✨ [pi4] Containerize Actual service

Added Bluetooth support to desktop, including PS3 controllers

.gitattributes

@@ -1 +1 @@
-home-manager/secrets/* filter=git-crypt diff=git-crypt
+shared/secrets/weather-api-key filter=git-crypt diff=git-crypt

.sops.yaml

@@ -0,0 +1,11 @@
+keys:
+  - &thinkpad age1j66v6z6hlsgqjfv5fz7fldm5q9jay4j5v5du6ymfda6hv40nsqesg89g7p
+  - &desktop age1fxr5s6d6ar0xy5pr63kpq93tk7jha5k96jcxnyquj6s2mw8mmcpss8w29w
+  - &pi4 age1xlnprpvshv93eerthxzg6cahklsfc4efh8dd6u8dte9u6cl0u5qsz48qlt
+creation_rules:
+  - path_regex: shared/secrets/secrets.yaml$
+    key_groups:
+      - age:
+          - *thinkpad
+          - *desktop
+          - *pi4

README.md

@@ -1,8 +1,8 @@
 # NixOS Configurations
 
-My NixOS configurations with dotfiles for my desktop
+My NixOS configurations with dotfiles for my systems.
 
-![Screenshot of desktop](./assets/desktop.png)
+![Screenshot of desktop](./.gitea/assets/desktop.png)
 
 ## Uses
 
@@ -17,8 +17,6 @@ My NixOS configurations with dotfiles for my desktop
 | Runner | Rofi       |
 | Fetch  | Fastfetch  |
 
-Requires Nix-channel with [NixOS 24.11](https://nixos.org/)
-
 ## Commands
 
 First time run, will create a shell with the minimum dependencies in order to download the rest
@@ -57,5 +55,11 @@ Update and switch
 - Will update the flakes and nix-channel, then switch if there are no errors
 
 ```Shell
-  just update
+  just update-all
+```
+
+To update a single flake and rebuild
+
+```Shell
+  just update zen-browser
 ```

configuration.nix

@@ -1,70 +0,0 @@
-{
-  pkgs,
-  outputs,
-  ...
-}:
-let
-  common = import ./common.nix;
-in
-{
-  imports = [ ./modules ];
-
-  nixpkgs.overlays = [ outputs.overlays.unstable-packages ];
-
-  # Bootloader.
-  boot.loader = {
-    systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
-  };
-
-  # Define a user account. Don't forget to set a password with 'passwd'.
-  users.users.${common.username} = {
-    isNormalUser = true;
-    description = common.username;
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-    ];
-  };
-
-  # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
-
-  environment.sessionVariables = {
-    # Tells Electron apps to use Wayland
-    NIXOS_OZONE_WL = "1";
-  };
-
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
-  environment.systemPackages = with pkgs; [
-    brightnessctl
-    wget
-    xdg-utils
-    xdg-desktop-portal
-    xdg-desktop-portal-gtk
-    unstable.protonmail-desktop
-    stremio
-    fastfetch
-    discord
-    nix-prefetch-github # Cmd to get rev and hash from GitHub
-    gimp
-    vlc
-    vdhcoapp
-    onlyoffice-desktopeditors
-  ];
-
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  programs.kdeconnect.enable = true;
-
-  services = {
-    flatpak.enable = false;
-    xserver.enable = true;
-  };
-
-  system.stateVersion = common.system.version;
-}

flake.lock

@@ -9,11 +9,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736090999,
+        "lastModified": 1744557573,
-        "narHash": "sha256-B5CJuHqfJrzPa7tObK0H9669/EClSHpa/P7B9EuvElU=",
+        "narHash": "sha256-XAyj0iDuI51BytJ1PwN53uLpzTDdznPDQFG4RwihlTQ=",
         "owner": "aylur",
         "repo": "ags",
-        "rev": "5527c3c07d92c11e04e7fd99d58429493dba7e3c",
+        "rev": "3ed9737bdbc8fc7a7c7ceef2165c9109f336bff6",
         "type": "github"
       },
       "original": {
@@ -31,11 +31,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735172721,
+        "lastModified": 1742571008,
-        "narHash": "sha256-rtEAwGsHSppnkR3Qg3eRJ6Xh/F84IY9CrBBLzYabalY=",
+        "narHash": "sha256-5WgfJAeBpxiKbTR/gJvxrGYfqQRge5aUDcGKmU1YZ1Q=",
         "owner": "aylur",
         "repo": "astal",
-        "rev": "6c84b64efc736e039a8a10774a4a1bf772c37aa2",
+        "rev": "dc0e5d37abe9424c53dcbd2506a4886ffee6296e",
         "type": "github"
       },
       "original": {
@@ -44,16 +44,53 @@
         "type": "github"
       }
     },
+    "astal_2": {
+      "inputs": {
+        "nixpkgs": [
+          "hyprpanel",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748416910,
+        "narHash": "sha256-FEQcs58HL8Fe4i7XlqVEUwthjxwvRvgX15gTTfW17sU=",
+        "owner": "aylur",
+        "repo": "astal",
+        "rev": "c1bd89a47c81c66ab5fc6872db5a916c0433fb89",
+        "type": "github"
+      },
+      "original": {
+        "owner": "aylur",
+        "repo": "astal",
+        "type": "github"
+      }
+    },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
     "catppuccin": {
       "inputs": {
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1739934729,
+        "lastModified": 1748080874,
-        "narHash": "sha256-PcrLk10meIJICzUJqtCMOJxoITzbH52fZg2XAB7SSsM=",
+        "narHash": "sha256-sUebEzAkrY8Aq5G0GHFyRddmRNGP/a2iTtV7ISNvi/c=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "b1ff2a638afa827f1473498190a2c1cae1cf41cf",
+        "rev": "0ba11b12be81f0849a89ed17ab635164ea8f0112",
         "type": "github"
       },
       "original": {
@@ -62,42 +99,85 @@
         "type": "github"
       }
     },
-    "flake-parts": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
       "inputs": {
-        "nixpkgs-lib": [
+        "flake-compat": [
-          "nixvim",
+          "simple-nixos-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "simple-nixos-mailserver",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1738453229,
+        "lastModified": 1742649964,
-        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
-        "owner": "hercules-ci",
+        "owner": "cachix",
-        "repo": "flake-parts",
+        "repo": "git-hooks.nix",
-        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "cachix",
-        "repo": "flake-parts",
+        "repo": "git-hooks.nix",
         "type": "github"
       }
     },
-    "flake-utils": {
+    "gitignore": {
       "inputs": {
-        "systems": "systems"
+        "nixpkgs": [
+          "simple-nixos-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1731533236,
+        "lastModified": 1709087332,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "numtide",
+        "owner": "hercules-ci",
-        "repo": "flake-utils",
+        "repo": "gitignore.nix",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
+        "owner": "hercules-ci",
-        "repo": "flake-utils",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "grayjay": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1748772835,
+        "narHash": "sha256-p/hGSN1DOU/pELQi5PTds8eL+czjmb/0RvwvLm7nGC8=",
+        "owner": "rishabh5321",
+        "repo": "grayjay-flake",
+        "rev": "998cbc285d936a45daf07414d03db3f60c133caa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rishabh5321",
+        "repo": "grayjay-flake",
         "type": "github"
       }
     },
@@ -108,16 +188,37 @@
         ]
       },
       "locked": {
-        "lastModified": 1739757849,
+        "lastModified": 1748665073,
-        "narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
+        "narHash": "sha256-RMhjnPKWtCoIIHiuR9QKD7xfsKb3agxzMfJY8V9MOew=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
+        "rev": "282e1e029cb6ab4811114fc85110613d72771dea",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "release-25.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "zen-browser",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1743604125,
+        "narHash": "sha256-ZD61DNbsBt1mQbinAaaEqKaJk2RFo9R/j+eYWeGMx7A=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "180fd43eea296e62ae68e079fcf56aba268b9a1a",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -125,16 +226,15 @@
     "hyprpanel": {
       "inputs": {
         "ags": "ags",
-        "nixpkgs": [
+        "astal": "astal_2",
-          "nixpkgs"
+        "nixpkgs": "nixpkgs_3"
-        ]
       },
       "locked": {
-        "lastModified": 1740863579,
+        "lastModified": 1748962037,
-        "narHash": "sha256-U4amsszfgPUTAa9FrIlYsCCpmAyko22h/nbjhmAZvAs=",
+        "narHash": "sha256-MkrOyZ6CqTzzmlfmvkPiezy51hG96xqucrR38xQpK/0=",
         "owner": "Jas-SinghFSU",
         "repo": "HyprPanel",
-        "rev": "2be9f1ef6c2df2ecf0eebe5a039e8029d8d151cd",
+        "rev": "8422c6b80526f8289a30b93cb5b354d9f007141d",
         "type": "github"
       },
       "original": {
@@ -143,41 +243,13 @@
         "type": "github"
       }
     },
-    "ixx": {
-      "inputs": {
-        "flake-utils": [
-          "nixvim",
-          "nuschtosSearch",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixvim",
-          "nuschtosSearch",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729958008,
-        "narHash": "sha256-EiOq8jF4Z/zQe0QYVc3+qSKxRK//CFHMB84aYrYGwEs=",
-        "owner": "NuschtOS",
-        "repo": "ixx",
-        "rev": "9fd01aad037f345350eab2cd45e1946cc66da4eb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NuschtOS",
-        "ref": "v0.0.6",
-        "repo": "ixx",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1736012469,
+        "lastModified": 1744463964,
-        "narHash": "sha256-/qlNWm/IEVVH7GfgAIyP6EsVZI6zjAx1cV5zNyrs+rI=",
+        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8f3e1f807051e32d8c95cd12b9b421623850a34d",
+        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
         "type": "github"
       },
       "original": {
@@ -187,17 +259,49 @@
         "type": "github"
       }
     },
-    "nixpkgs-unstable": {
+    "nixpkgs-25_05": {
       "locked": {
-        "lastModified": 1741010256,
+        "lastModified": 1747610100,
-        "narHash": "sha256-WZNlK/KX7Sni0RyqLSqLPbK8k08Kq7H7RijPJbq9KHM=",
+        "narHash": "sha256-rpR5ZPMkWzcnCcYYo3lScqfuzEw5Uyfh+R0EKZfroAc=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ba487dbc9d04e0634c64e3b1f0d25839a0a68246",
+        "rev": "ca49c4304acf0973078db0a9d200fd2bae75676d",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1748889542,
+        "narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1748693115,
+        "narHash": "sha256-StSrWhklmDuXT93yc3GrTlb0cKSS0agTAxMGjLKAsY8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "910796cabe436259a29a72e8d3f5e180fc6dfacc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -205,27 +309,27 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1741048562,
+        "lastModified": 1748693115,
-        "narHash": "sha256-W4YZ3fvWZiFYYyd900kh8P8wU6DHSiwaH0j4+fai1Sk=",
+        "narHash": "sha256-StSrWhklmDuXT93yc3GrTlb0cKSS0agTAxMGjLKAsY8=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6af28b834daca767a7ef99f8a7defa957d0ade6f",
+        "rev": "910796cabe436259a29a72e8d3f5e180fc6dfacc",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1735471104,
+        "lastModified": 1748370509,
-        "narHash": "sha256-0q9NGQySwDQc7RhAV2ukfnu7Gxa5/ybJ2ANT8DQrQrs=",
+        "narHash": "sha256-QlL8slIgc16W5UaI3w7xHQEP+Qmv/6vSNTpoZrrSlbk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "88195a94f390381c6afcdaa933c2f6ff93959cb4",
+        "rev": "4faa5f5321320e49a78ae7848582f684d64783e9",
         "type": "github"
       },
       "original": {
@@ -235,76 +339,125 @@
         "type": "github"
       }
     },
-    "nixvim": {
+    "nixpkgs_4": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
-        "nuschtosSearch": "nuschtosSearch"
-      },
       "locked": {
-        "lastModified": 1741098523,
+        "lastModified": 1748889542,
-        "narHash": "sha256-gXDSXDr6tAb+JgxGMvcEjKC9YO8tVOd8hMMZHJLyQ6Q=",
+        "narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
-        "owner": "nix-community",
+        "owner": "NixOS",
-        "repo": "nixvim",
+        "repo": "nixpkgs",
-        "rev": "03065fd4708bfdf47dd541d655392a60daa25ded",
+        "rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "NixOS",
-        "repo": "nixvim",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nuschtosSearch": {
+    "nixpkgs_5": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "ixx": "ixx",
-        "nixpkgs": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1738508923,
+        "lastModified": 1747179050,
-        "narHash": "sha256-4DaDrQDAIxlWhTjH6h/+xfG05jt3qDZrZE/7zDLQaS4=",
+        "narHash": "sha256-qhFMmDkeJX9KJwr5H32f1r7Prs7XbQWtO0h3V0a0rFY=",
-        "owner": "NuschtOS",
+        "owner": "NixOS",
-        "repo": "search",
+        "repo": "nixpkgs",
-        "rev": "86e2038290859006e05ca7201425ea5b5de4aecb",
+        "rev": "adaa24fbf46737f3f1b5497bf64bae750f82942e",
         "type": "github"
       },
       "original": {
-        "owner": "NuschtOS",
+        "owner": "NixOS",
-        "repo": "search",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1743448293,
+        "narHash": "sha256-bmEPmSjJakAp/JojZRrUvNcDX2R5/nuX6bm+seVaGhs=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "77b584d61ff80b4cef9245829a6f1dfad5afdfa3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
         "catppuccin": "catppuccin",
+        "grayjay": "grayjay",
         "home-manager": "home-manager",
         "hyprpanel": "hyprpanel",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_4",
+        "nixpkgs-stable": "nixpkgs-stable",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "nixvim": "nixvim",
+        "simple-nixos-mailserver": "simple-nixos-mailserver",
+        "sops-nix": "sops-nix",
         "spicetify-nix": "spicetify-nix",
         "zen-browser": "zen-browser"
       }
     },
+    "simple-nixos-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_5",
+        "nixpkgs-25_05": "nixpkgs-25_05"
+      },
+      "locked": {
+        "lastModified": 1747965231,
+        "narHash": "sha256-BW3ktviEhfCN/z3+kEyzpDKAI8qFTwO7+S0NVA0C90o=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "53007af63fade28853408370c4c600a63dd97f41",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "ref": "nixos-25.05",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747603214,
+        "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=",
+        "owner": "mic92",
+        "repo": "sops-nix",
+        "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "spicetify-nix": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-unstable"
         ],
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1740889006,
+        "lastModified": 1748752728,
-        "narHash": "sha256-A1iyKVvZrLdLwqWPC9OvPjC85ADQn2R1EGfCzJBl+wI=",
+        "narHash": "sha256-en008ncPUQjVx2i3PbM4RWeZkD9DNbJwIy0epppXe2o=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "f8d3757d4ae3af2175a631fb9598a42d30ee75fc",
+        "rev": "0e03de40d5128eb2ad600c98f57cf5db2cdf3240",
         "type": "github"
       },
       "original": {
@@ -328,31 +481,17 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "zen-browser": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1740554227,
+        "lastModified": 1748920570,
-        "narHash": "sha256-xpwZeMw2gGenixGQDyVv+ja+epcR+EJ1BPuGFdgFS18=",
+        "narHash": "sha256-m7EshkqPxa3IxN/qwxP1LlMlRdn37aiK0hghDieho8A=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "7de16ae319e6f6852274fa90b0d41c00049767c9",
+        "rev": "ff5bf0bcf588e8c1d0f5fcd635b0c8e1cce8aee5",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,67 +1,163 @@
 {
-  description = "NixOS configuration";
+  description = "Martin's NixOS configuration - Based on EmergentMind/nix-config";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
+    #
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    # ========= Official NixOS and HM Package Sources =========
+    #
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    # The next two are for pinning to stable vs unstable regardless of what the above is set to
+    # This is particularly useful when an upcoming stable release is in beta because you can effectively
+    # keep 'nixpkgs-stable' set to stable for critical packages while setting 'nixpkgs' to the beta branch to
+    # get a jump start on deprecation changes.
+    # See also 'stable-packages' and 'unstable-packages' overlays at 'overlays/default.nix"
+    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
 
