add ssl certs for darwin even though it didn't work

.gitignore

@@ -4,5 +4,3 @@
 **/.direnv/**
 result
 .luarc.json
-private/**
-!private/**.age

README.md

@@ -1,17 +1,6 @@
 This repository contains configuration files for my NixOS, macOS, and WSL
 hosts.
 
-They are organized and managed by [Nix](https://nixos.org), so some of the
-configuration may be difficult to translate to a non-Nix system.
-
-However, some of the configurations are easier to lift directly:
-
-- [Neovim](https://github.com/nmasur/dotfiles/tree/master/modules/neovim/lua)
-- [Fish functions](https://github.com/nmasur/dotfiles/tree/master/modules/shell/fish/functions)
-- [More fish aliases](https://github.com/nmasur/dotfiles/blob/master/modules/shell/fish/default.nix)
-- [Git aliases](https://github.com/nmasur/dotfiles/blob/master/modules/shell/git.nix)
-- [Hammerspoon](https://github.com/nmasur/dotfiles/tree/master/modules/darwin/hammerspoon)
-
 ---
 
 # Installation
@@ -25,7 +14,7 @@ installer disk:
 
 ```bash
 lsblk # Choose the disk you want to wipe
-nix-shell -p nixVersions.stable
+nix-shell -p nixFlakes
 nix run github:nmasur/dotfiles#installer -- nvme0n1 desktop
 ```
 
@@ -35,7 +24,7 @@ If you're already running NixOS, you can switch to this configuration with the
 following command:
 
 ```bash
-nix-shell -p nixVersions.stable
+nix-shell -p nixFlakes
 sudo nixos-rebuild switch --flake github:nmasur/dotfiles#desktop
 ```
 
@@ -46,16 +35,10 @@ WSL](https://xeiaso.net/blog/nix-flakes-4-wsl-2022-05-01), you can switch to
 the WSL configuration:
 
 ```
-nix-shell -p nixVersions.stable
+nix-shell -p nixFlakes
 sudo nixos-rebuild switch --flake github:nmasur/dotfiles#wsl
 ```
 
-You should also download the
-[FiraCode](https://github.com/ryanoasis/nerd-fonts/releases/download/v2.2.2/FiraCode.zip)
-font and install it on Windows. Install [Alacritty](https://alacritty.org/) and
-move the `windows/alacritty.yml` file to
-`C:\Users\<user>\AppData\Roaming\alacritty`.
-
 ## macOS
 
 To get started on a bare macOS installation, first install Nix:

apps/default.nix

@@ -1,23 +0,0 @@
-{ pkgs, ... }: rec {
-
-  default = readme;
-
-  # Format and install from nothing
-  installer = import ./installer.nix { inherit pkgs; };
-
-  # Display the readme for this repository
-  readme = import ./readme.nix { inherit pkgs; };
-
-  # Load the SSH key for this machine
-  loadkey = import ./loadkey.nix { inherit pkgs; };
-
-  # Encrypt secret for all machines
-  encrypt-secret = import ./encrypt-secret.nix { inherit pkgs; };
-
-  # Re-encrypt secrets for all machines
-  reencrypt-secrets = import ./reencrypt-secrets.nix { inherit pkgs; };
-
-  # Connect machine metrics to Netdata Cloud
-  netdata = import ./netdata-cloud.nix { inherit pkgs; };
-
-}

apps/encrypt-secret.nix

@@ -1,19 +0,0 @@
-{ pkgs, ... }: {
-
-  # nix run github:nmasur/dotfiles#encrypt-secret > private/mysecret.age
-
-  type = "app";
-
-  program = builtins.toString (pkgs.writeShellScript "encrypt-secret" ''
-    printf "\nEnter the secret data to encrypt for all hosts...\n\n" 1>&2
-    read -p "Secret: " secret
-    printf "\nEncrypting...\n\n" 1>&2
-    tmpfile=$(mktemp)
-    echo "''${secret}" > ''${tmpfile}
-    ${pkgs.age}/bin/age --encrypt --armor --recipients-file ${
-      builtins.toString ../hosts/public-keys
-    } $tmpfile
-    rm $tmpfile
-  '');
-
-}

apps/installer.nix

@@ -13,12 +13,10 @@
     PARTITION_PREFIX=""
 
     if [ -z "$DISK" ] || [ -z "$FLAKE" ]; then
-        ${pkgs.gum}/bin/gum style --width 50 --margin "1 2" --padding "2 4" \
+        echo "Missing required parameter."
-            --foreground "#fb4934" \
+        echo "Usage: installer -- <disk> <host>"
-            "Missing required parameter." \
+        echo "Example: installer -- nvme0n1 desktop"
-            "Usage: installer -- <disk> <host>" \
+        echo "Flake example: nix run github:nmasur/dotfiles#installer -- nvme0n1 desktop"
-            "Example: installer -- nvme0n1 desktop" \
-            "Flake example: nix run github:nmasur/dotfiles#installer -- nvme0n1 desktop"
         echo "(exiting)"
         exit 1
     fi
@@ -27,14 +25,10 @@
         PARTITION_PREFIX="p"
     esac
 
-    ${pkgs.gum}/bin/gum confirm \
+    parted /dev/''${DISK} -- mklabel gpt
-        "This will ERASE ALL DATA on the disk /dev/''${DISK}. Are you sure you want to continue?" \
+    parted /dev/''${DISK} -- mkpart primary 512MiB 100%
-        --default=false
+    parted /dev/''${DISK} -- mkpart ESP fat32 1MiB 512MiB
-
+    parted /dev/''${DISK} -- set 3 esp on
-    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mklabel gpt
-    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart primary 512MiB 100%
-    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart ESP fat32 1MiB 512MiB
-    ${pkgs.parted}/bin/parted /dev/''${DISK} -- set 3 esp on
     mkfs.ext4 -L nixos /dev/''${DISK}''${PARTITION_PREFIX}1
     mkfs.fat -F 32 -n boot /dev/''${DISK}''${PARTITION_PREFIX}2
 
@@ -42,7 +36,7 @@
     mkdir --parents /mnt/boot
     mount /dev/disk/by-label/boot /mnt/boot
 
-    ${pkgs.nixos-install-tools}/bin/nixos-install --flake github:nmasur/dotfiles#''${FLAKE}
+    nixos-install --flake github:nmasur/dotfiles#''${FLAKE}
   '');
 
 }

apps/loadkey.nix

@@ -1,12 +0,0 @@
-{ pkgs, ... }: {
-
-  type = "app";
-
-  program = builtins.toString (pkgs.writeShellScript "loadkey" ''
-    printf "\nEnter the seed phrase for your SSH key...\n"
-    printf "\nThen press ^D when complete.\n\n"
-    ${pkgs.melt}/bin/melt restore ~/.ssh/id_ed25519
-    printf "\n\nContinuing activation.\n\n"
-  '');
-
-}

apps/netdata-cloud.nix

@@ -1,19 +0,0 @@
-{ pkgs, ... }: {
-
-  type = "app";
-
-  program = builtins.toString (pkgs.writeShellScript "netdata-cloud" ''
-    if [ "$EUID" -ne 0 ]; then
-      echo "Please run as root"
-      exit 1
-    fi
-    mkdir --parents --mode 0750 /var/lib/netdata/cloud.d
-    printf "\nEnter the claim token for netdata cloud...\n\n"
-    read -p "Token: " token
-    echo "''${token}" > /var/lib/netdata/cloud.d/token
-    chown -R netdata:netdata /var/lib/netdata
-    ${pkgs.netdata}/bin/netdata-claim.sh -id=$(uuidgen)
-    printf "\n\nNow restart netdata service.\n\n"
-  '');
-
-}

apps/reencrypt-secrets.nix

@@ -1,27 +0,0 @@
-{ pkgs, ... }: {
-
-  # nix run github:nmasur/dotfiles#reencrypt-secrets ./private
-
-  type = "app";
-
-  program = builtins.toString (pkgs.writeShellScript "reencrypt-secrets" ''
-    if [ $# -eq 0 ]; then
-      echo "Must provide directory to reencrypt."
-      exit 1
-    fi
-    encrypted=$1
-    for encryptedfile in ''${1}/*; do
-      tmpfile=$(mktemp)
-      echo "Decrypting ''${encryptedfile}..."
-      ${pkgs.age}/bin/age --decrypt \
-        --identity ~/.ssh/id_ed25519 $encryptedfile > $tmpfile
-      echo "Encrypting ''${encryptedfile}..."
-      ${pkgs.age}/bin/age --encrypt --armor --recipients-file ${
-        builtins.toString ../hosts/public-keys
-      } $tmpfile > $encryptedfile
-      rm $tmpfile
-    done
-    echo "Finished."
-  '');
-
-}

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1666776005,
+        "lastModified": 1662478528,
-        "narHash": "sha256-HwSMF19PpczfqNHKcFsA6cF4PVbG00uUSdbq6q3jB5o=",
+        "narHash": "sha256-Myjd0HPL5lXri3NXOcJ6gP7IKod2eMweQBKM4uxgEGw=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "f6648ca0698d1611d7eadfa72b122252b833f86c",
+        "rev": "3b69bf3cc26ae19de847bfe54d6ab22d7381a90a",
         "type": "github"
       },
       "original": {
@@ -60,11 +60,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1666903647,
+        "lastModified": 1663328500,
-        "narHash": "sha256-sFI1Gh9DTGzHnBINondupUGYbe+T0wZcpcZjkW0qffM=",
+        "narHash": "sha256-7n+J/exp8ky4dmk02y5a9R7CGmJvHpzrHMzfEkMtSWA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "213a06295dff96668a1d673b9fd1c03ce1de6745",
+        "rev": "5427f3d1f0ea4357cd4af0bffee7248d640c6ffc",
         "type": "github"
       },
       "original": {
@@ -74,49 +74,13 @@
         "type": "github"
       }
     },
-    "nixlib": {
-      "locked": {
-        "lastModified": 1636849918,
-        "narHash": "sha256-nzUK6dPcTmNVrgTAC1EOybSMsrcx+QrVPyqRdyKLkjA=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "28a5b0557f14124608db68d3ee1f77e9329e9dd5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixos-generators": {
-      "inputs": {
-        "nixlib": "nixlib",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1666812839,
-        "narHash": "sha256-0nBDgjPU+iDsvz89W+cDEyhnFGSwCJmwDl/gMGqYiU0=",
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "rev": "41f3518bc194389df22a3d198215eae75e6b5ab9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1666959691,
+        "lastModified": 1663357389,
-        "narHash": "sha256-TRpWA3t8ata79HOGtFd5dDCl1kJQmIE16PDF53/Hcxo=",
+        "narHash": "sha256-oYA2nVRSi6yhCBqS5Vz465Hw+3BQOVFEhfbfy//3vTs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "448a599c49978c2794401bfc3a2e1fba1a8663be",
+        "rev": "da6a05816e7fa5226c3f61e285ef8d9dfc868f3c",
         "type": "github"
       },
       "original": {
@@ -143,11 +107,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1667025500,
+        "lastModified": 1663440270,
-        "narHash": "sha256-88akaieCIrqta3Uyha7Zv3FJWzKJebb2BrOdZba1zdI=",
+        "narHash": "sha256-RkBoLyxamsBqRn9lB9RbFSDg7KHiGgHBsrpffEVXWCQ=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "21dd192519af12a01f1348bbfa86cde47f7aa392",
+        "rev": "7511d58da488c67887745f40fd4846aa8c876d25",
         "type": "github"
       },
       "original": {
@@ -160,7 +124,6 @@
       "inputs": {
         "darwin": "darwin",
         "home-manager": "home-manager",
-        "nixos-generators": "nixos-generators",
         "nixpkgs": "nixpkgs",
         "nur": "nur",
         "wallpapers": "wallpapers",
@@ -205,11 +168,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1666720338,
+        "lastModified": 1661772734,
-        "narHash": "sha256-7V91ZtTz7zDXb6hivktQ9RlBglP+WEkYFSciPJHwMJw=",
+        "narHash": "sha256-DkvAaLDg9D6O0i2MzUknaf/U078K4KWAZaJQmNC/tL8=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "7bfb8f5aa91fee30a189eae32cda8ddc465076df",
+        "rev": "c1b0259313f661cf74051c916cf3bb4f061ce11f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -32,15 +32,9 @@
       flake = false;
     };
 
-    # Used to generate NixOS images for other platforms
-    nixos-generators = {
-      url = "github:nix-community/nixos-generators";
-      inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  };
+  outputs = { self, nixpkgs, darwin, wsl, home-manager, nur, wallpapers }:
-
-  outputs = { self, nixpkgs, ... }@inputs:
 
     let
 
@@ -51,7 +45,7 @@
         gitName = fullName;
         gitEmail = "7386960+nmasur@users.noreply.github.com";
         mailServer = "noahmasur.com";
-        dotfilesRepo = "git@github.com:nmasur/dotfiles";
+        dotfilesRepo = "https://github.com/nmasur/dotfiles";
       };
 
       # System types to support.
@@ -61,38 +55,33 @@
       # Helper function to generate an attrset '{ x86_64-linux = f "x86_64-linux"; ... }'.
       forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
 
-    in rec {
+    in {
 
       nixosConfigurations = {
-        desktop = import ./hosts/desktop { inherit inputs globals; };
+        desktop = import ./hosts/desktop {
-        wsl = import ./hosts/wsl { inherit inputs globals; };
+          inherit nixpkgs home-manager nur globals wallpapers;
-        oracle = import ./hosts/oracle { inherit inputs globals; };
+        };
+        wsl = import ./hosts/wsl { inherit nixpkgs wsl home-manager globals; };
       };
 
       darwinConfigurations = {
-        macbook = import ./hosts/macbook { inherit inputs globals; };
+        macbook = import ./hosts/macbook {
-      };
+          inherit nixpkgs darwin home-manager nur globals;
-
-      # For quickly applying local settings with:
-      # home-manager switch --flake .#desktop
-      homeConfigurations = {
-        desktop =
-          nixosConfigurations.desktop.config.home-manager.users.${globals.user}.home;
-        macbook =
-          darwinConfigurations.macbook.config.home-manager.users."Noah.Masur".home;
-      };
-
-      # Package servers into images with a generator
-      packages.x86_64-linux = with inputs; {
-        aws = import ./hosts/aws {
-          inherit inputs globals;
-          system = "x86_64-linux";
         };
       };
 
       apps = forAllSystems (system:
         let pkgs = import nixpkgs { inherit system; };
-        in import ./apps { inherit pkgs; });
+        in rec {
+          default = readme;
+
+          # Format and install from nothing
+          installer = import ./apps/installer.nix { inherit pkgs; };
+
+          # Display the readme for this repository
+          readme = import ./apps/readme.nix { inherit pkgs; };
+
+        });
 
       devShells = forAllSystems (system:
         let pkgs = import nixpkgs { inherit system; };
@@ -112,7 +101,6 @@
               vault
               awscli2
               google-cloud-sdk
-              ansible
               kubectl
               kubernetes-helm
               kustomize

