add actualtap for working with actual api

fix: pwmconfig hardware ids chnaged
add nix-index-database flake input
2026-07-29 11:48:35 +00:00 · 2026-07-29 00:46:26 +00:00 · 2026-07-28 20:10:59 -04:00 · 2026-07-28 18:34:12 -04:00 · 2026-07-28 22:04:29 +00:00 · 2026-07-28 16:58:10 -04:00
25 changed files with 461 additions and 77 deletions
@@ -1,5 +1,11 @@
 # Changelog

+## 2026-07-25
+
+- Added jjui config generation to `jujutsu.nix` in Home Manager to include custom GitHub ruleset bypass commands (`ctrl+b` and `ctrl+shift+b`).
+- Added `overlays/cheetah3.nix` to disable `pythonMetadataCheckPhase` for `cheetah3`. 
+  This fixes an issue where the NixOS rebuild fails for `sabnzbd` due to `importlib.metadata.PackageNotFoundError: No package metadata was found for cheetah3` during the Python package evaluation in `nixos-unstable`.
+
 ## 2026-07-20

 - Added `overlays/paho-mqtt.nix` to disable paho-mqtt's flaky, socket-based
@@ -28,11 +28,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784123936,
-        "narHash": "sha256-IOWwQMJhUxcojm0MRvuKs1fKLH727u4+hHeEOPhdUyA=",
+        "lastModified": 1784500460,
+        "narHash": "sha256-UvORnAxTRHax7RG74W8Z2t4GvIkX6AjJ5kk0QlwZomo=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "a4cf1d10853b0d2be19b9eca35d749e201d70b55",
+        "rev": "57a3171f94705599a2499248ca5758d5eb47c0e0",
        "type": "github"
      },
      "original": {
@@ -80,6 +80,22 @@
      }
    },
    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
      "flake": false,
      "locked": {
        "lastModified": 1767039857,
@@ -179,11 +195,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784351324,
-        "narHash": "sha256-By+kuRJZRqs2TuXgtR8vJ8cTKWXw33YG/Yollu5cO1U=",
+        "lastModified": 1784913159,
+        "narHash": "sha256-JWq0BfjO4ktpH5USfQNQzdvHpIDT8fSKD5K7LvdMRFs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "460108009ca1ff69ca2ff19079ca2c838d6e3080",
+        "rev": "079a3b5d1aa6a719920a51316253b7d6dd22738d",
        "type": "github"
      },
      "original": {
@@ -216,6 +232,46 @@
        "type": "github"
      }
    },
+    "nix-caddy-withplugins": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1784936738,
+        "narHash": "sha256-X4w9BrFkisfzla3m1WwDJUicUbI7JRdhzq5aS7rrB0k=",
+        "owner": "MichailiK",
+        "repo": "nix-caddy-withplugins",
+        "rev": "70307cfc568e5434cf42067d797b27c38ea69944",
+        "type": "github"
+      },
+      "original": {
+        "owner": "MichailiK",
+        "ref": "nixos-unstable",
+        "repo": "nix-caddy-withplugins",
+        "type": "github"
+      }
+    },
+    "nix-index-database": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785046085,
+        "narHash": "sha256-UiK+mmZJuLWQVhJ5b2wDzogIYWAesyRm6LA3h3Ulh3Y=",
+        "owner": "nix-community",
+        "repo": "nix-index-database",
+        "rev": "11665045df8b9938ef811a3bfdc65cffb02b4b70",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-index-database",
+        "type": "github"
+      }
+    },
    "nix2vim": {
      "inputs": {
        "flake-utils": "flake-utils_2",
@@ -306,11 +362,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1784280462,
-        "narHash": "sha256-DtoqIqM7VkR6NxAkcLpMwmi02USwWb3JdmNGLyhthc0=",
+        "lastModified": 1784707089,
+        "narHash": "sha256-2V/6imsUgB7mPZlHY54oeVBRDoZbPKnvzwkAHUSSufk=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "293d6abedf0478e681a4dfcfcb35b30fc796a32f",
+        "rev": "b3fe9581c9061c749abef42b6d4ee7b7c05c33fa",
        "type": "github"
      },
      "original": {
@@ -370,11 +426,27 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1784120854,
-        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
        "type": "github"
      },
      "original": {
@@ -384,7 +456,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
      "locked": {
        "lastModified": 1744536153,
        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
@@ -408,11 +480,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784353280,
-        "narHash": "sha256-MV8bFWGuoJCELexhGWWhv0GiWnDY9hpgGXgxB81mr9g=",
+        "lastModified": 1784959021,
+        "narHash": "sha256-Atc5ydxAmAAD5o8e6F8VVxVCOQb82bqi5TRNRUSBvZU=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "697f13fd230047493989b03576419792273c3a9e",
+        "rev": "1166a294990afd245fd72b8d2896075222408399",
        "type": "github"
      },
      "original": {
@@ -427,9 +499,11 @@
        "disko": "disko",
        "home-manager": "home-manager",
        "mac-app-util": "mac-app-util",
+        "nix-caddy-withplugins": "nix-caddy-withplugins",
+        "nix-index-database": "nix-index-database",
        "nix2vim": "nix2vim",
        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
        "nixpkgs-stable": "nixpkgs-stable",
        "nur": "nur",
        "rust-overlay": "rust-overlay",
@@ -440,14 +514,14 @@
    },
    "rust-overlay": {
      "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
-        "lastModified": 1784350408,
-        "narHash": "sha256-OstzLWL5t7Xe14xEC6GIMJCp0PrYNTSA0El7GG2av88=",
+        "lastModified": 1784956772,
+        "narHash": "sha256-5polVWDhgATIQj+RUV2ZlOd5nE6cGJo+C4tOEs5vp6U=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0",
+        "rev": "a163bd01a6e11ac58d4f8d11669da550b5afbbc6",
        "type": "github"
      },
      "original": {
@@ -554,17 +628,17 @@
    },
    "wsl": {
      "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1784058842,
-        "narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
+        "lastModified": 1784642409,
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
        "type": "github"
      },
      "original": {
@@ -40,6 +40,12 @@
      # inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
    };