-    catppuccin = {
-      url = "github:catppuccin/nix";
-    };
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.11";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    hyprpanel = {
+
-      url = "github:Jas-SinghFSU/HyprPanel";
+    #
+    # ========= Utilities =========
+    #
+    # Secrets management
+    sops-nix = {
+      url = "github:mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nixvim = {
+    # Catppuccin theming
-      url = "github:nix-community/nixvim";
+    catppuccin.url = "github:catppuccin/nix";
-      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    # Bar
-    };
+    hyprpanel.url = "github:Jas-SinghFSU/HyprPanel";
+    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-25.05";
+    # Spotify
     spicetify-nix = {
       url = "github:Gerg-L/spicetify-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+    # Browser
     zen-browser.url = "github:0xc000022070/zen-browser-flake";
+    # Video aggregator
+    grayjay.url = "github:rishabh5321/grayjay-flake";
   };
 
   outputs =
-    inputs@{
-      self, # Get a ref to outputs
-      nixpkgs,
-      nixpkgs-unstable,
-      home-manager,
-      ...
-    }:
-    let
-      system = "x86_64-linux";
-      pkgs = nixpkgs.legacyPackages.${system};
-      inherit (self) outputs;
-      common = import ./common.nix;
-    in
     {
-      defaultPackages.${system} = home-manager.defaultPackage.${system};
+      self,
+      nixpkgs,
+      home-manager,
+      simple-nixos-mailserver,
+      ...
+    }@inputs:
+    let
+      inherit (self) outputs;
+      common = import ./shared/common.nix;
+      theme = import ./shared/theme.nix;
 
-      # The minimum amount of dependencies in order to run 'just switch-now'
+      #
-      devShells.${system}.default = pkgs.mkShell {
+      # ========= Architectures =========
-        packages = with pkgs; [
+      #
-          just
+      forAllSystems = nixpkgs.lib.genAttrs [
-          git
+        "x86_64-linux"
-          git-crypt
+        "aarch64-linux"
-          nh
       ];
+
+      # ========== Extend lib with lib.custom ==========
+      # NOTE: This approach allows lib.custom to propagate into hm
+      # see: https://github.com/nix-community/home-manager/pull/3454
+      customLib = (_self: _super: { custom = import ./lib { inherit (nixpkgs) lib; }; });
+      lib = nixpkgs.lib.extend customLib;
+      libHm = home-manager.lib.extend customLib;
+
+      systems = builtins.map (config: defaultAttrs // config) [
+        {
+          hostName = "desktop";
+          nvidia.enable = true;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSzXyTuQyTrWsfORQbvgrqt/33+hfSUDXeMg6D1T2wz";
+        }
+        {
+          hostName = "thinkpad";
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILNlHKE/BD8kKfhJD7GBk1A3whZf3gTjk9VEgGAj3qsH";
+        }
+        {
+          hostName = "pi4";
+          system = "aarch64-linux";
+          wayland.enable = false;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJE9m7YiITe1sDqSZ7Pa8luIw3WToLsypixZEqE4wCQE";
+          address.private = common.localIpAddr 188;
+        }
+        {
+          hostName = "homelab";
+          wayland.enable = false;
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIARDv5nRlfPDXdV+Db4FaqeSJZ3/3MO0frYGzuVeqYAl";
+          address.private = common.localIpAddr 231;
+          address.tailnet = common.tailnetAddr "admin";
+        }
+      ];
+
+      defaultAttrs = {
+        hostName = builtins.abort "hostName is required";
+        system = "x86_64-linux";
+        username = common.username;
+        version = common.system.version;
+        wayland.enable = true;
+        nvidia.enable = false;
       };
 
-      # Adds the nix fmt command to format nix files
+      knownSystems = [
-      formatter.${system} = pkgs.nixfmt-rfc-style;
+        {
+          # Samsung S23 FE
+          hostName = "localhost-y4maoyqm";
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII7SSjiqnjif1Kko60iXVTKJ7a1/lRlR8TFNtoclNcnQ";
+        }
+        {
+          # OnePlus 8
+          hostName = "localhost-4izgka9k";
+          ssh.publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALtulVgLrUEpKnpfPFQTHjaEXTxs2Q818NC18eLx0bj";
+        }
+      ];
 
-      nixosConfigurations.${common.hostname} = nixpkgs.lib.nixosSystem {
+    in
-        system = system;
+    {
-        specialArgs = { inherit outputs inputs; }; # Pass args to modules
+      #
+      # ========= Overlays =========
+      #
+      # Custom modifications/overrides to upstream packages
+      overlays = import ./overlays.nix { inherit inputs; };
+
+      #
+      # ========= Host Configurations =========
+      #
+      nixosConfigurations = builtins.listToAttrs (
+        builtins.map (
+          {
+            hostName,
+            system,
+            username,
+            ...
+          }@systemConfig:
+
+          {
+            name = hostName;
+            value = nixpkgs.lib.nixosSystem {
+              inherit system;
+              specialArgs = {
+                inherit
+                  outputs
+                  inputs
+                  common
+                  theme
+                  lib
+                  systemConfig
+                  systems
+                  knownSystems
+                  ;
+                isDarwin = false;
+              };
               modules = [
-          ./configuration.nix
+                ./hosts/${hostName}
                 home-manager.nixosModules.home-manager
                 {
                   home-manager = {
@@ -69,23 +165,45 @@
                     backupFileExtension = "bkp";
                     useGlobalPkgs = true;
                     useUserPackages = true;
-              # Passes inputs as an argument to home-manager
+                    extraSpecialArgs = {
-              extraSpecialArgs = { inherit inputs; };
+                      inherit
-              users.${common.username} = import ./home-manager;
+                        inputs
+                        common
+                        theme
+                        libHm
+                        systemConfig
+                        systems
+                        ;
+                    };
+                    users.${username} = import ./hosts/${hostName}/home-manager;
                   };
                 }
-          ./overlays.nix
+                {
+                  nixpkgs.overlays = with inputs; [
+                    hyprpanel.overlay
+                  ];
+                }
               ];
             };
+          }
+        ) systems
+      );
 
-      overlays = {
+      #
-        # Gives access to unstable packages everywhere
+      # ========= Formatting =========
-        unstable-packages = final: _prev: {
+      #
-          unstable = import nixpkgs-unstable {
+      # Nix formatter available through 'nix fmt' https://github.com/NixOS/nixfmt
-            system = final.system;
+      formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.nixfmt-rfc-style);
-            config.allowUnfree = true;
+
-          };
+      #
-        };
+      # ========= DevShell =========
-      };
+      #
+      # Custom shell for bootstrapping on new hosts, modifying nix-config, and secrets management
+      devShells = forAllSystems (
+        system:
+        import ./shell.nix {
+          pkgs = nixpkgs.legacyPackages.${system};
+        }
+      );
     };
 }

home-manager/default.nix

@@ -1,69 +0,0 @@
-{
-  pkgs,
-  inputs,
-  ...
-}:
-let
-  common = import ../common.nix;
-  username = common.username;
-  dir = common.dir;
-in
-{
-  imports = [
-    inputs.catppuccin.homeManagerModules.catppuccin
-    ./btop.nix
-    ./cava
-    ./cursors.nix
-    ./default-applications.nix
-    ./development
-    ./fastfetch.nix
-    ./fish.nix
-    ./freetube.nix
-    ./gtk.nix
-    ./kitty.nix
-    ./mpv.nix
-    ./nextcloud.nix
-    ./rofi
-    ./wlogout
-    ./hyprland
-    ./spicetify.nix # TODO env conflict on latest version
-    ./yazi
-    ./zen
-  ];
-
-  dconf = {
-    enable = true;
-    settings = {
-      # Prefer dark mode for all GTK apps
-      "org/gnome/desktop/interface".color-scheme = "prefer-dark";
-    };
-  };
-
-  home = {
-    username = username;
-    homeDirectory = dir.home;
-
-    sessionVariables = {
-      XDG_PICTURES_DIR = dir.pictures; # Define the default dir for pictures
-    };
-
-    # You can update Home Manager without changing this value. See
-    # the Home Manager release notes for a list of state version
-    # changes in each release.
-    stateVersion = common.system.version;
-  };
-
-  programs = {
-    btop.enable = true;
-
-    # Let Home Manager install and manage itself.
-    home-manager.enable = true;
-  };
-
-  services = {
-    gpg-agent = {
-      enable = true;
-      pinentryPackage = pkgs.pinentry-curses;
-    };
-  };
-}

home-manager/development/nixvim/default.nix

@@ -1,77 +0,0 @@
-# Neovim configuration for Nix
-{ inputs, ... }:
-
-{
-  imports = [
-    inputs.nixvim.homeManagerModules.nixvim
-  ];
-
-  catppuccin.nvim.enable = true;
-
-  home.sessionVariables.EDITOR = "nvim";
-
-  programs.nixvim = {
-    enable = true;
-    clipboard.providers.wl-copy.enable = true;
-    colorschemes.catppuccin.enable = true;
-    defaultEditor = true;
-    vimdiffAlias = true; # Alias vimdiff to nvim -d
-
-    opts = {
-      number = true; # Show line numbers
-      relativenumber = true; # Show relative line numbers
-
-      shiftwidth = 2; # Tab width should be 2
-    };
-
-    plugins = {
-      bufferline.enable = false;
-
-      # Formatters
-      conform-nvim = {
-        enable = true;
-        # TODO use nix fmt on save
-        settings = { };
-      };
-
-      lsp = {
-        enable = true;
-        servers = {
-          nixd.enable = true;
-        };
-      };
-
-      lualine.enable = true;
-      luasnip.enable = true;
-
-      # Completions
-      cmp = {
-        enable = true;
-
-        autoEnableSources = true;
-
-        # TODO complete on <tab>
-        settings = {
-          sources = [
-            { name = "nvim-lsp"; }
-            { name = "path"; }
-            { name = "buffer"; }
-          ];
-        };
-      };
-
-      treesitter.enable = true;
-      web-devicons.enable = true;
-    };
-
-    extraConfigLua = ''
-      -- Translucent background
-      vim.cmd [[
-        highlight Normal guibg=none
-        highlight NonText guibg=none
-        highlight Normal ctermbg=none
-        highlight NonText ctermbg=none
-      ]]
-    '';
-  };
-}