hosts/aws/default.nix

@@ -1,32 +0,0 @@
-{ inputs, globals, ... }:
-
-with inputs;
-
-nixos-generators.nixosGenerate {
-  inherit system;
-  format = "amazon";
-  modules = [
-    home-manager.nixosModules.home-manager
-    {
-      user = globals.user;
-      fullName = globals.fullName;
-      dotfilesRepo = globals.dotfilesRepo;
-      gitName = globals.gitName;
-      gitEmail = globals.gitEmail;
-      networking.hostName = "sheep";
-      gui.enable = false;
-      colorscheme = (import ../modules/colorscheme/gruvbox);
-      passwordHash = null;
-      publicKey =
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
-      # AWS settings require this
-      permitRootLogin = "prohibit-password";
-    }
-    ../../hosts/common.nix
-    ../../modules/nixos
-    ../../modules/services/sshd.nix
-  ] ++ [
-    # Required to fix diskSize errors during build
-    ({ ... }: { amazonImage.sizeMB = 16 * 1024; })
-  ];
-}

hosts/aws/main.tf

@@ -1,80 +0,0 @@
-locals {
-  image_file = one(fileset(path.root, "result/nixos-amazon-image-*.vhd"))
-}
-
-# Upload to S3
-resource "aws_s3_object" "image" {
-  bucket = "your_bucket_name"
-  key    = basename(local.image_file)
-  source = local.image_file
-  etag   = filemd5(local.image_file)
-}
-
-# Setup IAM access for the VM Importer
-data "aws_iam_policy_document" "vmimport_trust_policy" {
-  statement {
-    actions = ["sts:AssumeRole"]
-    principals {
-      type        = "Service"
-      identifiers = ["vmie.amazonaws.com"]
-    }
-  }
-}
-
-data "aws_iam_policy_document" "vmimport" {
-  statement {
-    actions = [
-      "s3:GetBucketLocation",
-      "s3:GetObject",
-      "s3:ListBucket",
-    ]
-    resources = [
-      "arn:aws:s3:::${aws_s3_object.image.bucket}",
-      "arn:aws:s3:::${aws_s3_object.image.bucket}/*",
-    ]
-  }
-  statement {
-    actions = [
-      "ec2:ModifySnapshotAttribute",
-      "ec2:CopySnapshot",
-      "ec2:RegisterImage",
-      "ec2:Describe*",
-    ]
-    resources = ["*"]
-  }
-}
-
-resource "aws_iam_role" "vmimport" {
-  name               = "vmimport"
-  assume_role_policy = data.aws_iam_policy_document.vmimport_trust_policy.json
-  inline_policy {
-    name   = "vmimport"
-    policy = data.aws_iam_policy_document.vmimport.json
-  }
-}
-
-# Import to EBS
-resource "aws_ebs_snapshot_import" "image" {
-  disk_container {
-    format = "VHD"
-    user_bucket {
-      s3_bucket = aws_s3_object.image.bucket
-      s3_key    = aws_s3_object.image.key
-    }
-  }
-
-  role_name = aws_iam_role.vmimport.name
-}
-
-# Convert to AMI
-resource "aws_ami" "image" {
-  description         = "Created with NixOS."
-  name                = replace(basename(local.image_file), "/\\.vhd$/", "")
-  virtualization_type = "hvm"
-
-  ebs_block_device {
-    device_name = "/dev/xvda"
-    snapshot_id = aws_ebs_snapshot_import.image.id
-    volume_size = 8
-  }
-}

hosts/aws/workflow.yml

@@ -1,260 +0,0 @@
-name: 'Terraform'
-env:
-
-
-  AWS_ACCOUNT_NUMBER: ''
-  AWS_PLAN_ROLE_NAME: github_actions_plan
-  AWS_APPLY_ROLE_NAME: github_actions_admin
-
-  # Always required. Used for authenticating to AWS, but can also act as your
-  # default region if you don't want to specify in the provider configuration.
-  AWS_REGION: us-east-1
-
-  # You must change these to fit your project.
-  TF_VAR_project: change-me
-  TF_VAR_label: change-me
-  TF_VAR_owner: Your Name Here
-
-  # If storing Terraform in a subdirectory, specify it here.
-  TERRAFORM_DIRECTORY: .
-
-  # Pinned versions of tools to use.
-  # Check for new releases:
-  # - https://github.com/hashicorp/terraform/releases
-  # - https://github.com/fugue/regula/releases
-  # - https://github.com/terraform-linters/tflint/releases
-  TERRAFORM_VERSION: 1.2.6
-  REGULA_VERSION: 2.9.0
-  TFLINT_VERSION: 0.39.1
-
-  # Terraform configuration options
-  TERRAFORM_PARALLELISM: 10
-
-  # These variables are passed to Terraform based on GitHub information.
-  TF_VAR_repo: ${{ github.repository }}
-
-# This workflow is triggered in the following ways.
-on:
-
-  # Any push or merge to these branches.
-  push:
-    branches:
-      - dev
-      - prod
-
-  # Any pull request targeting these branches (plan only).
-  pull_request:
-    branches:
-      - dev
-      - prod
-
-
-  # Any manual trigger on these branches.
-  workflow_dispatch:
-    branches:
-      - dev
-      - prod
-
-# -------------------------------------------------------------------
-# The rest of this workflow can operate without adjustments. Edit the
-# below content at your own risk!
-# -------------------------------------------------------------------
-
-# Used to connect to AWS IAM
-permissions:
-  id-token: write
-  contents: read
-  pull-requests: write
-
-# Only run one workflow at a time for each Terraform state. This prevents
-# lockfile conflicts, especially during PR vs push.
-concurrency: terraform-${{ github.base_ref || github.ref }}
-
-jobs:
-  terraform:
-
-    name: 'Terraform'
-
-    # Change this if you need to run your deployment on-prem.
-    runs-on: ubuntu-latest
-
-    steps:
-
-      # Downloads the current repo code to the runner.
-      - name: Checkout Repo Code
-        uses: actions/checkout@v2
-
-      # Install Nix
-      - name: Install Nix
-        uses: cachix/install-nix-action@v17
-
-      # Build the image
-      - name: Build Image
-        run: nix build .#aws
-
-      # Login to AWS
-      - name: AWS Assume Role
-        uses: aws-actions/configure-aws-credentials@v1.6.1
-        with:
-          role-to-assume: ${{ env.AWS_ROLE_ARN }}
-          aws-region: ${{ env.AWS_REGION }}
-
-      # Exports all GitHub Secrets as environment variables prefixed by
-      # "TF_VAR_", which exposes them to Terraform. The name of each GitHub
-      # Secret must match its Terraform variable name exactly.
-      - name: Export Secrets to Terraform Variables
-        env:
-          ALL_SECRETS: ${{ toJson(secrets) }}
-        run: |
-          echo "$ALL_SECRETS" \
-            | jq "to_entries | .[] | \"TF_VAR_\" + ( .key | ascii_downcase ) + \"=\" + .value" \
-            | tr -d \" >> $GITHUB_ENV
-
-      # Installs the Terraform binary and some other accessory functions.
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_version: ${{ env.TERRAFORM_VERSION }}
-
-      # Checks whether Terraform is formatted properly. If this fails, you
-      # should install the pre-commit hook.
-      - name: Check Formatting
-        run: |
-          terraform fmt -no-color -check -diff -recursive
-
-      # Downloads a Terraform code lint test.
-      - uses: terraform-linters/setup-tflint@v1
-        name: Setup TFLint
-        with:
-          tflint_version: v${{ env.TFLINT_VERSION }}
-
-      # Sets up linting with this codebase.
-      - name: Init TFLint
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: tflint --init
-
-      # Lints the current code.
-      - name: Run TFLint
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          tflint -f compact
-          find ./modules/* -type d -maxdepth 0 | xargs -I __ tflint -f compact --disable-rule=terraform_required_providers --disable-rule=terraform_required_version __
-
-      # Connects to remote state backend and download providers.
-      - name: Terraform Init
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          terraform init \
-            -backend-config="role_arn=${{ env.AWS_STATE_ROLE_ARN }}" \
-            -backend-config="region=us-east-1" \
-            -backend-config="workspace_key_prefix=accounts/${{ env.AWS_ACCOUNT_NUMBER }}/${{ github.repository }}" \
-            -backend-config="key=state.tfstate" \
-            -backend-config="dynamodb_table=global-tf-state-lock"
-
-      # Set the Terraform Workspace to the current branch name.
-      - name: Set Terraform Workspace
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        shell: bash
-        run: |
-          export WORKSPACE=${{ github.base_ref || github.ref_name }}
-          terraform workspace select ${WORKSPACE} || terraform workspace new $WORKSPACE
-          echo "TF_WORKSPACE=$(echo ${WORKSPACE} | sed 's/\//_/g')" >> $GITHUB_ENV
-
-      # Checks differences between current code and infrastructure state.
-      - name: Terraform Plan
-        id: plan
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          terraform plan \
-            -input=false \
-            -no-color \
-            -out=tfplan \
-            -parallelism=${TERRAFORM_PARALLELISM} \
-            -var-file=variables-${TF_WORKSPACE}.tfvars
-
-      # Gets the results of the plan for pull requests.
-      - name: Terraform Show Plan
-        id: show
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: terraform show -no-color tfplan
-
-      # Adds the results of the plan to the pull request.
-      - name: Comment Plan
-        uses: actions/github-script@v6
-        if: github.event_name == 'pull_request'
-        env:
-          STDOUT: "```terraform\n${{ steps.show.outputs.stdout }}```"
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            // 1. Retrieve existing bot comments for the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            })
-            const botComment = comments.find(comment => {
-              return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
-            })
-
-            // 2. Prepare format of the comment
-            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
-            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
-            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
-            <details><summary>Validation Output</summary>
-
-            \`\`\`\n
-            ${{ steps.validate.outputs.stdout }}
-            \`\`\`
-
-            </details>
-
-            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
-
-            <details><summary>Show Plan</summary>
-
-            \`\`\`\n
-            ${process.env.PLAN}
-            \`\`\`
-
-            </details>
-
-            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;
-
-            // 3. If we have a comment, update it, otherwise create a new one
-            if (botComment) {
-              github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: botComment.id,
-                body: output
-              })
-            } else {
-              github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: output
-              })
-            }
-
-      # Downloads Regula and checks whether the plan meets compliance requirements.
-      - name: Regula Compliance Check
-        shell: bash
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          REGULA_URL="https://github.com/fugue/regula/releases/download/v${REGULA_VERSION}/regula_${REGULA_VERSION}_Linux_x86_64.tar.gz"
-          curl -sL "$REGULA_URL" -o regula.tar.gz
-          tar xzf regula.tar.gz
-          terraform show -json tfplan | ./regula run
-
-      # Deploys infrastructure or changes to infrastructure.
-      - name: Terraform Apply
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: |
-          terraform apply \
-            -auto-approve \
-            -input=false \
-            -parallelism=${TERRAFORM_PARALLELISM} \
-            tfplan

hosts/common.nix

@@ -21,11 +21,6 @@
           if pkgs.stdenv.isDarwin then "$HOME/Downloads" else "$HOME/downloads";
       };
     };
-    identityFile = lib.mkOption {
-      type = lib.types.str;
-      description = "Path to existing private key file.";
-      default = "/etc/ssh/ssh_host_ed25519_key";
-    };
     gui = {
       enable = mkEnableOption {
         description = "Enable graphics";
@@ -44,7 +39,6 @@
       else
         "/home/${config.user}");
     };
-
     dotfilesPath = mkOption {
       type = types.path;
       description = "Path of dotfiles repository.";
@@ -65,10 +59,7 @@
   in {
 
     # Enable features in Nix commands
-    nix.extraOptions = ''
+    nix.extraOptions = "experimental-features = nix-command flakes";
-      experimental-features = nix-command flakes
-      warn-dirty = false
-    '';
 
     # Basic common system packages for all devices
     environment.systemPackages = with pkgs; [ git vim wget curl ];

hosts/desktop/default.nix

@@ -1,6 +1,4 @@
-{ inputs, globals, ... }:
+{ nixpkgs, home-manager, nur, globals, wallpapers, ... }:
-
-with inputs;
 
 # System configuration for my desktop
 nixpkgs.lib.nixosSystem {
@@ -14,8 +12,8 @@ nixpkgs.lib.nixosSystem {
       nixpkgs.overlays = [ nur.overlay ];
       # Set registry to flake packages, used for nix X commands
       nix.registry.nixpkgs.flake = nixpkgs;
-      identityFile = "/home/${globals.user}/.ssh/id_ed25519";
       gaming.steam = true;
+      gaming.leagueoflegends = true;
       gaming.legendary = true;
       gui = {
         enable = true;
@@ -35,7 +33,7 @@ nixpkgs.lib.nixosSystem {
     ../../modules/graphical
     ../../modules/gaming
     ../../modules/applications
-    ../../modules/mail/default.nix
+    ../../modules/mail/himalaya.nix
     ../../modules/repositories/notes.nix
     ../../modules/services/keybase.nix
     ../../modules/services/gnupg.nix

hosts/macbook/default.nix

@@ -1,6 +1,4 @@
-{ inputs, globals, ... }:
+{ nixpkgs, darwin, home-manager, nur, globals, ... }:
-
-with inputs;
 
 # System configuration for my work MacBook
 darwin.lib.darwinSystem {
@@ -14,21 +12,18 @@ darwin.lib.darwinSystem {
     })
     home-manager.darwinModules.home-manager
     {
-      identityFile = "/home/${globals.user}/.ssh/id_ed25519";
       gui.enable = true;
       colorscheme = (import ../../modules/colorscheme/gruvbox);
       mailUser = globals.user;
-      networking.hostName = "noah-masur-mac";
       nixpkgs.overlays = [ nur.overlay ];
       # Set registry to flake packages, used for nix X commands
       nix.registry.nixpkgs.flake = nixpkgs;
     }
     ../common.nix
     ../../modules/darwin
-    ../../modules/mail
     ../../modules/applications/alacritty.nix
-    ../../modules/applications/kitty.nix
     ../../modules/applications/discord.nix
+    ../../modules/mail/himalaya.nix
     ../../modules/repositories/notes.nix
     ../../modules/programming/nix.nix
     ../../modules/programming/terraform.nix

hosts/oracle/default.nix

@@ -1,91 +0,0 @@
-{ inputs, globals, ... }:
-
-with inputs;
-
-# System configuration for an Oracle free server
-
-# How to install:
-# https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
-
-nixpkgs.lib.nixosSystem {
-  system = "aarch64-linux";
-  specialArgs = { };
-  modules = [
-    (removeAttrs globals [ "mailServer" ])
-    home-manager.nixosModules.home-manager
-    {
-      gui.enable = false;
-      colorscheme = (import ../../modules/colorscheme/gruvbox);
-
-      # FQDNs for various services
-      networking.hostName = "oracle";
-      bookServer = "books.masu.rs";
-      streamServer = "stream.masu.rs";
-      nextcloudServer = "cloud.masu.rs";
-      transmissionServer = "download.masu.rs";
-      metricsServer = "metrics.masu.rs";
-      vaultwardenServer = "vault.masu.rs";
-      giteaServer = "git.masu.rs";
-
-      # Disable passwords, only use SSH key
-      passwordHash = null;
-      publicKey =
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
-
-      # Nextcloud backup config
-      backupS3 = {
-        endpoint = "s3.us-west-002.backblazeb2.com";
-        bucket = "noahmasur-backup";
-        accessKeyId = "0026b0e73b2e2c80000000005";
-      };
-
-      # Grant access to Jellyfin directories from Nextcloud
-      users.users.nextcloud.extraGroups = [ "jellyfin" ];
-
-      # Wireguard config for Transmission
-      networking.wireguard.interfaces.wg0 = {
-
-        # The local IPs for this machine within the Wireguard network
-        # Any inbound traffic bound for these IPs should be kept on localhost
-        ips = [ "10.66.13.200/32" "fc00:bbbb:bbbb:bb01::3:dc7/128" ];
-
-        peers = [{
-
-          # Identity of Wireguard target peer (VPN)
-          publicKey = "bOOP5lIjqCdDx5t+mP/kEcSbHS4cZqE0rMlBI178lyY=";
-
-          # The public internet address of the target peer
-          endpoint = "86.106.143.132:51820";
-
-          # Which outgoing IP ranges should be sent through Wireguard
-          allowedIPs = [ "0.0.0.0/0" "::0/0" ];
-
-          # Send heartbeat signal within the network
-          persistentKeepalive = 25;
-
-        }];
-
-      };
-
-      # VPN port forwarding
-      services.transmission.settings.peer-port = 57599;
-
-      # Grant access to Transmission directories from Jellyfin
-      users.users.jellyfin.extraGroups = [ "transmission" ];
-    }
-    ./hardware-configuration.nix
-    ../common.nix
-    ../../modules/nixos
-    ../../modules/hardware/server.nix
-    ../../modules/services/sshd.nix
-    ../../modules/services/calibre.nix
-    ../../modules/services/jellyfin.nix
-    ../../modules/services/nextcloud.nix
-    ../../modules/services/cloudflare.nix
-    ../../modules/services/transmission.nix
-    ../../modules/services/prometheus.nix
-    ../../modules/services/vaultwarden.nix
-    ../../modules/services/gitea.nix
-    ../../modules/gaming/minecraft-server.nix
-  ];
-}

