTFZEQ3UrME81Y2FyRkxjZHFvUFN1eEZNa2cwWkUKLT4gc3NoLWVkMjU1
 MTkgWXlTVU1RIFM4ZURETk0yQ1NKN3owaDB5S3djeThtWkphS0xUaVd2MnBlS244
 d0V5bUUKKzE5UzZYUlpwTy9ydFQ3L2NmWFZBMEZCWWppYlFZQzhTVFhUc3BBRlpR
 dwotPiBzc2gtZWQyNTUxOSBuanZYNUEgbS9HaVFFRjU4VzMvSVZ1SlExZ1BBNWxK
 RVRESEVmeWxyMW5Pclk5UU4xOApaZ0hHMnlsb1BuMThsTG82d1k1Rm94VEFMcTBH
 TFoxRWpRSXJWQUJVWGN3Ci0+IHNzaC1lZDI1NTE5IENxSU9VQSBOK1AvRW5nNUlK
 NnB1UDhKdmFibTEwV2JhOGxKRGg1SnlMdytXaVQ1eW1NCnVIcjNnclVMSEJ3eDVk
 eExnY1EvbWg1OW4xR3FydDlzeUdLQW11UGRmclkKLT4gc3NoLWVkMjU1MTkgejFP
 Y1p3IHNxbDlpSkpPdEZVRGhwV3NKdTNJV0NTeUZoVVg3b0ZlRWdqelNaTDRWamMK
 N1czMXlEcWZzQ1g0dkxBTnNUQjdTdnZMUE9VRGphTjB4SjJyemJiU2w5NAotLS0g
 VlgyN24vMGl3a2N6ZGs1SjhOZmttWEl3WEFOK29EOUlkZ0N3blBBcHZQOArP/uJx
 SBFvBV0rLzRbo/8nhhizuT2TtKsJSJDIsFJxAOtF8ZwIbYwauBt1tJudtJaXgbv5
 JIk53sS3lelOwH11yx0aGcBNCR2UwpuYn1IwoW0qrt3ugi8rmQPRG8c8gSyNn2u7
 PnAj/NdAjieLGGLltwdq2wJhkbv800WmKx5sGgPNT1AdBS1b84h5ipQFnFf3Fi0N
 FJa9/j5qc7JtWEy4ecU6D03zcZD+CTCoN8SIW4+fldos1u7N2v2X5/YUw7T6jQ==
 -----END AGE ENCRYPTED FILE-----
--- a/hosts/aarch64-linux/flame/default.nix
+++ b/hosts/aarch64-linux/flame/default.nix
@ -0,0 +1,168 @@
 # The Flame
 # System configuration for an Oracle free server
 # How to install:
 # https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
 # These days, probably use nixos-anywhere instead.
 rec {
  networking.hostName = "flame";
  nmasur.settings = {
    username = "noah";
    fullName = "Noah Masur";
  };
  nmasur.profiles = {
    base.enable = true;
    server.enable = true;
    communications.enable = true;
  };
  home-manager.users."noah" = {
    nmasur.settings = {
      username = nmasur.settings.username;
      fullName = nmasur.settings.fullName;
      host = networking.hostName;
    };
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
      power-user.enable = true;
    };
    nmasur.presets.programs.helix.enable = true;
    home.stateVersion = "23.05";
  };
  system.stateVersion = "23.05";
  # File systems must be declared in order to boot
  # # This is the root filesystem containing NixOS
  # # I forgot to set a clean label for it
  # fileSystems."/" = {
  #   device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
  #   fsType = "ext4";
  # };
  # # This is the boot filesystem for systemd-boot
  # fileSystems."/boot" = {
  #   device = "/dev/disk/by-uuid/D5CA-237A";
  #   fsType = "vfat";
  # };
  # Allows private remote access over the internet
  nmasur.presets.services.cloudflared = {
    tunnel = {
      id = "bd250ee1-ed2e-42d2-b627-039f1eb5a4d2";
      credentialsFile = ./cloudflared-flame.age;
      ca = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK/6oyVqjFGX3Uvrc3VS8J9sphxzAnRzKC85xgkHfYgR3TK6qBGXzHrknEj21xeZrr3G2y1UsGzphWJd9ZfIcdA= open-ssh-ca@cloudflareaccess.org";
    };
  };
  # Taken from https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/oci-common.nix
  # fileSystems."/" = {
  #   device = "/dev/disk/by-label/nixos";
  #   fsType = "ext4";
  #   autoResize = true;
  # };
  # fileSystems."/boot" = {
  #   device = "/dev/disk/by-label/ESP";
  #   fsType = "vfat";
  # };
  boot.loader.efi.canTouchEfiVariables = false;
  boot.loader.grub = {
    device = "nodev";
    splashImage = null;
    extraConfig = ''
      serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
      terminal_input --append serial
      terminal_output --append serial
    '';
    efiInstallAsRemovable = true;
    efiSupport = true;
  };
  boot.loader.systemd-boot.enable = false;
  # https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/configuringntpservice.htm#Configuring_the_Oracle_Cloud_Infrastructure_NTP_Service_for_an_Instance
  networking.timeServers = [ "169.254.169.254" ];
  boot.growPartition = true;
  boot.kernelParams = [
    "net.ifnames=0"
    "nvme.shutdown_timeout=10"
    "nvme_core.shutdown_timeout=10"
    "libiscsi.debug_libiscsi_eh=1"
    "crash_kexec_post_notifiers"
    # aarch64-linux
    "console=ttyAMA0,115200n8"
    # VNC console
    "console=tty1"
  ];
  boot.initrd.availableKernelModules = [
    "virtio_net"
    "virtio_pci"
    "virtio_mmio"
    "virtio_blk"
    "virtio_scsi"
    "9p"
    "9pnet_virtio"
  ];
  boot.initrd.kernelModules = [
    "virtio_balloon"
    "virtio_console"
    "virtio_rng"
    "virtio_gpu"
  ];
  networking.useDHCP = true;
  # networking = {
  #   defaultGateway = "10.0.0.1";
  #   interfaces.eth0 = {
  #     ipAddress = throw "set your own";
  #     prefixLength = 24;
  #   };
  # };
  disko.devices = {
    disk = {
      main = {
        type = "disk";
        # device = "/dev/oracleoci/oraclevda"; # Consistent volume naming
        device = "/dev/sda"; # Consistent volume naming
        content = {
          type = "gpt";
          partitions = {
            boot = {
              size = "512M";
              type = "EF00";
              content = {
                type = "filesystem";
                format = "vfat";
                mountpoint = "/boot";
              };
            };
            root = {
              size = "100%";
              content = {
                type = "filesystem";
                format = "ext4";
                mountpoint = "/";
              };
            };
          };
        };
      };
    };
  };
  # # Otherwise the instance may not have a working network-online.target,
  # # making the fetch-ssh-keys.service fail
  # networking.useNetworkd = true;
 }
--- a/hosts/default.nix
+++ b/hosts/default.nix
@ -0,0 +1,47 @@
 # Return a list of all hosts
 nixpkgs:
 let
  inherit (nixpkgs) lib;
 in
 {
  # darwin-hosts = import ./darwin;
  aarch64-darwin-hosts = lib.pipe (lib.filesystem.listFilesRecursive ./aarch64-darwin) [
    # Get only files ending in default.nix
    (builtins.filter (name: lib.hasSuffix "default.nix" name))
    # Import each host function
    (map (file: {
      name = builtins.baseNameOf (builtins.dirOf file);
      value = import file;
    }))
    # Convert to an attrset of hostname -> host function
    (builtins.listToAttrs)
  ];
  aarch64-linux-hosts = lib.pipe (lib.filesystem.listFilesRecursive ./aarch64-linux) [
    # Get only files ending in default.nix
    (builtins.filter (name: lib.hasSuffix "default.nix" name))
    # Remove the first file
    (builtins.filter (name: name != ./aarch64-linux/default.nix))
    # Import each host function
    (map (file: {
      name = builtins.baseNameOf (builtins.dirOf file);
      value = import file;
    }))
    # Convert to an attrset of hostname -> host function
    (builtins.listToAttrs)
  ];
  x86_64-linux-hosts = lib.pipe (lib.filesystem.listFilesRecursive ./x86_64-linux) [
    # Get only files ending in default.nix
    (builtins.filter (name: lib.hasSuffix "default.nix" name))
    # Import each host function
    (map (file: {
      # name = lib.removeSuffix ".nix" (builtins.baseNameOf file);
      name = builtins.baseNameOf (builtins.dirOf file);
      value = import file;
    }))
    # Convert to an attrset of hostname -> host function
    (builtins.listToAttrs)
  ];
 }
--- a/hosts/flame/default.nix
+++ b/hosts/flame/default.nix
@ -1,98 +0,0 @@
 # The Flame
 # System configuration for an Oracle free server
 # How to install:
 # https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
 { inputs, globals, overlays, ... }:
 with inputs;
 nixpkgs.lib.nixosSystem {
  system = "aarch64-linux";
  specialArgs = { };
  modules = [
    ./hardware-configuration.nix
    ../../modules/common
    ../../modules/nixos
    (removeAttrs globals [ "mail.server" ])
    wsl.nixosModules.wsl
    home-manager.nixosModules.home-manager
    {
      server = true;
      gui.enable = false;
      theme = { colors = (import ../../colorscheme/gruvbox).dark; };
      nixpkgs.overlays = overlays;
      wsl.enable = false;
      caddy.enable = true;
      # FQDNs for various services
      networking.hostName = "flame";
      bookServer = "books.masu.rs";
      streamServer = "stream.masu.rs";
      nextcloudServer = "cloud.masu.rs";
      transmissionServer = "download.masu.rs";
      metricsServer = "metrics.masu.rs";
      vaultwardenServer = "vault.masu.rs";
      giteaServer = "git.masu.rs";
      # Disable passwords, only use SSH key
      publicKey =
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
      # Nextcloud backup config
      backup.s3 = {
        endpoint = "s3.us-west-002.backblazeb2.com";
        bucket = "noahmasur-backup";
        accessKeyId = "0026b0e73b2e2c80000000005";
      };
      # Grant access to Jellyfin directories from Nextcloud
      users.users.nextcloud.extraGroups = [ "jellyfin" ];
      # Wireguard config for Transmission
      wireguard.enable = true;
      networking.wireguard.interfaces.wg0 = {
        # The local IPs for this machine within the Wireguard network
        # Any inbound traffic bound for these IPs should be kept on localhost
        ips = [ "10.66.13.200/32" "fc00:bbbb:bbbb:bb01::3:dc7/128" ];
        peers = [{
          # Identity of Wireguard target peer (VPN)
          publicKey = "bOOP5lIjqCdDx5t+mP/kEcSbHS4cZqE0rMlBI178lyY=";
          # The public internet address of the target peer
          endpoint = "86.106.143.132:51820";
          # Which outgoing IP ranges should be sent through Wireguard
          allowedIPs = [ "0.0.0.0/0" "::0/0" ];
          # Send heartbeat signal within the network
          persistentKeepalive = 25;
        }];
      };
      # VPN port forwarding
      services.transmission.settings.peer-port = 57599;
      # Grant access to Transmission directories from Jellyfin
      users.users.jellyfin.extraGroups = [ "transmission" ];
      # Proxy traffic with Cloudflare
      cloudflare.enable = true;
      # Setup Minecraft server
      gaming.minecraft-server.enable = true;
      # Clone dotfiles
      dotfiles.enable = true;
      neovim.enable = true;
    }
  ];
 }
--- a/hosts/flame/hardware-configuration.nix
+++ b/hosts/flame/hardware-configuration.nix
@ -1,34 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { lib, modulesPath, ... }:
 {
  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
  boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];
  fileSystems."/" = {
    device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
    fsType = "ext4";
  };
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/D5CA-237A";
    fsType = "vfat";
  };
  swapDevices = [ ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
 }
--- a/hosts/hydra/default.nix
+++ b/hosts/hydra/default.nix
@ -1,49 +0,0 @@
 # The Hydra
 # System configuration for WSL
 { inputs, globals, overlays, ... }:
 with inputs;
 nixpkgs.lib.nixosSystem {
  system = "x86_64-linux";
  specialArgs = { };
  modules = [
    ../../modules/common
    ../../modules/nixos
    globals
    wsl.nixosModules.wsl
    home-manager.nixosModules.home-manager
    {
      networking.hostName = "hydra";
      nixpkgs.overlays = overlays;
      # Set registry to flake packages, used for nix X commands
      nix.registry.nixpkgs.flake = nixpkgs;
      identityFile = "/home/${globals.user}/.ssh/id_ed25519";
      gui.enable = false;
      theme = {
        colors = (import ../../colorscheme/gruvbox).dark;
        dark = true;
      };
      passwordHash = nixpkgs.lib.fileContents ../../private/password.sha512;
      wsl = {
        enable = true;
        wslConf.automount.root = "/mnt";
        defaultUser = globals.user;
        startMenuLaunchers = true;
        nativeSystemd = true;
        wslConf.network.generateResolvConf = true; # Turn off if it breaks VPN
        interop.includePath =
          false; # Including Windows PATH will slow down Neovim command mode
      };
      neovim.enable = true;
      mail.enable = true;
      mail.aerc.enable = true;
      mail.himalaya.enable = true;
      dotfiles.enable = true;
      nixlang.enable = true;
      lua.enable = true;
    }
  ];
 }
--- a/hosts/lookingglass/default.nix
+++ b/hosts/lookingglass/default.nix
@ -1,49 +0,0 @@
 # The Looking Glass
 # System configuration for my work Macbook
 { inputs, globals, overlays, ... }:
 with inputs;
 darwin.lib.darwinSystem {
  system = "x86_64-darwin";
  specialArgs = { };
  modules = [
    ../../modules/common
    ../../modules/darwin
    (globals // {