home-manager/gtk.nix

@@ -1,11 +0,0 @@
-let
-  theme = import ../theme.nix;
-in
-{
-  gtk.enable = true;
-  catppuccin.gtk = {
-    enable = true;
-    flavor = theme.flavor;
-    icon.enable = true;
-  };
-}

home-manager/hyprland/hyprpaper.nix

@@ -1,33 +0,0 @@
-# Wallpapers
-{ pkgs, ... }:
-
-let
-  common = import ../../common.nix;
-in
-{
-  home.packages = with pkgs; [
-    hyprpaper
-  ];
-
-  services.hyprpaper = {
-    enable = true;
-    settings =
-      let
-        wallpaperDir = ../../wallpapers;
-        monitor1 = "${wallpaperDir}/nixos_waves.png";
-      in
-      {
-        ipc = "on";
-        splash = false;
-        splash_offset = 2.0;
-
-        preload = [
-          monitor1
-        ];
-
-        wallpaper = [
-          "${common.monitor1},${monitor1}"
-        ];
-      };
-  };
-}

home-manager/hyprland/swaync/default.nix

@@ -1,463 +0,0 @@
-{ lib, ... }:
-let
-  theme = import ../../../theme.nix;
-in
-{
-  services.swaync = {
-    enable = false;
-    style = lib.mkDefault ''
-      * {
-        all: unset;
-        font-size: 14px;
-        font-family: "${theme.nerdFont} Nerd Font", monospace;
-        transition: 200ms;
-      }
-
-      trough highlight {
-        background: #${theme.textAlpha};
-      }
-
-      scale trough {
-        margin: 0 1rem;
-        background-color: #${theme.surface0Alpha};
-        min-height: 8px;
-        min-width: 70px;
-      }
-
-      slider {
-        background-color: #${theme.blueAlpha};
-      }
-
-      .floating-notifications.background .notification-row .notification-background {
-        box-shadow:
-          0 0 8px 0 rgba(0, 0, 0, 0.8),
-          inset 0 0 0 1px #${theme.surface0Alpha};
-        border-radius: 12.6px;
-        margin: 18px;
-        background-color: #${theme.baseAlpha};
-        color: #${theme.textAlpha};
-        padding: 0;
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification {
-        padding: 7px;
-        border-radius: 12.6px;
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification.critical {
-        box-shadow: inset 0 0 7px 0 #${theme.redAlpha};
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification
-        .notification-content {
-        margin: 7px;
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification
-        .notification-content
-        .summary {
-        color: #${theme.textAlpha};
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification
-        .notification-content
-        .time {
-        color: #${theme.subtext0Alpha};
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification
-        .notification-content
-        .body {
-        color: #${theme.textAlpha};
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification
-        > *:last-child
-        > * {
-        min-height: 3.4em;
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification
-        > *:last-child
-        > *
-        .notification-action {
-        border-radius: 7px;
-        color: #${theme.textAlpha};
-        background-color: #${theme.surface0Alpha};
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        margin: 7px;
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification
-        > *:last-child
-        > *
-        .notification-action:hover {
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        background-color: #${theme.surface0Alpha};
-        color: #${theme.textAlpha};
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .notification
-        > *:last-child
-        > *
-        .notification-action:active {
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        background-color: #${theme.sapphireAlpha};
-        color: #${theme.textAlpha};
-      }
-
-      /* Close Button */
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .close-button {
-        margin: 7px;
-        padding: 2px;
-        border-radius: 6.3px;
-        color: #${theme.baseAlpha};
-        background-color: #${theme.redAlpha};
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .close-button:hover {
-        background-color: #${theme.maroonAlpha};
-        color: #${theme.baseAlpha};
-      }
-
-      .floating-notifications.background
-        .notification-row
-        .notification-background
-        .close-button:active {
-        background-color: #${theme.redAlpha};
-        color: #${theme.baseAlpha};
-      }
-
-      .control-center {
-        box-shadow:
-          0 0 8px 0 rgba(0, 0, 0, 0.8),
-          inset 0 0 0 1px #${theme.surface0Alpha};
-        border-radius: 12.6px;
-        margin: 18px;
-        background-color: #${theme.baseAlpha};
-        color: #${theme.textAlpha};
-        padding: 14px;
-      }
-
-      .control-center .widget-title > label {
-        color: #${theme.textAlpha};
-        font-size: 1.3em;
-      }
-
-      .control-center .widget-title button {
-        border-radius: 7px;
-        color: #${theme.textAlpha};
-        background-color: #${theme.surface0Alpha};
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        padding: 8px;
-      }
-
-      .control-center .widget-title button:hover {
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        background-color: #585b70;
-        color: #${theme.textAlpha};
-      }
-
-      .control-center .widget-title button:active {
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        background-color: #${theme.sapphireAlpha};
-        color: #${theme.baseAlpha};
-      }
-
-      .control-center .notification-row .notification-background {
-        border-radius: 7px;
-        color: #${theme.textAlpha};
-        background-color: #${theme.surface0Alpha};
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        margin-top: 14px;
-      }
-
-      .control-center .notification-row .notification-background .notification {
-        padding: 7px;
-        border-radius: 7px;
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification.critical {
-        box-shadow: inset 0 0 7px 0 #${theme.redAlpha};
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification
-        .notification-content {
-        margin: 7px;
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification
-        .notification-content
-        .summary {
-        color: #${theme.textAlpha};
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification
-        .notification-content
-        .time {
-        color: #a6adc8;
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification
-        .notification-content
-        .body {
-        color: #${theme.textAlpha};
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification
-        > *:last-child
-        > * {
-        min-height: 3.4em;
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification
-        > *:last-child
-        > *
-        .notification-action {
-        border-radius: 7px;
-        color: #${theme.textAlpha};
-        background-color: #${theme.crustAlpha};
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        margin: 7px;
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification
-        > *:last-child
-        > *
-        .notification-action:hover {
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        background-color: #${theme.surface0Alpha};
-        color: #${theme.textAlpha};
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .notification
-        > *:last-child
-        > *
-        .notification-action:active {
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        background-color: #${theme.sapphireAlpha};
-        color: #${theme.textAlpha};
-      }
-
-      .control-center .notification-row .notification-background .close-button {
-        margin: 7px;
-        padding: 2px;
-        border-radius: 6.3px;
-        color: #${theme.baseAlpha};
-        background-color: #${theme.maroonAlpha};
-      }
-
-      .close-button {
-        border-radius: 6.3px;
-      }
-
-      .control-center .notification-row .notification-background .close-button:hover {
-        background-color: #${theme.redAlpha};
-        color: #${theme.baseAlpha};
-      }
-
-      .control-center
-        .notification-row
-        .notification-background
-        .close-button:active {
-        background-color: #${theme.redAlpha};
-        color: #${theme.baseAlpha};
-      }
-
-      .control-center .notification-row .notification-background:hover {
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        background-color: #${theme.overlay1Alpha};
-        color: #${theme.textAlpha};
-      }
-
-      .control-center .notification-row .notification-background:active {
-        box-shadow: inset 0 0 0 1px #${theme.surface1Alpha};
-        background-color: #${theme.sapphireAlpha};
-        color: #${theme.textAlpha};
-      }
-
-      .notification.critical progress {
-        background-color: #${theme.redAlpha};
-      }
-
-      .notification.low progress,
-      .notification.normal progress {
-        background-color: #${theme.blueAlpha};
-      }
-
-      .control-center-dnd {
-        margin-top: 5px;
-        border-radius: 8px;
-        background: #${theme.surface0Alpha};
-        border: 1px solid #${theme.surface1Alpha};
-        box-shadow: none;
-      }
-
-      .control-center-dnd:checked {
-        background: #${theme.surface0Alpha};
-      }
-
-      .control-center-dnd slider {
-        background: #${theme.surface1Alpha};
-        border-radius: 8px;
-      }
-
-      .widget-dnd {
-        margin: 0px;
-        font-size: 1.1rem;
-      }
-
-      .widget-dnd > switch {
-        font-size: initial;
-        border-radius: 8px;
-        background: #${theme.surface0Alpha};
-        border: 1px solid #${theme.surface1Alpha};
-        box-shadow: none;
-      }
-
-      .widget-dnd > switch:checked {
-        background: #${theme.surface0Alpha};
-      }
-
-      .widget-dnd > switch slider {
-        background: #${theme.surface1Alpha};
-        border-radius: 8px;
-        border: 1px solid #${theme.overlay0Alpha};
-      }
-
-      .widget-mpris .widget-mpris-player {
-        background: #${theme.surface0Alpha};
-        padding: 7px;
-      }
-
-      .widget-mpris .widget-mpris-title {
-        font-size: 1.2rem;
-      }
-
-      .widget-mpris .widget-mpris-subtitle {
-        font-size: 0.8rem;
-      }
-
-      .widget-menubar > box > .menu-button-bar > button > label {
-        font-size: 3rem;
-        padding: 0.5rem 2rem;
-      }
-
-      .widget-menubar > box > .menu-button-bar > :last-child {
-        color: #${theme.redAlpha};
-      }
-
-      .power-buttons button:hover,
-      .powermode-buttons button:hover,
-      .screenshot-buttons button:hover {
-        background: #${theme.surface0Alpha};
-      }
-
-      .control-center .widget-label > label {
-        color: #${theme.textAlpha};
-        font-size: 2rem;
-      }
-
-      .widget-buttons-grid {
-        padding-top: 1rem;
-      }
-
-      .widget-buttons-grid > flowbox > flowboxchild > button label {
-        font-size: 2.5rem;
-      }
-
-      .widget-volume {
-        padding-top: 1rem;
-      }
-
-      .widget-volume label {
-        font-size: 1.5rem;
-        color: #${theme.sapphireAlpha};
-      }
-
-      .widget-volume trough highlight {
-        background: #${theme.sapphireAlpha};
-      }
-
-      .widget-backlight trough highlight {
-        background: #${theme.yellowAlpha};
-      }
-
-      .widget-backlight label {
-        font-size: 1.5rem;
-        color: #${theme.yellowAlpha};
-      }
-
-      .widget-backlight .KB {
-        padding-bottom: 1rem;
-      }
-
-      .image {
-        padding-right: 0.5rem;
-      }
-    '';
-  };
-}

home-manager/hyprland/waybar/config/config.jsonc

@@ -1,108 +0,0 @@
-{
-  "layer": "top",
-  // Waybar at top layer
-  "position": "top",
-  // Waybar position (top|bottom|left|right)
-  // "width": 1280, // Waybar width
-  // Choose the order of the modules
-  "modules-left": ["hyprland/workspaces", "custom/music"],
-  "modules-center": ["hyprland/window"],
-  "modules-right": [
-    "hyprland/language",
-    "wireplumber",
-    "backlight",
-    "clock",
-    "custom/notification",
-    "tray",
-    "custom/lock",
-    "custom/power",
-  ],
-  "hyprland/workspaces": {
-    "disable-scroll": false,
-    "sort-by-name": true,
-    "format": " {id} ",
-  },
-  "hyprland/window": {
-    "format": "{initialTitle}",
-  },
-  "tray": {
-    "icon-size": 21,
-    "spacing": 10,
-  },
-  // TODO better music module
-  "custom/music": {
-    "format": "󰓃 {}",
-    "escape": true,
-    "interval": 5,
-    "tooltip": false,
-    "exec": "playerctl metadata --format='{{ title }}'",
-    "on-click": "playerctl play-pause",
-    "max-length": 50,
-  },
-  "clock": {
-    "timezone": "Europe/Oslo",
-    "tooltip-format": "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>",
-    "format": " {:%H:%M   %d/%m}",
-    "calendar": {
-      "mode": "month",
-      "weeks-pos": "left",
-      "format": {
-        "months": "<span color='#ffead3'><b>{}</b></span>",
-        "days": "<span color='#ecc6d9'><b>{}</b></span>",
-        "weeks": "<span color='#99ffdd'><b>W{}</b></span>",
-        "weekdays": "<span color='#ffcc66'><b>{}</b></span>",
-        "today": "<span color='#ff6699'><b><u>{}</u></b></span>",
-      },
-    },
-  },
-  "backlight": {
-    "device": "intel_backlight",
-    "format": "{icon}",
-    "format-icons": ["", "", "", "", "", "", "", "", ""],
-  },
-  "wireplumber": {
-    // "scroll-step": 1, // %, can be a float
-    "format": "{icon} {volume}%",
-    "format-muted": " ",
-    "format-icons": {
-      "default": ["", " ", " "],
-    },
-    "on-click": "pavucontrol",
-  },
-  "hyprland/language": {
-    "format-en": "EN",
-    "format-no": "NO",
-    "keyboard-name": "logitech-logitech-g710-keyboard",
-    "on-click": "hyprctl switchxkblayout logitech-logitech-g710-keyboard next",
-  },
-  "custom/lock": {
-    "tooltip": false,
-    "on-click": "sh -c '(sleep 0.5s; hyprlock)'",
-    "format": "",
-  },
-  "custom/power": {
-    "tooltip": false,
-    "on-click": "wlogout &",
-    "format": " ",
-  },
-  "custom/notification": {
-    "tooltip": false,
-    "format": "{icon}",
-    "format-icons": {
-      "notification": "<span foreground='#f38ba8'><sup></sup></span>",
-      "none": "",
-      "dnd-notification": "<span foreground='#f38ba8'><sup></sup></span>",
-      "dnd-none": "",
-      "inhibited-notification": "<span foreground='#f38ba8'><sup></sup></span>",
-      "inhibited-none": "",
-      "dnd-inhibited-notification": "<span foreground='#f38ba8'><sup></sup></span>",
-      "dnd-inhibited-none": "",
-    },
-    "return-type": "json",
-    "exec-if": "which swaync-client",
-    "exec": "swaync-client -swb",
-    "on-click": "swaync-client -t -sw",
-    "on-click-right": "swaync-client -d -sw",
-    "escape": true,
-  },
-}