hosts/oracle/hardware-configuration.nix

@@ -1,34 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/D5CA-237A";
-    fsType = "vfat";
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
-}

hosts/public-keys

@@ -1,4 +0,0 @@
-# Scan hosts: ssh-keyscan -t ed25519 <hostnames>
-
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s noah
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHVknmPi7sG6ES0G0jcsvebzKGWWaMfJTYgvOue6EULI oracle.masu.rs

hosts/server/default.nix

@@ -0,0 +1,20 @@
+{ nixpkgs, home-manager, globals, ... }:
+
+# System configuration for a generic server
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  specialArgs = { };
+  modules = [
+    globals
+    home-manager.nixosModules.home-manager
+    {
+      networking.hostName = "sheep";
+      gui.enable = false;
+      colorscheme = (import ../../modules/colorscheme/gruvbox);
+      passwordHash =
+        "$6$PZYiMGmJIIHAepTM$Wx5EqTQ5GApzXx58nvi8azh16pdxrN6Qrv1wunDlzveOgawitWzcIxuj76X9V868fsPi/NOIEO8yVXqwzS9UF.";
+    }
+    ../common.nix
+    ../../modules/nixos
+  ];
+}

hosts/wsl/default.nix

@@ -1,6 +1,4 @@
-{ inputs, globals, ... }:
+{ nixpkgs, wsl, home-manager, globals, ... }:
-
-with inputs;
 
 # System configuration for WSL
 nixpkgs.lib.nixosSystem {
@@ -14,7 +12,6 @@ nixpkgs.lib.nixosSystem {
       networking.hostName = "wsl";
       # Set registry to flake packages, used for nix X commands
       nix.registry.nixpkgs.flake = nixpkgs;
-      identityFile = "/home/${globals.user}/.ssh/id_ed25519";
       gui.enable = false;
       colorscheme = (import ../../modules/colorscheme/gruvbox);
       passwordHash =

modules/applications/alacritty.nix

@@ -23,8 +23,8 @@
           key_bindings = [
             # Used for word completion in fish_user_key_bindings
             {
-              key = "Return";
+              key = "L";
-              mods = "Shift";
+              mods = "Control|Shift";
               chars = "\\x1F";
             }
             # Used for searching nixpkgs in fish_user_key_bindings
@@ -34,8 +34,8 @@
               chars = "\\x11F";
             }
             {
-              key = "H";
+              key = "K";
-              mods = "Control|Shift";
+              mods = "Control";
               mode = "~Vi";
               action = "ToggleViMode";
             }

modules/applications/default.nix

@@ -6,7 +6,6 @@
     ./calibre.nix
     ./discord.nix
     ./firefox.nix
-    ./kitty.nix
     ./media.nix
     ./obsidian.nix
     ./qbittorrent.nix

modules/applications/firefox.nix

@@ -33,7 +33,6 @@
           settings = {
             "browser.aboutConfig.showWarning" = false;
             "browser.warnOnQuit" = false;
-            "browser.quitShortcut.disabled" = true;
             "browser.theme.dark-private-windows" = true;
             "browser.toolbars.bookmarks.visibility" = "newtab";
             "browser.startup.page" = 3; # Restore previous session

modules/applications/kitty.nix

@@ -1,76 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  config = lib.mkIf config.gui.enable {
-    home-manager.users.${config.user} = {
-      # xsession.windowManager.i3.config.terminal = "kitty";
-      # programs.rofi.terminal = "${pkgs.kitty}/bin/kitty";
-      programs.kitty = {
-        enable = true;
-        environment = { };
-        extraConfig = "";
-        font.size = 14;
-        keybindings = {
-          "shift+enter" = "send_text all \\x1F";
-          "super+f" = "toggle_fullscreen";
-        };
-        settings = {
-
-          # Colors (adapted from: https://github.com/kdrag0n/base16-kitty/blob/master/templates/default-256.mustache)
-          background = config.colorscheme.base00;
-          foreground = config.colorscheme.base05;
-          selection_background = config.colorscheme.base05;
-          selection_foreground = config.colorscheme.base00;
-          url_color = config.colorscheme.base04;
-          cursor = config.colorscheme.base05;
-          active_border_color = config.colorscheme.base03;
-          inactive_border_color = config.colorscheme.base01;
-          active_tab_background = config.colorscheme.base00;
-          active_tab_foreground = config.colorscheme.base05;
-          inactive_tab_background = config.colorscheme.base01;
-          inactive_tab_foreground = config.colorscheme.base04;
-          tab_bar_background = config.colorscheme.base01;
-
-          # normal
-          color0 = config.colorscheme.base00;
-          color1 = config.colorscheme.base08;
-          color2 = config.colorscheme.base0B;
-          color3 = config.colorscheme.base0A;
-          color4 = config.colorscheme.base0D;
-          color5 = config.colorscheme.base0E;
-          color6 = config.colorscheme.base0C;
-          color7 = config.colorscheme.base05;
-
-          # bright
-          color8 = config.colorscheme.base03;
-          color9 = config.colorscheme.base08;
-          color10 = config.colorscheme.base0B;
-          color11 = config.colorscheme.base0A;
-          color12 = config.colorscheme.base0D;
-          color13 = config.colorscheme.base0E;
-          color14 = config.colorscheme.base0C;
-          color15 = config.colorscheme.base07;
-
-          # extended base16 colors
-          color16 = config.colorscheme.base09;
-          color17 = config.colorscheme.base0F;
-          color18 = config.colorscheme.base01;
-          color19 = config.colorscheme.base02;
-          color20 = config.colorscheme.base04;
-          color21 = config.colorscheme.base06;
-
-          # Scrollback
-          scrolling_lines = 10000;
-          scrollback_pager_history_size = 10; # MB
-          scrollback_pager = ''
-            ${pkgs.neovim}/bin/nvim -c 'setlocal nonumber nolist showtabline=0 foldcolumn=0|Man!' -c "autocmd VimEnter * normal G" -'';
-
-          # Window
-          window_padding_width = 6;
-
-          tab_bar_edge = "top";
-          tab_bar_style = "slant";
-        };
-      };
-    };
-  };
-}

modules/applications/media.nix

@@ -5,7 +5,6 @@
       mpv # Video viewer
       sxiv # Image viewer
       mupdf # PDF viewer
-      zathura # PDF viewer
     ];
   };
 

modules/darwin/default.nix

@@ -5,9 +5,8 @@
     ./fonts.nix
     ./hammerspoon.nix
     ./homebrew.nix
-    ./kitty.nix
-    ./networking.nix
     ./nixpkgs.nix
+    ./ssl.nix
     ./system.nix
     ./tmux.nix
     ./user.nix

modules/darwin/fonts.nix

@@ -9,11 +9,6 @@
       font.normal.family = "FiraCode Nerd Font Mono";
     };
 
-    programs.kitty.font = {
-      package = pkgs.nerdfonts;
-      name = "FiraCode";
-    };
-
   };
 
 }

modules/darwin/hammerspoon/Spoons/Launcher.spoon/init.lua

@@ -56,7 +56,7 @@ function obj:init()
     -- Launcher shortcuts
     self.launcher:bind("ctrl", "space", function() end)
     self.launcher:bind("", "return", function()
-        self:switch("kitty.app")
+        self:switch("Alacritty.app")
     end)
     self.launcher:bind("", "C", function()
         self:switch("Calendar.app")

modules/darwin/homebrew.nix

@@ -29,19 +29,17 @@
     ];
     brews = [
       "trash" # Delete files and folders to trash instead of rm
-      "openjdk" # Required by Apache Directory Studio
     ];
     casks = [
-      "firefox" # Firefox packaging on Nix is broken for macOS
+      "firefox" # Firefox packaging on Nix is broken for MacOS
-      "1password" # 1Password packaging on Nix is broken for macOS
+      "1password" # 1Password packaging on Nix is broken for MacOS
       "scroll-reverser" # Different scroll style for mouse vs. trackpad
       "meetingbar" # Show meetings in menu bar
       "gitify" # Git notifications in menu bar
       "logitech-g-hub" # Mouse and keyboard management
       "mimestream" # Gmail client
-      "obsidian" # Obsidian packaging on Nix is not available for macOS
+      "obsidian" # Obsidian packaging on Nix is not available for MacOS
       "steam" # Not packaged for Nix
-      "apache-directory-studio" # Packaging on Nix is not available for macOS
     ];
   };
 

modules/darwin/kitty.nix

@@ -1,16 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  # MacOS-specific settings for Kitty
-  home-manager.users.${config.user} = {
-    programs.kitty = {
-      darwinLaunchOptions = [ "--start-as=fullscreen" ];
-      font.size = lib.mkForce 20;
-      settings = {
-        shell = "${pkgs.fish}/bin/fish";
-        macos_traditional_fullscreen = true;
-        macos_quit_when_last_window_closed = true;
-      };
-    };
-  };
-
-}

modules/darwin/networking.nix

@@ -1,9 +1,8 @@
-{ config, ... }: {
+{ ... }: {
 
   networking = {
-    computerName = "${config.fullName}'\\''s Mac";
+    computerName = "MacBook"; # Host name
-    # Adjust if necessary
+    hostName = "MacBook";
-    # hostName = "";
   };
 
 }

modules/darwin/nixpkgs.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }: {
+{ config, lib, ... }: {
 
   home-manager.users.${config.user} = {
 
@@ -18,13 +18,6 @@
             commandline --function execute
           '';
         };
-        rebuild-home = lib.mkForce {
-          body = ''
-            git -C ${config.dotfilesPath} add --intent-to-add --all
-            commandline -r "${pkgs.home-manager}/bin/home-manager switch --flake ${config.dotfilesPath}#${config.networking.hostName}";
-            commandline --function execute
-          '';
-        };
       };
     };
 

modules/darwin/ssl.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, ... }: {
+
+  # security.pki.certificateFiles = [
+  #   "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+  #   (builtins.toString ../work/nixos-org-certs.crt)
+  # ];
+
+  security.pki.certificates =
+    [ (builtins.readFile ../work/nixos-org-certs.crt) ];
+
+}

modules/darwin/system.nix

@@ -2,8 +2,6 @@
 
   services.nix-daemon.enable = true;
 
-  security.pam.enableSudoTouchIdAuth = true;
-
   system = {
 
     keyboard = {
@@ -141,12 +139,12 @@
 
       echo "Define dock icon function"
       __dock_item() {
-          printf "%s%s%s%s%s" \
+          printf '%s%s%s%s%s' \
-                 "<dict><key>tile-data</key><dict><key>file-data</key><dict>" \
+                 '<dict><key>tile-data</key><dict><key>file-data</key><dict>' \
-                 "<key>_CFURLString</key><string>" \
+                 '<key>_CFURLString</key><string>' \
                  "$1" \
-                 "</string><key>_CFURLStringType</key><integer>0</integer>" \
+                 '</string><key>_CFURLStringType</key><integer>0</integer>' \
-                 "</dict></dict></dict>"
+                 '</dict></dict></dict>'
       }
 
       echo "Choose and order dock icons"
@@ -163,6 +161,16 @@
           "$(__dock_item /Applications/Alacritty.app)" \
           "$(__dock_item /System/Applications/System\ Preferences.app)"
 
+      echo "Enable sudo Touch ID"
+      echo "# sudo: auth account password session" > /tmp/sudofile
+      echo "auth       sufficient     pam_smartcard.so" >> /tmp/sudofile
+      echo "auth       sufficient     pam_tid.so " >> /tmp/sudofile
+      echo "auth       required       pam_opendirectory.so" >> /tmp/sudofile
+      echo "account    required       pam_permit.so" >> /tmp/sudofile
+      echo "password   required       pam_deny.so" >> /tmp/sudofile
+      echo "session    required       pam_permit.so" >> /tmp/sudofile
+      sudo mv /tmp/sudofile /etc/pam.d/sudo
+
       echo "Allow apps from anywhere"
       SPCTL=$(spctl --status)
       if ! [ "$SPCTL" = "assessments disabled" ]; then

modules/darwin/user.nix

@@ -1,9 +1,8 @@
 { config, pkgs, lib, ... }: {
 
-  users.users."${config.user}" = {
+  users.users."${config.user}" = { # macOS user
-    # macOS user
     home = config.homePath;
-    shell = pkgs.fish; # Default shell
+    shell = pkgs.zsh; # Default shell
   };
 