      user = "Noah.Masur";
      gitName = "Noah-Masur_1701";
      gitEmail = "Noah.Masur@take2games.com";
    })
    home-manager.darwinModules.home-manager
    {
      networking.hostName = "noah-masur-mac";
      identityFile = "/Users/Noah.Masur/.ssh/id_ed25519";
      gui.enable = true;
      theme = {
        colors = (import ../../colorscheme/gruvbox).dark;
        dark = true;
      };
      mail.user = globals.user;
      nixpkgs.overlays = [ firefox-darwin.overlay ] ++ overlays;
      # Set registry to flake packages, used for nix X commands
      nix.registry.nixpkgs.flake = nixpkgs;
      charm.enable = true;
      neovim.enable = true;
      mail.enable = true;
      mail.aerc.enable = true;
      mail.himalaya.enable = true;
      kitty.enable = true;
      discord.enable = true;
      firefox.enable = true;
      dotfiles.enable = true;
      nixlang.enable = true;
      terraform.enable = true;
      python.enable = true;
      lua.enable = true;
      kubernetes.enable = true;
      _1password.enable = true;
    }
  ];
 }
--- a/hosts/swan/default.nix
+++ b/hosts/swan/default.nix
@ -1,48 +0,0 @@
 # The Swan
 # System configuration for my home NAS server
 { inputs, globals, overlays, ... }:
 with inputs;
 nixpkgs.lib.nixosSystem {
  system = "x86_64-linux";
  specialArgs = { };
  modules = [
    ./hardware-configuration.nix
    ../../modules/common
    ../../modules/nixos
    (removeAttrs globals [ "mail.server" ])
    wsl.nixosModules.wsl
    home-manager.nixosModules.home-manager
    {
      server = true;
      gui.enable = false;
      theme = { colors = (import ../../colorscheme/gruvbox).dark; };
      nixpkgs.overlays = overlays;
      wsl.enable = false;
      caddy.enable = true;
      networking.hostName = "swan";
      # Disable passwords, only use SSH key
      publicKey =
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
      # Clone dotfiles
      dotfiles.enable = true;
      neovim.enable = true;
      boot.zfs.enabled = true;
      boot.kernelPackages =
        config.boot.zfs.package.latestCompatibleLinuxPackages;
      boot.zfs.extraPools = [ "mypool" ];
      services.zfs.autoScrub.enable = true;
      services.zfs.autoScrub.interval = "daily";
      services.nfs.server.enable = true;
    }
  ];
 }
--- a/hosts/tempest/default.nix
+++ b/hosts/tempest/default.nix
@ -1,63 +0,0 @@
 # The Tempest
 # System configuration for my desktop
 { inputs, globals, overlays, ... }:
 with inputs;
 nixpkgs.lib.nixosSystem {
  system = "x86_64-linux";
  specialArgs = { };
  modules = [
    ./hardware-configuration.nix
    ../../modules/common
    ../../modules/nixos
    globals
    wsl.nixosModules.wsl
    home-manager.nixosModules.home-manager
    {
      physical = true;
      networking.hostName = "tempest";
      nixpkgs.overlays = [ nur.overlay ] ++ overlays;
      # Set registry to flake packages, used for nix X commands
      nix.registry.nixpkgs.flake = nixpkgs;
      identityFile = "/home/${globals.user}/.ssh/id_ed25519";
      gui.enable = true;
      theme = {
        colors = (import ../../colorscheme/gruvbox).dark;
        dark = true;
      };
      wallpaper = "${wallpapers}/gruvbox/road.jpg";
      gtk.theme.name = nixpkgs.lib.mkDefault "Adwaita-dark";
      passwordHash = nixpkgs.lib.fileContents ../../private/password.sha512;
      wsl.enable = false;
      publicKey = null;
      charm.enable = true;
      neovim.enable = true;
      media.enable = true;
      firefox.enable = true;
      kitty.enable = true;
      _1password.enable = true;
      discord.enable = true;
      nautilus.enable = true;
      obsidian.enable = true;
      mail.enable = true;
      mail.aerc.enable = true;
      mail.himalaya.enable = true;
      keybase.enable = true;
      # mullvad.enable = true;
      nixlang.enable = true;
      dotfiles.enable = true;
      gaming = {
        enable = true;
        steam.enable = true;
        legendary.enable = true;
        lutris.enable = true;
        leagueoflegends.enable = true;
      };
    }
  ];
 }
--- a/hosts/tempest/hardware-configuration.nix
+++ b/hosts/tempest/hardware-configuration.nix
@ -1,40 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, modulesPath, ... }:
 {
  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
  boot.initrd.availableKernelModules =
    [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ "amdgpu" ];
  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];
  services.xserver.videoDrivers = [ "amdgpu" ];
  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
    fsType = "ext4";
  };
  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
    fsType = "vfat";
  };
  swapDevices = [ ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
  # networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true;
  powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
  hardware.cpu.amd.updateMicrocode =
    lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/x86_64-darwin/readme.md
+++ b/hosts/x86_64-darwin/readme.md
@ -0,0 +1 @@
 # No x86 Darwin Hosts Currently
--- a/hosts/x86_64-linux/arrow/default.nix
+++ b/hosts/x86_64-linux/arrow/default.nix
@ -0,0 +1,47 @@
 # The Arrow
 # System configuration for temporary VM
 rec {
  # Hardware
  networking.hostName = "arrow";
  nmasur.settings = {
    username = "noah";
    fullName = "Noah Masur";
  };
  nmasur.profiles = {
    base.enable = true;
    server.enable = true;
  };
  home-manager.users."noah" = {
    nmasur.settings = {
      username = nmasur.settings.username;
      fullName = nmasur.settings.fullName;
      host = networking.hostName;
    };
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
    };
    home.stateVersion = "23.05";
  };
  system.stateVersion = "23.05";
  # These filesystems are ignored by nixos-generators
  # This is the root filesystem containing NixOS
  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
    fsType = "ext4";
  };
  # This is the boot filesystem for Grub
  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
    fsType = "vfat";
  };
 }
--- a/hosts/x86_64-linux/hydra/default.nix
+++ b/hosts/x86_64-linux/hydra/default.nix
@ -0,0 +1,54 @@
 # The Hydra
 # System configuration for WSL
 rec {
  # Hardware
  networking.hostName = "hydra";
  nmasur.settings = {
    username = "noah";
    fullName = "Noah Masur";
  };
  nmasur.profiles = {
    base.enable = true;
    wsl.enable = true;
  };
  home-manager.users."noah" = {
    nmasur.settings = {
      username = nmasur.settings.username;
      fullName = nmasur.settings.fullName;
      host = networking.hostName;
    };
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
      power-user.enable = true;
    };
    home.stateVersion = "23.05";
  };
  system.stateVersion = "23.05";
  # This is the root filesystem containing NixOS
  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
    fsType = "ext4";
  };
  # This is the boot filesystem for Grub
  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
    fsType = "vfat";
  };
  # Not sure what's necessary but too afraid to remove anything
  boot.initrd.availableKernelModules = [
    "xhci_pci"
    "ahci"
    "nvme"
    "usb_storage"
    "sd_mod"
  ];
 }
--- a/hosts/x86_64-linux/staff/default.nix
+++ b/hosts/x86_64-linux/staff/default.nix
@ -0,0 +1,68 @@
 # The Staff
 # System configuration test
 rec {
  # Hardware
  networking.hostName = "staff";
  nmasur.settings = {
    username = "noah";
    fullName = "Noah Masur";
  };
  nmasur.profiles = {
    base.enable = true;
    home.enable = true;
    gui.enable = true;
  };
  nmasur.presets.services.cloudflared.enable = false;
  nmasur.presets.services.kanata.enable = false;
  nmasur.presets.services.openssh.enable = true;
  home-manager.users."noah" = {
    nmasur.settings = {
      username = nmasur.settings.username;
      fullName = nmasur.settings.fullName;
      host = networking.hostName;
    };
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
      linux-gui.enable = true;
      power-user.enable = true;
    };
    nmasur.presets.services.mbsync = {
      user = nmasur.settings.username;
      server = "noahmasur.com";
    };
    home.stateVersion = "23.05";
  };
  system.stateVersion = "23.05";
  # Not sure what's necessary but too afraid to remove anything
  # File systems must be declared in order to boot
  # Required to have a boot loader to work
  boot.loader.systemd-boot.enable = true;
  # This is the root filesystem containing NixOS
  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
    fsType = "ext4";
  };
  # This is the boot filesystem for Grub
  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
    fsType = "vfat";
  };
  # Allows private remote access over the internet
  # nmasur.presets.services.cloudflared = {
  #   tunnel = {
  #     id = "ac133a82-31fb-480c-942a-cdbcd4c58173";
  #     credentialsFile = ../../private/cloudflared-tempest.age;
  #     ca = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPY6C0HmdFCaxYtJxFr3qV4/1X4Q8KrYQ1hlme3u1hJXK+xW+lc9Y9glWHrhiTKilB7carYTB80US0O47gI5yU4= open-ssh-ca@cloudflareaccess.org";
  #   };
  # };
 }
--- a/hosts/x86_64-linux/swan/cloudflared-swan.age
+++ b/hosts/x86_64-linux/swan/cloudflared-swan.age
@ -0,0 +1,19 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBuU1BO
 ZGdOVFRTekN3SFRhQWYwcWt6OHpLZXM0aENsQ3d1VWpxYUhXN3k4CnNwNWpQcU90
 elR0eWVyMWFUUkhORFRQeVdsdTErWUgzNW9mN1BWS2szbUUKLT4gc3NoLWVkMjU1
 MTkgWXlTVU1RIDRRS0VESG5NNWpxbm1DTjBkY2ExR3I3aE1PUTNVTXBFZ2wwVC9j
 WDIrMTgKaXkwWk1xRWp6Z3c3NFZZS0cybHFqcUVRczNMZ05tSmxPNjBlVmRHK2h3
 SQotPiBzc2gtZWQyNTUxOSBuanZYNUEgYWI1SkhBZ0Jrb3hzbDRwcnRMeHhGSlpB
 aWt5ZmRxaGhmbXFDQWdNamxRbwpXMWo0TjZhbHM3ejFYNVU5WlkxWTJSbVBPOEhr
 MUt3akxMU3QzN3Z4M0lFCi0+IHNzaC1lZDI1NTE5IENxSU9VQSA1dmdFRE1QSU55
 WUVuOU9OTHJjM0RxVWhmTlEvdk1mNU1iUEwyNlFqRFZvCldleVNGQ1RZdU1tU2J2
 dWxGZlVkaDBWNEZRUFNBcEIvTEdkODdDS25GdGsKLT4gc3NoLWVkMjU1MTkgejFP
 Y1p3IG5SbVpVZldPSkJXYm9BZ3B6OXZXMlB4T2Z5RHptR1pqbVRVUS9LVEZyUzgK
 ZlVTZWlUQ2VoWVNuOGE5Wk5vZGdVVldzbUZKRERyUFN0eVJ4TWpmL2gwcwotLS0g
 MlJmTlVkdHhHQ25JWm0xVmdjVDFYM1lHaE9WdnJSVkVMMnNwV0c4eXc0QQpYTchD
 DCiEm4rOav4/IwK26gSgi2B4qq4RETyAbF4oa87cvFM8zVXo7W8nF+eWzeWGNZrc
 yRFfOYf4gtlNCVLc+UAapvM1rKuw1IOQeJLAwGCHygXKWY7zSXdT2ERACXESvCCz
 b7W62NVx0Pc4mAAQB3QU995HFVFuHLa939PPPlkgxqepNWCKrmUFl/qjRpOoVrV6
 GwRgIo36PhcfZVCswyVXgcc4M3CCG5ZuWInuuljqTB70OzBVkKCaUeiRaRIZJg==
 -----END AGE ENCRYPTED FILE-----
--- a/hosts/x86_64-linux/swan/default.nix
+++ b/hosts/x86_64-linux/swan/default.nix
@ -0,0 +1,82 @@
 # The Swan
 # System configuration for my home NAS server
 rec {
  networking.hostName = "swan";
  nmasur.settings = {
    username = "noah";
    fullName = "Noah Masur";
  };
  nmasur.profiles = {
    base.enable = true;
    server.enable = true;
    home.enable = true;
    nas.enable = true;
    shared-media.enable = true;
  };
  home-manager.users."noah" = {
    nmasur.settings = {
      username = nmasur.settings.username;
      fullName = nmasur.settings.fullName;
      host = networking.hostName;
    };
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
      power-user.enable = true;
    };
    home.stateVersion = "23.05";
  };
  system.stateVersion = "23.05";
  # Not sure what's necessary but too afraid to remove anything
  boot.initrd.availableKernelModules = [
    "xhci_pci"
    "ahci"
    "nvme"
    "usb_storage"
    "sd_mod"
  ];
  # Required for transcoding
  boot.initrd.kernelModules = [ "amdgpu" ];
  boot.kernelParams = [
    "radeon.si_support=0"
    "amdgpu.si_support=1"
    "radeon.cik_support=0"
    "amdgpu.cik_support=1"
    "amdgpu.dc=1"
  ];
  # Required binary blobs to boot on this machine
  hardware.enableRedistributableFirmware = true;
  # Prioritize efficiency over performance
  powerManagement.cpuFreqGovernor = "powersave";
  # Allow firmware updates
  hardware.cpu.intel.updateMicrocode = true;
  # ZFS
  # Generated with: head -c 8 /etc/machine-id
  networking.hostId = "600279f4"; # Random ID required for ZFS
  # Sets root ext4 filesystem instead of declaring it manually
  disko = {
    enableConfig = true;
    devices = (import ./root.nix { disk = "/dev/nvme0n1"; });
  };
  # Allows private remote access over the internet
  nmasur.presets.services.cloudflared = {
    tunnel = {