home-manager/hyprland/waybar/config/mocha.css

@@ -1,37 +0,0 @@
-/*
-*
-* Catppuccin Mocha palette
-* Maintainer: rubyowo
-*
-*/
-
-@define-color base   #1e1e2e;
-@define-color mantle #181825;
-@define-color crust  #11111b;
-
-@define-color text     #cdd6f4;
-@define-color subtext0 #a6adc8;
-@define-color subtext1 #bac2de;
-
-@define-color surface0 #313244;
-@define-color surface1 #45475a;
-@define-color surface2 #585b70;
-
-@define-color overlay0 #6c7086;
-@define-color overlay1 #7f849c;
-@define-color overlay2 #9399b2;
-
-@define-color blue      #89b4fa;
-@define-color lavender  #b4befe;
-@define-color sapphire  #74c7ec;
-@define-color sky       #89dceb;
-@define-color teal      #94e2d5;
-@define-color green     #a6e3a1;
-@define-color yellow    #f9e2af;
-@define-color peach     #fab387;
-@define-color maroon    #eba0ac;
-@define-color red       #f38ba8;
-@define-color mauve     #cba6f7;
-@define-color pink      #f5c2e7;
-@define-color flamingo  #f2cdcd;
-@define-color rosewater #f5e0dc;

home-manager/hyprland/waybar/config/style.css

@@ -1,104 +0,0 @@
-@import "mocha.css";
-
-* {
-  font-family: JetBrainsMono Nerd Font;
-  font-size: 15px;
-  min-height: 0;
-}
-
-#waybar {
-  background: transparent;
-  color: @text;
-  margin: 5px 5px;
-}
-
-#workspaces {
-  border-radius: 1rem;
-  background-color: @surface0;
-  margin: 5px 5px 5px 1rem;
-}
-
-#workspaces button {
-  color: @lavender;
-  border-radius: 1rem;
-  padding: 0.4rem;
-}
-
-#workspaces button.active {
-  color: @sky;
-  border-radius: 1rem;
-}
-
-#workspaces button:hover {
-  color: @sapphire;
-  border-radius: 1rem;
-}
-
-#language,
-#window,
-#custom-notification,
-#custom-music,
-#tray,
-#backlight,
-#clock,
-#wireplumber,
-#custom-lock,
-#custom-power {
-  background-color: @surface0;
-  padding: 0.5rem 1rem;
-  margin: 5px 0;
-}
-
-#clock {
-  color: @blue;
-}
-
-#backlight {
-  color: @yellow;
-}
-
-#backlight {
-  border-radius: 0;
-}
-
-#language {
-  color: @red;
-  border-radius: 1rem 0 0 1rem;
-  margin-left: 1rem;
-}
-
-#wireplumber {
-  color: @maroon;
-}
-
-#custom-music {
-  color: @mauve;
-  border-radius: 1rem;
-}
-
-#window {
-  color: @mauve;
-  border-radius: 1rem;
-}
-
-#custom-lock {
-  border-radius: 1rem 0 0 1rem;
-  color: @lavender;
-}
-
-#custom-power {
-  margin-right: 1rem;
-  border-radius: 0 1rem 1rem 0;
-  color: @red;
-}
-
-#custom-notification {
-  margin-right: 1rem;
-  border-radius: 0 1rem 1rem 0;
-  color: @sapphire;
-}
-
-#tray {
-  margin-right: 1rem;
-  border-radius: 1rem;
-}

home-manager/hyprland/waybar/default.nix

@@ -1,6 +0,0 @@
-{
-  home.file.".config/waybar" = {
-    source = ./config;
-    recursive = true;
-  };
-}

home-manager/secretsLoader.nix

@@ -1,6 +0,0 @@
-lib:
-
-{
-  loadSecret =
-    filePath: lib.strings.trim (lib.strings.removeSuffix "\n" (builtins.readFile filePath));
-}

home-manager/wlogout/default.nix

@@ -1,116 +0,0 @@
-# Log out and shutdown menu
-{
-  home.file =
-    let
-      dir = ".config/wlogout";
-    in
-    {
-      "${dir}/hibernate.svg".source = ./hibernate.svg;
-      "${dir}/lock.svg".source = ./lock.svg;
-      "${dir}/logout.svg".source = ./logout.svg;
-      "${dir}/reboot.svg".source = ./reboot.svg;
-      "${dir}/shutdown.svg".source = ./shutdown.svg;
-      "${dir}/suspend.svg".source = ./suspend.svg;
-    };
-
-  programs.wlogout = {
-    enable = false;
-    layout = [
-      {
-        label = "lock";
-        action = "sh -c '(sleep 0.5s; hyprlock)'";
-        text = "Lock";
-        keybind = "l";
-      }
-      {
-        label = "hibernate";
-        action = "systemctl hibernate";
-        text = "Hibernate";
-        keybind = "h";
-      }
-      {
-        label = "logout";
-        action = "loginctl terminate-user $USER";
-        text = "Logout";
-        keybind = "e";
-      }
-      {
-        label = "shutdown";
-        action = "systemctl poweroff";
-        text = "Shutdown";
-        keybind = "s";
-      }
-      {
-        label = "suspend";
-        action = "systemctl suspend";
-        text = "Suspend";
-        keybind = "u";
-      }
-      {
-        label = "reboot";
-        action = "systemctl reboot";
-        text = "Reboot";
-        keybind = "r";
-      }
-    ];
-    style =
-      let
-        theme = import ../../theme.nix;
-      in
-      ''
-        * {
-          background-image: none;
-          box-shadow: none;
-        }
-
-        window {
-          background-color: rgba(30, 30, 46, 0.9);
-        }
-
-        button {
-          border-radius: 0;
-          border-color: #${theme.pinkAlpha};
-          text-decoration-color: #${theme.textAlpha};
-          color: #${theme.textAlpha};
-          background-color: #${theme.mantleAlpha};
-          border-style: solid;
-          border-width: 1px;
-          background-repeat: no-repeat;
-          background-position: center;
-          background-size: 25%;
-        }
-
-        button:focus,
-        button:active,
-        button:hover {
-          /* 20% Overlay 2, 80% mantle */
-          background-color: rgb(48, 50, 66);
-          outline-style: none;
-        }
-
-        #lock {
-          background-image: url("./lock.svg");
-        }
-
-        #logout {
-          background-image: url("./logout.svg");
-        }
-
-        #suspend {
-          background-image: url("./suspend.svg");
-        }
-
-        #hibernate {
-          background-image: url("./hibernate.svg");
-        }
-
-        #shutdown {
-          background-image: url("./shutdown.svg");
-        }
-
-        #reboot {
-          background-image: url("./reboot.svg");
-        }
-      '';
-  };
-}

home-manager/wlogout/hibernate.svg

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Svg Vector Icons : http://www.onlinewebfonts.com/icon -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg fill="#f5c2e7" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve">
-<metadata> Svg Vector Icons : http://www.onlinewebfonts.com/icon </metadata>
-<g><g><path d="M500,10C229.4,10,10,229.4,10,500s219.4,490,490,490s490-219.4,490-490S770.6,10,500,10z M500,885.1c-212.7,0-385.1-172.4-385.1-385.1S287.3,114.9,500,114.9S885.1,287.3,885.1,500S712.7,885.1,500,885.1z M576.5,308.7v382.4c0,42.2-34.2,76.5-76.5,76.5c-42.3,0-76.5-34.2-76.5-76.5V308.7c0-42.2,34.2-76.5,76.5-76.5C542.2,232.3,576.5,266.5,576.5,308.7z"/></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g><g></g></g>
-</svg>

home-manager/wlogout/lock.svg

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Svg Vector Icons : http://www.onlinewebfonts.com/icon -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg fill="#f5c2e7" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve">
-<metadata> Svg Vector Icons : http://www.onlinewebfonts.com/icon </metadata>
-<g><g><path d="M321.8,455.5h356.4V321.8c0-49.2-17.4-91.2-52.2-126c-34.8-34.8-76.8-52.2-126-52.2c-49.2,0-91.2,17.4-126,52.2c-34.8,34.8-52.2,76.8-52.2,126L321.8,455.5L321.8,455.5z M900.9,522.3v400.9c0,18.6-6.5,34.3-19.5,47.3c-13,13-28.8,19.5-47.3,19.5H165.9c-18.6,0-34.3-6.5-47.3-19.5s-19.5-28.8-19.5-47.3V522.3c0-18.6,6.5-34.3,19.5-47.3c13-13,28.8-19.5,47.3-19.5h22.3V321.8c0-85.4,30.6-158.7,91.9-219.9C341.3,40.6,414.6,10,500,10c85.4,0,158.7,30.6,219.9,91.9c61.3,61.3,91.9,134.6,91.9,219.9v133.6h22.3c18.6,0,34.3,6.5,47.3,19.5C894.4,487.9,900.9,503.7,900.9,522.3L900.9,522.3z"/></g></g>
-</svg>

home-manager/wlogout/logout.svg

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Svg Vector Icons : http://www.onlinewebfonts.com/icon -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg fill="#f5c2e7" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve">
-<metadata> Svg Vector Icons : http://www.onlinewebfonts.com/icon </metadata>
-<g><path d="M622.5,990H50.8C26.3,990,10,973.7,10,949.2V50.8C10,26.3,26.3,10,50.8,10h571.7c24.5,0,40.8,16.3,40.8,40.8v285.8c0,24.5-16.3,40.8-40.8,40.8s-40.8-16.3-40.8-40.8v-245h-490v816.7h490v-245c0-24.5,16.3-40.8,40.8-40.8s40.8,16.3,40.8,40.8v285.8C663.3,973.7,647,990,622.5,990z"/><path d="M949.2,540.8H336.7c-24.5,0-40.8-16.3-40.8-40.8c0-24.5,16.3-40.8,40.8-40.8h612.5c24.5,0,40.8,16.3,40.8,40.8C990,524.5,973.7,540.8,949.2,540.8z"/><path d="M949.2,540.8c-12.3,0-20.4-4.1-28.6-12.3L757.3,365.3c-16.3-16.3-16.3-40.8,0-57.2c16.3-16.3,40.8-16.3,57.2,0l163.3,163.3c16.3,16.3,16.3,40.8,0,57.2C969.6,536.8,961.4,540.8,949.2,540.8z"/><path d="M785.8,704.2c-12.3,0-20.4-4.1-28.6-12.3c-16.3-16.3-16.3-40.8,0-57.2l163.3-163.3c16.3-16.3,40.8-16.3,57.2,0c16.3,16.3,16.3,40.8,0,57.2L814.4,691.9C806.3,700.1,798.1,704.2,785.8,704.2z"/></g>
-</svg>

home-manager/wlogout/reboot.svg

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Svg Vector Icons : http://www.onlinewebfonts.com/icon -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg fill="#f5c2e7" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve">
-<metadata> Svg Vector Icons : http://www.onlinewebfonts.com/icon </metadata>
-<g><path d="M134.6,285.6C64.9,420.7,60.1,590,137.1,723.4L42,668.5l-32,55.4c93.1,52.1,133.6,75.9,184,106.2c28.5-51.5,52.8-94.4,107.4-186.1L246,612l-53.4,92.5C65.4,502.7,167.2,200.3,398.8,126.2C638,29.3,929,223.5,931.5,481.5c19.6,236.7-208.9,443.6-439.3,416.2l-29.5,51c277.7,54.4,556.5-201.7,524.7-483.1C976.1,170.8,637.1-41.2,367.1,77.5C262.8,114.2,183.1,191.5,134.6,285.6z"/></g>
-</svg>