 }

modules/darwin/utilities.nix

@@ -1,19 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, ... }: {
-
-let
-
-  # Quickly package shell scripts with their dependencies
-  # From https://discourse.nixos.org/t/how-to-create-a-script-with-dependencies/7970/6
-  mkScript = { name, file, env ? [ ] }:
-    pkgs.writeScriptBin name ''
-      for i in ${lib.concatStringsSep " " env}; do
-        export PATH="$i/bin:$PATH"
-      done
-
-      exec ${pkgs.bash}/bin/bash ${file} $@
-    '';
-
-in {
 
   home-manager.users.${config.user} = {
 
@@ -26,17 +11,12 @@ in {
       mpd # TUI slideshows
       awscli2
       awslogs
-      google-cloud-sdk
+      kubectl
-      ansible
+      k9s
-      vault
-      consul
       noti # Create notifications programmatically
-      ipcalc # Make IP network calculations
+      ipcalc
-      (mkScript {
+      (pkgs.writeScriptBin "ocr"
-        name = "ocr";
+        (builtins.readFile ../shell/bash/scripts/ocr.sh))
-        file = ../shell/bash/scripts/ocr.sh;
-        env = [ tesseract ];
-      })
     ];
 
     programs.fish.shellAbbrs = {

modules/gaming/minecraft-server.nix

@@ -1,145 +0,0 @@
-{ pkgs, ... }:
-
-let
-
-  localPort = 25564;
-  publicPort = 49732;
-  rconPort = 25575;
-  rconPassword = "thiscanbeanything";
-
-in {
-
-  unfreePackages = [ "minecraft-server" ];
-
-  services.minecraft-server = {
-    enable = true;
-    eula = true;
-    declarative = true;
-    whitelist = { };
-    openFirewall = false;
-    serverProperties = {
-      server-port = localPort;
-      difficulty = "normal";
-      gamemode = "survival";
-      white-list = false;
-      enforce-whitelist = false;
-      level-name = "world";
-      motd = "Welcome!";
-      pvp = true;
-      player-idle-timeout = 30;
-      generate-structures = true;
-      max-players = 20;
-      snooper-enabled = false;
-      spawn-npcs = true;
-      spawn-animals = true;
-      spawn-monsters = true;
-      allow-nether = true;
-      allow-flight = false;
-      enable-rcon = true;
-      "rcon.port" = rconPort;
-      "rcon.password" = rconPassword;
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ publicPort ];
-
-  ## Automatically start and stop Minecraft server based on player connections
-
-  # Adapted shamelessly from:
-  # https://dataswamp.org/~solene/2022-08-20-on-demand-minecraft-with-systemd.html
-
-  # Prevent Minecraft from starting by default
-  systemd.services.minecraft-server = { wantedBy = pkgs.lib.mkForce [ ]; };
-
-  # Listen for connections on the public port, to trigger the actual
-  # listen-minecraft service.
-  systemd.sockets.listen-minecraft = {
-    wantedBy = [ "sockets.target" ];
-    requires = [ "network.target" ];
-    listenStreams = [ "${toString publicPort}" ];
-  };
-
-  # Proxy traffic to local port, and trigger hook-minecraft
-  systemd.services.listen-minecraft = {
-    path = [ pkgs.systemd ];
-    requires = [ "hook-minecraft.service" "listen-minecraft.socket" ];
-    after = [ "hook-minecraft.service" "listen-minecraft.socket" ];
-    serviceConfig.ExecStart =
-      "${pkgs.systemd.out}/lib/systemd/systemd-socket-proxyd 127.0.0.1:${
-        toString localPort
-      }";
-  };
-
-  # Start Minecraft if required and wait for it to be available
-  # Then unlock the listen-minecraft.service
-  systemd.services.hook-minecraft = {
-    path = with pkgs; [ systemd libressl busybox ];
-
-    # Start Minecraft and the auto-shutdown timer
-    script = ''
-      systemctl start minecraft-server.service
-      systemctl start stop-minecraft.timer
-    '';
-
-    # Keep checking until the service is available
-    postStart = ''
-      for i in $(seq 60); do
-        if ${pkgs.libressl.nc}/bin/nc -z 127.0.0.1 ${
-          toString localPort
-        } > /dev/null ; then
-          exit 0
-        fi
-        ${pkgs.busybox.out}/bin/sleep 1
-      done
-      exit 1
-    '';
-  };
-
-  # Run a player check on a schedule for auto-shutdown
-  systemd.timers.stop-minecraft = {
-    timerConfig = {
-      OnCalendar = "*-*-* *:*:0/20"; # Every 20 seconds
-      Unit = "stop-minecraft.service";
-    };
-  };
-
-  # If no players are connected, then stop services and prepare to resume again
-  systemd.services.stop-minecraft = {
-    serviceConfig.Type = "oneshot";
-    script = ''
-      # Check when service was launched
-      servicestartsec=$(
-        date -d \
-          "$(systemctl show \
-               --property=ActiveEnterTimestamp \
-               minecraft-server.service \
-               | cut -d= -f2)" \
-        +%s)
-
-      # Calculate elapsed time
-      serviceelapsedsec=$(( $(date +%s) - servicestartsec))
-
-      # Ignore if service just started
-      if [ $serviceelapsedsec -lt 180 ]
-      then
-        echo "Server was just started"
-        exit 0
-      fi
-
-      PLAYERS=$(
-        printf "list\n" \
-          | ${pkgs.rcon.out}/bin/rcon -m \
-          -H 127.0.0.1 -p ${builtins.toString rconPort} -P ${rconPassword} \
-      )
-
-      if echo "$PLAYERS" | grep "are 0 of a"
-      then
-        echo "Stopping server"
-        systemctl stop minecraft-server.service
-        systemctl stop hook-minecraft.service
-        systemctl stop stop-minecraft.timer
-      fi
-    '';
-  };
-
-}

modules/gaming/steam.nix

@@ -4,7 +4,7 @@
 
   config = lib.mkIf config.gaming.steam {
     hardware.steam-hardware.enable = true;
-    unfreePackages = [ "steam" "steam-original" "steamcmd" "steam-run" ];
+    unfreePackages = [ "steam" "steam-original" "steamcmd" ];
     environment.systemPackages = with pkgs; [
 
       steam

modules/graphical/fonts.nix

@@ -21,7 +21,6 @@ in {
       services.polybar.config."bar/main".font-0 = "Hack Nerd Font:size=10;2";
       programs.rofi.font = "Hack Nerd Font 14";
       programs.alacritty.settings.font.normal.family = fontName;
-      programs.kitty.font.name = fontName;
     };
 
   };

modules/graphical/i3.nix

@@ -7,14 +7,13 @@ let
   lockUpdate =
     "${pkgs.betterlockscreen}/bin/betterlockscreen --update ${config.gui.wallpaper} --display 1 --span";
 
-in
+in {
-{
 
-  config = {
+  config = lib.mkIf config.services.xserver.enable {
 
     services.xserver.windowManager = {
       i3 = {
-        enable = config.services.xserver.enable;
+        enable = true;
         package = pkgs.i3-gaps;
       };
     };
@@ -26,10 +25,9 @@ in
 
     home-manager.users.${config.user} = {
       xsession.windowManager.i3 = {
-        enable = config.services.xserver.enable;
+        enable = true;
         package = pkgs.i3-gaps;
-        config =
+        config = let
-          let
           modifier = "Mod4"; # Super key
           ws1 = "1:I";
           ws2 = "2:II";
@@ -41,18 +39,16 @@ in
           ws8 = "8:VIII";
           ws9 = "9:IX";
           ws10 = "10:X";
-          in
+        in {
-          {
           modifier = modifier;
           assigns = {
             "${ws1}" = [{ class = "Firefox"; }];
-              "${ws2}" = [{ class = "kitty"; }];
+            "${ws2}" = [{ class = "Alacritty"; }];
             "${ws3}" = [{ class = "discord"; }];
             "${ws4}" = [{ class = "Steam"; }];
           };
           bars = [{ command = "echo"; }]; # Disable i3bar
-            colors =
+          colors = let
-              let
             background = config.colorscheme.base00;
             inactiveBackground = config.colorscheme.base01;
             border = config.colorscheme.base01;
@@ -61,8 +57,7 @@ in
             inactiveText = config.colorscheme.base04;
             urgentBackground = config.colorscheme.base08;
             indicator = "#00000000";
-              in
+          in {
-              {
             background = config.colorscheme.base00;
             focused = {
               inherit background indicator text border;
@@ -116,7 +111,7 @@ in
 
             # Launchers
             "${modifier}+Return" =
-                "exec --no-startup-id kitty; workspace ${ws2}; layout tabbed";
+              "exec --no-startup-id alacritty; workspace ${ws2}; layout tabbed";
             "${modifier}+space" =
               "exec --no-startup-id ${config.gui.launcherCommand}";
             "${modifier}+Shift+s" =
@@ -215,13 +210,7 @@ in
               notification = false;
             }
             {
-                command =
+              command = "i3-msg workspace ${ws1}";
-                  "i3-msg workspace ${ws2}, move workspace to output right";
-                notification = false;
-              }
-              {
-                command =
-                  "i3-msg workspace ${ws1}, move workspace to output left";
               notification = false;
             }
           ];
@@ -249,7 +238,7 @@ in
       };
 
       programs.fish.functions = {
-        update-lock-screen = lib.mkIf config.services.xserver.enable {
+        update-lock-screen = {
           description = "Update lockscreen with wallpaper";
           body = lockUpdate;
         };
@@ -258,20 +247,17 @@ in
       # Update lock screen cache only if cache is empty
       home.activation.updateLockScreenCache =
         let cacheDir = "${config.homePath}/.cache/betterlockscreen/current";
-        in
+        in config.home-manager.users.${config.user}.lib.dag.entryAfter
-        lib.mkIf config.services.xserver.enable
-          (config.home-manager.users.${config.user}.lib.dag.entryAfter
         [ "writeBoundary" ] ''
           if [ ! -d ${cacheDir} ] || [ -z "$(ls ${cacheDir})" ]; then
               $DRY_RUN_CMD ${lockUpdate}
           fi
-          '');
+        '';
 
     };
 
     # Ref: https://github.com/betterlockscreen/betterlockscreen/blob/next/system/betterlockscreen%40.service
     systemd.services.lock = {
-      enable = config.services.xserver.enable;
       description = "Lock the screen on resume from suspend";
       before = [ "sleep.target" "suspend.target" ];
       serviceConfig = {

modules/graphical/picom.nix

@@ -6,7 +6,6 @@
 
         services.picom = {
           enable = true;
-          backend = "glx";
           settings = {
             blur = false;
             blurExclude = [ ];

modules/graphical/xorg.nix

@@ -27,11 +27,6 @@ in {
           # Make the login screen dark
           greeters.gtk.theme = gtkTheme;
 
-          # Show default user
-          extraSeatDefaults = ''
-            greeter-hide-users = false
-          '';
-
         };
       };
 

modules/hardware/audio.nix

@@ -33,11 +33,8 @@ in {
   config = lib.mkIf config.gui.enable {
     sound.enable = true;
 
-    # Enable PipeWire
+    # Enable PulseAudio
-    services.pipewire = {
+    hardware.pulseaudio.enable = true;
-      enable = true;
-      pulse.enable = true;
-    };
 
     # These aren't necessary, but helpful for the user
     environment.systemPackages = with pkgs; [
@@ -55,8 +52,7 @@ in {
         # Make sure that Volnoti actually starts (home-manager doesn't start
         # user daemon's automatically)
         startup = [{
-          command =
+          command = "systemctl --user restart volnoti";
-            "systemctl --user restart volnoti --alpha 0.15 --radius 40 --timeout 0.2";
           always = true;
           notification = false;
         }];

modules/hardware/boot.nix

@@ -10,9 +10,6 @@
       # Check for other OSes and make them available
       useOSProber = true;
 
-      # Attempt to display GRUB on widescreen monitor
-      gfxmodeEfi = "1920x1080";
-
       # Install GRUB onto the boot disk
       # device = config.fileSystems."/boot".device;
 

modules/hardware/server.nix

@@ -1,7 +0,0 @@
-{ config, ... }: {
-
-  # Servers need a bootloader or they won't start
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-}

modules/mail/aerc.nix

@@ -1,187 +0,0 @@
-{ config, pkgs, ... }: {
-
-  config = {
-
-    home-manager.users.${config.user} = {
-
-      home.packages = with pkgs; [
-        w3m # Render HTML
-        dante # Socksify for rendering HTML
-      ];
-
-      programs.aerc = {
-        enable = true;
-        extraBinds = {
-          # Binds are of the form <key sequence> = <command to run>
-          # To use '=' in a key sequence, substitute it with "Eq": "<Ctrl+Eq>"
-          # If you wish to bind #, you can wrap the key sequence in quotes: "#" = quit
-          global = {
-            "<C-p>" = ":prev-tab<Enter>";
-            "<C-n>" = ":next-tab <Enter>";
-            "<C-t>" = ":term<Enter>";
-            "?" = ":help keys<Enter>";
-          };
-
-          messages = {
-            q = ":quit<Enter>";
-
-            j = ":next <Enter>";
-            "<Down>" = ":next<Enter>";
-            "<C-d>" = ":next 50%<Enter>";
-            "<C-f>" = ":next 100%<Enter>";
-            "<PgDn>" = ":next 100%<Enter>";
-
-            k = ":prev <Enter>";
-            "<Up>" = ":prev<Enter>";
-            "<C-u>" = ":prev 50%<Enter>";
-            "<C-b>" = ":prev 100%<Enter>";
-            "<PgUp>" = ":prev 100%<Enter>";
-            g = ":select 0 <Enter>";
-            G = ":select -1<Enter>";
-
-            J = ":next-folder <Enter>";
-            K = ":prev-folder<Enter>";
-            H = ":collapse-folder<Enter>";
-            L = ":expand-folder<Enter>";
-
-            v = ":mark -t<Enter>";
-            V = ":mark -v<Enter>";
-
-            T = ":toggle-threads<Enter>";
-
-            "<Enter>" = ":view<Enter>";
-            d = ":prompt 'Really delete this message?' 'delete-message'<Enter>";
-            D = ":move Trash<Enter>";
-            A = ":archive flat<Enter>";
-
-            C = ":compose<Enter>";
-
-            rr = ":reply -a<Enter>";
-            rq = ":reply -aq<Enter>";
-            Rr = ":reply<Enter>";
-            Rq = ":reply -q<Enter>";
-
-            c = ":cf<space>";
-            "$" = ":term<space>";
-            "!" = ":term<space>";
-            "|" = ":pipe<space>";
-
-            "/" = ":search<space>";
-            "\\" = ":filter <space>";
-            n = ":next-result<Enter>";
-            N = ":prev-result<Enter>";
-            "<Esc>" = ":clear<Enter>";
-          };
-
-          "messages:folder=Drafts" = { "<Enter>" = ":recall<Enter>"; };
-
-          view = {
-            "/" = ":toggle-key-passthrough <Enter> /";
-            q = ":close<Enter>";
-            O = ":open<Enter>";
-            S = ":save<space>";
-            "|" = ":pipe<space>";
-            D = ":move Trash<Enter>";
-            A = ":archive flat<Enter>";
-
-            "<C-l>" = ":open-link <space>";
-
-            f = ":forward <Enter>";
-            rr = ":reply -a<Enter>";
-            rq = ":reply -aq<Enter>";
-            Rr = ":reply<Enter>";
-            Rq = ":reply -q<Enter>";
-
-            H = ":toggle-headers<Enter>";
-            "<C-k>" = ":prev-part<Enter>";
-            "<C-j>" = ":next-part<Enter>";
-            J = ":next <Enter>";
-            K = ":prev<Enter>";
-          };
-
-          "view::passthrough" = {
-            "$noinherit" = "true";
-            "$ex" = "<C-x>";
-            "<Esc>" = ":toggle-key-passthrough<Enter>";
-          };
-
-          compose = {
-            # Keybindings used when the embedded terminal is not selected in the compose
-            # view
-            "$noinherit" = "true";
-            "$ex" = "<C-x>";
-            "<C-k>" = ":prev-field<Enter>";
-            "<C-j>" = ":next-field<Enter>";
-            "<A-p>" = ":switch-account -p<Enter>";
-            "<A-n>" = ":switch-account -n<Enter>";
-            "<tab>" = ":next-field<Enter>";
-            "<C-p>" = ":prev-tab<Enter>";
-            "<C-n>" = ":next-tab<Enter>";
-          };
-
-          "compose::editor" = {
-            # Keybindings used when the embedded terminal is selected in the compose view
-            "$noinherit" = "true";
-            "$ex" = "<C-x>";
-            "<C-k>" = ":prev-field<Enter>";
-            "<C-j>" = ":next-field<Enter>";
-            "<C-p>" = ":prev-tab<Enter>";
-            "<C-n>" = ":next-tab<Enter>";
-          };
-
-          "compose::review" = {
-            # Keybindings used when reviewing a message to be sent
-            y = ":send <Enter>";
-            n = ":abort<Enter>";
-            p = ":postpone<Enter>";
-            q = ":choose -o d discard abort -o p postpone postpone<Enter>";
-            e = ":edit<Enter>";
-            a = ":attach<space>";
-            d = ":detach<space>";
-          };
-
-          terminal = {
-            "$noinherit" = "true";
-            "$ex" = "<C-x>";
-            "<C-p>" = ":prev-tab<Enter>";
-            "<C-n>" = ":next-tab<Enter>";
-          };
-
-        };
-        extraConfig = {
-          general.unsafe-accounts-conf = true;
-          viewer = { pager = "${pkgs.less}/bin/less -R"; };
-          filters = {
-            "text/plain" =
-              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
-            "text/calendar" =
-              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/calendar";
-            "text/html" =
-              "${pkgs.aerc}/share/aerc/filters/html"; # Requires w3m, dante
-            # "text/html" =
-            #   "${pkgs.aerc}/share/aerc/filters/html | ${pkgs.aerc}/share/aerc/filters/colorize";
-            # "text/*" =
-            #   ''${pkgs.bat}/bin/bat -fP --file-name="$AERC_FILENAME "'';
-            "message/delivery-status" =
-              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
-            "message/rfc822" =
-              "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
-            "application/x-sh" = "${pkgs.bat}/bin/bat -fP -l sh";
-            "application/pdf" = "${pkgs.zathura}/bin/zathura -";
-          };
-        };
-      };
-      accounts.email.accounts.home.aerc = {
-        enable = true;
-        extraAccounts = {
-          check-mail = "5m";
-          check-mail-cmd = "${pkgs.isync}/bin/mbsync -a";
-        };
-      };
-
-      programs.fish.shellAbbrs = { ae = "aerc"; };
-
-    };
-
-  };
-}