      id = "646754ac-2149-4a58-b51a-e1d0a1f3ade2";
      credentialsFile = ./cloudflared-swan.age;
      ca = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org";
    };
  };
 }
--- a/hosts/x86_64-linux/swan/root.nix
+++ b/hosts/x86_64-linux/swan/root.nix
@ -0,0 +1,39 @@
 { disk, ... }:
 {
  disk = {
    boot = {
      type = "disk";
      device = disk;
      content = {
        type = "gpt";
        partitions = {
          # Boot partition
          ESP = rec {
            size = "512MiB";
            type = "EF00";
            label = "boot";
            device = "/dev/disk/by-label/${label}";
            content = {
              type = "filesystem";
              format = "vfat";
              mountpoint = "/boot";
              extraArgs = [ "-n ${label}" ];
            };
          };
          # Root partition ext4
          root = rec {
            size = "100%";
            label = "nixos";
            device = "/dev/disk/by-label/${label}";
            content = {
              type = "filesystem";
              format = "ext4";
              mountpoint = "/";
              extraArgs = [ "-L ${label}" ];
            };
          };
        };
      };
    };
  };
 }
--- a/hosts/x86_64-linux/tempest/cloudflared-tempest.age
+++ b/hosts/x86_64-linux/tempest/cloudflared-tempest.age
@ -0,0 +1,19 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBMMDZj
 dkdOSTc1bHgybjAwcUVHUXFhY0I0NE45K1B5SEh4NGN4T0tpREhjCnViQzVXTVk3
 dzB5ZEY5d1hvcHVDSXVubElOdEVQQ0Fja2dnL0ZnVG4wNEUKLT4gc3NoLWVkMjU1
 MTkgWXlTVU1RIHRiVkNzRCs4V3EvL2szNG8zSlRYSVloRlVsSTk3a0hnSFMyUzRN
 K0lyMzQKWDhIOTVzMGJkaGpVQmNtS0pPQnNTSjRmK1dYck1SUFd5VnVvYnJSWkhs
 YwotPiBzc2gtZWQyNTUxOSBuanZYNUEgUy9kWmxsc0p2L0pFWDlPMGlzeVBHNjJ2
 a05ycmZtbUJrOXRBVVgxVjVtZwo4RVM3Sms2M2krdjU0K1ZHREhhRkdMcENTbTJr
 UEh6cWcvOGNIRUNJZUFvCi0+IHNzaC1lZDI1NTE5IENxSU9VQSA5d0FwTWJzZEpJ
 UEJaZi91YXZOOFhGVlVVekEvSVRnK3Y2VFdhL216SVZrCkRURE9OYnIvSGVtMWNl
 MWFGSTEwUVBITTlnaWVXc1hpMFpqdFdMcFY2NHMKLT4gc3NoLWVkMjU1MTkgejFP
 Y1p3IDhkUk9KTE1UMysvajY3WEx5MFdLeEdlVnBmSUx6TTlnYWdqaWorYm0rRGMK
 SlhaRFNLaTZHVkpRR3U5eE5JOTBPWWM3OTFka1ZWSHJMaFFhZG1CSzNVTQotLS0g
 THNSTmNzK3JvbVN5S3RaVlQwdDRiOWFkVGZ3WUtyT2IyMWtPSVNtajF5YwoCUWHU
 KSe09W6BaVEW2x0ieBXN6KkL4FNPAP8zCom8fNVjyjAZpxd2t0kisJjJ45xg8eG4
 x9sj+hG9EsWIFvVpnF7LUIEXcRMjvRlNXED8HmYR0qzUhc89VQ9N4EoQPJYN1dME
 kxAzH8p5HBidxfJLpACaG5QHGb97chJXTDrT+ZKt+hPfZ16OhsKBj2s0gvHbcCQH
 sdqQT4+FlJshDiRiauTmqF/umnCnzl4+H4Xe8kLVrZxDOAv1iwuTX8zcaNOFNw==
 -----END AGE ENCRYPTED FILE-----
--- a/hosts/x86_64-linux/tempest/default.nix
+++ b/hosts/x86_64-linux/tempest/default.nix
@ -0,0 +1,110 @@
 # The Tempest
 # System configuration for my desktop
 rec {
  # Hardware
  networking.hostName = "tempest";
  nmasur.settings = {
    username = "noah";
    fullName = "Noah Masur";
  };
  nmasur.profiles = {
    base.enable = true;
    home.enable = true;
    gui.enable = true;
    gaming.enable = true;
  };
  nmasur.presets.services.grub.enable = true;
  home-manager.users."noah" = {
    nmasur.settings = {
      username = nmasur.settings.username;
      fullName = nmasur.settings.fullName;
      host = networking.hostName;
    };
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
      linux-gui.enable = true;
      linux-gaming.enable = true;
      power-user.enable = true;
      developer.enable = true;
      experimental.enable = true;
    };
    home.stateVersion = "23.05";
  };
  system.stateVersion = "23.05";
  # Not sure what's necessary but too afraid to remove anything
  boot.initrd.availableKernelModules = [
    "nvme"
    "xhci_pci"
    "ahci"
    "usb_storage"
    "usbhid"
    "sd_mod"
  ];
  # Graphics and VMs
  boot.initrd.kernelModules = [ "amdgpu" ];
  boot.kernelModules = [ "kvm-amd" ];
  services.xserver.videoDrivers = [ "amdgpu" ];
  # Required binary blobs to boot on this machine
  hardware.enableRedistributableFirmware = true;
  # Prioritize performance over efficiency
  powerManagement.cpuFreqGovernor = "performance";
  # Allow firmware updates
  hardware.cpu.amd.updateMicrocode = true;
  # Helps reduce GPU fan noise under idle loads
  hardware.fancontrol.enable = true;
  hardware.fancontrol.config = ''
    # Configuration file generated by pwmconfig, changes will be lost
    INTERVAL=10
    DEVPATH=hwmon0=devices/pci0000:00/0000:00:03.1/0000:06:00.0/0000:07:00.0/0000:08:00.0
    DEVNAME=hwmon0=amdgpu
    FCTEMPS=hwmon0/pwm1=hwmon0/temp1_input
    FCFANS= hwmon0/pwm1=hwmon0/fan1_input
    MINTEMP=hwmon0/pwm1=50
    MAXTEMP=hwmon0/pwm1=70
    MINSTART=hwmon0/pwm1=100
    MINSTOP=hwmon0/pwm1=10
    MINPWM=hwmon0/pwm1=10
    MAXPWM=hwmon0/pwm1=240
  '';
  # File systems must be declared in order to boot
  # This is the root filesystem containing NixOS
  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
    fsType = "ext4";
  };
  # This is the boot filesystem for Grub
  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
    fsType = "vfat";
  };
  # Allows private remote access over the internet
  nmasur.presets.services.cloudflared = {
    tunnel = {
      id = "ac133a82-31fb-480c-942a-cdbcd4c58173";
      credentialsFile = ./cloudflared-tempest.age;
      ca = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPY6C0HmdFCaxYtJxFr3qV4/1X4Q8KrYQ1hlme3u1hJXK+xW+lc9Y9glWHrhiTKilB7carYTB80US0O47gI5yU4= open-ssh-ca@cloudflareaccess.org";
    };
  };
  # Allows requests to force machine to wake up
  # This network interface might change, needs to be set specifically for each machine.
  # Or set usePredictableInterfaceNames = false
  networking.interfaces.enp5s0.wakeOnLan.enable = true;
 }
--- a/lib/default.nix
+++ b/lib/default.nix
@ -0,0 +1,234 @@
 inputs:
 let
  lib = inputs.nixpkgs.lib;
 in
 lib
 // rec {
  # Returns all files in a directory matching a suffix
  filesInDirectoryWithSuffix =
    directory: suffix:
    lib.pipe (lib.filesystem.listFilesRecursive directory) [
      # Get only files ending in .nix
      (builtins.filter (name: lib.hasSuffix suffix name))
    ];
  # Returns all files ending in .nix for a directory
  nixFiles = directory: filesInDirectoryWithSuffix directory ".nix";
  # Returns all files ending in default.nix for a directory
  defaultFiles = directory: filesInDirectoryWithSuffix directory "default.nix";
  # Imports all files in a directory and passes inputs
  importOverlays =
    directory:
    lib.pipe (nixFiles directory) [
      # Import each overlay file
      (map (file: (import file) inputs))
    ];
  # Import default files as attrset with keys provided by parent directory
  defaultFilesToAttrset =
    directory:
    lib.pipe (defaultFiles directory) [
      # Import each file
      (map (file: {
        name = builtins.baseNameOf (builtins.dirOf file);
        value = import file;
      }))
      # Convert to an attrset of parent dir name -> file
      (builtins.listToAttrs)
    ];
  # [ package1/package.nix package2/package.nix package2/hello.sh ]
  buildPkgsFromDirectoryAndPkgs =
    directory: pkgs:
    lib.pipe (filesInDirectoryWithSuffix directory "package.nix") [
      # Apply callPackage to create a derivation
      # Must use final.callPackage to avoid infinite recursion
      # [ package1.drv package2.drv ]
      (builtins.map (name: pkgs.callPackage name { }))
      # Convert the list to an attrset with keys from pname or name attr
      # { package1 = package1.drv, package2 = package2.drv }
      (builtins.listToAttrs (
        map (v: {
          name = v."pname" or v."name";
          value = v;
        })
      ))
    ];
  # Common overlays to always use
  overlays = [
    inputs.nur.overlays.default
    inputs.nix2vim.overlay
    inputs.zellij-switch.overlays.default
    inputs.helix.overlays.default
    inputs.yazi.overlays.default
  ] ++ (importOverlays ../overlays);
  # System types to support.
  supportedSystems = [
    "x86_64-linux"
    "x86_64-darwin"
    "aarch64-linux"
    "aarch64-darwin"
  ];
  # Split system types by operating system
  linuxSystems = builtins.filter (lib.hasSuffix "linux") supportedSystems;
  darwinSystems = builtins.filter (lib.hasSuffix "darwin") supportedSystems;
  # Helper function to generate an attrset '{ x86_64-linux = f "x86_64-linux"; ... }'.
  forSystems = systems: lib.genAttrs systems;
  forAllSystems = lib.genAttrs supportedSystems;
  # { x86_64-linux = { tempest = { settings = ...; }; }; };
  hosts = forAllSystems (system: defaultFilesToAttrset ../hosts/${system});
  linuxHosts = lib.filterAttrs (name: value: builtins.elem name linuxSystems) hosts;
  darwinHosts = lib.filterAttrs (name: value: builtins.elem name darwinSystems) hosts;
  # { system -> pkgs }
  pkgsBySystem = forAllSystems (
    system:
    import inputs.nixpkgs {
      inherit system overlays;
      config.permittedInsecurePackages = [ "litestream-0.3.13" ];
      config.allowUnfree = true;
    }
  );
  colorscheme = defaultFilesToAttrset ../colorscheme;
  homeModule = {
    home-manager = {
      # Include home-manager config in NixOS
      sharedModules = nixFiles ../platforms/home-manager;
      # Use the system-level nixpkgs instead of Home Manager's
      useGlobalPkgs = lib.mkDefault true;
      # Install packages to /etc/profiles instead of ~/.nix-profile, useful when
      # using multiple profiles for one user
      useUserPackages = lib.mkDefault true;
    };
  };
  buildHome =
    {
      system,
      module,
      specialArgs,
    }:
    inputs.home-manager.lib.homeManagerConfiguration {
      pkgs = pkgsBySystem.${system};
      modules = [
        { imports = (nixFiles ../platforms/home-manager); }
        module
      ];
      extraSpecialArgs = {
        inherit colorscheme;
      } // specialArgs;
    };
  buildNixos =
    {
      system,
      module,
      specialArgs,
    }:
    inputs.nixpkgs.lib.nixosSystem {
      inherit specialArgs;
      pkgs = pkgsBySystem.${system};
      modules = [
        inputs.home-manager.nixosModules.home-manager
        inputs.disko.nixosModules.disko
        inputs.wsl.nixosModules.wsl
        { imports = (nixFiles ../platforms/nixos); }
        module
        {
          home-manager = {
            extraSpecialArgs = {
              inherit colorscheme;
            } // specialArgs;
          } // homeModule.home-manager;
        }
      ];
    };
  buildDarwin =
    {
      system,
      module,
      specialArgs,
    }:
    inputs.darwin.lib.darwinSystem {
      inherit system specialArgs;
      modules = [
        inputs.home-manager.darwinModules.home-manager
        inputs.mac-app-util.darwinModules.default
        {
          imports = (nixFiles ../platforms/nix-darwin);
          nixpkgs.pkgs = pkgsBySystem.${system};
        }
        module
        {
          home-manager = {
            extraSpecialArgs = {
              inherit colorscheme;
            } // specialArgs;
          } // homeModule.home-manager;
        }
      ];
    };
  generatorOptions = {
    amazon = {
      aws.enable = true;
    };
    iso = {
      nmasur.profiles.wsl.enable = lib.mkForce false;
      boot.loader.grub.enable = lib.mkForce false;
    };
    qcow-efi = {
      nmasur.profiles.wsl.enable = lib.mkForce false;
      boot.loader.grub.enable = lib.mkForce false;
      fileSystems."/boot".device = lib.mkForce "/dev/disk/by-label/ESP";
    };
  };
  generateImage =
    {
      system,
      module,
      format,
      specialArgs,
    }:
    inputs.nixos-generators.nixosGenerate {
      inherit system format;
      pkgs = pkgsBySystem.${system};
      modules = [
        inputs.home-manager.nixosModules.home-manager
        inputs.disko.nixosModules.disko
        inputs.wsl.nixosModules.wsl
        {
          imports = (nixFiles ../platforms/nixos) ++ (nixFiles ../platforms/generators);
        }
        generatorOptions.${format}
        module
        {
          home-manager = {
            extraSpecialArgs = {
              inherit colorscheme;
            } // specialArgs;
          } // homeModule.home-manager;
        }
      ];
      specialArgs = {
      } // specialArgs;
    };
 }
--- a/misc/README.md
+++ b/misc/README.md
@ -0,0 +1,21 @@
 # Miscellaneous
 These files contain important data sourced by the configuration, or simply
 information to store for safekeeping later.