home-manager/wlogout/shutdown.svg

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Svg Vector Icons : http://www.onlinewebfonts.com/icon -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg fill="#f5c2e7" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve">
-<metadata> Svg Vector Icons : http://www.onlinewebfonts.com/icon </metadata>
-<g><path d="M764,152.1c30.9,22,58.3,46.8,82.4,74.6c24,27.8,44.6,57.8,61.8,90.1c17.2,32.3,30.2,66.4,39.1,102.4c8.9,36,13.4,72.6,13.4,109.6c0,63.8-12.2,123.7-36.5,179.6c-24.4,55.9-57.3,104.7-98.8,146.2c-41.5,41.5-90.2,74.5-146.2,98.8C623.2,977.8,563.3,990,499.5,990c-63.1,0-122.7-12.2-178.6-36.5c-55.9-24.4-104.8-57.3-146.7-98.8c-41.9-41.5-74.8-90.2-98.8-146.2c-24-55.9-36-115.8-36-179.6c0-36.4,4.3-72.1,12.9-107.1c8.6-35,20.8-68.3,36.5-99.9c15.8-31.6,35.3-61.1,58.7-88.5c23.3-27.5,49.4-52.2,78.2-74.1c15.1-11,31.4-15.1,48.9-12.4c17.5,2.7,31.7,11.3,42.7,25.7c11,14.4,15.1,30.5,12.4,48.4c-2.7,17.8-11.3,32.3-25.7,43.2c-43.2,31.6-76.4,70.3-99.3,116.3c-23,46-34.5,95.4-34.5,148.2c0,45.3,8.6,88,25.7,128.2c17.2,40.1,40.7,75.1,70.5,105c29.9,29.9,64.9,53.5,105,71c40.1,17.5,82.9,26.3,128.2,26.3c45.3,0,88-8.7,128.2-26.3c40.1-17.5,75.1-41.2,105-71s53.5-64.9,71-105c17.5-40.1,26.3-82.9,26.3-128.2c0-53.5-12.4-104.1-37.1-151.8c-24.7-47.7-59.4-87-104-117.9c-15.1-10.3-24.2-24.4-27.3-42.2c-3.1-17.8,0.5-34.3,10.8-49.4c10.3-14.4,24.4-23.2,42.2-26.2C732.5,138.2,748.9,141.8,764,152.1L764,152.1z M499.5,531.9c-17.8,0-33.1-6.3-45.8-19c-12.7-12.7-19-28-19-45.8V75.9c0-17.8,6.3-33.3,19-46.3c12.7-13,28-19.6,45.8-19.6c18.5,0,34.1,6.5,46.8,19.6c12.7,13,19,28.5,19,46.3v391.2c0,17.8-6.3,33.1-19,45.8C533.6,525.6,518,531.9,499.5,531.9L499.5,531.9z"/></g>
-</svg>

home-manager/wlogout/style.css

@@ -1,53 +0,0 @@
-* {
-  background-image: none;
-  box-shadow: none;
-}
-
-window {
-  background-color: rgba(30, 30, 46, 0.9);
-}
-
-button {
-  border-radius: 0;
-  border-color: #f5c2e7;
-  text-decoration-color: #cdd6f4;
-  color: #cdd6f4;
-  background-color: #181825;
-  border-style: solid;
-  border-width: 1px;
-  background-repeat: no-repeat;
-  background-position: center;
-  background-size: 25%;
-}
-
-button:focus,
-button:active,
-button:hover {
-  /* 20% Overlay 2, 80% mantle */
-  background-color: rgb(48, 50, 66);
-  outline-style: none;
-}
-
-#lock {
-  background-image: url("./lock.svg");
-}
-
-#logout {
-  background-image: url("./logout.svg");
-}
-
-#suspend {
-  background-image: url("./suspend.svg");
-}
-
-#hibernate {
-  background-image: url("./hibernate.svg");
-}
-
-#shutdown {
-  background-image: url("./shutdown.svg");
-}
-
-#reboot {
-  background-image: url("./reboot.svg");
-}

home-manager/wlogout/suspend.svg

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Svg Vector Icons : http://www.onlinewebfonts.com/icon -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
-<svg fill="#f5c2e7" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve">
-<metadata> Svg Vector Icons : http://www.onlinewebfonts.com/icon </metadata>
-<g><path d="M500,990c-66.1,0-130.3-13-190.7-38.5c-58.4-24.7-110.8-60-155.7-105s-80.3-97.4-105-155.7C23,630.3,10,566.1,10,500c0-66.1,13-130.3,38.5-190.7c24.7-58.4,60-110.8,105-155.7c45-45,97.4-80.3,155.7-105C369.7,23,433.9,10,500,10c66.1,0,130.3,13,190.7,38.5c58.4,24.7,110.8,60,155.7,105c45,45,80.3,97.4,105,155.7C977,369.7,990,433.9,990,500c0,66.1-13,130.3-38.5,190.7c-24.7,58.4-60,110.8-105,155.7s-97.4,80.3-155.7,105C630.3,977,566.1,990,500,990z M500,79.6c-112.3,0-217.9,43.7-297.3,123.1C123.3,282.1,79.6,387.7,79.6,500s43.7,217.9,123.1,297.3c79.4,79.4,185,123.1,297.3,123.1c112.3,0,217.9-43.7,297.3-123.1c79.4-79.4,123.1-185,123.1-297.3s-43.7-217.9-123.1-297.3C717.9,123.3,612.3,79.6,500,79.6z"/><path d="M322.5,290.6h108v412h-108V290.6z"/><path d="M561.6,290.6h107.9v412H561.6V290.6z"/></g>
-</svg>

home-manager/yazi/default.nix

@@ -1,327 +0,0 @@
-{ lib, ... }:
-let
-  theme = import ../../theme.nix;
-  batTheme = ".config/yazi/catppuccin-${theme.flavor}.tmTheme";
-in
-{
-  home.file.${batTheme}.source = ./catppuccin-mocha.tmTheme;
-
-  programs.yazi = {
-    enable = true;
-    settings = {
-      manager = {
-        ratio = [
-          2
-          4
-          2
-        ];
-        sort_by = "natural";
-        sort_sensitive = true;
-        sort_reverse = false;
-        sort_dir_first = true;
-        linemode = "none";
-        show_hidden = true;
-        show_symlink = true;
-      };
-
-      preview = {
-        image_filter = "lanczos3";
-        image_quality = 90;
-        tab_size = 1;
-        max_width = 600;
-        max_height = 900;
-        cache_dir = "";
-        ueberzug_scale = 1;
-        ueberzug_offset = [
-          0
-          0
-          0
-          0
-        ];
-      };
-
-      tasks = {
-        micro_workers = 5;
-        macro_workers = 10;
-        bizarre_retry = 5;
-      };
-    };
-    theme = lib.mkForce {
-      manager = {
-        cwd = {
-          fg = "#${theme.tealAlpha}";
-        };
-
-        hovered = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-        preview_hovered = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.textAlpha}";
-        };
-
-        find_keyword = {
-          fg = "#${theme.yellowAlpha}";
-          italic = true;
-        };
-        find_position = {
-          fg = "#${theme.pinkAlpha}";
-          bg = "reset";
-          italic = true;
-        };
-
-        marker_copied = {
-          fg = "#${theme.greenAlpha}";
-          bg = "#${theme.greenAlpha}";
-        };
-        marker_cut = {
-          fg = "#${theme.redAlpha}";
-          bg = "#${theme.redAlpha}";
-        };
-        marker_marked = {
-          fg = "#${theme.tealAlpha}";
-          bg = "#${theme.tealAlpha}";
-        };
-        marker_selected = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-
-        tab_active = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.textAlpha}";
-        };
-        tab_inactive = {
-          fg = "#${theme.textAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-        tab_width = 1;
-
-        count_copied = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.greenAlpha}";
-        };
-        count_cut = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.redAlpha}";
-        };
-        count_selected = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-        };
-
-        border_symbol = "│";
-        border_style.fg = "#${theme.overlay1Alpha}";
-
-        syntect_theme = "~/${batTheme}";
-      };
-
-      mode = {
-        normal_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.blueAlpha}";
-          bold = true;
-        };
-        normal_alt = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-
-        select_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.greenAlpha}";
-          bold = true;
-        };
-        select_alt = {
-          fg = "#${theme.greenAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-
-        unset_main = {
-          fg = "#${theme.baseAlpha}";
-          bg = "#${theme.flamingoAlpha}";
-          bold = true;
-        };
-        unset_alt = {
-          fg = "#${theme.flamingoAlpha}";
-          bg = "#${theme.surface0Alpha}";
-        };
-      };
-
-      status = {
-        separator_open = "";
-        separator_close = "";
-
-        progress_label = {
-          fg = "#ffffff";
-          bold = true;
-        };
-        progress_normal = {
-          fg = "#${theme.blueAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-        progress_error = {
-          fg = "#${theme.redAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-
-        perm_type = {
-          fg = "#${theme.blueAlpha}";
-        };
-        perm_read = {
-          fg = "#${theme.yellowAlpha}";
-        };
-        perm_write = {
-          fg = "#${theme.redAlpha}";
-        };
-        perm_exec = {
-          fg = "#${theme.greenAlpha}";
-        };
-        perm_sep = {
-          fg = "#${theme.overlay1Alpha}";
-        };
-      };
-
-      input = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = { };
-        value = { };
-        selected.reversed = true;
-      };
-
-      pick = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        active = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        inactive = { };
-      };
-
-      confirm = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = {
-          fg = "#${theme.blueAlpha}";
-        };
-        content = { };
-        list = { };
-        btn_yes = {
-          reversed = true;
-        };
-        btn_no = { };
-      };
-
-      completion = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-      };
-      tasks = {
-        border = {
-          fg = "#${theme.blueAlpha}";
-        };
-        title = { };
-        hovered = {
-          underline = true;
-        };
-      };
-
-      which = {
-        mask = {
-          bg = "#${theme.surface0Alpha}";
-        };
-        cand = {
-          fg = "#${theme.tealAlpha}";
-        };
-        rest = {
-          fg = "#9399b2";
-        };
-        desc = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        separator = "  ";
-        separator_style = {
-          fg = "#${theme.surface2Alpha}";
-        };
-      };
-      help = {
-        on = {
-          fg = "#${theme.tealAlpha}";
-        };
-        run = {
-          fg = "#${theme.pinkAlpha}";
-        };
-        desc = {
-          fg = "#9399b2";
-        };
-        hovered = {
-          bg = "#${theme.surface2Alpha}";
-          bold = true;
-        };
-        footer = {
-          fg = "#${theme.textAlpha}";
-          bg = "#${theme.surface1Alpha}";
-        };
-      };
-
-      notify = {
-        title_info = {
-          fg = "#${theme.tealAlpha}";
-        };
-        title_warn = {
-          fg = "#${theme.yellowAlpha}";
-        };
-        title_error = {
-          fg = "#${theme.redAlpha}";
-        };
-      };
-      filetype = {
-        rules = [
-          # Media
-          {
-            mime = "image/*";
-            fg = "#${theme.tealAlpha}";
-          }
-          {
-            mime = "{audio;video}/*";
-            fg = "#${theme.yellowAlpha}";
-          }
-
-          # Archives
-          {
-            mime = "application/*zip";
-            fg = "#${theme.pinkAlpha}";
-          }
-          {
-            mime = "application/x-{tar;bzip*;7z-compressed;xz;rar}";
-            fg = "#${theme.pinkAlpha}";
-          }
-
-          # Documents
-          {
-            mime = "application/{pdf;doc;rtf}";
-            fg = "#${theme.greenAlpha}";
-          }
-
-          # Fallback
-          {
-            name = "*";
-            fg = "#${theme.textAlpha}";
-          }
-          {
-            name = "*/";
-            fg = "#${theme.blueAlpha}";
-          }
-        ];
-      };
-
-      icon = import ./icons.nix;
-    };
-  };
-}

home-manager/zen/default.nix

@@ -1,12 +0,0 @@
-{ pkgs, inputs, ... }:
-
-{
-  # TODO programatically get default name
-  home = {
-    file.".zen/xdaxqlov.default/chrome" = {
-      source = ./chrome;
-      recursive = true;
-    };
-    packages = with pkgs; [ inputs.zen-browser.packages.${system}.default ]; # Beta
-  };
-}

hosts/desktop/bluetooth.nix

@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+
+{
+  hardware.bluetooth = {
+    enable = true;
+    input = {
+      # Required to get PS3 controllers working
+      General = {
+        ClassicBondedOnly = false;
+        UserspaceHID = false;
+      };
+    };
+    powerOnBoot = true;
+    package = pkgs.unstable.bluez;
+  };
+
+  services.blueman.enable = true;
+}

hosts/desktop/common.nix

@@ -0,0 +1,4 @@
+{
+  monitor1 = "DP-1";
+  monitor2 = "DP-3";
+}

hosts/desktop/default.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [
+    (lib.custom.relativeToDesktop "modules")
+    ./bluetooth.nix
+    ./hardware-configuration.nix
+  ];
+
+  boot.kernelPackages = pkgs.linuxPackages_6_14;
+}

hosts/desktop/hardware-configuration.nix

@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/5e3f0f97-4bb4-4a53-ace2-9ed19ff9e8ea";
+    fsType = "btrfs";
+    options = [ "subvol=@" ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D188-48A9";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s20f0u8.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/desktop/home-manager/default.nix