+    # Caddy with decoupled plugin hashes
+    nix-caddy-withplugins = {
+      url = "github:MichailiK/nix-caddy-withplugins/nixos-unstable";
+      # Important: Do not follow nixpkgs here, per the README
+    };
+
    # Manage disk format and partitioning
    disko = {
      url = "github:nix-community/disko";
@@ -52,6 +58,11 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };

+    nix-index-database = {
+      url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
    # Convert Nix to Neovim config
    nix2vim = {
      url = "github:gytis-ivaskevicius/nix2vim";
@@ -52,7 +52,7 @@ rec {

  # Graphics and VMs
  boot.initrd.kernelModules = [ "amdgpu" ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ "kvm-amd" "it87" ];
  services.xserver.videoDrivers = [ "amdgpu" ];

  # Required binary blobs to boot on this machine
@@ -69,16 +69,16 @@ rec {
  hardware.fancontrol.config = ''
    # Configuration file generated by pwmconfig, changes will be lost
    INTERVAL=10
-    DEVPATH=hwmon0=devices/pci0000:00/0000:00:03.1/0000:06:00.0/0000:07:00.0/0000:08:00.0
-    DEVNAME=hwmon0=amdgpu
-    FCTEMPS=hwmon0/pwm1=hwmon0/temp1_input
-    FCFANS= hwmon0/pwm1=hwmon0/fan1_input
-    MINTEMP=hwmon0/pwm1=50
-    MAXTEMP=hwmon0/pwm1=70
-    MINSTART=hwmon0/pwm1=100
-    MINSTOP=hwmon0/pwm1=10
-    MINPWM=hwmon0/pwm1=10
-    MAXPWM=hwmon0/pwm1=240
+    DEVPATH=hwmon1=devices/pci0000:00/0000:00:03.1/0000:06:00.0/0000:07:00.0/0000:08:00.0
+    DEVNAME=hwmon1=amdgpu
+    FCTEMPS=hwmon1/pwm1=hwmon1/temp1_input
+    FCFANS= hwmon1/pwm1=hwmon1/fan1_input
+    MINTEMP=hwmon1/pwm1=50
+    MAXTEMP=hwmon1/pwm1=70
+    MINSTART=hwmon1/pwm1=100
+    MINSTOP=hwmon1/pwm1=10
+    MINPWM=hwmon1/pwm1=10
+    MAXPWM=hwmon1/pwm1=240
  '';