 ---
 Creating hashed password for [password.sha512](./password.sha512):
 ```
 mkpasswd -m sha-512
 ```
 ---
 Getting key for [public-keys](./public-keys):
 ```
 ssh-keyscan -t ed25519 <hostname>
 ```
--- a/misc/libratbag-profile
+++ b/misc/libratbag-profile
@ -0,0 +1,23 @@
 Profile 1: (active)
 Name: n/a
 Report Rate: 1000Hz
 Resolutions:
  0: 400dpi (active) (default)
  1: 800dpi
  2: 1600dpi
  3: 2400dpi
  4: 0dpi
 Button: 0 is mapped to 'button 1'
 Button: 1 is mapped to 'button 2'
 Button: 2 is mapped to 'button 3'
 Button: 3 is mapped to 'button 4'
 Button: 4 is mapped to 'button 5'
 Button: 5 is mapped to macro '↕F11'
 Button: 6 is mapped to macro '↕VOLUMEDOWN'
 Button: 7 is mapped to macro '↕VOLUMEUP'
 Button: 8 is mapped to 'unknown'
 Button: 9 is mapped to 'wheel-right'
 Button: 10 is mapped to 'wheel-left'
 LED: 0, depth: monochrome, mode: on, color: 000000
 LED: 1, depth: monochrome, mode: on, color: 000000
 LED: 2, depth: monochrome, mode: on, color: 000000
--- a/private/password.sha512
+++ b/private/password.sha512
--- a/misc/public-keys
+++ b/misc/public-keys
@ -0,0 +1,7 @@
 # Scan hosts: ssh-keyscan -t ed25519 <hostnames>
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHVknmPi7sG6ES0G0jcsvebzKGWWaMfJTYgvOue6EULI flame
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ9mwXlZnIALt9SnH3FOZvdgHLM5ZqwYUERXBbM7Rwh6 swan
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC3yHivgEXr2ecwe58h9bkhwTYivf3GwL8xenQKMeiUb tempest
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmGHIWBZzRx35/yFgnPJSHN2+35WJ30G9c5tDhPsCrl arrow
--- a/modules/common/applications/1password.nix
+++ b/modules/common/applications/1password.nix
@ -1,20 +0,0 @@
 { config, pkgs, lib, ... }: {
  options = {
    _1password = {
      enable = lib.mkEnableOption {
        description = "Enable 1Password.";
        default = false;
      };
    };
  };
  config = lib.mkIf
    (config.gui.enable && config._1password.enable && pkgs.stdenv.isLinux) {
      unfreePackages = [ "1password" "_1password-gui" ];
      home-manager.users.${config.user} = {
        home.packages = with pkgs; [ _1password-gui ];
      };
    };
 }
--- a/modules/common/applications/alacritty.nix
+++ b/modules/common/applications/alacritty.nix
@ -1,99 +0,0 @@
 { config, pkgs, lib, ... }: {
  options = {
    alacritty = {
      enable = lib.mkEnableOption {
        description = "Enable Alacritty.";
        default = false;
      };
    };
  };
  config = lib.mkIf (config.gui.enable && config.alacritty.enable) {
    home-manager.users.${config.user} = {
      xsession.windowManager.i3.config.terminal = "alacritty";
      programs.rofi.terminal = "${pkgs.alacritty}/bin/alacritty";
      programs.alacritty = {
        enable = true;
        settings = {
          window = {
            dimensions = {
              columns = 85;
              lines = 30;
            };
            padding = {
              x = 20;
              y = 20;
            };
            opacity = 1.0;
          };
          scrolling.history = 10000;
          font = { size = 14.0; };
          key_bindings = [
            # Used for word completion in fish_user_key_bindings
            {
              key = "Return";
              mods = "Shift";
              chars = "\\x1F";
            }
            # Used for searching nixpkgs in fish_user_key_bindings
            {
              key = "N";
              mods = "Control|Shift";
              chars = "\\x11F";
            }
            {
              key = "H";
              mods = "Control|Shift";
              mode = "~Vi";
              action = "ToggleViMode";
            }
            {
              key = "Return";
              mode = "Vi";
              action = "ToggleViMode";
            }
            # Used to enable $ keybind in Vi mode
            {
              key = 5; # Scancode for key4
              mods = "Shift";
              mode = "Vi|~Search";
              action = "Last";
            }
          ];
          colors = {
            primary = {
              background = config.theme.colors.base00;
              foreground = config.theme.colors.base05;
            };
            cursor = {
              text = "#1d2021";
              cursor = config.theme.colors.base05;
            };
            normal = {
              black = "#1d2021";
              red = config.theme.colors.base08;
              green = config.theme.colors.base0B;
              yellow = config.theme.colors.base0A;
              blue = config.theme.colors.base0D;
              magenta = config.theme.colors.base0E;
              cyan = config.theme.colors.base0C;
              white = config.theme.colors.base05;
            };
            bright = {
              black = config.theme.colors.base03;
              red = config.theme.colors.base09;
              green = config.theme.colors.base01;
              yellow = config.theme.colors.base02;
              blue = config.theme.colors.base04;
              magenta = config.theme.colors.base06;
              cyan = config.theme.colors.base0F;
              white = config.theme.colors.base07;
            };
          };
          draw_bold_text_with_bright_colors = false;
        };
      };
    };
  };
 }
--- a/modules/common/applications/default.nix
+++ b/modules/common/applications/default.nix
@ -1,15 +0,0 @@
 { ... }: {
  imports = [
    ./1password.nix
    ./alacritty.nix
    ./discord.nix
    ./firefox.nix
    ./kitty.nix
    ./media.nix
    ./obsidian.nix
    ./qbittorrent.nix
    ./nautilus.nix
  ];
 }
--- a/modules/common/applications/discord.nix
+++ b/modules/common/applications/discord.nix
@ -1,28 +0,0 @@
 { config, pkgs, lib, ... }: {
  options = {
    discord = {
      enable = lib.mkEnableOption {
        description = "Enable Discord.";
        default = false;
      };
    };
  };
  config = lib.mkIf (config.gui.enable && config.discord.enable) {
    unfreePackages = [ "discord" ];
    home-manager.users.${config.user} = {
      home.packages = with pkgs; [ discord ];
      xdg.configFile."discord/settings.json".text = ''
        {
          "BACKGROUND_COLOR": "#202225",
          "IS_MAXIMIZED": false,
          "IS_MINIMIZED": false,
          "OPEN_ON_STARTUP": false,
          "MINIMIZE_TO_TRAY": false,
          "SKIP_HOST_UPDATE": true
        }
      '';
    };
  };
 }
--- a/modules/common/applications/firefox.nix
+++ b/modules/common/applications/firefox.nix
@ -1,164 +0,0 @@
 { config, pkgs, lib, ... }:
 {
  options = {
    firefox = {
      enable = lib.mkEnableOption {
        description = "Enable Firefox.";
        default = false;
      };
    };
  };
  config = lib.mkIf (config.gui.enable && config.firefox.enable) {
    unfreePackages = [
      (lib.mkIf config._1password.enable "onepassword-password-manager")
      "okta-browser-plugin"
    ];
    home-manager.users.${config.user} = {
      programs.firefox = {
        enable = true;
        package =
          if pkgs.stdenv.isDarwin then pkgs.firefox-bin else pkgs.firefox;
        profiles.default = {
          id = 0;
          name = "default";
          isDefault = true;
          extensions = with pkgs.nur.repos.rycee.firefox-addons; [
            ublock-origin
            vimium
            multi-account-containers
            facebook-container
            temporary-containers
            (lib.mkIf config._1password.enable onepassword-password-manager)
            okta-browser-plugin
            sponsorblock
            reddit-enhancement-suite
            return-youtube-dislikes
            markdownload
            darkreader
            snowflake
            don-t-fuck-with-paste
            i-dont-care-about-cookies
            wappalyzer
          ];
          settings = {
            "app.update.auto" = false;
            "browser.aboutConfig.showWarning" = false;
            "browser.warnOnQuit" = false;
            "browser.quitShortcut.disabled" =
              if pkgs.stdenv.isLinux then true else false;
            "browser.theme.dark-private-windows" = true;
            "browser.toolbars.bookmarks.visibility" = false;
            "browser.startup.page" = 3; # Restore previous session
            "browser.newtabpage.enabled" = false; # Make new tabs blank
            "trailhead.firstrun.didSeeAboutWelcome" =
              true; # Disable welcome splash
            "dom.forms.autocomplete.formautofill" = false; # Disable autofill
            "extensions.formautofill.creditCards.enabled" =
              false; # Disable credit cards
            "dom.payments.defaults.saveAddress" = false; # Disable address save
            "general.autoScroll" = true; # Drag middle-mouse to scroll
            "services.sync.prefs.sync.general.autoScroll" =
              false; # Prevent disabling autoscroll
            "extensions.pocket.enabled" = false;
            "toolkit.legacyUserProfileCustomizations.stylesheets" =
              true; # Allow userChrome.css
            "layout.css.color-mix.enabled" = true;
            "ui.systemUsesDarkTheme" =
              if config.theme.dark == true then 1 else 0;
          };
          userChrome = ''
            :root {
              --focus-outline-color: ${config.theme.colors.base04} !important;
              --toolbar-color: ${config.theme.colors.base07} !important;
              --tab-min-height: 30px !important;
            }
            /* Background of tab bar */
            .toolbar-items {
              background-color: ${config.theme.colors.base00} !important;
            }
            /* Extra tab bar sides on macOS */
            .titlebar-spacer {
              background-color: ${config.theme.colors.base00} !important;
            }
            .titlebar-buttonbox-container {
              background-color: ${config.theme.colors.base00} !important;
            }
            #tabbrowser-tabs {
              border-inline-start: 0 !important;
            }
            /* Private Browsing indicator on macOS */
            #private-browsing-indicator-with-label {
              background-color: ${config.theme.colors.base00} !important;
              margin-inline: 0 !important;
              padding-inline: 7px;
            }
            /* Tabs themselves */
            .tabbrowser-tab .tab-stack {
              border-radius: 5px 5px 0 0;
              overflow: hidden;
              background-color: ${config.theme.colors.base00};
              color: ${config.theme.colors.base06} !important;
            }
            .tab-content {
              border-bottom: 2px solid color-mix(in srgb, var(--identity-tab-color) 40%, transparent);
              border-radius: 5px 5px 0 0;
              background-color: ${config.theme.colors.base00};
              color: ${config.theme.colors.base06} !important;
            }
            .tab-content[selected=true] {
              border-bottom: 2px solid color-mix(in srgb, var(--identity-tab-color) 25%, transparent);
              background-color: ${config.theme.colors.base01} !important;
              color: ${config.theme.colors.base07} !important;
            }
            /* Below tab bar */
            #nav-bar {
              background: ${config.theme.colors.base01} !important;
            }
            /* URL bar in nav bar */
            #urlbar[focused=true] {
              color: ${config.theme.colors.base07} !important;
              background: ${config.theme.colors.base02} !important;
              caret-color: ${config.theme.colors.base05} !important;
            }
            #urlbar:not([focused=true]) {
              color: ${config.theme.colors.base04} !important;
              background: ${config.theme.colors.base02} !important;
            }
            #urlbar ::-moz-selection {
              color: ${config.theme.colors.base07} !important;
              background: ${config.theme.colors.base02} !important;
            }
            #urlbar-input-container {
              border: 1px solid ${config.theme.colors.base01} !important;
            }
            #urlbar-background {
              background: ${config.theme.colors.base01} !important;
            }
            /* Text in URL bar */
            #urlbar-input, #urlbar-scheme, .searchbar-textbox {
              color: ${config.theme.colors.base07} !important;
            }
          '';
          userContent = ''
            @-moz-document url-prefix(about:blank) {
              * {
                background-color:${config.theme.colors.base01} !important;
              }
            }
          '';
          extraConfig = "";
        };
      };
    };
  };
 }
--- a/modules/common/applications/kitty.nix
+++ b/modules/common/applications/kitty.nix
@ -1,88 +0,0 @@
 { config, pkgs, lib, ... }: {
  options = {
    kitty = {
      enable = lib.mkEnableOption {
        description = "Enable Kitty.";
        default = false;
      };
    };
  };
  config = lib.mkIf (config.gui.enable && config.kitty.enable) {
    home-manager.users.${config.user} = {
      # xsession.windowManager.i3.config.terminal = "kitty";
      # programs.rofi.terminal = "${pkgs.kitty}/bin/kitty";
      programs.kitty = {
        enable = true;
        environment = { };
        extraConfig = "";
        font.size = 14;
        keybindings = {
          "shift+enter" = "send_text all \\x1F";
          "super+f" = "toggle_fullscreen";
        };
        settings = {
          # Colors (adapted from: https://github.com/kdrag0n/base16-kitty/blob/master/templates/default-256.mustache)
          background = config.theme.colors.base00;
          foreground = config.theme.colors.base05;
          selection_background = config.theme.colors.base05;
          selection_foreground = config.theme.colors.base00;
          url_color = config.theme.colors.base04;
          cursor = config.theme.colors.base05;
          active_border_color = config.theme.colors.base03;
          inactive_border_color = config.theme.colors.base01;
          active_tab_background = config.theme.colors.base00;
          active_tab_foreground = config.theme.colors.base05;
          inactive_tab_background = config.theme.colors.base01;
          inactive_tab_foreground = config.theme.colors.base04;
          tab_bar_background = config.theme.colors.base01;
          # normal
          color0 = config.theme.colors.base00;
          color1 = config.theme.colors.base08;
          color2 = config.theme.colors.base0B;
          color3 = config.theme.colors.base0A;
          color4 = config.theme.colors.base0D;
          color5 = config.theme.colors.base0E;
          color6 = config.theme.colors.base0C;
          color7 = config.theme.colors.base05;
          # bright