@@ -0,0 +1,14 @@
+{
+  lib,
+  ...
+}:
+
+{
+  imports = [
+    (lib.custom.relativeToDesktop "home-manager")
+    ./hyprpaper.nix
+    ./settings.nix
+  ];
+
+  programs.git.signing.key = "706F53DD087A91DE";
+}

hosts/desktop/home-manager/hyprpaper.nix

@@ -0,0 +1,29 @@
+# Wallpapers
+{
+  lib,
+  theme,
+  ...
+}:
+
+{
+  services.hyprpaper.settings =
+    let
+      wallpaper1 = builtins.toString theme.wallpaper.monitor1;
+      wallpaper2 = builtins.toString theme.wallpaper.monitor2;
+    in
+    {
+      preload = lib.mkForce [
+        wallpaper1
+        wallpaper2
+      ];
+
+      wallpaper =
+        let
+          common = import ../common.nix;
+        in
+        lib.mkForce [
+          "${common.monitor1},${wallpaper1}"
+          "${common.monitor2},${wallpaper2}"
+        ];
+    };
+}

hosts/desktop/home-manager/settings.nix

@@ -0,0 +1,12 @@
+{ lib, ... }:
+
+{
+  wayland.windowManager.hyprland.settings.monitor =
+    let
+      common = import ../common.nix;
+    in
+    lib.mkForce [
+      "${common.monitor1}, 3440x1440@175, 0x0, 1"
+      "${common.monitor2}, 3840x2160@60, 3440x0, 1.5, transform, 1"
+    ];
+}

hosts/desktop/home-manager/zen/default.nix

@@ -0,0 +1,7 @@
+{
+  # TODO merge with shared
+  home.file.".zen/audtxq7n.default/chrome" = {
+    source = ./chrome;
+    recursive = true;
+  };
+}

hosts/pi4/actual.nix

@@ -0,0 +1,42 @@
+{ config, common, ... }:
+let
+  domain = "beta.budget.${common.domain}";
+in
+{
+  networking.nat = {
+    enable = true;
+    internalInterfaces = [ "ve-*" ];
+    externalInterface = "wlan0";
+    # Lazy IPv6 connectivity for the container
+    enableIPv6 = true;
+  };
+
+  containers.actual = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "192.168.10.188";
+    localAddress = "192.168.10.11";
+    config =
+      { ... }:
+      {
+        services = {
+          actual = {
+            enable = true;
+            settings = {
+              port = 8084;
+              loginMethod = "password";
+            };
+          };
+        };
+        system.stateVersion = common.system.version;
+      };
+  };
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${config.containers.actual.localAddress}:8084";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/pi4/boot.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+
+{
+  boot = {
+    kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "usbhid"
+      "usb_storage"
+    ];
+    loader = {
+      grub.enable = false;
+      generic-extlinux-compatible.enable = true;
+    };
+  };
+}

hosts/pi4/caddy.nix

@@ -0,0 +1,91 @@
+{ common, ... }:
+let
+  domain = common.domain;
+in
+{
+  services.caddy = {
+    enable = false;
+    email = "cert@${domain}";
+    virtualHosts =
+      let
+        localProxy = proxyTo "localhost";
+        homelabProxy = proxyTo "192.168.10.231";
+        proxyTo = ip: port: "reverse_proxy ${ip}:${builtins.toString port}";
+        redirect = subdomain: "redir https://${subdomain}.${domain}{uri}";
+      in
+      {
+        "beta.${domain}".extraConfig = ''
+          redir https://${domain}{uri}
+        '';
+        "git.${domain}".extraConfig = ''
+          ${redirect "code"}
+        '';
+        "kitchenowl.${domain}".extraConfig = ''
+          ${redirect "grocery"}
+        '';
+        # Gitea
+        "code.${domain}".extraConfig = ''
+          ${homelabProxy 3000}
+        '';
+        # Forgejo
+        "beta.code.${domain}".extraConfig = ''
+          ${localProxy 8001}
+        '';
+        # Nextcloud
+        "nextcloud.${domain}".extraConfig = ''
+          redir /.well-known/carddav /remote.php/dav 301
+          redir /.well-known/caldav /remote.php/dav 301
+          ${homelabProxy 11000}
+        '';
+        # Kitchenowl
+        "grocery.${domain}".extraConfig = ''
+          ${homelabProxy 800}
+        '';
+        # Actual Budget
+        "budget.${domain}".extraConfig = ''
+          ${homelabProxy 5006}
+        '';
+        # Uptime Kuma
+        "status.${domain}".extraConfig = ''
+          ${homelabProxy 3001}
+        '';
+        # Headscale
+        "vpn.${domain}".extraConfig = ''
+          reverse_proxy /web* 192.168.10.231:8084
+          reverse_proxy * 192.168.10.231:8082
+        '';
+        # Headscale SmartDNS
+        "dns.${domain}".extraConfig = ''
+          ${homelabProxy 8082}
+        '';
+        # FreshRSS
+        "rss.${domain}".extraConfig = ''
+          ${homelabProxy 8085}
+        '';
+        # Ente backend
+        "api.ente.${domain}".extraConfig = ''
+          ${homelabProxy 8083}
+        '';
+        # Ente Photos frontend
+        "ente.${domain}".extraConfig = ''
+          ${homelabProxy 3003}
+        '';
+        # Ente Auth frontend
+        "mfa.${domain}".extraConfig = ''
+          ${homelabProxy 3004}
+        '';
+        # Homepage / portfolio
+        "${domain}".extraConfig = ''
+          ${homelabProxy 4321}
+        '';
+        # Yamtrack
+        "track.${domain}".extraConfig = ''
+          ${homelabProxy 8090}
+        '';
+        # Donetick
+        "chore.${domain}".extraConfig = ''
+          ${homelabProxy 2021}
+        '';
+      };
+  };
+}

hosts/pi4/default.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+
+{
+  imports = with lib.custom; [
+    (relativeToBase "modules")
+    ./actual.nix
+    ./boot.nix
+    ./caddy.nix
+    ./forgejo.nix
+    ./hardware.nix
+    ./headscale.nix
+    ./mailserver.nix
+    ./nextcloud.nix
+    ./nginx.nix
+    ./podman.nix
+    ./postgres.nix
+    ./security
+  ];
+}

hosts/pi4/forgejo.nix

@@ -0,0 +1,94 @@
+{
+  config,
+  pkgs,
+  lib,
+  systemConfig,
+  common,
+  ...
+}:
+let
+  cfg = config.services.forgejo;
+  srv = cfg.settings.server;
+  domain = "beta.code.${common.domain}";
+  passwordKey = "forgejo/admin-pass";
+  runnerTokenKey = "forgejo/runner-token";
+in
+{
+  services = {
+    nginx.virtualHosts.${domain} = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString srv.HTTP_PORT}";
+      serverAliases = [ "beta.git.${common.domain}" ];
+    };
+
+    forgejo = {
+      enable = true;
+      database.type = "postgres";
+      # Enable support for Git Large File Storage
+      lfs.enable = true;
+
+      secrets.mailer.PASSWD = config.sops.secrets."mailserver/password-hash".path;
+
+      settings = {
+        server = {
+          DOMAIN = domain;
+          # You need to specify this to remove the port from URLs in the web UI.
+          ROOT_URL = "https://${domain}/";
+          HTTP_PORT = 8002;
+        };
+        # You can temporarily allow registration to create an admin user.
+        service.DISABLE_REGISTRATION = true;
+        # Add support for actions, based on act: https://github.com/nektos/act
+        actions = {
+          ENABLED = true;
+          DEFAULT_ACTIONS_URL = "github";
+        };
+        # Sending emails is completely optional
+        # You can send a test email from the web UI at:
+        # Profile Picture > Site Administration > Configuration >  Mailer Configuration
+        mailer = lib.mkIf config.mailserver.enable {
+          ENABLED = true;
+          PROTOCOL = "smtps";
+          SMTP_ADDR = config.mailserver.fqdn;
+          FROM = "noreply-forgejo@${common.domain}";
+          USER = "${systemConfig.username}@${common.domain}";
+        };
+      };
+    };
+    gitea-actions-runner = {
+      package = pkgs.forgejo-actions-runner;
+      instances.default = {
+        enable = true;
+        name = "monolith";
+        url = "https://${domain}";
+        # Obtaining the path to the runner token file may differ
+        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
+        tokenFile = config.sops.secrets.${runnerTokenKey}.path;
+        labels = [
+          "docker:docker://node:20-bullseye"
+          "native:host"
+        ];
+      };
+    };
+  };
+
+  sops.secrets = {
+    ${passwordKey}.owner = "forgejo";
+    ${runnerTokenKey}.owner = "forgejo";
+  };
+
+  # Create a single admin user / update password if exists
+  systemd.services.forgejo.preStart =
+    let
+      adminCmd = "${lib.getExe config.services.forgejo.package} admin user";
+      pwd = config.sops.secrets.${passwordKey};
+      user = "martin"; # Note, Forgejo doesn't allow creation of an account named "admin"
+      email = "git@${common.domain}";
+    in
+    ''
+      ${adminCmd} create --admin --email "${email}" --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
+      ## Alter an existing user. Will prompt new password on login
+      # ${adminCmd} change-password --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
+    '';
+}

hosts/pi4/hardware.nix

@@ -0,0 +1,12 @@
+{
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+      options = [ "noatime" ];
+    };
+    # TODO mount ext hdd
+  };
+
+  hardware.enableRedistributableFirmware = true;
+}

hosts/pi4/headscale.nix

@@ -0,0 +1,66 @@
+{
+  config,
+  common,
+  ...
+}:
+let
+  cfg = config.services.headscale;
+
+  domain = "beta.vpn.${common.domain}";
+  dnsDomain = "secure.${common.domain}";
+in
+{
+  networking.firewall = {
+    trustedInterfaces = [ config.services.tailscale.interfaceName ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+
+  services = {
+    headscale = {
+      enable = true;
+      address = "0.0.0.0";
+      port = 8083;
+      settings = {
+        database = {
+          postgres = {
+            host = "/run/postgresql";
+            name = "headscale";
+            port = config.services.postgresql.settings.port;
+            user = cfg.user;
+          };
+          type = "postgres";
+        };
+        dns = {
+          base_domain = dnsDomain;
+          magic_dns = true;
+        };
+        logtail.enabled = false;
+        server_url = "https://${domain}";
+      };
+    };
+
+    nginx.virtualHosts.${domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.headscale.port}";
+        proxyWebsockets = true;
+      };
+    };
+
+    postgresql =
+      let
+        psql = cfg.settings.database.postgres;
+      in
+      {
+        ensureDatabases = [ psql.name ];
+        ensureUsers = [
+          {
+            name = psql.user;
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+  };
+
+}

hosts/pi4/home-manager/default.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+
+{
+  imports = with lib.custom; [
+    (relativeToBase "home-manager")
+  ];
+
+  programs.git.signing.key = "E3FA0E995C0D0E5E";
+}

hosts/pi4/mailserver.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  inputs,
+  common,
+  systemConfig,
+  ...
+}:
+let
+  passwordHashKey = "mailserver/password-hash";
+in
+{
+  imports = [
+    inputs.simple-nixos-mailserver.nixosModule
+  ];
+
+  mailserver = {
+    enable = true;
+    # stateVersion = 1; TODO uncomment on 25.11
+    fqdn = "mail.${common.domain}";
+    domains = [
+      common.domain
+    ];
+
+    # A list of all login accounts. To create the password hashes, use
+    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+    loginAccounts = {
+      "${systemConfig.username}@${common.domain}" = {
+        hashedPasswordFile = config.sops.secrets.${passwordHashKey}.path;
+      };
+    };
+
+    # Use Let's Encrypt certificates. Note that this needs to set up a stripped
+    # down nginx and opens port 80.
+    certificateScheme = "acme-nginx";
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    25
+    465
+    587
+  ];
+
+  sops.secrets.${passwordHashKey}.neededForUsers = true;
+}