modules/mail/default.nix

@@ -1,83 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  imports = [ ./himalaya.nix ./aerc.nix ];
-
-  options = {
-    mailUser = lib.mkOption {
-      type = lib.types.str;
-      description = "User name for the email address.";
-      default = config.user;
-    };
-    mailServer = lib.mkOption {
-      type = lib.types.str;
-      description = "Server name for the email address.";
-    };
-  };
-
-  config = {
-
-    home-manager.users.${config.user} = {
-      programs.mbsync = { enable = true; };
-      services.mbsync = lib.mkIf pkgs.stdenv.isLinux {
-        enable = true;
-        frequency = "*:0/5";
-      };
-      accounts.email = {
-        maildirBasePath = "${config.homePath}/mail";
-        accounts = {
-          home = let address = "${config.mailUser}@${config.mailServer}";
-          in {
-            userName = address;
-            realName = config.fullName;
-            primary = true;
-            inherit address;
-            aliases = map (mailUser: "${mailUser}@${config.mailServer}") [
-              "me"
-              "hey"
-              "admin"
-            ];
-            alot = { };
-            flavor = "plain";
-            folders = { };
-            getmail = { };
-            imap = {
-              host = "imap.purelymail.com";
-              port = 993;
-              tls.enable = true;
-            };
-            imapnotify = {
-              enable = false;
-              boxes = [ ];
-              onNotify = "";
-              onNotifyPost = "";
-            };
-            maildir = { path = "main"; };
-            mbsync = {
-              enable = true;
-              create = "maildir";
-              expunge = "none";
-              remove = "none";
-              patterns = [ "*" ];
-              extraConfig.channel = {
-                CopyArrivalDate = "yes"; # Sync time of original message
-              };
-            };
-            mu.enable = false;
-            notmuch.enable = false;
-            passwordCommand =
-              "${pkgs.age}/bin/age --decrypt --identity ${config.identityFile} ${
-                builtins.toString ../../private/mailpass.age
-              }";
-            smtp = {
-              host = "smtp.purelymail.com";
-              port = 465;
-              tls.enable = true;
-            };
-          };
-        };
-      };
-
-    };
-
-  };
-}

modules/mail/himalaya.nix

@@ -1,19 +1,89 @@
-{ config, ... }: {
+{ config, pkgs, lib, ... }: {
+
+  options = {
+    mailUser = lib.mkOption {
+      type = lib.types.str;
+      description = "User name for the email address.";
+      default = config.user;
+    };
+    mailServer = lib.mkOption {
+      type = lib.types.str;
+      description = "Server name for the email address.";
+    };
+  };
 
   config = {
 
     home-manager.users.${config.user} = {
 
       programs.himalaya = { enable = true; };
-      accounts.email.accounts.home.himalaya = {
+      programs.mbsync = { enable = true; };
+      services.mbsync = lib.mkIf pkgs.stdenv.isLinux {
+        enable = true;
+        frequency = "*:0/5";
+      };
+
+      accounts.email = {
+        maildirBasePath = "${config.homePath}/mail";
+        accounts = {
+          home = let address = "${config.mailUser}@${config.mailServer}";
+          in {
+            userName = address;
+            realName = config.fullName;
+            primary = true;
+            inherit address;
+            aliases = map (mailUser: "${mailUser}@${config.mailServer}") [
+              "me"
+              "hey"
+              "admin"
+            ];
+            alot = { };
+            flavor = "plain";
+            folders = { };
+            getmail = { };
+            himalaya = {
               enable = true;
               settings = {
-          backend = "imap";
-          sender = "smtp";
                 downloads-dir = config.userDirs.download;
                 smtp-insecure = true;
               };
             };
+            imap = {
+              host = "imap.purelymail.com";
+              port = 993;
+              tls.enable = true;
+            };
+            imapnotify = {
+              enable = false;
+              boxes = [ ];
+              onNotify = "";
+              onNotifyPost = "";
+            };
+            maildir = { path = "main"; };
+            mbsync = {
+              enable = true;
+              create = "maildir";
+              expunge = "none";
+              remove = "none";
+              patterns = [ "*" ];
+              extraConfig.channel = {
+                CopyArrivalDate = "yes"; # Sync time of original message
+              };
+            };
+            mu.enable = false;
+            notmuch.enable = false;
+            passwordCommand =
+              "${pkgs.age}/bin/age --decrypt --identity ${config.homePath}/.ssh/id_ed25519 ${
+                builtins.toString ./mailpass.age
+              }";
+            smtp = {
+              host = "smtp.purelymail.com";
+              port = 465;
+              tls.enable = true;
+            };
+          };
+        };
+      };
 
       programs.fish.shellAbbrs = { hi = "himalaya"; };
 

modules/mail/mailpass.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 MgHaOw 8h/ESNjn0gknNXoHM34UobHzPgmRunoP97H+KHOuGQM
+qowH+6TlCRECGCscRgKx6kswY+PZezYUD6E+x9e+5pM
+--- kFj1JzRdh/D13Uq9aNTzMJIFysEE+kzzthjewOIR2+o
+Ȳ<EFBFBD><EFBFBD>6<EFBFBD><EFBFBD><EFBFBD>}rC<72>z<><7A><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

modules/neovim/lua/packer/lsp.lua

@@ -14,7 +14,8 @@ M.packer = function(use)
                 return vim.fn.executable(program) == 1
             end
 
-            local capabilities = require("cmp_nvim_lsp").default_capabilities()
+            local capabilities =
+                require("cmp_nvim_lsp").update_capabilities(vim.lsp.protocol.make_client_capabilities())
             if on_path("lua-language-server") then
                 require("lspconfig").sumneko_lua.setup({
                     capabilities = capabilities,
@@ -79,7 +80,6 @@ M.packer = function(use)
                 return vim.fn.executable(program) == 1
             end
 
-            local augroup = vim.api.nvim_create_augroup("LspFormatting", {})
             require("null-ls").setup({
                 sources = {
                     require("null-ls").builtins.formatting.stylua.with({
@@ -133,15 +133,15 @@ M.packer = function(use)
                     -- require("null-ls").builtins.diagnostics.pylint,
                 },
                 -- Format on save
-                on_attach = function(client, bufnr)
+                on_attach = function(client)
-                    if client.supports_method("textDocument/formatting") then
+                    if client.resolved_capabilities.document_formatting then
-                        vim.api.nvim_clear_autocmds({ group = augroup, buffer = bufnr })
+                        local id = vim.api.nvim_create_augroup("LspFormatting", {
+                            clear = true,
+                        })
                         vim.api.nvim_create_autocmd("BufWritePre", {
-                            group = augroup,
+                            group = id,
-                            buffer = bufnr,
+                            pattern = "*",
-                            callback = function()
+                            callback = vim.lsp.buf.formatting_seq_sync,
-                                vim.lsp.buf.format({ bufnr = bufnr })
-                            end,
                         })
                     end
                 end,

modules/neovim/lua/packer/misc.lua

@@ -29,39 +29,7 @@ M.packer = function(use)
     })
 
     -- Markdown renderer / wiki notes
-    -- use("vimwiki/vimwiki")
+    use("vimwiki/vimwiki")
-    use({
-        "jakewvincent/mkdnflow.nvim",
-        config = function()
-            require("mkdnflow").setup({
-                modules = {
-                    bib = false,
-                    conceal = true,
-                    folds = false,
-                },
-                perspective = {
-                    priority = "current",
-                    fallback = "first",
-                    nvim_wd_heel = false, -- Don't change working dir
-                },
-                links = {
-                    style = "markdown",
-                    conceal = true,
-                },
-                wrap = true,
-                to_do = {
-                    symbols = { " ", "-", "x" },
-                },
-            })
-            vim.api.nvim_create_autocmd("FileType", {
-                pattern = "markdown",
-                callback = function()
-                    vim.o.autowriteall = true -- Save in new buffer
-                    vim.o.wrapmargin = 79 -- Wrap text automatically
-                end,
-            })
-        end,
-    })
 end
 
 return M

modules/neovim/lua/packer/speed.lua

@@ -8,6 +8,49 @@ M.packer = function(use)
             require("impatient")
         end,
     })
+
+    -- Improve speed and filetype detection
+    use({
+        "nathom/filetype.nvim",
+        config = function()
+            -- Filetype for .env files
+            local envfiletype = function()
+                vim.bo.filetype = "text"
+                vim.bo.syntax = "sh"
+            end
+            -- Force filetype patterns that Vim doesn't know about
+            require("filetype").setup({
+                overrides = {
+                    extensions = {
+                        Brewfile = "brewfile",
+                        muttrc = "muttrc",
+                        tfvars = "terraform",
+                        tf = "terraform",
+                    },
+                    literal = {
+                        Caskfile = "brewfile",
+                        [".gitignore"] = "gitignore",
+                        config = "config",
+                    },
+                    complex = {
+                        [".*git/config"] = "gitconfig",
+                        ["tmux.conf%..*link"] = "tmux",
+                        ["gitconfig%..*link"] = "gitconfig",
+                        [".*ignore%..*link"] = "gitignore",
+                        [".*%.toml%..*link"] = "toml",
+                    },
+                    function_extensions = {},
+                    function_literal = {
+                        [".envrc"] = envfiletype,
+                        [".env"] = envfiletype,
+                        [".env.dev"] = envfiletype,
+                        [".env.prod"] = envfiletype,
+                        [".env.example"] = envfiletype,
+                    },
+                },
+            })
+        end,
+    })
 end
 
 return M

modules/neovim/lua/packer/syntax.lua

@@ -8,7 +8,7 @@ M.packer = function(use)
     -- Syntax engine
     use({
         "nvim-treesitter/nvim-treesitter",
-        commit = "9ada5f70f98d51e9e3e76018e783b39fd1cd28f7",
+        commit = "989c75046c46d2ed96bb65c5badd6b8f785e7f09",
         run = ":TSUpdate",
         config = function()
             require("nvim-treesitter.configs").setup({

modules/neovim/lua/packer/visuals.lua

@@ -16,29 +16,7 @@ M.packer = function(use)
             vim.keymap.set("v", "<Leader>gd", gitsigns.diffthis)
             vim.keymap.set("n", "<Leader>rgf", gitsigns.reset_buffer)
             vim.keymap.set("v", "<Leader>hs", gitsigns.stage_hunk)
-            vim.keymap.set("v", "<Leader>hr", gitsigns.reset_hunk)
+            vim.keymap.set("v", "<Leader>hs", gitsigns.reset_hunk)
-            vim.keymap.set("v", "<Leader>hr", gitsigns.reset_hunk)
-
-            -- Navigation
-            vim.keymap.set("n", "]g", function()
-                if vim.wo.diff then
-                    return "]g"
-                end
-                vim.schedule(function()
-                    gitsigns.next_hunk()
-                end)
-                return "<Ignore>"
-            end, { expr = true })
-
-            vim.keymap.set("n", "[g", function()
-                if vim.wo.diff then
-                    return "[g"
-                end
-                vim.schedule(function()
-                    gitsigns.prev_hunk()
-                end)
-                return "<Ignore>"
-            end, { expr = true })
         end,
     })
 
@@ -124,6 +102,7 @@ M.packer = function(use)
                 },
                 view = {
                     width = 30,
+                    height = 30,
                     hide_root_folder = false,
                     side = "left",
                     mappings = {

modules/neovim/lua/settings.lua

@@ -32,6 +32,8 @@ vim.opt.completeopt = {
     "menuone",
     "noselect",
 }
+-- Required until 0.6.0: do not source the default filetype.vim
+vim.g.did_load_filetypes = 1
 
 -- Remember last position when reopening file
 vim.api.nvim_exec(
@@ -75,16 +77,40 @@ vim.api.nvim_exec(
     false
 )
 
-vim.api.nvim_create_autocmd("FileType", {
-    pattern = "*.eml",
-    callback = function()
-        vim.o.wrapmargin = 79 -- Wrap text automatically
-    end,
-})
-
 -- Netrw
 vim.g.netrw_liststyle = 3 -- Change style to 'tree' view
 vim.g.netrw_banner = 0 -- Remove useless banner
 vim.g.netrw_winsize = 15 -- Explore window takes % of page
 vim.g.netrw_browse_split = 4 -- Open in previous window
 vim.g.netrw_altv = 1 -- Always split left
+
+-- VimWiki
+vim.g.vimwiki_list = {
+    {
+        ["path"] = "$NOTES_PATH",
+        ["syntax"] = "markdown",
+        ["index"] = "home",
+        ["ext"] = ".md",
+    },
+}
+vim.g.vimwiki_key_mappings = {
+    ["all_maps"] = 1,
+    ["mouse"] = 1,
+}
+vim.g.vimwiki_auto_chdir = 1 -- Set local dir to Wiki when open
+vim.g.vimwiki_create_link = 0 -- Don't automatically create new links
+vim.g.vimwiki_listsyms = " x" -- Set checkbox symbol progression
+vim.g.vimwiki_table_mappings = 0 -- VimWiki table keybinds interfere with tab completion
+vim.api.nvim_exec(
+    [[
+    au FileType markdown inoremap ;tt <Esc>:AddTag<CR>
+
+    function! PInsert(item)
+        let @z=a:item
+        norm "zpx
+    endfunction
+
+    command! AddTag call fzf#run({'source': 'rg "#[A-Za-z/]+[ |\$]" -o --no-filename --no-line-number | sort | uniq', 'sink': function('PInsert')})
+]],
+    false
+)

modules/nixos/user.nix

@@ -3,9 +3,8 @@
   options = {
 
     passwordHash = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
+      type = lib.types.str;
       description = "Password created with mkpasswd -m sha-512";
-      # Test it by running: mkpasswd -m sha-512 --salt "PZYiMGmJIIHAepTM"
     };
 