          color8 = config.theme.colors.base03;
          color9 = config.theme.colors.base08;
          color10 = config.theme.colors.base0B;
          color11 = config.theme.colors.base0A;
          color12 = config.theme.colors.base0D;
          color13 = config.theme.colors.base0E;
          color14 = config.theme.colors.base0C;
          color15 = config.theme.colors.base07;
          # extended base16 colors
          color16 = config.theme.colors.base09;
          color17 = config.theme.colors.base0F;
          color18 = config.theme.colors.base01;
          color19 = config.theme.colors.base02;
          color20 = config.theme.colors.base04;
          color21 = config.theme.colors.base06;
          # Scrollback
          scrolling_lines = 10000;
          scrollback_pager_history_size = 10; # MB
          scrollback_pager = ''
            ${pkgs.neovim}/bin/nvim -c 'setlocal nonumber nolist showtabline=0 foldcolumn=0|Man!' -c "autocmd VimEnter * normal G" -'';
          # Window
          window_padding_width = 6;
          tab_bar_edge = "top";
          tab_bar_style = "slant";
          # Audio
          enable_audio_bell = false;
        };
      };
    };
  };
 }
--- a/modules/common/applications/media.nix
+++ b/modules/common/applications/media.nix
@ -1,30 +0,0 @@
 { config, pkgs, lib, ... }: {
  options = {
    media = {
      enable = lib.mkEnableOption {
        description = "Enable media programs.";
        default = false;
      };
    };
  };
  config = lib.mkIf (config.gui.enable && config.media.enable) {
    home-manager.users.${config.user} = {
      home.packages = with pkgs; [
        mpv # Video viewer
        sxiv # Image viewer
        mupdf # PDF viewer
        zathura # PDF viewer
      ];
      # Set default for opening PDFs
      xdg.mimeApps.defaultApplications."application/pdf" =
        [ "zathura.desktop" ];
      xdg.mimeApps.defaultApplications."image/*" = [ "sxiv.desktop" ];
    };
  };
 }
--- a/modules/common/applications/nautilus.nix
+++ b/modules/common/applications/nautilus.nix
@ -1,33 +0,0 @@
 { config, pkgs, lib, ... }: {
  options = {
    nautilus = {
      enable = lib.mkEnableOption {
        description = "Enable Nautilus file manager.";
        default = false;
      };
    };
  };
  # Install Nautilus file manager
  config = lib.mkIf (config.gui.enable && config.nautilus.enable) {
    home-manager.users.${config.user} = {
      home.packages = with pkgs; [
        gnome.nautilus
        gnome.sushi # Quick preview with spacebar
      ];
      # Set default for opening directories
      xdg.mimeApps.defaultApplications."inode/directory" =
        [ "nautilus.desktop" ];
      programs.fish.functions = {
        qr = {
          body =
            "${pkgs.qrencode}/bin/qrencode $argv[1] -o /tmp/qr.png | ${pkgs.gnome.sushi}/bin/sushi /tmp/qr.png";
        };
      };
    };
  };
 }
--- a/modules/common/applications/obsidian.nix
+++ b/modules/common/applications/obsidian.nix
@ -1,19 +0,0 @@
 { config, pkgs, lib, ... }: {
  options = {
    obsidian = {
      enable = lib.mkEnableOption {
        description = "Enable Obsidian.";
        default = false;
      };
    };
  };
  config = lib.mkIf (config.gui.enable && config.obsidian.enable) {
    unfreePackages = [ "obsidian" ];
    home-manager.users.${config.user} = {
      home.packages = with pkgs; [ obsidian ];
    };
  };
 }
--- a/modules/common/applications/qbittorrent.nix
+++ b/modules/common/applications/qbittorrent.nix
@ -1,21 +0,0 @@
 { config, pkgs, lib, ... }: {
  options = {
    qbittorrent = {
      enable = lib.mkEnableOption {
        description = "Enable qBittorrent.";
        default = false;
      };
    };
  };
  config = lib.mkIf (config.gui.enable && config.qbittorrent.enable) {
    home-manager.users.${config.user} = {
      home.packages = with pkgs; [ qbittorrent ];
    };
  };
 }
--- a/modules/common/default.nix
+++ b/modules/common/default.nix
@ -1,107 +0,0 @@
 { config, lib, pkgs, ... }: {
  imports =
    [ ./applications ./mail ./neovim ./programming ./repositories ./shell ];
  options = {
    user = lib.mkOption {
      type = lib.types.str;
      description = "Primary user of the system";
    };
    fullName = lib.mkOption {
      type = lib.types.str;
      description = "Human readable name of the user";
    };
    userDirs = {
      # Required to prevent infinite recursion when referenced by himalaya
      download = lib.mkOption {
        type = lib.types.str;
        description = "XDG directory for downloads";
        default =
          if pkgs.stdenv.isDarwin then "$HOME/Downloads" else "$HOME/downloads";
      };
    };
    identityFile = lib.mkOption {
      type = lib.types.str;
      description = "Path to existing private key file.";
      default = "/etc/ssh/ssh_host_ed25519_key";
    };
    gui = {
      enable = lib.mkEnableOption {
        description = "Enable graphics.";
        default = false;
      };
    };
    theme = {
      colors = lib.mkOption {
        type = lib.types.attrs;
        description = "Base16 color scheme.";
        default = (import ../colorscheme/gruvbox).dark;
      };
      dark = lib.mkOption {
        type = lib.types.bool;
        description = "Enable dark mode.";
        default = true;
      };
    };
    # colorscheme = lib.mkOption {
    #   type = types.attrs;
    #   description = "Base16 color scheme";
    # };
    homePath = lib.mkOption {
      type = lib.types.path;
      description = "Path of user's home directory.";
      default = builtins.toPath (if pkgs.stdenv.isDarwin then
        "/Users/${config.user}"
      else
        "/home/${config.user}");
    };
    dotfilesPath = lib.mkOption {
      type = lib.types.path;
      description = "Path of dotfiles repository.";
      default = config.homePath + "/dev/personal/dotfiles";
    };
    dotfilesRepo = lib.mkOption {
      type = lib.types.str;
      description = "Link to dotfiles repository.";
    };
    unfreePackages = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      description = "List of unfree packages to allow.";
      default = [ ];
    };
  };
  config = let stateVersion = "23.05";
  in {
    # Enable features in Nix commands
    nix.extraOptions = ''
      experimental-features = nix-command flakes
      warn-dirty = false
    '';
    # Basic common system packages for all devices
    environment.systemPackages = with pkgs; [ git vim wget curl ];
    # Use the system-level nixpkgs instead of Home Manager's
    home-manager.useGlobalPkgs = true;
    # Install packages to /etc/profiles instead of ~/.nix-profile, useful when
    # using multiple profiles for one user
    home-manager.useUserPackages = true;
    # Allow specified unfree packages (identified elsewhere)
    # Retrieves package object based on string name
    nixpkgs.config.allowUnfreePredicate = pkg:
      builtins.elem (lib.getName pkg) config.unfreePackages;
    # Pin a state version to prevent warnings
    home-manager.users.${config.user}.home.stateVersion = stateVersion;
    home-manager.users.root.home.stateVersion = stateVersion;
  };
 }
--- a/modules/common/mail/aerc.nix
+++ b/modules/common/mail/aerc.nix
@ -1,189 +0,0 @@
 { config, pkgs, lib, ... }: {
  options.mail.aerc.enable = lib.mkEnableOption "Aerc email.";
  config = lib.mkIf config.mail.aerc.enable {
    home-manager.users.${config.user} = {
      home.packages = with pkgs; [
        w3m # Render HTML
        dante # Socksify for rendering HTML
      ];
      programs.aerc = {
        enable = true;
        extraBinds = {
          # Binds are of the form <key sequence> = <command to run>
          # To use '=' in a key sequence, substitute it with "Eq": "<Ctrl+Eq>"
          # If you wish to bind #, you can wrap the key sequence in quotes: "#" = quit
          global = {
            "<C-p>" = ":prev-tab<Enter>";
            "<C-n>" = ":next-tab <Enter>";
            "<C-t>" = ":term<Enter>";
            "?" = ":help keys<Enter>";
          };
          messages = {
            q = ":quit<Enter>";
            j = ":next <Enter>";
            "<Down>" = ":next<Enter>";
            "<C-d>" = ":next 50%<Enter>";
            "<C-f>" = ":next 100%<Enter>";
            "<PgDn>" = ":next 100%<Enter>";
            k = ":prev <Enter>";
            "<Up>" = ":prev<Enter>";
            "<C-u>" = ":prev 50%<Enter>";
            "<C-b>" = ":prev 100%<Enter>";
            "<PgUp>" = ":prev 100%<Enter>";
            g = ":select 0 <Enter>";
            G = ":select -1<Enter>";
            J = ":next-folder <Enter>";
            K = ":prev-folder<Enter>";
            H = ":collapse-folder<Enter>";
            L = ":expand-folder<Enter>";
            v = ":mark -t<Enter>";
            V = ":mark -v<Enter>";
            T = ":toggle-threads<Enter>";
            "<Enter>" = ":view<Enter>";
            d = ":prompt 'Really delete this message?' 'delete-message'<Enter>";
            D = ":move Trash<Enter>";
            A = ":archive flat<Enter>";
            C = ":compose<Enter>";
            rr = ":reply -a<Enter>";
            rq = ":reply -aq<Enter>";
            Rr = ":reply<Enter>";
            Rq = ":reply -q<Enter>";
            c = ":cf<space>";
            "$" = ":term<space>";
            "!" = ":term<space>";
            "|" = ":pipe<space>";
            "/" = ":search<space>";
            "\\" = ":filter <space>";
            n = ":next-result<Enter>";
            N = ":prev-result<Enter>";
            "<Esc>" = ":clear<Enter>";
          };
          "messages:folder=Drafts" = { "<Enter>" = ":recall<Enter>"; };
          view = {
            "/" = ":toggle-key-passthrough <Enter> /";
            q = ":close<Enter>";
            O = ":open<Enter>";
            S = ":save<space>";
            "|" = ":pipe<space>";
            D = ":move Trash<Enter>";
            A = ":archive flat<Enter>";
            "<C-l>" = ":open-link <space>";
            f = ":forward <Enter>";
            rr = ":reply -a<Enter>";
            rq = ":reply -aq<Enter>";
            Rr = ":reply<Enter>";
            Rq = ":reply -q<Enter>";
            H = ":toggle-headers<Enter>";
            "<C-k>" = ":prev-part<Enter>";
            "<C-j>" = ":next-part<Enter>";
            J = ":next <Enter>";
            K = ":prev<Enter>";
          };
          "view::passthrough" = {
            "$noinherit" = "true";
            "$ex" = "<C-x>";
            "<Esc>" = ":toggle-key-passthrough<Enter>";
          };
          compose = {
            # Keybindings used when the embedded terminal is not selected in the compose
            # view
            "$noinherit" = "true";
            "$ex" = "<C-x>";
            "<C-k>" = ":prev-field<Enter>";
            "<C-j>" = ":next-field<Enter>";
            "<A-p>" = ":switch-account -p<Enter>";
            "<A-n>" = ":switch-account -n<Enter>";
            "<tab>" = ":next-field<Enter>";
            "<C-p>" = ":prev-tab<Enter>";
            "<C-n>" = ":next-tab<Enter>";
          };
          "compose::editor" = {
            # Keybindings used when the embedded terminal is selected in the compose view
            "$noinherit" = "true";
            "$ex" = "<C-x>";
            "<C-k>" = ":prev-field<Enter>";
            "<C-j>" = ":next-field<Enter>";
            "<C-p>" = ":prev-tab<Enter>";
            "<C-n>" = ":next-tab<Enter>";
          };
          "compose::review" = {
            # Keybindings used when reviewing a message to be sent
            y = ":send <Enter>";
            n = ":abort<Enter>";
            p = ":postpone<Enter>";
            q = ":choose -o d discard abort -o p postpone postpone<Enter>";
            e = ":edit<Enter>";
            a = ":attach<space>";
            d = ":detach<space>";
          };
          terminal = {
            "$noinherit" = "true";
            "$ex" = "<C-x>";
            "<C-p>" = ":prev-tab<Enter>";
            "<C-n>" = ":next-tab<Enter>";
          };
        };
        extraConfig = {
          general.unsafe-accounts-conf = true;
          viewer = { pager = "${pkgs.less}/bin/less -R"; };
          filters = {
            "text/plain" =
              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
            "text/calendar" =
              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/calendar";
            "text/html" =
              "${pkgs.aerc}/share/aerc/filters/html"; # Requires w3m, dante
            # "text/html" =
            #   "${pkgs.aerc}/share/aerc/filters/html | ${pkgs.aerc}/share/aerc/filters/colorize";
            # "text/*" =
            #   ''${pkgs.bat}/bin/bat -fP --file-name="$AERC_FILENAME "'';
            "message/delivery-status" =
              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
            "message/rfc822" =
              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
            "application/x-sh" = "${pkgs.bat}/bin/bat -fP -l sh";
            "application/pdf" = "${pkgs.zathura}/bin/zathura -";
          };
        };
      };
      accounts.email.accounts.home.aerc = {
        enable = true;
        extraAccounts = {
          check-mail = "5m";
          check-mail-cmd = "${pkgs.isync}/bin/mbsync -a";
        };
      };
      programs.fish.shellAbbrs = { ae = "aerc"; };
    };
  };
 }
--- a/modules/common/mail/default.nix
+++ b/modules/common/mail/default.nix
@ -1,84 +0,0 @@
 { config, pkgs, lib, ... }: {
  imports = [ ./himalaya.nix ./aerc.nix ];
  options = {
    mail.enable = lib.mkEnableOption "Mail service.";
    mail.user = lib.mkOption {
      type = lib.types.str;
      description = "User name for the email address.";
      default = config.user;
    };
    mail.server = lib.mkOption {
      type = lib.types.str;
      description = "Server name for the email address.";
    };
  };
  config = lib.mkIf config.mail.enable {
    home-manager.users.${config.user} = {
      programs.mbsync = { enable = true; };
      services.mbsync = lib.mkIf pkgs.stdenv.isLinux {
        enable = true;
        frequency = "*:0/5";
      };
      accounts.email = {
        maildirBasePath = "${config.homePath}/mail";
        accounts = {
          home = let address = "${config.mail.user}@${config.mail.server}";
          in {
            userName = address;
            realName = config.fullName;
            primary = true;
            inherit address;
            aliases = map (user: "${user}@${config.mail.server}") [
              "me"
              "hey"
              "admin"
            ];
            alot = { };
            flavor = "plain";
            folders = { };
            getmail = { };
            imap = {
              host = "imap.purelymail.com";
              port = 993;