hosts/pi4/nextcloud.nix

@@ -0,0 +1,90 @@
+# https://mich-murphy.com/configure-nextcloud-nixos/
+{
+  pkgs,
+  config,
+  common,
+  ...
+}:
+let
+  adminPassKey = "nextcloud/admin-pass";
+  domain = "beta.nextcloud.${common.domain}";
+  dbname = "nextcloud";
+  dbuser = dbname;
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    certs.${config.services.nextcloud.hostName}.email = "acme@${common.domain}";
+  };
+
+  services = {
+    nextcloud = {
+      enable = true;
+
+      autoUpdateApps.enable = true;
+
+      config = {
+        adminpassFile = config.sops.secrets.${adminPassKey}.path;
+        dbtype = "pgsql";
+        dbname = dbname;
+        dbuser = dbuser;
+        # default directory for postgresql, ensures automatic setup of db
+        dbhost = "/run/postgresql";
+        adminuser = "admin";
+      };
+
+      extraApps = {
+        inherit (config.services.nextcloud.package.packages.apps)
+          contacts
+          deck
+          notes
+          tasks
+          ;
+      };
+      extraAppsEnable = true;
+
+      hostName = domain;
+      https = true;
+
+      maxUploadSize = "0"; # No max limit
+      package = pkgs.nextcloud31;
+
+      settings = {
+        default_phone_region = "NO";
+        trusted_domains = [
+          domain
+        ];
+      };
+    };
+
+    nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+      forceSSL = true;
+      enableACME = true;
+    };
+
+    postgresql = {
+      ensureDatabases = [ dbname ];
+      ensureUsers = [
+        {
+          name = dbuser;
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+    postgresqlBackup = {
+      enable = true;
+      location = "/data/backup/nextclouddb";
+      databases = [ dbname ];
+      # time to start backup in systemd.time format
+      startAt = "*-*-* 23:15:00";
+    };
+  };
+
+  sops.secrets.${adminPassKey}.neededForUsers = true;
+
+  # ensure postgresql db is started with nextcloud
+  systemd.services."nextcloud-setup" = {
+    requires = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
+  };
+}

hosts/pi4/nginx.nix

@@ -0,0 +1,93 @@
+{
+  common,
+  ...
+}:
+let
+  domain = common.domain;
+  proxyTo = address: port: {
+    enableACME = true;
+    forceSSL = true;
+    locations."/".proxyPass = "${address}:${builtins.toString port}";
+  };
+  proxyLocations = locations: {
+    enableACME = true;
+    forceSSL = true;
+    inherit locations;
+  };
+  homelab = "http://${common.localIpAddr 231}";
+  homelabProxy = proxyTo homelab; # TODO get homelab local ip from systems
+  redirect = subdomain: {
+    enableACME = true;
+    forceSSL = true;
+    globalRedirect = if subdomain == "" then domain else "${subdomain}.${domain}";
+  };
+in
+{
+  services.nginx = {
+    enable = true;
+    enableReload = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts = {
+      # Beta is currently stable
+      "www.${domain}" = redirect "";
+      "beta.${domain}" = redirect "";
+      "git.${domain}" = redirect "code";
+      "kitchenowl.${domain}" = redirect "grocery";
+      # Gitea
+      "code.${domain}" = homelabProxy 3000;
+      # Nextcloud
+      "nextcloud.${domain}" = proxyLocations {
+        "/".proxyPass = "${homelab}:11000";
+        "/.well-known/carddav".return = "301 /remote.php/dav";
+        "/.well-known/caldav".return = "301 /remote.php/dav";
+      };
+      # Kitchenowl
+      "grocery.${domain}" = homelabProxy 800;
+      # Actual budget
+      "budget.${domain}" = homelabProxy 5006;
+      # Uptime Kuma
+      "status.${domain}" = homelabProxy 3001;
+      # Headscale
+      "vpn.${domain}" = proxyLocations {
+        "/web".proxyPass = "${homelab}:8084";
+        "/" = {
+          proxyPass = "${homelab}:8082";
+          extraConfig = ''
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_redirect http:// https://;
+            proxy_buffering off;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+          '';
+        };
+      };
+      # Headscale SmartDNS
+      "dns.${domain}" = homelabProxy 8082;
+      # FreshRSS
+      "rss.${domain}" = homelabProxy 8085;
+      # Ente backend
+      "api.ente.${domain}" = homelabProxy 8083;
+      # Ente Photos frontend
+      "ente.${domain}" = homelabProxy 3003;
+      # Ente Auth frontend
+      "mfa.${domain}" = homelabProxy 3004;
+      # Homepage / portfolio
+      "${domain}" = homelabProxy 4321;
+      # Yamtrack
+      "track.${domain}" = homelabProxy 8090;
+      # Donetick
+      "chore.${domain}" = homelabProxy 2021;
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "acme@${domain}";
+  };
+}

hosts/pi4/podman.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+
+{
+  virtualisation = {
+    # Enable common container config files in /etc/containers
+    containers.enable = true;
+    podman = {
+      enable = true;
+
+      # Create a `docker` alias for podman, to use it as a drop-in replacement
+      dockerCompat = true;
+
+      # Required for containers under podman-compose to be able to talk to each other.
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+
+  # Useful other development tools
+  environment.systemPackages = with pkgs; [
+    podman-tui # status of containers in the terminal
+    podman-compose # start group of containers for dev
+  ];
+}

hosts/pi4/postgres.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  services.postgresql = {
+    enable = true;
+    authentication = pkgs.lib.mkOverride 10 ''
+      #type database  DBuser        auth-method
+      local all       all           trust
+    '';
+  };
+}

hosts/pi4/security/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./firewall.nix
+  ];
+
+  services.pcscd.enable = true;
+}

hosts/pi4/security/firewall.nix

@@ -0,0 +1,17 @@
+{ common, ... }:
+
+{
+  networking = {
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        80
+        443
+      ];
+      extraInputRules = ''
+        ip saddr ${common.localIpRange} accept
+      '';
+    };
+    nftables.enable = true;
+  };
+}

hosts/thinkpad/common.nix

@@ -0,0 +1,4 @@
+{
+  # Empty matches all monitors
+  monitor1 = "";
+}

hosts/thinkpad/default.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+  imports = [
+    (lib.custom.relativeToDesktop "modules")
+    ./battery.nix
+    ./bluetooth.nix
+    ./hardware-configuration.nix
+    ./security.nix
+  ];
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  environment.systemPackages = with pkgs; [
+    brightnessctl
+    hyprsunset # Blue light filter
+  ];
+
+}

hosts/thinkpad/home-manager/default.nix

@@ -0,0 +1,14 @@
+{
+  lib,
+  ...
+}:
+
+{
+  imports = [
+    (lib.custom.relativeToDesktop "home-manager")
+    ./hyprland
+    ./zen
+  ];
+
+  programs.git.signing.key = "848D71DE0590C199";
+}

hosts/thinkpad/home-manager/hyprland/default.nix

@@ -0,0 +1,8 @@
+# Home configurations for Hyprland. For system configs, see ./modules/hyprland
+{
+  imports = [
+    ./hyprlock.nix
+    ./hyprpanel.nix
+    ./settings.nix
+  ];
+}

hosts/thinkpad/home-manager/hyprland/hyprlock.nix

@@ -0,0 +1,15 @@
+{ pkgs, lib, ... }:
+
+{
+  # TODO fingerprint prompt using $FPRINTPROMPT
+  programs.hyprlock = {
+    package = pkgs.unstable.hyprlock;
+    settings = {
+      auth."fingerprint:enabled" = true;
+      # Override removed settings shared config
+      general = lib.mkForce {
+        hide_cursor = true;
+      };
+    };
+  };
+}

hosts/thinkpad/home-manager/hyprland/hyprpanel.nix

@@ -0,0 +1,16 @@
+{
+  lib,
+  ...
+}:
+
+{
+  programs.hyprpanel.settings.layout."bar.layouts"."*".right = lib.mkForce [
+    "kbinput"
+    "volume"
+    "network"
+    "systray"
+    "clock"
+    "battery"
+    "notifications"
+  ];
+}

hosts/thinkpad/home-manager/hyprland/settings.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  ...
+}:
+
+{
+  wayland.windowManager.hyprland.settings = {
+    monitor =
+      let
+        common = import ../../common.nix;
+      in
+      lib.mkForce [
+        "${common.monitor1}, 1920x1080@60.05, 0x0, 1"
+      ];
+
+    # Autostart
+    exec-once = [
+      "hyprsunset -t 5000" # Set blue light filter
+    ];
+
+    input = {
+      sensitivity = lib.mkForce 0.4; # -1.0 - 1.0, 0 means no modification.
+      touchpad.natural_scroll = lib.mkForce true;
+    };
+
+    gestures = {
+      workspace_swipe = lib.mkForce true;
+      workspace_swipe_distance = lib.mkForce 150;
+      workspace_swipe_min_speed_to_force = lib.mkForce 0;
+      workspace_swipe_cancel_ratio = lib.mkForce 0.5;
+    };
+  };
+}

hosts/thinkpad/home-manager/zen/chrome/userChrome.css

@@ -0,0 +1,113 @@
+/* Catppuccin Mocha Blue userChrome.css*/
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --zen-colors-primary: #313244 !important;
+    --zen-primary-color: #89b4fa !important;
+    --zen-colors-secondary: #313244 !important;
+    --zen-colors-tertiary: #181825 !important;
+    --zen-colors-border: #89b4fa !important;
+    --toolbarbutton-icon-fill: #89b4fa !important;
+    --lwt-text-color: #cdd6f4 !important;
+    --toolbar-field-color: #cdd6f4 !important;
+    --tab-selected-textcolor: rgb(171, 197, 247) !important;
+    --toolbar-field-focus-color: #cdd6f4 !important;
+    --toolbar-color: #cdd6f4 !important;
+    --newtab-text-primary-color: #cdd6f4 !important;
+    --arrowpanel-color: #cdd6f4 !important;
+    --arrowpanel-background: #1e1e2e !important;
+    --sidebar-text-color: #cdd6f4 !important;
+    --lwt-sidebar-text-color: #cdd6f4 !important;
+    --lwt-sidebar-background-color: #11111b !important;
+    --toolbar-bgcolor: #313244 !important;
+    --newtab-background-color: #1e1e2e !important;
+    --zen-themed-toolbar-bg: #181825 !important;
+    --zen-main-browser-background: #181825 !important;
+  }
+
+  #permissions-granted-icon {
+    color: #181825 !important;
+  }
+
+  .sidebar-placesTree {
+    background-color: #1e1e2e !important;
+  }
+
+  #zen-workspaces-button {
+    background-color: #1e1e2e !important;
+  }
+
+  #TabsToolbar {
+    background-color: #181825 !important;
+  }
+
+  #urlbar-background {
+    background-color: #1e1e2e !important;
+  }
+
+  .content-shortcuts {
+    background-color: #1e1e2e !important;
+    border-color: #89b4fa !important;
+  }
+
+  .urlbarView-url {
+    color: #89b4fa !important;
+  }
+
+  #zenEditBookmarkPanelFaviconContainer {
+    background: #11111b !important;
+  }
+
+  toolbar .toolbarbutton-1 {
+    &:not([disabled]) {
+      &:is([open], [checked])
+        > :is(
+          .toolbarbutton-icon,
+          .toolbarbutton-text,
+          .toolbarbutton-badge-stack
+        ) {
+        fill: #11111b;
+      }
+    }
+  }
+
+  .identity-color-blue {
+    --identity-tab-color: #89b4fa !important;
+    --identity-icon-color: #89b4fa !important;
+  }
+
+  .identity-color-turquoise {
+    --identity-tab-color: #94e2d5 !important;
+    --identity-icon-color: #94e2d5 !important;
+  }
+
+  .identity-color-green {
+    --identity-tab-color: #a6e3a1 !important;
+    --identity-icon-color: #a6e3a1 !important;
+  }
+
+  .identity-color-yellow {
+    --identity-tab-color: #f9e2af !important;
+    --identity-icon-color: #f9e2af !important;
+  }
+
+  .identity-color-orange {
+    --identity-tab-color: #fab387 !important;
+    --identity-icon-color: #fab387 !important;
+  }
+
+  .identity-color-red {
+    --identity-tab-color: #f38ba8 !important;
+    --identity-icon-color: #f38ba8 !important;
+  }
+
+  .identity-color-pink {
+    --identity-tab-color: #f5c2e7 !important;
+    --identity-icon-color: #f5c2e7 !important;
+  }
+
+  .identity-color-purple {
+    --identity-tab-color: #cba6f7 !important;
+    --identity-icon-color: #cba6f7 !important;
+  }
+}