  # File systems must be declared in order to boot
@@ -154,10 +154,12 @@ lib
      pkgs = pkgsBySystem.${system};
      modules = [
        inputs.home-manager.nixosModules.home-manager
+        inputs.nix-index-database.nixosModules.default
        inputs.disko.nixosModules.disko
        inputs.wsl.nixosModules.wsl
        { imports = (nixFiles ../platforms/nixos); }
        module
+        # (builtins.removeAttrs module [ "home-manager" ])
        {
          home-manager = {
            extraSpecialArgs = {
@@ -179,6 +181,8 @@ lib
    inputs.darwin.lib.darwinSystem {
      inherit system specialArgs;
      modules = [
+        inputs.home-manager.darwinModules.home-manager
+        inputs.nix-index-database.darwinModules.nix-index
        inputs.mac-app-util.darwinModules.default
        {
          imports = (nixFiles ../platforms/nix-darwin);
@@ -223,6 +227,7 @@ lib
      pkgs = pkgsBySystem.${system};
      modules = [
        inputs.home-manager.nixosModules.home-manager
+        inputs.nix-index-database.homeModules.default
        inputs.disko.nixosModules.disko
        inputs.wsl.nixosModules.wsl
        {
@@ -0,0 +1,9 @@
+_inputs: _final: prev: {
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyfinal: pyprev: {
+      cheetah3 = pyprev.cheetah3.overridePythonAttrs (_old: {
+        dontCheckPythonMetadata = true;
+      });
+    })
+  ];
+}
@@ -0,0 +1 @@
+inputs: inputs.nix-caddy-withplugins.overlays.default
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nodejs,
+}:
+
+buildNpmPackage rec {
+  pname = "actualtap";
+  version = "1.0.34";
+
+  src = fetchFromGitHub {
+    owner = "MattFaz";
+    repo = "actualtap";
+    rev = "v${version}";
+    hash = "sha256-I2yb3WCOXYx/6RXiKjePlpChrr9G1il44OdON/SeVCw=";
+  };
+
+  npmDepsHash = "sha256-LlTLwUt0Yja4NSBLbaYPV/keawSJKffno/28rtSj/oQ=";
+
+  dontNpmBuild = true;
+
+  postPatch = ''
+    substituteInPlace src/server.js \
+      --replace-fail 'port: 3001' 'port: process.env.PORT || 3001'
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin
+    cat <<EOF > $out/bin/actualtap
+    #!/bin/sh
+    exec ${lib.getExe nodejs} $out/lib/node_modules/actualtap/src/server.js "\$@"
+    EOF
+    chmod +x $out/bin/actualtap
+  '';
+
+  meta = with lib; {
+    description = "Automatically create transactions in Actual Budget when you use Tap-to-Pay on a mobile device";
+    homepage = "https://github.com/MattFaz/actualtap";
+    license = licenses.gpl3Only;
+    maintainers = [ ];
+  };
+}
@@ -2,21 +2,10 @@

 {
  pkgs,
-  fetchFromGitHub,
  ...
 }:

-# Maintain a static version so that the plugin hash doesn't keep breaking
-(pkgs.caddy.overrideAttrs rec {
-  version = "2.10.2";
-  src = fetchFromGitHub {
-    owner = "caddyserver";
-    repo = "caddy";
-    tag = "v${version}";
-    hash = "sha256-KvikafRYPFZ0xCXqDdji1rxlkThEDEOHycK8GP5e8vk=";
-  };
-}).withPlugins
-  {
+pkgs.caddy.withPlugins {
  plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-    hash = "sha256-xz43pXTsnYmXZDAAUT+vTapoq3O/8br7igGwqZbjFdk=";
-  }
+  hash = "sha256-HuVBmiT3kD6RrDejQ6SnjCN8f7pFdZlGtZFbEf47bks=";
+}
@@ -7,6 +7,7 @@

 let
  cfg = config.nmasur.presets.programs.jujutsu;
+  tomlFormat = pkgs.formats.toml { };
 in

 {
@@ -31,6 +32,31 @@ in
      };
    };

+    xdg.configFile."jjui/config.toml".source = tomlFormat.generate "jjui-config" {
+      actions = [
+        {
+          name = "set-github-bypass";
+          lua = ''
+            exec_shell([[gh api --method PATCH -H "Accept: application/vnd.github+json" /repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/properties/values -f 'properties[][property_name]=Allow-Ruleset-Bypass' -f 'properties[][value]=true']])
+            flash("Set GitHub rule bypass")
+          '';
+          key = "ctrl+b";
+          scope = "revisions";
+          desc = "Set GitHub rule bypass";
+        }
+        {
+          name = "remove-github-bypass";
+          lua = ''
+            exec_shell([[gh api --method PATCH -H "Accept: application/vnd.github+json" /repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/properties/values -f 'properties[][property_name]=Allow-Ruleset-Bypass' -f 'properties[][value]=']])
+            flash("Removed GitHub rule bypass")
+          '';
+          key = "ctrl+shift+b";
+          scope = "revisions";
+          desc = "Remove GitHub rule bypass";
+        }
+      ];
+    };
+
    home.packages = [
      # Required for the fsmonitor to auto-snapshot
      pkgs.stable.watchman
@@ -1,6 +1,6 @@
 {
  config,
-  pkgs,
+  # pkgs,
  lib,
  ...
 }:
@@ -23,17 +23,18 @@ in
    };