              tls.enable = true;
            };
            imapnotify = {
              enable = false;
              boxes = [ ];
              onNotify = "";
              onNotifyPost = "";
            };
            maildir = { path = "main"; };
            mbsync = {
              enable = true;
              create = "maildir";
              expunge = "none";
              remove = "none";
              patterns = [ "*" ];
              extraConfig.channel = {
                CopyArrivalDate = "yes"; # Sync time of original message
              };
            };
            mu.enable = false;
            notmuch.enable = false;
            passwordCommand =
              "${pkgs.age}/bin/age --decrypt --identity ${config.identityFile} ${
                builtins.toString ../../private/mailpass.age
              }";
            smtp = {
              host = "smtp.purelymail.com";
              port = 465;
              tls.enable = true;
            };
          };
        };
      };
    };
  };
 }
--- a/modules/common/mail/himalaya.nix
+++ b/modules/common/mail/himalaya.nix
@ -1,25 +0,0 @@
 { config, lib, ... }: {
  options.mail.himalaya.enable = lib.mkEnableOption "Himalaya email.";
  config = lib.mkIf config.mail.himalaya.enable {
    home-manager.users.${config.user} = {
      programs.himalaya = { enable = true; };
      accounts.email.accounts.home.himalaya = {
        enable = true;
        backend = "imap";
        sender = "smtp";
        settings = {
          downloads-dir = config.userDirs.download;
          smtp-insecure = true;
        };
      };
      programs.fish.shellAbbrs = { hi = "himalaya"; };
    };
  };
 }
--- a/modules/common/neovim/config/lsp.nix
+++ b/modules/common/neovim/config/lsp.nix
@ -1,66 +0,0 @@
 { pkgs, dsl, ... }: {
  plugins = [
    pkgs.vimPlugins.nvim-lspconfig
    pkgs.vimPlugins.lsp-colors-nvim
    pkgs.vimPlugins.null-ls-nvim
  ];
  use.lspconfig.sumneko_lua.setup = dsl.callWith {
    settings = { Lua = { diagnostics = { globals = [ "vim" "hs" ]; }; }; };
    capabilities = dsl.rawLua "require('cmp_nvim_lsp').default_capabilities()";
    cmd = [ "${pkgs.sumneko-lua-language-server}/bin/lua-language-server" ];
  };
  use.lspconfig.nil_ls.setup = dsl.callWith {
    cmd = [ "${pkgs.nil}/bin/nil" ];
    capabilities = dsl.rawLua "require('cmp_nvim_lsp').default_capabilities()";
  };
  use.lspconfig.pyright.setup = dsl.callWith {
    cmd = [ "${pkgs.pyright}/bin/pyright-langserver" "--stdio" ];
  };
  use.lspconfig.terraformls.setup =
    dsl.callWith { cmd = [ "${pkgs.terraform-ls}/bin/terraform-ls" "serve" ]; };
  vim.api.nvim_create_augroup = dsl.callWith [ "LspFormatting" { } ];
  lua = ''
    ${builtins.readFile ./lsp.lua}
    require("null-ls").setup({
        sources = {
            require("null-ls").builtins.formatting.stylua.with({ command = "${pkgs.stylua}/bin/stylua" }),
            require("null-ls").builtins.formatting.black.with({ command = "${pkgs.black}/bin/black" }),
            require("null-ls").builtins.diagnostics.flake8.with({ command = "${pkgs.python310Packages.flake8}/bin/flake8" }),
            require("null-ls").builtins.formatting.fish_indent.with({ command = "${pkgs.fish}/bin/fish_indent" }),
            require("null-ls").builtins.formatting.nixfmt.with({ command = "${pkgs.nixfmt}/bin/nixfmt" }),
            require("null-ls").builtins.formatting.rustfmt.with({ command = "${pkgs.rustfmt}/bin/rustfmt" }),
            require("null-ls").builtins.diagnostics.shellcheck.with({ command = "${pkgs.shellcheck}/bin/shellcheck" }),
            require("null-ls").builtins.formatting.shfmt.with({
                command = "${pkgs.shfmt}/bin/shfmt",
                extra_args = { "-i", "4", "-ci" },
            }),
            require("null-ls").builtins.formatting.terraform_fmt.with({
                command = "${pkgs.terraform}/bin/terraform",
                extra_filetypes = { "hcl" },
            }),
        },
        on_attach = function(client, bufnr)
            if client.supports_method("textDocument/formatting") then
                vim.api.nvim_clear_autocmds({ group = augroup, buffer = bufnr })
                vim.api.nvim_create_autocmd("BufWritePre", {
                    group = augroup,
                    buffer = bufnr,
                    callback = function()
                        vim.lsp.buf.format({ bufnr = bufnr })
                    end,
                })
            end
        end,
    })
  '';
 }
--- a/modules/common/neovim/config/syntax.nix
+++ b/modules/common/neovim/config/syntax.nix
@ -1,52 +0,0 @@
 { pkgs, ... }: {
  plugins = [
    (pkgs.vimPlugins.nvim-treesitter.withPlugins (_plugins:
      with pkgs.tree-sitter-grammars; [
        tree-sitter-hcl
        tree-sitter-python
        tree-sitter-lua
        tree-sitter-nix
        tree-sitter-fish
        tree-sitter-toml
        tree-sitter-yaml
        tree-sitter-json
      ]))
    pkgs.vimPlugins.vim-matchup # Better % jumping in languages
    pkgs.vimPlugins.nginx-vim
    pkgs.vimPlugins.vim-helm
    pkgs.vimPlugins.vim-puppet
  ];
  setup."nvim-treesitter.configs" = {
    highlight = { enable = true; };
    indent = { enable = true; };
    textobjects = {
      select = {
        enable = true;
        lookahead = true; # Jump forward automatically
        keymaps = {
          "['af']" = "@function.outer";
          "['if']" = "@function.inner";
          "['ac']" = "@class.outer";
          "['ic']" = "@class.inner";
          "['al']" = "@loop.outer";
          "['il']" = "@loop.inner";
          "['aa']" = "@call.outer";
          "['ia']" = "@call.inner";
          "['ar']" = "@parameter.outer";
          "['ir']" = "@parameter.inner";
          "['aC']" = "@comment.outer";
          "['iC']" = "@comment.outer";
          "['a/']" = "@comment.outer";
          "['i/']" = "@comment.outer";
          "['a;']" = "@statement.outer";
          "['i;']" = "@statement.outer";
        };
      };
    };
  };
 }
--- a/modules/common/neovim/config/toggleterm.nix
+++ b/modules/common/neovim/config/toggleterm.nix
@ -1,13 +0,0 @@
 { pkgs, dsl, ... }: {
  plugins = [ pkgs.vimPlugins.toggleterm-nvim ];
  use.toggleterm.setup = dsl.callWith {
    open_mapping = dsl.rawLua "[[<c-\\>]]";
    hide_numbers = true;
    direction = "float";
  };
  lua = builtins.readFile ./toggleterm.lua;
 }
--- a/modules/common/neovim/config/tree.nix
+++ b/modules/common/neovim/config/tree.nix
@ -1,77 +0,0 @@
 { pkgs, dsl, ... }: {
  plugins = [ pkgs.vimPlugins.nvim-tree-lua pkgs.vimPlugins.nvim-web-devicons ];
  # Disable netrw eagerly
  # https://github.com/kyazdani42/nvim-tree.lua/commit/fb8735e96cecf004fbefb086ce85371d003c5129
  vim.g = {
    loaded = 1;
    loaded_netrwPlugin = 1;
  };
  setup.nvim-tree = {
    disable_netrw = true;
    hijack_netrw = true;
    update_focused_file = {
      enable = true;
      update_cwd = true;
      ignore_list = { };
    };
    diagnostics = {
      enable = true;
      icons = {
        hint = "";
        info = "";
        warning = "";
        error = "";
      };
    };
    renderer = {
      icons = {
        glyphs = {
          git = {
            unstaged = "~";
            staged = "+";
            unmerged = "";
            renamed = "➜";
            deleted = "";
            untracked = "?";
            ignored = "◌";
          };
        };
      };
    };
    view = {
      width = 30;
      hide_root_folder = false;
      side = "left";
      mappings = {
        custom_only = false;
        list = [
          {
            key = [ "l" "<CR>" "o" ];
            cb = dsl.rawLua
              "require('nvim-tree.config').nvim_tree_callback('edit')";
          }
          {
            key = "h";
            cb = dsl.rawLua
              "require('nvim-tree.config').nvim_tree_callback('close_node')";
          }
          {
            key = "v";
            cb = dsl.rawLua
              "require('nvim-tree.config').nvim_tree_callback('vsplit')";
          }
        ];
      };
      number = false;
      relativenumber = false;
    };
  };
  lua = ''
    vim.keymap.set("n", "<Leader>e", ":NvimTreeFindFileToggle<CR>", { silent = true })
  '';
 }
--- a/modules/common/neovim/default.nix
+++ b/modules/common/neovim/default.nix
@ -1,44 +0,0 @@
 { config, pkgs, lib, ... }:
 let
  neovim = import ./package {
    inherit pkgs;
    colors = import config.theme.colors.neovimConfig { inherit pkgs; };
  };
 in {
  options.neovim.enable = lib.mkEnableOption "Neovim.";
  config = lib.mkIf config.neovim.enable {
    home-manager.users.${config.user} =
      {
        home.packages = [ neovim ];
        programs.git.extraConfig.core.editor = "nvim";
        home.sessionVariables = {
          EDITOR = "nvim";
          MANPAGER = "nvim +Man!";
        };
        programs.fish = {
          shellAliases = { vim = "nvim"; };
          shellAbbrs = {
            v = lib.mkForce "nvim";
            vl = lib.mkForce "nvim -c 'normal! `0' -c 'bdelete 1'";
            vll = "nvim -c 'Telescope oldfiles'";
          };
        };
        programs.kitty.settings.scrollback_pager = lib.mkForce ''
          ${neovim}/bin/nvim -c 'setlocal nonumber nolist showtabline=0 foldcolumn=0|Man!' -c "autocmd VimEnter * normal G" -'';
      };
    # # Used for icons in Vim
    # fonts.fonts = with pkgs; [ nerdfonts ];
  };
 }
--- a/modules/common/neovim/init.lua
+++ b/modules/common/neovim/init.lua
@ -1,4 +0,0 @@
 require("packer_init")
 require("settings")
 require("keybinds")
 require("background")
--- a/modules/common/neovim/lua/packer/completion.lua
+++ b/modules/common/neovim/lua/packer/completion.lua
@ -1,164 +0,0 @@
 -- =======================================================================
 -- Completion System
 -- =======================================================================
 local M = {}
 M.packer = function(use)
    -- Completion sources
    use("hrsh7th/cmp-nvim-lsp") --- Language server completion plugin
    use("hrsh7th/cmp-buffer") --- Generic text completion
    use("hrsh7th/cmp-path") --- Local file completion
    use("hrsh7th/cmp-cmdline") --- Command line completion
    use("hrsh7th/cmp-nvim-lua") --- Nvim lua api completion
    use("saadparwaiz1/cmp_luasnip") --- Luasnip completion
    use("lukas-reineke/cmp-rg") --- Ripgrep completion
    use("rafamadriz/friendly-snippets") -- Lots of pre-generated snippets
    -- Completion engine
    use({
        "hrsh7th/nvim-cmp",
        requires = { "L3MON4D3/LuaSnip" },
        config = function()
            local cmp = require("cmp")
            local kind_icons = {
                Text = "",
                Method = "m",
                Function = "",
                Constructor = "",
                Field = "",
                Variable = "",
                Class = "",
                Interface = "",
                Module = "",
                Property = "",
                Unit = "",
                Value = "",
                Enum = "",
                Keyword = "",
                Snippet = "",
                Color = "",
                File = "",
                Reference = "",
                Folder = "",
                EnumMember = "",
                Constant = "",
                Struct = "",
                Event = "",
                Operator = "",
                TypeParameter = "",
            }
            cmp.setup({
                -- Only enable on non-prompt buffers
                -- So don't use in telescope
                enabled = function()
                    if vim.bo.buftype == "prompt" then
                        return false
                    end
                    return true
                end,
                -- Setup snippet completion
                snippet = {
                    expand = function(args)
                        require("luasnip").lsp_expand(args.body)
                    end,
                },
                -- Setup completion keybinds
                mapping = {
                    ["<C-n>"] = cmp.mapping(cmp.mapping.select_next_item(), { "i", "c" }),
                    ["<C-p>"] = cmp.mapping(cmp.mapping.select_prev_item(), { "i", "c" }),
                    ["<C-d>"] = cmp.mapping(cmp.mapping.scroll_docs(-4), { "i", "c" }),
                    ["<C-f>"] = cmp.mapping(cmp.mapping.scroll_docs(4), { "i", "c" }),
                    ["<C-e>"] = cmp.mapping(cmp.mapping.abort(), { "i", "c" }),
                    ["<Esc>"] = function(_)
                        cmp.mapping({
                            i = cmp.mapping.abort(),
                            c = cmp.mapping.close(),
                        })
                        vim.cmd("stopinsert") --- Abort and leave insert mode
                    end,
                    ["<CR>"] = cmp.mapping.confirm({
                        behavior = cmp.ConfirmBehavior.Insert,
                        select = true,
                    }),
                    ["<C-r>"] = cmp.mapping.confirm({
                        behavior = cmp.ConfirmBehavior.Replace,
                        select = true,
                    }),
                    ["<C-l>"] = cmp.mapping(function(_)
                        if require("luasnip").expand_or_jumpable() then
                            require("luasnip").expand_or_jump()
                        end
                    end, { "i", "s" }),
                },
                -- Setup completion engines
                sources = {
                    { name = "nvim_lua" },
                    { name = "nvim_lsp" },
                    { name = "luasnip" },
                    { name = "path" },
                    { name = "buffer", keyword_length = 3, max_item_count = 10 },
                    {
                        name = "rg",
                        keyword_length = 6,
                        max_item_count = 10,
                        option = { additional_arguments = "--ignore-case" },
                    },
                },
                -- Visual presentation
                formatting = {
                    fields = { "kind", "abbr", "menu" },
                    format = function(entry, vim_item)
                        vim_item.kind = string.format("%s", kind_icons[vim_item.kind])
                        vim_item.menu = ({
                            luasnip = "[Snippet]",
                            buffer = "[Buffer]",
                            path = "[Path]",
                            rg = "[Grep]",
                            nvim_lsp = "[LSP]",
                            nvim_lua = "[Lua]",
                        })[entry.source.name]
                        return vim_item
                    end,