   };

modules/programming/kubernetes.nix

@@ -2,13 +2,7 @@
 
   home-manager.users.${config.user} = {
 
-    home.packages = with pkgs; [
+    home.packages = with pkgs; [ kubectl k9s ];
-      kubectl # Basic Kubernetes queries
-      k9s # Terminal Kubernetes UI
-      kubernetes-helm # Helm CLI
-      fluxcd # Bootstrap clusters with Flux
-      kustomize # Kustomize CLI (for Flux)
-    ];
 
     programs.fish.shellAbbrs = {
       k = "kubectl";

modules/repositories/notes.nix

@@ -3,7 +3,7 @@
   home-manager.users.${config.user} = {
 
     home.sessionVariables = {
-      NOTES_PATH = "${config.homePath}/dev/personal/notes/content";
+      NOTES_PATH = "${config.homePath}/dev/personal/notes";
     };
 
   };

modules/services/backups.nix

@@ -1,66 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  imports = [ ./secrets.nix ];
-
-  options = {
-
-    backupS3 = {
-      endpoint = lib.mkOption {
-        type = lib.types.str;
-        description = "S3 endpoint for backups";
-      };
-      bucket = lib.mkOption {
-        type = lib.types.str;
-        description = "S3 bucket for backups";
-      };
-      accessKeyId = lib.mkOption {
-        type = lib.types.str;
-        description = "S3 access key ID for backups";
-      };
-    };
-
-  };
-
-  config = {
-
-    users.groups.backup = { };
-
-    secrets.backup = {
-      source = ../../private/backup.age;
-      dest = "${config.secretsDirectory}/backup";
-      group = "backup";
-      permissions = "0440";
-    };
-
-    users.users.litestream.extraGroups = [ "backup" ];
-
-    services.litestream = {
-      enable = true;
-      environmentFile = config.secrets.backup.dest;
-    };
-
-    # Wait for secret to exist
-    systemd.services.litestream = {
-      after = [ "backup-secret.service" ];
-      requires = [ "backup-secret.service" ];
-      environment.AWS_ACCESS_KEY_ID = config.backupS3.accessKeyId;
-    };
-
-    # # Backup library to object storage
-    # services.restic.backups.calibre = {
-    #   user = "calibre-web";
-    #   repository =
-    #     "s3://${config.backupS3.endpoint}/${config.backupS3.bucket}/calibre";
-    #   paths = [
-    #     "/var/books"
-    #     "/var/lib/calibre-web/app.db"
-    #     "/var/lib/calibre-web/gdrive.db"
-    #   ];
-    #   initialize = true;
-    #   timerConfig = { OnCalendar = "00:05:00"; };
-    #   environmentFile = backupS3File;
-    # };
-
-  };
-
-}

modules/services/caddy.nix

@@ -1,35 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  options = {
-    caddyRoutes = lib.mkOption {
-      type = lib.types.listOf lib.types.attrs;
-      description = "Caddy JSON routes for http servers";
-    };
-    caddyBlocks = lib.mkOption {
-      type = lib.types.listOf lib.types.attrs;
-      description = "Caddy JSON error blocks for http servers";
-      default = [ ];
-    };
-  };
-
-  config = {
-
-    services.caddy = {
-      enable = true;
-      adapter = "''"; # Required to enable JSON
-      configFile = pkgs.writeText "Caddyfile" (builtins.toJSON {
-        apps.http.servers.main = {
-          listen = [ ":443" ];
-          routes = config.caddyRoutes;
-          errors.routes = config.caddyBlocks;
-        };
-      });
-
-    };
-
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
-    networking.firewall.allowedUDPPorts = [ 443 ];
-
-  };
-
-}

modules/services/calibre.nix

@@ -1,74 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  imports = [ ./caddy.nix ./backups.nix ];
-
-  options = {
-    bookServer = lib.mkOption {
-      type = lib.types.str;
-      description = "Hostname for Calibre library";
-    };
-  };
-
-  config = {
-
-    services.calibre-web = {
-      enable = true;
-      openFirewall = true;
-      options = {
-        reverseProxyAuth.enable = false;
-        enableBookConversion = true;
-        enableBookUploading = true;
-      };
-    };
-
-    # Fix: https://github.com/janeczku/calibre-web/issues/2422
-    nixpkgs.overlays = [
-      (final: prev: {
-        calibre-web = prev.calibre-web.overrideAttrs (old: {
-          patches = (old.patches or [ ])
-            ++ [ ../../patches/calibre-web-cloudflare.patch ];
-        });
-      })
-    ];
-
-    caddyRoutes = [{
-      match = [{ host = [ config.bookServer ]; }];
-      handle = [{
-        handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:8083"; }];
-        headers.request.add."X-Script-Name" = [ "/calibre-web" ];
-      }];
-    }];
-
-    # Run a backup on a schedule
-    systemd.timers.calibre-backup = {
-      timerConfig = {
-        OnCalendar = "*-*-* 00:00:00"; # Once per day
-        Unit = "calibre-backup.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-
-    # Backup Calibre data to object storage
-    systemd.services.calibre-backup =
-      let libraryPath = "/var/lib/calibre-web"; # Default location
-      in {
-        description = "Backup Calibre data";
-        environment.AWS_ACCESS_KEY_ID = config.backupS3.accessKeyId;
-        serviceConfig = {
-          Type = "oneshot";
-          User = "calibre-web";
-          Group = "backup";
-          EnvironmentFile = config.secrets.backup.dest;
-        };
-        script = ''
-          ${pkgs.awscli2}/bin/aws s3 sync \
-              ${libraryPath}/ \
-              s3://${config.backupS3.bucket}/calibre/ \
-              --endpoint-url=https://${config.backupS3.endpoint}
-        '';
-      };
-
-  };
-
-}

modules/services/cloudflare.nix

@@ -1,56 +0,0 @@
-# This module is necessary for hosts that are serving through Cloudflare.
-
-{ ... }:
-
-let
-
-  cloudflareIpRanges = [
-
-    # Cloudflare IPv4: https://www.cloudflare.com/ips-v4
-    "173.245.48.0/20"
-    "103.21.244.0/22"
-    "103.22.200.0/22"
-    "103.31.4.0/22"
-    "141.101.64.0/18"
-    "108.162.192.0/18"
-    "190.93.240.0/20"
-    "188.114.96.0/20"
-    "197.234.240.0/22"
-    "198.41.128.0/17"
-    "162.158.0.0/15"
-    "104.16.0.0/13"
-    "104.24.0.0/14"
-    "172.64.0.0/13"
-    "131.0.72.0/22"
-
-    # Cloudflare IPv6: https://www.cloudflare.com/ips-v6
-    "2400:cb00::/32"
-    "2606:4700::/32"
-    "2803:f800::/32"
-    "2405:b500::/32"
-    "2405:8100::/32"
-    "2a06:98c0::/29"
-    "2c0f:f248::/32"
-
-  ];
-
-in {
-
-  imports = [ ./caddy.nix ];
-
-  config = {
-
-    # Forces Caddy to error if coming from a non-Cloudflare IP
-    caddyBlocks = [{
-      match = [{ not = [{ remote_ip.ranges = cloudflareIpRanges; }]; }];
-      handle = [{
-        handler = "static_response";
-        abort = true;
-      }];
-    }];
-
-    # Allows Nextcloud to trust Cloudflare IPs
-    services.nextcloud.config.trustedProxies = cloudflareIpRanges;
-
-  };
-}

modules/services/gitea.nix

@@ -1,93 +0,0 @@
-{ config, lib, ... }:
-
-let giteaPath = "/var/lib/gitea"; # Default service directory
-
-in {
-
-  imports = [ ./caddy.nix ./backups.nix ];
-
-  options = {
-
-    giteaServer = lib.mkOption {
-      description = "Hostname for Gitea.";
-      type = lib.types.str;
-    };
-
-  };
-
-  config = {
-    services.gitea = {
-      enable = true;
-      httpPort = 3001;
-      httpAddress = "127.0.0.1";
-      rootUrl = "https://${config.giteaServer}/";
-      database.type = "sqlite3";
-      settings = {
-        repository = {
-          DEFAULT_PUSH_CREATE_PRIVATE = true;
-          DISABLE_HTTP_GIT = false;
-          ACCESS_CONTROL_ALLOW_ORIGIN = config.giteaServer;
-          ENABLE_PUSH_CREATE_USER = true;
-          ENABLE_PUSH_CREATE_ORG = true;
-          DEFAULT_BRANCH = "main";
-        };
-        server = {
-          SSH_PORT = 22;
-          START_SSH_SERVER = false; # Use sshd instead
-          DISABLE_SSH = false;
-          # SSH_LISTEN_HOST = "0.0.0.0";
-          # SSH_LISTEN_PORT = 122;
-        };
-        service.DISABLE_REGISTRATION = true;
-        session.COOKIE_SECURE = true;
-        ui.SHOW_USER_EMAIL = false;
-      };
-      extraConfig = null;
-    };
-
-    networking.firewall.allowedTCPPorts = [ 122 ];
-
-    caddyRoutes = [{
-      match = [{ host = [ config.giteaServer ]; }];
-      handle = [{
-        handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:3001"; }];
-      }];
-    }];
-
-    ## Backup config
-
-    # Open to groups, allowing for backups
-    systemd.services.gitea.serviceConfig.StateDirectoryMode =
-      lib.mkForce "0770";
-    systemd.tmpfiles.rules = [
-      "d ${giteaPath}/data 0775 gitea gitea"
-      "f ${giteaPath}/data/gitea.db 0660 gitea gitea"
-    ];
-
-    # Allow litestream and gitea to share a sqlite database
-    users.users.litestream.extraGroups = [ "gitea" ];
-    users.users.gitea.extraGroups = [ "litestream" ];
-
-    # Backup sqlite database with litestream
-    services.litestream = {
-      settings = {
-        dbs = [{
-          path = "${giteaPath}/data/gitea.db";
-          replicas = [{
-            url =
-              "s3://${config.backupS3.bucket}.${config.backupS3.endpoint}/gitea";
-          }];
-        }];
-      };
-    };
-
-    # Don't start litestream unless gitea is up
-    systemd.services.litestream = {
-      after = [ "gitea.service" ];
-      requires = [ "gitea.service" ];
-    };
-
-  };
-
-}

modules/services/honeypot.nix

@@ -1,75 +0,0 @@
-{ lib, pkgs, ... }:
-
-# Currently has some issues that don't make this viable.
-
-# Taken from:
-# https://dataswamp.org/~solene/2022-09-29-iblock-implemented-in-nixos.html
-
-# You will need to flush all rules when removing:
-# https://serverfault.com/questions/200635/best-way-to-clear-all-iptables-rules
-
-let
-
-  portsToBlock = [ 25545 25565 25570 ];
-  portsString =
-    builtins.concatStringsSep "," (builtins.map builtins.toString portsToBlock);
-
-  # Block IPs for 20 days
-  expire = 60 * 60 * 24 * 20;
-
-  rules = table: [
-    "INPUT -i eth0 -p tcp -m multiport --dports ${portsString} -m state --state NEW -m recent --set"
-    "INPUT -i eth0 -p tcp -m multiport --dports ${portsString} -m state --state NEW -m recent --update --seconds 10 --hitcount 1 -j SET --add-set ${table} src"
-    "INPUT -i eth0 -p tcp -m set --match-set ${table} src -j nixos-fw-refuse"
-    "INPUT -i eth0 -p udp -m set --match-set ${table} src -j nixos-fw-refuse"
-  ];
-
-  create-rules = lib.concatStringsSep "\n"
-    (builtins.map (rule: "iptables -C " + rule + " || iptables -A " + rule)
-      (rules "blocked") ++ builtins.map
-      (rule: "ip6tables -C " + rule + " || ip6tables -A " + rule)
-      (rules "blocked6"));
-
-  delete-rules = lib.concatStringsSep "\n"
-    (builtins.map (rule: "iptables -C " + rule + " && iptables -D " + rule)
-      (rules "blocked") ++ builtins.map
-      (rule: "ip6tables -C " + rule + " && ip6tables -D " + rule)
-      (rules "blocked6"));
-
-in {
-
-  networking.firewall = {
-
-    extraPackages = [ pkgs.ipset ];
-    # allowedTCPPorts = portsToBlock;
-
-    # Restore ban list when starting up
-    extraCommands = ''
-      if test -f /var/lib/ipset.conf
-      then
-          ipset restore -! < /var/lib/ipset.conf
-      else
-          ipset -exist create blocked hash:ip ${
-            if expire > 0 then "timeout ${toString expire}" else ""
-          }
-          ipset -exist create blocked6 hash:ip family inet6 ${
-            if expire > 0 then "timeout ${toString expire}" else ""
-          }
-      fi
-      ${create-rules}
-    '';
-
-    # Save list when shutting down
-    extraStopCommands = ''
-      ipset -exist create blocked hash:ip ${
-        if expire > 0 then "timeout ${toString expire}" else ""
-      }
-      ipset -exist create blocked6 hash:ip family inet6 ${
-        if expire > 0 then "timeout ${toString expire}" else ""
-      }
-      ipset save > /var/lib/ipset.conf
-      ${delete-rules}
-    '';
-  };
-
-}

modules/services/jellyfin.nix

@@ -1,30 +0,0 @@
-{ config, lib, ... }: {
-
-  options = {
-    streamServer = lib.mkOption {
-      type = lib.types.str;
-      description = "Hostname for Jellyfin library";
-    };
-  };
-
-  config = {
-
-    services.jellyfin.enable = true;
-
-    caddyRoutes = [{
-      match = [{ host = [ config.streamServer ]; }];
-      handle = [{
-        handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:8096"; }];
-      }];
-    }];
-
-    # Create videos directory, allow anyone in Jellyfin group to manage it
-    systemd.tmpfiles.rules = [
-      "d /var/lib/jellyfin 0775 jellyfin jellyfin"
-      "d /var/lib/jellyfin/library 0775 jellyfin jellyfin"
-    ];
-
-  };
-
-}

modules/services/netdata.nix

@@ -1,14 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  config = {
-
-    services.netdata = {
-      enable = true;
-
-      # Disable local dashboard (unsecured)
-      config = { web.mode = "none"; };
-    };
-
-  };
-
-}

modules/services/nextcloud.nix

@@ -1,87 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  imports = [ ./caddy.nix ./secrets.nix ./backups.nix ];
-
-  options = {
-
-    nextcloudServer = lib.mkOption {
-      type = lib.types.str;
-      description = "Hostname for Nextcloud";
-    };
-
-  };
-
-  config = {
-
-    services.nextcloud = {
-      enable = true;
-      package = pkgs.nextcloud24; # Required to specify
-      https = true;
-      hostName = "localhost";
-      maxUploadSize = "50G";
-      config = {
-        adminpassFile = config.secrets.nextcloud.dest;
-        extraTrustedDomains = [ config.nextcloudServer ];
-      };
-    };
-
-    # Don't let Nginx use main ports (using Caddy instead)
-    services.nginx.virtualHosts."localhost".listen = [{
-      addr = "127.0.0.1";
-      port = 8080;
-    }];
-
-    # Point Caddy to Nginx
-    caddyRoutes = [{
-      match = [{ host = [ config.nextcloudServer ]; }];
-      handle = [{
-        handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:8080"; }];
-      }];
-    }];
-
-    # Create credentials file for nextcloud
-    secrets.nextcloud = {
-      source = ../../private/nextcloud.age;
-      dest = "${config.secretsDirectory}/nextcloud";
-      owner = "nextcloud";
-      group = "nextcloud";
-      permissions = "0440";
-    };
-    systemd.services.nextcloud-secret = {
-      requiredBy = [ "nextcloud-setup.service" ];
-      before = [ "nextcloud-setup.service" ];
-    };
-
-    ## Backup config
-
-    # Open to groups, allowing for backups
-    systemd.services.phpfpm-nextcloud.serviceConfig.StateDirectoryMode =
-      lib.mkForce "0770";
-
-    # Allow litestream and nextcloud to share a sqlite database
-    users.users.litestream.extraGroups = [ "nextcloud" ];
-    users.users.nextcloud.extraGroups = [ "litestream" ];
-
-    # Backup sqlite database with litestream
-    services.litestream = {
-      settings = {
-        dbs = [{
-          path = "${config.services.nextcloud.datadir}/data/nextcloud.db";
-          replicas = [{
-            url =
-              "s3://${config.backupS3.bucket}.${config.backupS3.endpoint}/nextcloud";
-          }];
-        }];
-      };
-    };
-
-    # Don't start litestream unless nextcloud is up
-    systemd.services.litestream = {
-      after = [ "phpfpm-nextcloud.service" ];
-      requires = [ "phpfpm-nextcloud.service" ];
-    };
-
-  };
-
-}