    # Create nix-index if doesn't exist
-    home.activation.createNixIndex =
-      let
-        cacheDir = "${config.xdg.cacheHome}/nix-index";
-      in
-      lib.mkIf config.programs.nix-index.enable (
-        config.lib.dag.entryAfter [ "writeBoundary" ] ''
-          if [ ! -d ${cacheDir} ]; then
-              run ${pkgs.nix-index}/bin/nix-index -f ${pkgs.path}
-          fi
-        ''
-      );
+    # Should not be necessary with the nix-index-database flake
+    # home.activation.createNixIndex =
+    #   let
+    #     cacheDir = "${config.xdg.cacheHome}/nix-index";
+    #   in
+    #   lib.mkIf config.programs.nix-index.enable (
+    #     config.lib.dag.entryAfter [ "writeBoundary" ] ''
+    #       if [ ! -d ${cacheDir} ]; then
+    #           run ${pkgs.nix-index}/bin/nix-index -f ${pkgs.path}
+    #       fi
+    #     ''
+    #   );

  };

@@ -48,11 +48,15 @@ in
        tilesize = 44;

        persistent-apps = map mkDockApp [
-          "${pkgs._1password-gui}/Applications/1Password.app"
+          "/Applications/1Password.app"
+          "${pkgs.thunderbird}/Applications/Thunderbird.app"
          "${pkgs.slack}/Applications/Slack.app"
+          "/System/Applications/Reminders.app"
          "/System/Applications/Calendar.app"
+          "/Applications/Claude.app"
          "${pkgs.firefox-unwrapped}/Applications/Firefox.app"
          "/System/Applications/Messages.app"
+          "/System/Applications/Preview.app"
          "/System/Applications/Mail.app"
          "/Applications/zoom.us.app"
          "${config.programs.ghostty.package}/Applications/Ghostty.app"
@@ -61,7 +65,6 @@ in
          # refuses to launch it ("damaged"). See presets/programs/homebrew.nix.
          "/Applications/Discord.app"
          "${pkgs.obsidian}/Applications/Obsidian.app"
-          "${pkgs.thunderbird}/Applications/Thunderbird.app"
        ];
      };
    };
@@ -33,7 +33,7 @@ in
    xdg.configFile."hammerspoon/Spoons/Launcher.spoon/init.lua".source =
      pkgs.replaceVars ./Spoons/Launcher.spoon/init.lua
        {
-          discord = "${pkgs.discord}/Applications/Discord.app";
+          discord = "Discord.app";
          firefox = "${pkgs.firefox-unwrapped}/Applications/Firefox.app";
          ghostty = "${pkgs.ghostty-bin}/Applications/Ghostty.app";
          obsidian = "${pkgs.obsidian}/Applications/Obsidian.app";
@@ -21,6 +21,9 @@ in

    home.packages = [

+      pkgs.nmasur.ren-find # Rename files
+      pkgs.nmasur.rep-grep # Replace text in files
+
      # Charm tools

      pkgs.glow # Markdown previews
@@ -29,8 +29,6 @@ in
      pkgs.nixfmt # Format Nix code
      pkgs.nmasur.jqr # FZF fq JSON tool
      pkgs.nmasur.osc # Clipboard over SSH
-      pkgs.nmasur.ren-find # Rename files
-      pkgs.nmasur.rep-grep # Replace text in files
      pkgs.pandoc # Convert text documents
      pkgs.qrencode # Generate qr codes
      pkgs.spacer # Output lines in terminal
@@ -109,8 +109,9 @@ in
    };