                },
                -- Docs
                -- window = {
                --     completion = cmp.config.window.bordered(),
                --     documentation = cmp.config.window.bordered(),
                -- },
                -- Extra features
                experimental = {
                    native_menu = false, --- Use cmp menu instead of Vim menu
                    ghost_text = true, --- Show preview auto-completion
                },
            })
            -- Use buffer source for `/`
            cmp.setup.cmdline("/", {
                sources = {
                    { name = "buffer", keyword_length = 5 },
                },
            })
            -- Use cmdline & path source for ':'
            cmp.setup.cmdline(":", {
                sources = cmp.config.sources({
                    { name = "path" },
                }, {
                    { name = "cmdline" },
                }),
            })
        end,
    })
 end
 return M
--- a/modules/common/neovim/lua/packer/lsp.lua
+++ b/modules/common/neovim/lua/packer/lsp.lua
@ -1,153 +0,0 @@
 -- =======================================================================
 -- Language Server
 -- =======================================================================
 local M = {}
 M.packer = function(use)
    -- Language server engine
    use({
        "neovim/nvim-lspconfig",
        requires = { "hrsh7th/cmp-nvim-lsp" },
        config = function()
            local function on_path(program)
                return vim.fn.executable(program) == 1
            end
            local capabilities = require("cmp_nvim_lsp").default_capabilities()
            if on_path("lua-language-server") then
                require("lspconfig").sumneko_lua.setup({
                    capabilities = capabilities,
                    -- Turn off errors for vim global variable
                    settings = {
                        Lua = {
                            diagnostics = {
                                globals = { "vim", "hs" },
                            },
                        },
                    },
                })
            end
            if on_path("rust-analyzer") then
                require("lspconfig").rust_analyzer.setup({ capabilities = capabilities })
            end
            if on_path("tflint") then
                require("lspconfig").tflint.setup({ capabilities = capabilities })
            end
            if on_path("terraform-ls") then
                require("lspconfig").terraformls.setup({ capabilities = capabilities })
            end
            if on_path("pyright") then
                require("lspconfig").pyright.setup({
                    on_attach = function()
                        -- set keymaps (requires 0.7.0)
                        -- vim.keymap.set("n", "", "", {buffer=0})
                    end,
                    capabilities = capabilities,
                })
            end
            if on_path("nil") then
                require("lspconfig").nil_ls.setup({ capabilities = capabilities })
            end
            vim.keymap.set("n", "gd", vim.lsp.buf.definition)
            vim.keymap.set("n", "gT", vim.lsp.buf.type_definition)
            vim.keymap.set("n", "gi", vim.lsp.buf.implementation)
            vim.keymap.set("n", "gh", vim.lsp.buf.hover)
            -- vim.keymap.set("n", "gr", telescope.lsp_references)
            vim.keymap.set("n", "<Leader>R", vim.lsp.buf.rename)
            vim.keymap.set("n", "]e", vim.diagnostic.goto_next)
            vim.keymap.set("n", "[e", vim.diagnostic.goto_prev)
            vim.keymap.set("n", "<Leader>de", vim.diagnostic.open_float)
            vim.keymap.set("n", "<Leader>E", vim.lsp.buf.code_action)
        end,
    })
    -- Pretty highlights
    use("folke/lsp-colors.nvim")
    -- Linting
    use({
        "jose-elias-alvarez/null-ls.nvim",
        branch = "main",
        requires = {
            "nvim-lua/plenary.nvim",
            "neovim/nvim-lspconfig",
        },
        config = function()
            local function on_path(program)
                return vim.fn.executable(program) == 1
            end
            local augroup = vim.api.nvim_create_augroup("LspFormatting", {})
            require("null-ls").setup({
                sources = {
                    require("null-ls").builtins.formatting.stylua.with({
                        condition = function()
                            return on_path("stylua")
                        end,
                    }),
                    require("null-ls").builtins.formatting.black.with({
                        condition = function()
                            return on_path("black")
                        end,
                    }),
                    require("null-ls").builtins.diagnostics.flake8.with({
                        condition = function()
                            return on_path("flake8")
                        end,
                    }),
                    require("null-ls").builtins.formatting.fish_indent.with({
                        condition = function()
                            return on_path("fish_indent")
                        end,
                    }),
                    require("null-ls").builtins.formatting.nixfmt.with({
                        condition = function()
                            return on_path("nixfmt")
                        end,
                    }),
                    require("null-ls").builtins.formatting.rustfmt.with({
                        condition = function()
                            return on_path("rustfmt")
                        end,
                    }),
                    require("null-ls").builtins.diagnostics.shellcheck.with({
                        condition = function()
                            return on_path("shellcheck")
                        end,
                    }),
                    require("null-ls").builtins.formatting.shfmt.with({
                        extra_args = { "-i", "4", "-ci" },
                        condition = function()
                            return on_path("shfmt")
                        end,
                    }),
                    require("null-ls").builtins.formatting.terraform_fmt.with({
                        condition = function()
                            return on_path("terraform")
                        end,
                    }),
                    -- require("null-ls").builtins.diagnostics.luacheck,
                    -- require("null-ls").builtins.diagnostics.markdownlint,
                    -- require("null-ls").builtins.diagnostics.pylint,
                },
                -- Format on save
                on_attach = function(client, bufnr)
                    if client.supports_method("textDocument/formatting") then
                        vim.api.nvim_clear_autocmds({ group = augroup, buffer = bufnr })
                        vim.api.nvim_create_autocmd("BufWritePre", {
                            group = augroup,
                            buffer = bufnr,
                            callback = function()
                                vim.lsp.buf.format({ bufnr = bufnr })
                            end,
                        })
                    end
                end,
            })
        end,
    })
 end
 return M
--- a/modules/common/neovim/lua/packer/misc.lua
+++ b/modules/common/neovim/lua/packer/misc.lua
@ -1,67 +0,0 @@
 local M = {}
 M.packer = function(use)
    -- Important tweaks
    use("tpope/vim-surround") --- Manipulate parentheses
    -- Convenience tweaks
    use("tpope/vim-eunuch") --- File manipulation in Vim
    use("tpope/vim-vinegar") --- Fixes netrw file explorer
    use("tpope/vim-fugitive") --- Git commands and syntax
    use("tpope/vim-repeat") --- Actually repeat using .
    -- Use gc or gcc to add comments
    use({
        "numToStr/Comment.nvim",
        config = function()
            require("Comment").setup()
        end,
    })
    -- Alignment tool
    use({
        "godlygeek/tabular",
        config = function()
            vim.keymap.set("", "<Leader>ta", ":Tabularize /")
            vim.keymap.set("", "<Leader>t#", ":Tabularize /#<CR>")
            vim.keymap.set("", "<Leader>tl", ":Tabularize /---<CR>")
        end,
    })
    -- Markdown renderer / wiki notes
    -- use("vimwiki/vimwiki")
    use({
        "jakewvincent/mkdnflow.nvim",
        config = function()
            require("mkdnflow").setup({
                modules = {
                    bib = false,
                    conceal = true,
                    folds = false,
                },
                perspective = {
                    priority = "current",
                    fallback = "first",
                    nvim_wd_heel = false, -- Don't change working dir
                },
                links = {
                    style = "markdown",
                    conceal = true,
                },
                wrap = true,
                to_do = {
                    symbols = { " ", "-", "x" },
                },
            })
            vim.api.nvim_create_autocmd("FileType", {
                pattern = "markdown",
                callback = function()
                    vim.o.autowriteall = true -- Save in new buffer
                    vim.o.wrapmargin = 79 -- Wrap text automatically
                end,
            })
        end,
    })
 end
 return M
--- a/modules/common/neovim/lua/packer/speed.lua
+++ b/modules/common/neovim/lua/packer/speed.lua
@ -1,13 +0,0 @@
 local M = {}
 M.packer = function(use)
    -- Startup speed hacks
    use({
        "lewis6991/impatient.nvim",
        config = function()
            require("impatient")
        end,
    })
 end
 return M
--- a/modules/common/neovim/lua/packer/syntax.lua
+++ b/modules/common/neovim/lua/packer/syntax.lua
@ -1,72 +0,0 @@
 -- =======================================================================
 -- Syntax
 -- =======================================================================
 local M = {}
 M.packer = function(use)
    -- Syntax engine
    use({
        "nvim-treesitter/nvim-treesitter",
        commit = "9ada5f70f98d51e9e3e76018e783b39fd1cd28f7",
        run = ":TSUpdate",
        config = function()
            require("nvim-treesitter.configs").setup({
                ensure_installed = {
                    "hcl",
                    "python",
                    "lua",
                    "nix",
                    "fish",
                    "toml",
                    "yaml",
                    "json",
                },
                auto_install = true,
                highlight = { enable = true },
                indent = { enable = true },
            })
        end,
    })
    -- Syntax-aware Textobjects
    use({
        "nvim-treesitter/nvim-treesitter-textobjects",
        requires = { "nvim-treesitter/nvim-treesitter" },
        config = function()
            require("nvim-treesitter.configs").setup({
                textobjects = {
                    select = {
                        enable = true,
                        lookahead = true, -- Jump forward automatically
                        keymaps = {
                            ["af"] = "@function.outer",
                            ["if"] = "@function.inner",
                            ["ac"] = "@class.outer",
                            ["ic"] = "@class.inner",
                            ["al"] = "@loop.outer",
                            ["il"] = "@loop.inner",
                            ["aa"] = "@call.outer",
                            ["ia"] = "@call.inner",
                            ["ar"] = "@parameter.outer",
                            ["ir"] = "@parameter.inner",
                            ["aC"] = "@comment.outer",
                            ["iC"] = "@comment.outer",
                            ["a/"] = "@comment.outer",
                            ["i/"] = "@comment.outer",
                            ["a;"] = "@statement.outer",
                            ["i;"] = "@statement.outer",
                        },
                    },
                },
            })
        end,
    })
    -- Additional syntax sources
    use("chr4/nginx.vim") --- Nginx syntax
    use("towolf/vim-helm") --- Helm syntax
    use("rodjek/vim-puppet") --- Puppet syntax
 end
 return M
--- a/modules/common/neovim/lua/packer/telescope.lua
+++ b/modules/common/neovim/lua/packer/telescope.lua
@ -1,139 +0,0 @@
 -- =======================================================================
 -- Fuzzy Launcher
 -- =======================================================================
 local M = {}
 M.packer = function(use)
    use({
        "nvim-telescope/telescope.nvim",
        branch = "master",
        requires = { "nvim-lua/plenary.nvim" },
        config = function()
            -- Telescope: quit instantly with escape
            local actions = require("telescope.actions")
            require("telescope").setup({
                defaults = {
                    mappings = {
                        i = {
                            ["<esc>"] = actions.close,
                            ["<C-h>"] = "which_key",
                        },
                    },
                },
                pickers = {
                    find_files = { theme = "ivy" },
                    oldfiles = { theme = "ivy" },
                    buffers = { theme = "dropdown" },
                },
                extensions = {
                    fzy_native = {},
                    zoxide = {},
                    project = {
                        base_dirs = { "~/dev" },
                    },
                },
            })
            local telescope = require("telescope.builtin")
            vim.keymap.set("n", "<Leader>k", telescope.keymaps)
            vim.keymap.set("n", "<Leader>/", telescope.live_grep)
            vim.keymap.set("n", "<Leader>ff", telescope.find_files)
            vim.keymap.set("n", "<Leader>fp", telescope.git_files)
            vim.keymap.set("n", "<Leader>fw", telescope.grep_string)
            vim.keymap.set("n", "<Leader>b", telescope.buffers)
            vim.keymap.set("n", "<Leader>hh", telescope.help_tags)
            vim.keymap.set("n", "<Leader>fr", telescope.oldfiles)
            vim.keymap.set("n", "<Leader>cc", telescope.commands)
            vim.keymap.set("n", "<Leader>gc", telescope.git_commits)
            vim.keymap.set("n", "<Leader>gf", telescope.git_bcommits)
            vim.keymap.set("n", "<Leader>gb", telescope.git_branches)
            vim.keymap.set("n", "<Leader>gs", telescope.git_status)