modules/services/prometheus.nix

@@ -1,30 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  options.metricsServer = lib.mkOption {
-    type = lib.types.str;
-    description = "Hostname of the Grafana server.";
-  };
-
-  config = {
-
-    services.grafana.enable = true;
-    services.prometheus = {
-      enable = true;
-      exporters.node.enable = true;
-      scrapeConfigs = [{
-        job_name = "local";
-        static_configs = [{ targets = [ "127.0.0.1:9100" ]; }];
-      }];
-    };
-
-    caddyRoutes = [{
-      match = [{ host = [ config.metricsServer ]; }];
-      handle = [{
-        handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:3000"; }];
-      }];
-    }];
-
-  };
-
-}

modules/services/secrets.nix

@@ -1,91 +0,0 @@
-# Secrets management method taken from here:
-# https://xeiaso.net/blog/nixos-encrypted-secrets-2021-01-20
-
-# In my case, I pre-encrypt my secrets and commit them to git.
-
-{ config, pkgs, lib, ... }: {
-
-  options = {
-
-    secretsDirectory = lib.mkOption {
-      type = lib.types.str;
-      description = "Default path to place secrets.";
-      default = "/var/private";
-    };
-
-    secrets = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule {
-        options = {
-          source = lib.mkOption {
-            type = lib.types.path;
-            description = "Path to encrypted secret.";
-          };
-          dest = lib.mkOption {
-            type = lib.types.str;
-            description = "Resulting path for decrypted secret.";
-          };
-          owner = lib.mkOption {
-            default = "root";
-            type = lib.types.str;
-            description = "User to own the secret.";
-          };
-          group = lib.mkOption {
-            default = "root";
-            type = lib.types.str;
-            description = "Group to own the secret.";
-          };
-          permissions = lib.mkOption {
-            default = "0400";
-            type = lib.types.str;
-            description = "Permissions expressed as octal.";
-          };
-        };
-      });
-      description = "Set of secrets to decrypt to disk.";
-      default = { };
-    };
-
-  };
-
-  config = {
-
-    # Create a default directory to place secrets
-
-    systemd.tmpfiles.rules = [ "d ${config.secretsDirectory} 0755 root wheel" ];
-
-    # Declare oneshot service to decrypt secret using SSH host key
-    # - Requires that the secret is already encrypted for the host
-    # - Encrypt secrets: nix run github:nmasur/dotfiles#encrypt-secret
-
-    systemd.services = lib.mapAttrs' (name: attrs: {
-      name = "${name}-secret";
-      value = {
-
-        description = "Decrypt secret for ${name}";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig.Type = "oneshot";
-        script = ''
-          ${pkgs.age}/bin/age --decrypt \
-            --identity ${config.identityFile} \
-            --output ${attrs.dest} \
-            ${attrs.source}
-
-          chown '${attrs.owner}':'${attrs.group}' '${attrs.dest}'
-          chmod '${attrs.permissions}' '${attrs.dest}'
-        '';
-
-      };
-    }) config.secrets;
-
-    # Example declaration
-    # config.secrets.my-secret = {
-    #   source = ../../private/my-secret.age;
-    #   dest = "/var/lib/private/my-secret";
-    #   owner = "my-app";
-    #   group = "my-app";
-    #   permissions = "0440";
-    # };
-
-  };
-
-}

modules/services/sshd.nix

@@ -1,33 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  options = {
-    publicKey = lib.mkOption {
-      type = lib.types.str;
-      description = "Public SSH key authorized for this system.";
-    };
-    permitRootLogin = lib.mkOption {
-      type = lib.types.str;
-      description = "Root login settings.";
-      default = "no";
-    };
-  };
-
-  config = {
-    services.openssh = {
-      enable = true;
-      ports = [ 22 ];
-      passwordAuthentication = false;
-      gatewayPorts = "no";
-      forwardX11 = false;
-      allowSFTP = true;
-      permitRootLogin = config.permitRootLogin;
-    };
-
-    users.users.${config.user}.openssh.authorizedKeys.keys =
-      [ config.publicKey ];
-
-    # Implement a simple fail2ban service for sshd
-    services.sshguard.enable = true;
-  };
-
-}

modules/services/transmission.nix

@@ -1,79 +0,0 @@
-{ config, pkgs, lib, ... }: {
-
-  imports = [ ./wireguard.nix ./secrets.nix ];
-
-  options = {
-    transmissionServer = lib.mkOption {
-      type = lib.types.str;
-      description = "Hostname for Transmission";
-    };
-  };
-
-  config = let
-    namespace = config.networking.wireguard.interfaces.wg0.interfaceNamespace;
-    vpnIp = lib.strings.removeSuffix "/32"
-      (builtins.head config.networking.wireguard.interfaces.wg0.ips);
-  in {
-
-    # Setup transmission
-    services.transmission = {
-      enable = true;
-      settings = {
-        port-forwarding-enabled = false;
-        rpc-authentication-required = true;
-        rpc-port = 9091;
-        rpc-bind-address = "0.0.0.0";
-        rpc-username = config.user;
-        rpc-host-whitelist = config.transmissionServer;
-        rpc-host-whitelist-enabled = true;
-        rpc-whitelist = "127.0.0.1,${vpnIp}";
-        rpc-whitelist-enabled = true;
-      };
-      credentialsFile = config.secrets.transmission.dest;
-    };
-
-    # Bind transmission to wireguard namespace
-    systemd.services.transmission = {
-      bindsTo = [ "netns@${namespace}.service" ];
-      requires = [ "network-online.target" "transmission-secret.service" ];
-      after = [ "wireguard-wg0.service" "transmission-secret.service" ];
-      unitConfig.JoinsNamespaceOf = "netns@${namespace}.service";
-      serviceConfig.NetworkNamespacePath = "/var/run/netns/${namespace}";
-    };
-
-    # Create reverse proxy for web UI
-    caddyRoutes = [{
-      match = [{ host = [ config.transmissionServer ]; }];
-      handle = [{
-        handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:9091"; }];
-      }];
-    }];
-
-    # Allow inbound connections to reach namespace
-    systemd.services.transmission-web-netns = {
-      description = "Forward to transmission in wireguard namespace";
-      requires = [ "transmission.service" ];
-      after = [ "transmission.service" ];
-      serviceConfig = {
-        Restart = "on-failure";
-        TimeoutStopSec = 300;
-      };
-      wantedBy = [ "multi-user.target" ];
-      script = ''
-        ${pkgs.iproute2}/bin/ip netns exec ${namespace} ${pkgs.iproute2}/bin/ip link set dev lo up
-        ${pkgs.socat}/bin/socat tcp-listen:9091,fork,reuseaddr exec:'${pkgs.iproute2}/bin/ip netns exec ${namespace} ${pkgs.socat}/bin/socat STDIO "tcp-connect:${vpnIp}:9091"',nofork
-      '';
-    };
-
-    # Create credentials file for transmission
-    secrets.transmission = {
-      source = ../../private/transmission.json.age;
-      dest = "${config.secretsDirectory}/transmission.json";
-      owner = "transmission";
-      group = "transmission";
-    };
-
-  };
-
-}

modules/services/vaultwarden.nix

@@ -1,123 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let vaultwardenPath = "/var/lib/bitwarden_rs"; # Default service directory
-
-in {
-
-  imports = [ ./caddy.nix ./secrets.nix ./backups.nix ];
-
-  options = {
-
-    vaultwardenServer = lib.mkOption {
-      description = "Hostname for Vaultwarden.";
-      type = lib.types.str;
-    };
-
-  };
-
-  config = {
-    services.vaultwarden = {
-      enable = true;
-      config = {
-        DOMAIN = "https://${config.vaultwardenServer}";
-        SIGNUPS_ALLOWED = false;
-        SIGNUPS_VERIFY = true;
-        INVITATIONS_ALLOWED = true;
-        WEB_VAULT_ENABLED = true;
-        ROCKET_ADDRESS = "127.0.0.1";
-        ROCKET_PORT = 8222;
-        WEBSOCKET_ENABLED = true;
-        WEBSOCKET_ADDRESS = "0.0.0.0";
-        WEBSOCKET_PORT = 3012;
-        LOGIN_RATELIMIT_SECONDS = 60;
-        LOGIN_RATELIMIT_MAX_BURST = 10;
-        ADMIN_RATELIMIT_SECONDS = 300;
-        ADMIN_RATELIMIT_MAX_BURST = 3;
-      };
-      environmentFile = config.secrets.vaultwarden.dest;
-      dbBackend = "sqlite";
-    };
-
-    secrets.vaultwarden = {
-      source = ../../private/vaultwarden.age;
-      dest = "${config.secretsDirectory}/vaultwarden";
-      owner = "vaultwarden";
-      group = "vaultwarden";
-    };
-
-    networking.firewall.allowedTCPPorts = [ 3012 ];
-
-    caddyRoutes = [{
-      match = [{ host = [ config.vaultwardenServer ]; }];
-      handle = [{
-        handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:8222"; }];
-      }];
-    }];
-
-    ## Backup config
-
-    # Open to groups, allowing for backups
-    systemd.services.vaultwarden.serviceConfig.StateDirectoryMode =
-      lib.mkForce "0770";
-    systemd.tmpfiles.rules = [
-      "f ${vaultwardenPath}/db.sqlite3 0660 vaultwarden vaultwarden"
-      "f ${vaultwardenPath}/db.sqlite3-shm 0660 vaultwarden vaultwarden"
-      "f ${vaultwardenPath}/db.sqlite3-wal 0660 vaultwarden vaultwarden"
-    ];
-
-    # Allow litestream and vaultwarden to share a sqlite database
-    users.users.litestream.extraGroups = [ "vaultwarden" ];
-    users.users.vaultwarden.extraGroups = [ "litestream" ];
-
-    # Backup sqlite database with litestream
-    services.litestream = {
-      settings = {
-        dbs = [{
-          path = "${vaultwardenPath}/db.sqlite3";
-          replicas = [{
-            url =
-              "s3://${config.backupS3.bucket}.${config.backupS3.endpoint}/vaultwarden";
-          }];
-        }];
-      };
-    };
-
-    # Don't start litestream unless vaultwarden is up
-    systemd.services.litestream = {
-      after = [ "vaultwarden.service" ];
-      requires = [ "vaultwarden.service" ];
-    };
-
-    # Run a separate file backup on a schedule
-    systemd.timers.vaultwarden-backup = {
-      timerConfig = {
-        OnCalendar = "*-*-* 06:00:00"; # Once per day
-        Unit = "vaultwarden-backup.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-
-    # Backup other Vaultwarden data to object storage
-    systemd.services.vaultwarden-backup = {
-      description = "Backup Vaultwarden files";
-      environment.AWS_ACCESS_KEY_ID = config.backupS3.accessKeyId;
-      serviceConfig = {
-        Type = "oneshot";
-        User = "vaultwarden";
-        Group = "backup";
-        EnvironmentFile = config.secrets.backup.dest;
-      };
-      script = ''
-        ${pkgs.awscli2}/bin/aws s3 sync \
-            ${vaultwardenPath}/ \
-            s3://${config.backupS3.bucket}/vaultwarden/ \
-            --endpoint-url=https://${config.backupS3.endpoint} \
-            --exclude "*db.sqlite3*" \
-            --exclude ".db.sqlite3*"
-      '';
-    };
-
-  };
-
-}

modules/services/wireguard.nix

@@ -1,44 +1,18 @@
-{ config, pkgs, lib, ... }: {
+{ ... }: {
-
-  imports = [ ./secrets.nix ];
-
-  config = {
-
   networking.wireguard = {
     enable = true;
     interfaces = {
       wg0 = {
-
+        ips = [ "10.66.127.235/32" "fc00:bbbb:bbbb:bb01::3:7fea/128" ];
-          # Establishes identity of this machine
+        generatePrivateKeyFile = true;
-          generatePrivateKeyFile = false;
+        privateKeyFile = "/private/wireguard/wg0";
-          privateKeyFile = config.secrets.wireguard.dest;
+        peers = [{
-
+          publicKey = "cVDIYPzNChIeANp+0jE12kWM5Ga1MbmNErT1Pmaf12A=";
-          # Move to network namespace for isolating programs
+          allowedIPs = [ "0.0.0.0/0" "::0/0" ];
-          interfaceNamespace = "wg";
+          endpoint = "89.46.62.197:51820";
-
+          persistentKeepalive = 25;
+        }];
       };
     };
   };
-
-    # Create namespace for Wireguard
-    # This allows us to isolate specific programs to Wireguard
-    systemd.services."netns@" = {
-      description = "%I network namespace";
-      before = [ "network.target" ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
-        ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
-      };
-    };
-
-    # Create private key file for wireguard
-    secrets.wireguard = {
-      source = ../../private/wireguard.age;
-      dest = "${config.secretsDirectory}/wireguard";
-    };
-
-  };
-
 }

modules/shell/age.nix

@@ -0,0 +1,5 @@
+{ config, pkgs, ... }: {
+
+  home-manager.users.${config.user}.home.packages = with pkgs; [ age ];
+
+}

modules/shell/bash/scripts/ocr.sh

@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p tesseract
 
 # Yoinked from https://github.com/JJGO/dotfiles
 # Adapted from https://github.com/sdushantha/bin
@@ -8,13 +9,13 @@ TEXT_FILE="/tmp/ocr.txt"
 IMAGE_FILE="/tmp/ocr.png"
 
 function notify-send() {
-    /usr/bin/osascript -e "display notification \"$2\" with title \"OCR\""
+    osascript -e "display notification \"$2\" with title \"OCR\""
 }
 
 PATH="/usr/local/bin/:$PATH"
 
 # Take screenshot by selecting the area
-/usr/sbin/screencapture -i "$IMAGE_FILE"
+screencapture -i "$IMAGE_FILE"
 
 # Get the exit code of the previous command.
 # So in this case, it is the screenshot command. If it did not exit with an
@@ -43,7 +44,7 @@ fi
 