    # Allow web traffic to Caddy
-    nmasur.presets.services.caddy.routes = [
+    nmasur.presets.services.caddy.routes = lib.mkAfter [
      {
+        group = "actual";
        match = [ { host = [ hostnames.budget ]; } ];
        handle = [
          {
@@ -0,0 +1,122 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.actualtap;
+
+  actualtapConfigType = lib.types.submodule {
+    options = {
+      port = lib.mkOption {
+        type = lib.types.port;
+        description = "Port to use for the actualtap instance localhost";
+      };
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = "Path prefix for this actualtap instance on the reverse proxy";
+      };
+      budgetIdFile = lib.mkOption {
+        type = lib.types.path;
+        description = "Path to the age encrypted file containing the budget ID";
+      };
+      apiKeyFile = lib.mkOption {
+        type = lib.types.path;
+        description = "Path to the age encrypted file containing the API key";
+      };
+    };
+  };
+
+in
+
+{
+  options.nmasur.presets.services.actualtap = {
+    enable = lib.mkEnableOption "ActualTap instances";
+    instances = lib.mkOption {
+      type = lib.types.attrsOf actualtapConfigType;
+      default = { };
+      description = "Attribute set of ActualTap instances.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    users.users.actualtap = {
+      isSystemUser = true;
+      group = "shared";
+      uid = 981;
+    };
+
+    systemd.services = lib.mapAttrs' (
+      name: instance:
+      lib.nameValuePair "actualtap-${name}" {
+        enable = true;
+        description = "ActualTap - ${name}";
+        after = [
+          "network.target"
+          "actual.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+
+        environment = {
+          PORT = builtins.toString instance.port;
+          ACTUAL_URL = "http://127.0.0.1:${builtins.toString config.nmasur.presets.services.actualbudget.port}";
+        };
+
+        serviceConfig = {
+          User = config.users.users.actualtap.name;
+          Group = config.users.users.actualtap.group;
+          EnvironmentFile = [
+            config.secrets."actualbudget-password".dest
+            config.secrets."actualtap-${name}-budget-id".dest
+            config.secrets."actualtap-${name}-api-key".dest
+          ];
+          ExecStart = lib.getExe pkgs.nmasur.actualtap;
+          Restart = "on-failure";
+          WorkingDirectory = "/var/lib/actualtap-${name}";
+          StateDirectory = "actualtap-${name}";
+        };
+      }
+    ) cfg.instances;
+
+    secrets = lib.mkMerge (
+      lib.mapAttrsToList (name: instance: {
+        "actualtap-${name}-budget-id" = {
+          source = instance.budgetIdFile;
+          dest = "${config.secretsDirectory}/actualtap-${name}-budget-id";
+          owner = config.users.users.actualtap.name;
+          group = config.users.users.actualtap.group;
+        };
+        "actualtap-${name}-api-key" = {
+          source = instance.apiKeyFile;
+          dest = "${config.secretsDirectory}/actualtap-${name}-api-key";
+          owner = config.users.users.actualtap.name;
+          group = config.users.users.actualtap.group;
+        };
+      }) cfg.instances
+    );
+
+    nmasur.presets.services.caddy.routes = lib.mapAttrsToList (name: instance: {
+      group = "actual";
+      match = [
+        {
+          host = [ hostnames.budget ];
+          path = [ "${instance.path}*" ];
+        }
+      ];
+      handle = [
+        {
+          handler = "rewrite";
+          strip_path_prefix = instance.path;
+        }
+        {
+          handler = "reverse_proxy";
+          upstreams = [ { dial = "localhost:${builtins.toString instance.port}"; } ];
+        }
+      ];
+    }) cfg.instances;
+  };
+}
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBIUkxs
+RmFmNmo3L2MwVVhmeTdUVGdXOWRIVDd5c21EVnhtWWUwTVpWbW5zCnNSS1luUHNW
+YlIwbmVrbTJTUUdOQkpCbGpNQm1tYlRrbDhaWEhJUDRHaDQKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIHJIYTd4eFo3aklGQ1Evb0JPOGZSWDh1Q1pXU3ExZ1pmR29qT2lP
+bFcwREkKTWFXMlZCeXpoMi92OXdtN3plekE2dFlCbk44YncxLzJYZzE2amNIVnEz