            vim.keymap.set("n", "<Leader>s", telescope.current_buffer_fuzzy_find)
            vim.keymap.set("n", "<Leader>N", function()
                local opts = {
                    prompt_title = "Search Notes",
                    cwd = "$NOTES_PATH",
                }
                telescope.live_grep(opts)
            end)
            vim.keymap.set("n", "<Leader>fN", function()
                local opts = {
                    prompt_title = "Find Notes",
                    cwd = "$NOTES_PATH",
                }
                telescope.find_files(opts)
            end)
            vim.keymap.set("n", "<Leader>cr", function()
                local opts = require("telescope.themes").get_ivy({
                    layout_config = {
                        bottom_pane = {
                            height = 15,
                        },
                    },
                })
                telescope.command_history(opts)
            end)
        end,
    })
    -- Faster sorting
    use("nvim-telescope/telescope-fzy-native.nvim")
    -- Jump around tmux sessions
    -- use("camgraff/telescope-tmux.nvim")
    -- Jump directories
    use({
        "jvgrootveld/telescope-zoxide",
        requires = { "nvim-lua/popup.nvim", "nvim-telescope/telescope.nvim" },
        config = function()
            vim.keymap.set("n", "<Leader>fz", require("telescope").extensions.zoxide.list)
        end,
    })
    -- Jump projects
    use({
        "nvim-telescope/telescope-project.nvim",
        requires = { "nvim-telescope/telescope.nvim" },
        config = function()
            require("telescope").load_extension("project")
            vim.keymap.set("n", "<C-p>", function()
                local opts = require("telescope.themes").get_ivy({
                    layout_config = {
                        bottom_pane = {
                            height = 10,
                        },
                    },
                })
                require("telescope").extensions.project.project(opts)
            end)
        end,
    })
    -- File browser
    use({
        "nvim-telescope/telescope-file-browser.nvim",
        requires = { "nvim-telescope/telescope.nvim" },
        config = function()
            require("telescope").load_extension("file_browser")
            vim.keymap.set("n", "<Leader>fa", require("telescope").extensions.file_browser.file_browser)
            vim.keymap.set("n", "<Leader>fD", function()
                local opts = {
                    prompt_title = "Find Downloads",
                    cwd = "~/downloads",
                }
                require("telescope").extensions.file_browser.file_browser(opts)
            end)
        end,
    })
 end
 return M
--- a/modules/common/neovim/lua/packer/toggleterm.lua
+++ b/modules/common/neovim/lua/packer/toggleterm.lua
@ -1,79 +0,0 @@
 local M = {}
 M.packer = function(use)
    use({
        "akinsho/toggleterm.nvim",
        tag = "v2.1.0",
        config = function()
            require("toggleterm").setup({
                open_mapping = [[<c-\>]],
                hide_numbers = true,
                direction = "float",
            })
            vim.keymap.set("t", "<A-CR>", "<C-\\><C-n>") --- Exit terminal mode
            -- Only set these keymaps for toggleterm
            vim.api.nvim_create_autocmd("TermOpen", {
                pattern = "term://*toggleterm#*",
                callback = function()
                    -- vim.keymap.set("t", "<Esc>", "<C-\\><C-n>") --- Exit terminal mode
                    vim.keymap.set("t", "<C-h>", "<C-\\><C-n><C-w>h")
                    vim.keymap.set("t", "<C-j>", "<C-\\><C-n><C-w>j")
                    vim.keymap.set("t", "<C-k>", "<C-\\><C-n><C-w>k")
                    vim.keymap.set("t", "<C-l>", "<C-\\><C-n><C-w>l")
                end,
            })
            local terminal = require("toggleterm.terminal").Terminal
            local basicterminal = terminal:new()
            function TERM_TOGGLE()
                basicterminal:toggle()
            end
            local nixpkgs = terminal:new({ cmd = "nix repl '<nixpkgs>'" })
            function NIXPKGS_TOGGLE()
                nixpkgs:toggle()
            end
            local gitwatch = terminal:new({ cmd = "fish --interactive --init-command 'gh run watch'" })
            function GITWATCH_TOGGLE()
                gitwatch:toggle()
            end
            local k9s = terminal:new({ cmd = "k9s" })
            function K9S_TOGGLE()
                k9s:toggle()
            end
            vim.keymap.set("n", "<Leader>t", TERM_TOGGLE)
            vim.keymap.set("n", "<Leader>P", NIXPKGS_TOGGLE)
            vim.keymap.set("n", "<Leader>gw", GITWATCH_TOGGLE)
            vim.keymap.set("n", "<Leader>9", K9S_TOGGLE)
        end,
    })
    -- Connect to telescope
    -- use({
    --     "https://git.sr.ht/~havi/telescope-toggleterm.nvim",
    --     event = "TermOpen",
    --     requires = {
    --         "akinsho/nvim-toggleterm.lua",
    --         "nvim-telescope/telescope.nvim",
    --         "nvim-lua/popup.nvim",
    --         "nvim-lua/plenary.nvim",
    --     },
    --     config = function()
    --         require("telescope").load_extension("toggleterm")
    --         require("telescope-toggleterm").setup({
    --             telescope_mappings = {
    --                 -- <ctrl-c> : kill the terminal buffer (default) .
    --                 ["<C-c>"] = require("telescope-toggleterm").actions.exit_terminal,
    --             },
    --         })
    --     end,
    -- })
 end
 return M
--- a/modules/common/neovim/lua/packer/visuals.lua
+++ b/modules/common/neovim/lua/packer/visuals.lua
@ -1,164 +0,0 @@
 local M = {}
 M.packer = function(use)
    -- Git next to line numbers
    use({
        "lewis6991/gitsigns.nvim",
        branch = "main",
        requires = { "nvim-lua/plenary.nvim" },
        config = function()
            local gitsigns = require("gitsigns")
            gitsigns.setup()
            vim.keymap.set("n", "<Leader>gB", gitsigns.blame_line)
            vim.keymap.set("n", "<Leader>gp", gitsigns.preview_hunk)
            vim.keymap.set("v", "<Leader>gp", gitsigns.preview_hunk)
            vim.keymap.set("n", "<Leader>gd", gitsigns.diffthis)
            vim.keymap.set("v", "<Leader>gd", gitsigns.diffthis)
            vim.keymap.set("n", "<Leader>rgf", gitsigns.reset_buffer)
            vim.keymap.set("v", "<Leader>hs", gitsigns.stage_hunk)
            vim.keymap.set("v", "<Leader>hr", gitsigns.reset_hunk)
            vim.keymap.set("v", "<Leader>hr", gitsigns.reset_hunk)
            -- Navigation
            vim.keymap.set("n", "]g", function()
                if vim.wo.diff then
                    return "]g"
                end
                vim.schedule(function()
                    gitsigns.next_hunk()
                end)
                return "<Ignore>"
            end, { expr = true })
            vim.keymap.set("n", "[g", function()
                if vim.wo.diff then
                    return "[g"
                end
                vim.schedule(function()
                    gitsigns.prev_hunk()
                end)
                return "<Ignore>"
            end, { expr = true })
        end,
    })
    -- Status bar
    use({
        "hoob3rt/lualine.nvim",
        requires = { "kyazdani42/nvim-web-devicons", opt = true },
        config = function()
            require("lualine").setup({
                options = {
                    theme = "gruvbox",
                    icons_enabled = true,
                },
            })
        end,
    })
    -- Buffer line ("tabs")
    use({
        "akinsho/bufferline.nvim",
        tag = "v2.4.0",
        requires = { "kyazdani42/nvim-web-devicons", "moll/vim-bbye" },
        config = function()
            require("bufferline").setup({
                options = {
                    diagnostics = "nvim_lsp",
                    always_show_bufferline = false,
                    separator_style = "slant",
                    offsets = { { filetype = "NvimTree" } },
                },
            })
            -- Move buffers
            vim.keymap.set("n", "L", ":BufferLineCycleNext<CR>", { silent = true })
            vim.keymap.set("n", "H", ":BufferLineCyclePrev<CR>", { silent = true })
            -- Kill buffer
            vim.keymap.set("n", "<Leader>x", " :Bdelete<CR>", { silent = true })
            -- Shift buffers
            -- vim.keymap.set("n", "<C-L>", ":BufferLineMoveNext<CR>")
            -- vim.keymap.set("i", "<C-L>", "<Esc>:BufferLineMoveNext<CR>i")
            -- vim.keymap.set("n", "<C-H>", ":BufferLineMovePrev<CR>")
            -- vim.keymap.set("i", "<C-H>", "<Esc>:BufferLineMovePrev<CR>i")
        end,
    })
    -- File explorer
    use({
        "kyazdani42/nvim-tree.lua",
        requires = { "kyazdani42/nvim-web-devicons" },
        config = function()
            require("nvim-tree").setup({
                disable_netrw = true,
                hijack_netrw = true,
                update_focused_file = {
                    enable = true,
                    update_cwd = true,
                    ignore_list = {},
                },
                diagnostics = {
                    enable = true,
                    icons = {
                        hint = "",
                        info = "",
                        warning = "",
                        error = "",
                    },
                },
                renderer = {
                    icons = {
                        glyphs = {
                            git = {
                                unstaged = "~",
                                staged = "+",
                                unmerged = "",
                                renamed = "➜",
                                deleted = "",
                                untracked = "?",
                                ignored = "◌",
                            },
                        },
                    },
                },
                view = {
                    width = 30,
                    hide_root_folder = false,
                    side = "left",
                    mappings = {
                        custom_only = false,
                        list = {
                            {
                                key = { "l", "<CR>", "o" },
                                cb = require("nvim-tree.config").nvim_tree_callback("edit"),
                            },
                            { key = "h", cb = require("nvim-tree.config").nvim_tree_callback("close_node") },
                            { key = "v", cb = require("nvim-tree.config").nvim_tree_callback("vsplit") },
                        },
                    },
                    number = false,
                    relativenumber = false,
                },
            })
            vim.keymap.set("n", "<Leader>e", ":NvimTreeFindFileToggle<CR>", { silent = true })
            -- https://github.com/kyazdani42/nvim-tree.lua/commit/fb8735e96cecf004fbefb086ce85371d003c5129
            vim.g.loaded = 1
            vim.g.loaded_netrwPlugin = 1
        end,
    })
    -- Markdown pretty view
    use("ellisonleao/glow.nvim")
    -- Hex color previews
    use({
        "norcalli/nvim-colorizer.lua",
        config = function()
            require("colorizer").setup()
        end,
    })
 end
 return M
--- a/modules/common/neovim/lua/packer_init.lua
+++ b/modules/common/neovim/lua/packer_init.lua
@ -1,34 +0,0 @@
 -- Bootstrap the Packer plugin manager
 local fn = vim.fn
 local install_path = fn.stdpath("data") .. "/site/pack/packer/start/packer.nvim"
 if fn.empty(fn.glob(install_path)) > 0 then
    PACKER_BOOTSTRAP = fn.system({
        "git",
        "clone",
        "--depth",
        "1",
        "https://github.com/wbthomason/packer.nvim",
        install_path,
    })
 end
 require("packer").startup(function(use)
    -- Maintain plugin manager
    use("wbthomason/packer.nvim")
    -- Include other files initialized by packer
    require("packer.speed").packer(use)
    require("packer.misc").packer(use)
    require("packer.colors").packer(use)
    require("packer.visuals").packer(use)
    require("packer.lsp").packer(use)
    require("packer.completion").packer(use)
    require("packer.syntax").packer(use)
    require("packer.telescope").packer(use)
    require("packer.toggleterm").packer(use)
    -- Auto-install after bootstrapping
    if PACKER_BOOTSTRAP then
        require("packer").sync()
    end
 end)
--- a/modules/common/neovim/lua/settings.lua
+++ b/modules/common/neovim/lua/settings.lua
@ -1,17 +0,0 @@
 -- ===========================================================================
 -- Settings
 -- ===========================================================================
 vim.filetype.add({
    pattern = {
        [".*%.tfvars"] = "hcl",
        [".*%.tf"] = "hcl",
    },
 })
 vim.api.nvim_create_autocmd("FileType", {
    pattern = "*.eml",
    callback = function()
        vim.o.wrapmargin = 79 -- Wrap text automatically
    end,
 })
--- a/modules/common/programming/default.nix
+++ b/modules/common/programming/default.nix
@ -1,12 +0,0 @@
 { ... }: {
  imports = [
    ./haskell.nix
    ./kubernetes.nix
    ./lua.nix
    ./nix.nix
    ./python.nix
    ./terraform.nix
  ];
 }
--- a/modules/common/programming/haskell.nix
+++ b/modules/common/programming/haskell.nix
@ -1,14 +0,0 @@
 { config, lib, ... }: {
  options.haskell.enable = lib.mkEnableOption "Haskell programming language.";
  config = lib.mkIf config.haskell.enable {
    # Binary Cache for Haskell.nix
    nix.settings.trusted-public-keys =
      [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
    nix.settings.substituters = [ "https://cache.iog.io" ];
  };
 }
--- a/modules/common/programming/lua.nix
+++ b/modules/common/programming/lua.nix
@ -1,12 +0,0 @@
 { config, pkgs, lib, ... }: {
  options.lua.enable = lib.mkEnableOption "Lua programming language.";
  config = lib.mkIf config.lua.enable {
    home-manager.users.${config.user}.home.packages = with pkgs; [
      stylua # Lua formatter
      sumneko-lua-language-server # Lua LSP
    ];
  };
 }
--- a/modules/common/programming/nix.nix
+++ b/modules/common/programming/nix.nix
@ -1,18 +0,0 @@
 { config, pkgs, lib, ... }: {
  options.nixlang.enable = lib.mkEnableOption "Nix programming language.";
  config = lib.mkIf config.nixlang.enable {
    home-manager.users.${config.user} = {
      home.packages = with pkgs; [
        nixfmt # Nix file formatter
        nil # Nix language server
      ];
    };
  };
 }
--- a/Show More
+++ b/Show More