 # Copy text to clipboard
 # xclip -selection clip < "$TEXT_FILE"
-/usr/bin/pbcopy <"$TEXT_FILE"
+pbcopy <"$TEXT_FILE"
 
 # Send a notification with the text that was grabbed using OCR
 notify-send "ocr" "$(cat $TEXT_FILE)"

modules/shell/charm.nix

@@ -1,13 +0,0 @@
-{ config, pkgs, ... }: {
-
-  home-manager.users.${config.user} = {
-
-    home.packages = with pkgs; [
-      glow # Markdown previews
-      skate # Key-value store
-      charm # Manage account and filesystem
-    ];
-
-  };
-
-}

modules/shell/default.nix

@@ -1,6 +1,6 @@
 { ... }: {
   imports = [
-    ./charm.nix
+    ./age.nix
     ./direnv.nix
     ./fish
     ./fzf.nix

modules/shell/fish/default.nix

@@ -7,11 +7,10 @@
   home-manager.users.${config.user} = {
 
     # Packages used in abbreviations and aliases
-    home.packages = with pkgs; [ curl exa ];
+    home.packages = with pkgs; [ curl ];
 
     programs.fish = {
       enable = true;
-      shellAliases = { ls = "exa"; };
       functions = {
         commandline-git-commits = {
           description = "Insert commit into commandline";
@@ -42,6 +41,7 @@
           description = "Tidy up JSON using jq";
           body = "pbpaste | jq '.' | pbcopy"; # Need to fix for non-macOS
         };
+        ls = { body = "${pkgs.exa}/bin/exa $argv"; };
         note = {
           description = "Edit or create a note";
           argumentNames = "filename";

modules/shell/nixpkgs.nix

@@ -1,18 +1,16 @@
-{ config, pkgs, lib, ... }: {
+{ config, pkgs, ... }: {
   home-manager.users.${config.user} = {
 
     programs.fish = {
       shellAbbrs = {
         n = "nix";
-        ns = "nix-shell -p";
+        ns = "nix-shell --run fish -p";
-        nsf = "nix-shell --run fish -p";
         nsr = "nix-shell-run";
         nps = "nix repl '<nixpkgs>'";
         nixo = "man configuration.nix";
         nixh = "man home-configuration.nix";
         nr = "rebuild-nixos";
         nro = "rebuild-nixos offline";
-        hm = "rebuild-home";
       };
       functions = {
         nix-shell-run = {
@@ -40,14 +38,7 @@
                 set option "--option substitute false"
             end
             git -C ${config.dotfilesPath} add --intent-to-add --all
-            commandline -r "doas nixos-rebuild switch $option --flake ${config.dotfilesPath}#${config.networking.hostName}"
+            commandline -r "doas nixos-rebuild switch $option --flake ${config.dotfilesPath}"
-            commandline --function execute
-          '';
-        };
-        rebuild-home = {
-          body = ''
-            git -C ${config.dotfilesPath} add --intent-to-add --all
-            commandline -r "${pkgs.home-manager}/bin/home-manager switch --flake ${config.dotfilesPath}#${config.networking.hostName}";
             commandline --function execute
           '';
         };

modules/shell/starship.nix

@@ -9,7 +9,6 @@
         "$git_branch"
         "$git_commit"
         "$git_status"
-        "$hostname"
         "$cmd_duration"
         "$character"
       ];
@@ -48,10 +47,6 @@
         deleted = "✘";
         style = "red";
       };
-      hostname = {
-        ssh_only = true;
-        format = "on [$hostname](bold red) ";
-      };
       nix_shell = {
         format = "[$symbol $name]($style)";
         symbol = "❄️";

modules/shell/utilities.nix

@@ -31,8 +31,6 @@ in {
       vimv-rs # Batch rename files
       dig # DNS lookup
       lf # File viewer
-      # whois # Lookup IPs
-      age # Encryption
     ];
 
     programs.zoxide.enable = true; # Shortcut jump command

modules/work/nixos-org-certs.crt

@@ -0,0 +1,20 @@
+T2 Palo Alto CA
+-----BEGIN CERTIFICATE-----
+MIIDIjCCAgqgAwIBAgIJAOE7K8F61qxbMA0GCSqGSIb3DQEBCwUAMEExCzAJBgNV
+BAYTAlVTMQswCQYDVQQIEwJOWTELMAkGA1UECxMCSVQxGDAWBgNVBAMTD1QyIFBh
+bG8gQWx0byBDQTAeFw0xNTA3MTUyMzUzNDJaFw0yNTA3MTIyMzUzNDJaMEExCzAJ
+BgNVBAYTAlVTMQswCQYDVQQIEwJOWTELMAkGA1UECxMCSVQxGDAWBgNVBAMTD1Qy
+IFBhbG8gQWx0byBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBa
+nVZxAhk+spmp8JBzwtgPS+2oQ/Kpv7BRWn7Rj52oAL++a4DH2zRLb3f4mMyPpgEX
+nNrvZSkonxJToEMhAed5eIKNOjcwDT8kLatfmE/LHD4xNeK0FN0p0OlTJkwLI5KZ
+rne/YKqkYscYfjxyugYPb3ukjYfxeGNfeF9HGKTPAcL+fj0/fgkffJJPZ+d9+C2Z
+YXXI36DoXEjHUPxOz/hKL5ohM4m86OHt6qvZaG/b43raI99ckRFTwmoF+AfdIgVa
+3cuaxhnGyv+bC41LTxd1Azzys0txfxkFrt14oBUgOmPJelC26KgFoHnG8hSykNaH
+Uh8S8i8jmXgEdUN+bGkCAwEAAaMdMBswDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMC
+AgQwDQYJKoZIhvcNAQELBQADggEBAAqFo1P7Btgt9BZRpwmjA8ghQmQZQ9Fek1m2
+aOmkPMa6OqWxXDT5VU/b02LfKb+uVLsdBC1cv7ZrRYZc7ATt8d19rohvSn7DL8GR
+FEjYgj1OFvblbN8zHogDVx4gD57j9imT40vNpBcsEiRlNXDu/ExbhsDiing1tdmq
+eULdQg13kdJzqVS6xJ10qddqRRUWASkq5qUwvTO2MQkCjPSGjUAHeHa9vCZRiVWQ
+vWVwZ7CZ6XTzqcpfKdT/xKGHbT6xQxIhLVOvSMIhirh8OyFVzM5m+PHYN4KO6x5j
++Je/viLhvfaEVUntOkOcpQVmwOYZezQZqDDRWXo9k0vqGnZ8Gog=
+-----END CERTIFICATE-----

patches/calibre-web-cloudflare.patch

@@ -1,25 +0,0 @@
-diff --git a/cps/__init__.py b/cps/__init__.py
-index 0b912d23..ad5d1fa9 100644
---- a/cps/__init__.py
-+++ b/cps/__init__.py
-@@ -83,7 +83,6 @@ app.config.update(
- lm = MyLoginManager()
- lm.login_view = 'web.login'
- lm.anonymous_user = ub.Anonymous
--lm.session_protection = 'strong'
- 
- if wtf_present:
-     csrf = CSRFProtect()
-diff --git a/cps/admin.py b/cps/admin.py
-index 1004ee78..e295066e 100644
---- a/cps/admin.py
-+++ b/cps/admin.py
-@@ -98,8 +98,6 @@ def before_request():
-     # make remember me function work
-     if current_user.is_authenticated:
-         confirm_login()
--    if not ub.check_user_session(current_user.id, flask_session.get('_id')) and 'opds' not in request.path:
--        logout_user()
-     g.constants = constants
-     g.user = current_user
-     g.allow_registration = config.config_public_reg

private/backup.age

@@ -1,10 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBmVEo2
-bExsZERhYi9vVXMxVThRK2w3dFR4UlZVcGlsWUFPM3pReTQwaW5ZCjQ5Z3g3amZC
-bWUwWkdKTStVbFpwMmdwK3pQQU5CeE5tMVNHbXI1UkdCTFUKLT4gc3NoLWVkMjU1
-MTkgWXlTVU1RIE9sTG1lOHIyVGdLNWtJRTZtdGNWWEFsTTJ5bE1HS1V2MEdKeGNN
-WFMyV28KVlRHdDg5SGFadVlJempKWkp6eEp6TkhINnl0R0xDL0J0WXByclpFWE5I
-VQotLS0gVVhaUDZLTy8xS3hKOVliSlpuTEY2Q2xOQUEvblBtUG9Vb0I5ZE1oOUZ1
-VQr18Jwx6XDa7bwq0QWT6NdIFzqNUHWhDyUvS9twncFsr0yEAUDQd2XLtE+Vc8T9
-Z7y/C8Ct5+duqd6YaeqROJz5zVj0NnI0lshirBl89PQWF9ihp4V4Hw==
------END AGE ENCRYPTED FILE-----

private/mailpass.age

@@ -1,10 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBIRnEy
-am1HTXptMmpSTjZQa2hQSUxNUU1rdXlod3U3bVZ0VGxQVlE2WldBClg0K3k5MDZH
-NFlPdHI0VnZSZE9DTTNMeDdldUpFQ3V0V0k0RnRIZHFhdzAKLT4gc3NoLWVkMjU1
-MTkgWXlTVU1RIFlxZFpqNU5kNVY2VUk0Um0zZ1d1M2FlRkYvV1BoTEFSNjZ2Vk9I
-QTVHM0UKY2gvVU9wckVUNEFwdUwyVFJZUGwxOFFKYm12cUlFTEVrb3IvcXI3TnND
-UQotLS0gMHdaajFjV2ozd0g5dWN5YkhiU2NBVWZVSU00aVIzY0VKYjJleVlQTUdX
-QQo7rH6kOTRFP43U/qiBOCHx+hBGlaODFRS1CgzkuqfMOq8PM28RsIN+l3sbwjxE
-W8chE/A0EChjIDtfYTMgsN3cYg==
------END AGE ENCRYPTED FILE-----

private/nextcloud.age

@@ -1,10 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBudkxn
-ZzU1YVViYUZBWVVTYm1SeHpvanQ5M0YwVGo2YldlN2RwY0tscWpBCjd0ZmtLZ2th
-dEMrQk5QV0EzT0RpVkg5bGo1cHdTNzVYVkZpVzE4aHR0azgKLT4gc3NoLWVkMjU1
-MTkgWXlTVU1RIFlqaEI2QUNnMjR1T0FENXJIMEJWOUFJUXZ4SlJxbUFnQktWUW9w
-UFlmUUkKL1RwaWxoNFM4SkpadWtyN3JnWHdjVTYrQmo0dU9JUnp0MjN5enVsUm9o
-ZwotLS0gWUd2eTR2VGkyeTZ5cHNuanMrSlZKVmc4T1ZORExmUnhDSjN0NEJkNjkz
-cwriuyYCgvJe7TRi3n/JwxIRKMsoh7+xj4B5Fdxuj3BOtKVi1geSjlDHVklRwu9Y
-IMCTLqQtj08JnuLfDezRGHAYCM8=
------END AGE ENCRYPTED FILE-----

private/transmission.json.age

@@ -1,10 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBSYUU2
-OWp1ZDRLVTJrR1k3SVdXZnRPN3RUNDY5RFM2WEZaTzRmdU1zSWdrCjV1VHpNMG81
-VHA4LzdsN3FpOUNoTGNlWmlHS3E4dTVvWTVoZHJMSlNYTHMKLT4gc3NoLWVkMjU1
-MTkgWXlTVU1RIDVjM1JmclgxQThKcU1XQWptWmN0MjlKU1NvMEpwMnYyd3Y4czBT
-RTVkQ0UKc0pOYkRxZldsWnloQnBYMWk1eFU0M3R5SkZVTUYyaldIcENONE1PWVJv
-NAotLS0gclZDQndaREZpZ2Z0R0d0alBPeW1tZFVOVHhSaHNlQTRXdTRoZmFDUFFK
-SQqueOUzTFuhSryWW4Do+NAUcq2YdOtN8gmP5Zcp1oMe/9+JIs6Upjsc3eWn+dSA
-7QwbGlTyd6D0+PLJxHA18Xfgpj5owGeTDtwykFPgdO1BjE8C3KlgzUfN
------END AGE ENCRYPTED FILE-----

private/vaultwarden.age

@@ -1,11 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBqNm0x
-YVc0bXp6eldNdkp1QWk2cEI0WFBhVVd3cHhDODNwMS9UUTBPN25JCmxXZnRIcFZr
-SFJrQnI3R1BTUk1BcVl3RjlUaXMzSXpqaGdTMi9reno1eHcKLT4gc3NoLWVkMjU1
-MTkgWXlTVU1RIFlKWCtsWGtWdTI4L0ZFTVRHNFN5by9vTE95MXFoMVZGYlYrM1I2
-alREaE0Kd251SGRDdE96VmZqblhEWXFkZDhvRUZsZ1pnZ3NqdEdJSlBvaXhoOHVB
-WQotLS0gaGJNRm14SkdXcTFmYlJUell1WUZUeEllT3ZwMkNaejF3eWJ5U1ZSdno1
-MAqQIT8vvUro+C+avm6lCPfrX9yigKzx/gtKfMB//1Ie7BUo1+o5iYoA+R0luMU8
-/zVX1yGAzDPqas/HfYclIPg3bdjm2dnpz0ltOrOvjA4x3nEzzrmS96zo3Fy1d8oX
-oAMw2l/p2QDHI60cyhvC
------END AGE ENCRYPTED FILE-----

private/wireguard.age

@@ -1,10 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBOOXNm
-VG5EMHhEU2JLbkYyY1VXdXZJd2VxSEVXUjZaaURnU254QUVzUENzCnhnV21oRFNY
-NGpMeXlqdDlYRmltN1cxTlJ3eWFTVElpK0ZBalA3QVFoL2MKLT4gc3NoLWVkMjU1
-MTkgWXlTVU1RIDk3TVhDVVBjQU5XNjVTbkxKdUNEU25uZXREeEpHcTF4STg4VXR1
-V2xzRTQKZTBXZUQrbjIwTDEwOEc3MktpQzBjTzhjS3lTNTJ0TEMyMVBOODQ0N0lt
-OAotLS0gODA2L2FpSmxiWDAyM1IvM2Q4U2QrNmRkVjl1bFhURW5sNCtWZ2tiMnZU
-YwoC0chavNt+a/AImm/7bNheZIPghrobp9g+ga+UpRWBtM2snpkyFZrBR0qAkw/f
-3krp5Rrco7IOlEwWx96UzvAUpKlC7CdVI1MFa76ZUg==
------END AGE ENCRYPTED FILE-----

windows/alacritty.yml

@@ -720,10 +720,10 @@ shell:
 # in the order they were defined in.
 key_bindings:
   # Used for word completion in fish_user_key_bindings
-  - { key: Return, mods: Shift, chars: "\x1F" }
+  - { key: L, mods: Control|Shift, chars: "\x1F" }
   # Used for searching nixpkgs in fish_user_key_bindings
   - { key: N, mods: Control|Shift, chars: "\x11F" }
-  - { key: H, mods: Control|Shift, mode: ~Vi, action: ToggleViMode }
+  - { key: K, mods: Control, mode: ~Vi, action: ToggleViMode }
   - { key: Return, mode: Vi, action: ToggleViMode }
   # Used to enable $ keybind in Vi mode
   - { key: 5, mods: Shift, mode: Vi|~Search, action: Last }

windows/windows-programs.md

@@ -1,20 +0,0 @@
-# Windows Programs
-
-- Monitorian (monitor brightness)
-- Firefox
-- Alacritty
-- Mullvad
-- Keybase (dokan)
-- qBittorrent
-- 1Password
-- Authy Desktop
-- Autohotkey
-- 7zip
-- Audacity
-- Calibre
-- Discord
-- Git
-- Netflix
-- Obsidian
-- Realtek HD Audio
-- AMD Software