+QQotPiBzc2gtZWQyNTUxOSBuanZYNUEgWi8rNnV4VWtwUEEzbys4Skl1Z0p0Ly9r
+ZS82dzFJeEhHVHpSNU04WU5CVQpIMWhQcDdNeU45dVpkVyswQW1RK2Q0aXpkZXMz
+MXAraG9KUFBDUVdFcTRVCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBUQWQvU0JwdTlX
+UkJYakdYTjU1YlBzWHEzY3FQa1dhMmp6UjE0RTJYN1ZBCmk0SWc0Ym1mUTdVL1NJ
+ZXJFVkNmckRaVnlkSmUxL0dSUlo5VER0b2x3WVUKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IHBIQllKcmczOVJvSzRMZW9mVjZjTFo1ZjVJNDRvUG9pSnlRZDBUWEtoV2sK
+aGhPeUpkVEZ0QWxDM1VJZzlDWEZ2VnFuTFRCVDkzY2JLVWNQTUE2STMyRQotLS0g
+cXhWR2lQWnkxOUZhRzhOTS96UDJWVmZEQVpZTkF1MmlpNCtEbDZzRGZaYwof4Y/t
+N5osO/bY+ojbarYoCBq12NSaKKlL6MNy1OQZOuOF0IP1CZ0fLY+R9DgJcNol3I73
+q4JyXbfohWtG/2NdIwhRXumQ/OnY1maVvg==
+-----END AGE ENCRYPTED FILE-----
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyAyRTF0
+L3Y3ZVJ0YlJSbzR6cnNWeVNRd2czNUVKWmtQNFA3VFRlb053d1dRCmxmTGRGSFhL
+UmlSdUVQNzVPcktIdE0yVWFhVGpGYVRPMEpNQll6Z0owNFEKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIHE5L09YNWFaT0JLT0o0YjdQY01GRDByeFVXeE9LMXNFNGFCWkFO
+ZStBd28KamhUYzd1VXhlL3RqY3hlMG5UeGFJemY2ajRhVGZ2ZDJNb1hSRHkrUFNt
+NAotPiBzc2gtZWQyNTUxOSBuanZYNUEgbDdMVzNTT1Y2VmVsZyt2WTh0RWdUVEpY
+c0RoRWE2S2ZyZXFuTllFU1FVWQpmeDF0MEp2NEYxS2k1ZlJaTVNWMWdRRlJ1UWh2
+Wm0xbHhGYXhoWGtDbVkwCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBJeERSTUpPbzhu
+NGQrZXRoWGJEalBlMHdQUmlsVkF2TEZBOStOZ3ExN2lzClRZeE5yZG1uY3ZRRDNy
+am5uTjRiTnpLSkhURWZTNzgyVVdOVDA2WlpqZmsKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IGticUNqWDJ0RTJTZmdXdzVWM0xsejBvYUJ3MXZvNWw1OWE3aUJMTCtSQ2MK
+KzMyZW5jZUNIV1puVFlLMEdyeUdoUUt3MjlzTUgvWlFob0QwME9ZZ1VVNAotLS0g
+VU5nOFA0Nzd3ckhnRHdSNkVSNG9tZks5VmVoZnlmU1R6bzl4ZVdMcGlLTQqZWLkP
+VdZPvgCJ8A9UcKWl+5f8Jjlc79d6ib8wwfMRl0zK4SNQJGgcXr6sFuieY3H4DzRb
+MuqKZQBBIKtPAmrvmzcKgNSeiJoZjG801Jqd3lpkJEA=
+-----END AGE ENCRYPTED FILE-----
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBSR2tx
+b2FyZ2t0d2xONGIvYjJrcVU1VTNHT3RVbjlWT1IyUW1CM1BkNVNzCmJmNFFFbUR6
+WG9ncmhuakFzVHhSVEtZUlR4dWg3cWRzUXc2ZmVpZ3NqZ1EKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIGFFRmFsVjdkTkFZY29XdWo4akVDaEZHMTdXRDY4N2U5WE13a1JD
+QWdXMkUKbnVXazZpSzZqTHJqamFUdDJMMUpiTEhLeTJqcVNmV2dncjVvZlNNT09M
+WQotPiBzc2gtZWQyNTUxOSBuanZYNUEgTzV0eGpSU2plaTFCTXZTbFB2R1VOQnFn
+d01EUXcza3JuR3RFUzE3N2MzawpqT0ZRQ1hPTFcvZ2ZOQjNGcThYL1lSdURXbWlv
+NkRSRERJQ1IvSHdMa2M4Ci0+IHNzaC1lZDI1NTE5IENxSU9VQSBvQjZkYVJjYy9H
+L3BSVWRPczlOOGV2RkRBSGlIakF1cG1yQk9tbXNWdWlZCnZGaGxvdkZVWXp2THhK
+RnRBQ2VSNkErU0VnOWlYbkY2U1JCZTlBSFFUK0UKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IFQrdUtDdENRK2dnN2t3dVBsN0oxYkNRSm43aDREa3ZJQjhvTWpxM0FWVEkK
+OTNCVFRTclFFckFkQXBzWnBybWxKRm92TEFqRU5ZWkprdytJQm5RT2tOYwotLS0g
+Nk5WZXhZM0VXaHpVK2EzeGFqNS9hZUlLQjlJRU9EMnVLL3VRV3RKTkVRcwpA8GqA
+24oLFT1VIE5eNl/Ltd102W4J6jafmiizCEu3/7EULI/X5oh2LvjSjOuivW6y+Gbu
+rXITu245mDM6ZqE2LikYR6134QSC2lmNvw==
+-----END AGE ENCRYPTED FILE-----
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyAyakVC
+ZGZqMitTVVc0KzJSV0c3V3Ryc2JSWXp0V2I4YURmektyVGh5a2hBCjlCaGQ4SmxQ
+VzhBRWw4SW9QamdVZDVvK3laVkNuWTRhMW1hR1ZmS1lqOWsKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIE5oVVdMWHZlSEJ2akc1UVcrdnNNOWgzaGFhb2VWNlNxQU5yQzM0
+dGk3eGsKaE1Ba3BneC9yQTBpcXo3YWhqcDZheUJnbE5vS0Z0WUNzYnQ1a2o5OVN4
+YwotPiBzc2gtZWQyNTUxOSBuanZYNUEgcitOTmNKS04xc01LNTZKbE9QblVKRUVr
+ZHdyY0Q2VWtUQ1VOQnFZTjNpbwp0RmNTV2RwR2RlcG5odE81VEFxNGhJOVFYd3Zk
+TU9IanIzMFkxVU1GUlQwCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBmRC92WjRkTVFz
+eGlFa1VhcEk1NVpkVnFVVkpZRTdzMGR1aWNuWW9ZTFFVCkFRaVM5a1hjcjV3dU1m
+WHNnSWhSN1l4ZVEwUkhXZVg3UFRZQStSVllFcEEKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IFUreGtraXo5aXM2OTFKcjZkL2p0ZEVwaEFXL3B5R2M1Q1J2elZYVityRUkK
+bk80bnp1UzgzdmFqV0RJaVFhaytPWnJpQ0Y4Wmg1M2xLbGJyUzZzazlMUQotLS0g
+dlZiRzZVSkYwbEVDaEVzZUhoRUkwMUpTM3pyOWJBaHUzZG8vejdmVklBYwpirejN
+5cR1roLwVsunUkn+gnaMCYk+tDlaZABGXAC94k9RQVF06KquxeK0S17KOeQNn9Gb
+N70JDklLLfuDsWbry6rIDYqsiEmTKi0WXhn44E1PaXQ=
+-----END AGE ENCRYPTED FILE-----
@@ -32,15 +32,11 @@ in
        reverseProxyAuth.enable = false;
        enableBookConversion = true;
        enableBookUploading = true;
+        # Point this directly to the folder containing your 'metadata.db' file
        calibreLibrary = libraryPath;
      };
    };

-    # metadata.db lives in /var/lib/calibre-web-db and is symlinked into the
-    # library dir; ProtectSystem=strict in the upstream module blocks writes
-    # through symlinks unless the real target path is also listed.
-    systemd.services.calibre-web.serviceConfig.ReadWritePaths = [ "/var/lib/calibre-web-db" ];
-
    # Allow web traffic to Caddy
    nmasur.presets.services.caddy.routes = [
      {
@@ -65,6 +61,13 @@ in
    # Grant user access to Calibre directories
    users.users.${username}.extraGroups = [ "calibre-web" ];

+    # Ensure the service has explicit filesystem read/write access to the library path
+    # This fixes the "sqlite3.OperationalError: unable to open database file" bug
+    systemd.services.calibre-web.serviceConfig.ReadWritePaths = [
+      libraryPath
+      "/var/lib/calibre-web-db"
+    ];
+
    # Run a backup on a schedule
    systemd.timers.calibre-backup = lib.mkIf config.nmasur.presets.services.litestream.enable {
      timerConfig = {
@@ -20,6 +20,9 @@ in
      };
    };

+    # Fix BASE_URL for downloading backups
+    systemd.services.mealie.environment.BASE_URL = lib.mkForce "https://${hostnames.recipes}";
+
    nmasur.presets.services.caddy.routes = [
      {
        match = [ { host = [ hostnames.recipes ]; } ];
@@ -57,9 +57,10 @@ in
    ];

    # Extending time for home-manager build for things like nix-index cache
-    systemd.services."home-manager-${username}" = {
-      serviceConfig.TimeoutStartSec = lib.mkForce "45m";
-    };
+    # Should not be necessary with nix-index-database flake
+    # systemd.services."home-manager-${username}" = {
+    #   serviceConfig.TimeoutStartSec = lib.mkForce "45m";
+    # };

    allowUnfreePackages = config.home-manager.users.${username}.allowUnfreePackages;

@@ -21,6 +21,23 @@ in
      };
      services = {
        actualbudget.enable = lib.mkDefault true;
+        actualtap = {
+          enable = lib.mkDefault true;
+          instances = {
+            budget1 = {
+              port = 3031;
+              path = "/actualtap1";
+              budgetIdFile = ../presets/services/actualtap/budget1-id.age;
+              apiKeyFile = ../presets/services/actualtap/budget1-api-key.age;
+            };
+            budget2 = {
+              port = 3032;
+              path = "/actualtap2";
+              budgetIdFile = ../presets/services/actualtap/budget2-id.age;
+              apiKeyFile = ../presets/services/actualtap/budget2-api-key.age;
+            };
+          };
+        };
        caddy.enable = lib.mkDefault true;
        cloudflare.enable = lib.mkDefault true;
        cloudflared.enable = lib.mkDefault true;
Author	SHA1	Message	Date
Noah Masur	59685bf023	add actualtap for working with actual api	2026-07-29 00:46:26 +00:00
Noah Masur	a3a5c516ce	fix: pwmconfig hardware ids chnaged	2026-07-28 20:10:59 -04:00
Noah Masur	033026bff8	add nix-index-database flake input	2026-07-28 18:34:12 -04:00
Noah Masur	5929b3201d	fix calibre-web write issue	2026-07-28 22:04:29 +00:00
Noah Masur	373beb6daf	move ren and rep to experimental i don't like having to build them	2026-07-28 16:58:10 -04:00
Noah Masur	8cef9bfb59	feat(jjui): add custom github ruleset bypass commands	2026-07-28 11:34:48 -04:00
Noah Masur	98d426ce89	more dock cleanup	2026-07-28 11:34:42 -04:00
Noah Masur	e107431fa9	fix(python): disable python metadata check for cheetah3 to fix sabnzbd build	2026-07-28 11:34:39 -04:00
Noah Masur	1960d84e7a	re-arrange dock with preview and thunderbird	2026-07-25 14:35:26 -04:00
Noah Masur	671a17af76	fix discord and 1pass dock link	2026-07-25 09:29:58 -04:00
github-actions[bot]andgithub-actions[bot]	71709776f9	flake.lock: Update Flake lock file updates: • Updated input 'darwin': 'github:lnl7/nix-darwin/a4cf1d10853b0d2be19b9eca35d749e201d70b55' (2026-07-15) → 'github:lnl7/nix-darwin/57a3171f94705599a2499248ca5758d5eb47c0e0' (2026-07-19) • Updated input 'home-manager': 'github:nix-community/home-manager/460108009ca1ff69ca2ff19079ca2c838d6e3080' (2026-07-18) → 'github:nix-community/home-manager/079a3b5d1aa6a719920a51316253b7d6dd22738d' (2026-07-24) • Updated input 'nix-caddy-withplugins': 'github:MichailiK/nix-caddy-withplugins/79db67d97207b6e32eaba69d5c3e6d7e63144154' (2026-06-14) → 'github:MichailiK/nix-caddy-withplugins/70307cfc568e5434cf42067d797b27c38ea69944' (2026-07-24) • Updated input 'nixpkgs': 'github:nixos/nixpkgs/753cc8a3a87467296ddd1fa93f0cc3e81120ee46' (2026-07-15) → 'github:nixos/nixpkgs/e2587caef70cea85dd97d7daab492899902dbf5d' (2026-07-23) • Updated input 'nixpkgs-stable': 'github:nixos/nixpkgs/293d6abedf0478e681a4dfcfcb35b30fc796a32f' (2026-07-17) → 'github:nixos/nixpkgs/b3fe9581c9061c749abef42b6d4ee7b7c05c33fa' (2026-07-22) • Updated input 'nur': 'github:nix-community/nur/697f13fd230047493989b03576419792273c3a9e' (2026-07-18) → 'github:nix-community/nur/1166a294990afd245fd72b8d2896075222408399' (2026-07-25) • Updated input 'rust-overlay': 'github:oxalica/rust-overlay/3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0' (2026-07-18) → 'github:oxalica/rust-overlay/a163bd01a6e11ac58d4f8d11669da550b5afbbc6' (2026-07-25) • Updated input 'wsl': 'github:nix-community/NixOS-WSL/24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad' (2026-07-14) → 'github:nix-community/NixOS-WSL/eaeb18da90024448a60eb1ec7132eafa4003404e' (2026-07-21)	2026-07-25 06:05:57 +00:00
Noah Masur	829af86dd8	switch to nix caddy plugin module in order to prevent frequent need to re-hash	2026-07-21 15:08:29 +00:00
Noah Masur	e7fd5eb770	update caddy hash	2026-07-20 23:12:23 +00:00
Noah Masur	f0b400d134	set base url for mealie	2026-07-20 22:32:03 +00:00
				`@@ -0,0 +1 @@`
				`inputs: inputs.nix-caddy-withplugins.overlays.default`