hosts/thinkpad/home-manager/zen/chrome/userContent.css

@@ -0,0 +1,158 @@
+/* Catppuccin Mocha Blue userContent.css*/
+
+@media (prefers-color-scheme: dark) {
+  /* Common variables affecting all pages */
+  @-moz-document url-prefix("about:") {
+    :root {
+      --in-content-page-color: #cdd6f4 !important;
+      --color-accent-primary: #89b4fa !important;
+      --color-accent-primary-hover: rgb(163, 197, 251) !important;
+      --color-accent-primary-active: rgb(138, 153, 250) !important;
+      background-color: #1e1e2e !important;
+      --in-content-page-background: #1e1e2e !important;
+    }
+  }
+
+  /* Variables and styles specific to about:newtab and about:home */
+  @-moz-document url("about:newtab"), url("about:home") {
+    :root {
+      --newtab-background-color: #1e1e2e !important;
+      --newtab-background-color-secondary: #313244 !important;
+      --newtab-element-hover-color: #313244 !important;
+      --newtab-text-primary-color: #cdd6f4 !important;
+      --newtab-wordmark-color: #cdd6f4 !important;
+      --newtab-primary-action-background: #89b4fa !important;
+    }
+
+    .icon {
+      color: #89b4fa !important;
+    }
+
+    .search-wrapper .logo-and-wordmark .logo {
+      background:
+        url("zen-logo-mocha.svg"),
+        url("https://raw.githubusercontent.com/IAmJafeth/zen-browser/main/themes/Mocha/Blue/zen-logo-mocha.svg")
+          no-repeat center !important;
+      display: inline-block !important;
+      height: 82px !important;
+      width: 82px !important;
+      background-size: 82px !important;
+    }
+
+    @media (max-width: 609px) {
+      .search-wrapper .logo-and-wordmark .logo {
+        background-size: 64px !important;
+        height: 64px !important;
+        width: 64px !important;
+      }
+    }
+
+    .card-outer:is(:hover, :focus, .active):not(.placeholder) .card-title {
+      color: #89b4fa !important;
+    }
+
+    .top-site-outer .search-topsite {
+      background-color: #89b4fa !important;
+    }
+
+    .compact-cards .card-outer .card-context .card-context-icon.icon-download {
+      fill: #a6e3a1 !important;
+    }
+  }
+
+  /* Variables and styles specific to about:preferences */
+  @-moz-document url-prefix("about:preferences") {
+    :root {
+      --zen-colors-tertiary: #181825 !important;
+      --in-content-text-color: #cdd6f4 !important;
+      --link-color: #89b4fa !important;
+      --link-color-hover: rgb(163, 197, 251) !important;
+      --zen-colors-primary: #313244 !important;
+      --in-content-box-background: #313244 !important;
+      --zen-primary-color: #89b4fa !important;
+    }
+
+    groupbox,
+    moz-card {
+      background: #1e1e2e !important;
+    }
+
+    button,
+    groupbox menulist {
+      background: #313244 !important;
+      color: #cdd6f4 !important;
+    }
+
+    .main-content {
+      background-color: #11111b !important;
+    }
+
+    .identity-color-blue {
+      --identity-tab-color: #8aadf4 !important;
+      --identity-icon-color: #8aadf4 !important;
+    }
+
+    .identity-color-turquoise {
+      --identity-tab-color: #8bd5ca !important;
+      --identity-icon-color: #8bd5ca !important;
+    }
+
+    .identity-color-green {
+      --identity-tab-color: #a6da95 !important;
+      --identity-icon-color: #a6da95 !important;
+    }
+
+    .identity-color-yellow {
+      --identity-tab-color: #eed49f !important;
+      --identity-icon-color: #eed49f !important;
+    }
+
+    .identity-color-orange {
+      --identity-tab-color: #f5a97f !important;
+      --identity-icon-color: #f5a97f !important;
+    }
+
+    .identity-color-red {
+      --identity-tab-color: #ed8796 !important;
+      --identity-icon-color: #ed8796 !important;
+    }
+
+    .identity-color-pink {
+      --identity-tab-color: #f5bde6 !important;
+      --identity-icon-color: #f5bde6 !important;
+    }
+
+    .identity-color-purple {
+      --identity-tab-color: #c6a0f6 !important;
+      --identity-icon-color: #c6a0f6 !important;
+    }
+  }
+
+  /* Variables and styles specific to about:addons */
+  @-moz-document url-prefix("about:addons") {
+    :root {
+      --zen-dark-color-mix-base: #181825 !important;
+      --background-color-box: #1e1e2e !important;
+    }
+  }
+
+  /* Variables and styles specific to about:protections */
+  @-moz-document url-prefix("about:protections") {
+    :root {
+      --zen-primary-color: #1e1e2e !important;
+      --social-color: #cba6f7 !important;
+      --coockie-color: #89dceb !important;
+      --fingerprinter-color: #f9e2af !important;
+      --cryptominer-color: #b4befe !important;
+      --tracker-color: #a6e3a1 !important;
+      --in-content-primary-button-background-hover: rgb(81, 83, 105) !important;
+      --in-content-primary-button-text-color-hover: #cdd6f4 !important;
+      --in-content-primary-button-background: #45475a !important;
+      --in-content-primary-button-text-color: #cdd6f4 !important;
+    }
+
+    .card {
+      background-color: #313244 !important;
+    }
+  }
+}

hosts/thinkpad/home-manager/zen/chrome/zen-logo.svg

@@ -0,0 +1,13 @@
+<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g clip-path="url(#clip0_15_9)">
+    <rect width="1024" height="1024" rx="225" fill="#11111b"/>
+    <circle cx="512" cy="512" r="340" stroke="#cdd6f4" stroke-width="70"/>
+    <circle cx="512" cy="512" r="224.915" stroke="#cdd6f4" stroke-width="51"/>
+    <circle cx="512" cy="512" r="129.018" stroke="#cdd6f4" stroke-width="31"/>
+  </g>
+  <defs>
+    <clipPath id="clip0_15_9">
+      <rect width="1024" height="1024" fill="white"/>
+    </clipPath>
+  </defs>
+</svg>

hosts/thinkpad/home-manager/zen/default.nix

@@ -0,0 +1,7 @@
+{
+  # TODO merge with shared
+  home.file.".zen/xdaxqlov.default/chrome" = {
+    source = ./chrome;
+    recursive = true;
+  };
+}

hosts/thinkpad/security.nix

@@ -0,0 +1,38 @@
+{ pkgs, ... }:
+
+{
+  security = {
+    pam.services = {
+      gdm-fingerprint.text = ''
+        auth       required                    pam_shells.so
+        auth       requisite                   pam_nologin.so
+        auth       requisite                   pam_faillock.so      preauth
+        auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
+        auth       optional                    pam_permit.so
+        auth       required                    pam_env.so
+        auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
+        auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
+
+        account    include                     login
+
+        password   required                    pam_deny.so
+
+        session    include                     login
+        session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
+      '';
+      login.fprintAuth = false;
+    };
+  };
+
+  # Start the driver at boot
+  systemd.services.fprintd = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.Type = "simple";
+  };
+
+  # Install the driver
+  services.fprintd = {
+    enable = true;
+    tod.driver = pkgs.libfprint-2-tod1-goodix-550a; # Goodix 550a driver (from Lenovo)
+  };
+}

justfile

@@ -1,26 +1,45 @@
+# List all receipes
 default:
     @just --list
 
+# Format all files in repo
 fmt:
     treefmt --on-unmatched info
 
+# Build a specific host but don't activate it. Host must use same system as target system
+build HOST:
+    git add .
+    just fmt
+    nh os build . -H {{HOST}}
+
+# Switch to new config, but don't add to bootloader
 test *FLAGS:
     git add .
     just fmt
     nh os test . {{FLAGS}}
 
+# Add new configuration to bootloader, but don't activate it now
+boot *FLAGS:
+    git add .
+    just fmt
+    nh os test . {{FLAGS}}
+
+# Switch to new config and add to bootloader
 switch *FLAGS:
     git add .
     just fmt
     nh os switch . {{FLAGS}}
 
+# Switch to new config and add to bootloader without formatting or adding to git
 switch-now *FLAGS:
     nh os switch . {{FLAGS}}
 
-update:
+update-all *FLAGS:
-    nix-channel --update
     nix flake update
+    just switch {{FLAGS}}
 
+update PKG:
+    nix flake update {{PKG}}
     just switch
 
 # Encrypt all files in the repo using git-crypt
@@ -30,3 +49,32 @@ lock:
 # Decrypt all files in the repo using git-crypt and the user's GPG key
 unlock:
     git-crypt unlock ~/.config/git/crypt-key
+
+# Connect to tailnet or sign-in if not registered
+start-tailscale:
+    tailscale up --login-server https://vpn.martials.no
+
+# Generate a new SSH key without passphrase
+generate-ssh:
+    ssh-keygen -t ed25519 -a 32 -f ~/.ssh/id_ed25519 -P ""
+
+# Generate a new age key from an existing ssh key (without passphrase)
+generate-age-from-ssh:
+    mkdir -p ~/.config/sops/age
+    nix run nixpkgs#ssh-to-age -- -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt
+
+# Get a public age key from an existing age private key
+get-public-age-key:
+    nix shell nixpkgs#age -c age-keygen -y ~/.config/sops/age/keys.txt
+
+# Get the public ssh key from the current user
+get-public-ssh-key:
+    cat ~/.ssh/id_ed25519.pub
+
+# Edit the SOPS secrets file
+edit-secrets:
+    nix run nixpkgs#sops -- shared/secrets/secrets.yaml
+
+# Hash a string using the mkpasswd command
+hash PASS:
+    echo "{{PASS}}" | mkpasswd -s

lib/default.nix

@@ -0,0 +1,27 @@
+# FIXME(lib.custom): Add some stuff from hmajid2301/dotfiles/lib/module/default.nix, as simplifies option declaration
+{ lib, ... }:
+with builtins;
+
+{
+  getSecret = with lib.strings; filePath: trim (removeSuffix "\n" (readFile filePath));
+
+  # use path relative to the root of the project
+  relativeToRoot = lib.path.append ../.;
+  relativeToBase = lib.path.append ../shared/base;
+  relativeToDesktop = lib.path.append ../shared/desktop;
+
+  scanPaths =
+    path:
+    map (f: (path + "/${f}")) (
+      attrNames (
+        lib.attrsets.filterAttrs (
+          path: _type:
+          (_type == "directory") # include directories
+          || (
+            (path != "default.nix") # ignore default.nix
+            && (lib.strings.hasSuffix ".nix" path) # include .nix files
+          )
+        ) (readDir path)
+      )
+    );
+}

modules/default.nix

@@ -1,19 +0,0 @@
-{
-  imports = [
-    ./battery.nix
-    ./bluetooth.nix
-    ./development.nix
-    ./fonts.nix
-    ./gaming
-    ./gnome
-    ./hardware
-    ./locale.nix
-    ./networking.nix
-    ./nix-helper.nix
-    ./hyprland
-    ./sddm.nix
-    ./security.nix
-    ./shell.nix
-    ./qt.nix
-  ];
-}

modules/development.nix

@@ -1,41 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    # IDEs
-    jetbrains.rust-rover
-    jetbrains.webstorm
-    jetbrains.rider
-    vscodium # TODO set up extensions
-    # Tools
-    dotnet-sdk_9
-    dotnet-aspnetcore_9
-    git
-    rustup
-    nodejs_22
-    pnpm
-    just
-    gcc # Required for C, Rust and others
-    # Language servers
-    nixd
-    nil
-    # Formatters
-    nixfmt-rfc-style
-    treefmt
-    nodePackages.prettier
-    shfmt
-  ];
-
-  virtualisation.docker = {
-    enable = true;
-    storageDriver = "btrfs";
-    rootless = {
-      enable = true;
-      setSocketVariable = true;
-    };
-  };
-
-  services.ollama = {
-    enable = true;
-  };
-}

modules/fonts.nix

@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    font-awesome # Icons
-  ];
-
-  fonts =
-    let
-      theme = import ../theme.nix;
-    in
-    {
-      fontconfig.enable = true;
-      packages = with pkgs; [
-        (nerdfonts.override { fonts = [ theme.nerdFont ]; })
-        jetbrains-mono
-        # The line below will replace the lines above in 25.05
-        # nerd-fonts.jetbrains-mono
-        font-awesome
-      ];
-    };
-
-}

modules/networking.nix

@@ -1,23 +0,0 @@
-let
-  common = import ../common.nix;
-in
-{
-  networking = {
-    networkmanager.enable = true;
-    hostName = common.hostname;
-    # wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  };
-
-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
-
-  programs.ssh.enableAskPassword = false;
-
-  services.tailscale.enable = true;
-}

modules/security.nix

@@ -1,68 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    gnupg
-    yubioath-flutter
-  ];
-
-  programs.gnupg.agent.enable = true;
-
-  security = {
-    pam = {
-      services = {
-        gdm-fingerprint.text = ''
-          auth       required                    pam_shells.so
-          auth       requisite                   pam_nologin.so
-          auth       requisite                   pam_faillock.so      preauth
-          auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
-          auth       optional                    pam_permit.so
-          auth       required                    pam_env.so
-          auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
-          auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
-
-          account    include                     login
-
-          password   required                    pam_deny.so
-
-          session    include                     login
-          session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
-        '';
-        login = {
-          fprintAuth = false;
-          u2fAuth = false; # U2F and password
-        };
-        sudo.u2fAuth = true; # U2F or password
-      };
-      u2f = {
-        enable = true;
-        settings = {
-          cue = true; # Prompt: Please touch the device
-          interactive = false; # Prompt: Insert your U2F device, then press ENTER.
-        };
-      };
-    };
-  };
-
-  # Start the driver at boot
-  systemd.services.fprintd = {
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig.Type = "simple";
-  };
-
-  # Install the driver
-  services.fprintd = {
-    enable = true;
-    tod.driver = pkgs.libfprint-2-tod1-goodix-550a; # Goodix 550a driver (from Lenovo)
-  };
-
-  # however for focaltech 2808:a658, use fprintd with overidden package (without tod)
-  # services.fprintd.package = pkgs.fprintd.override {
-  #   libfprint = pkgs.libfprint-focaltech-2808-a658;
-  # };
-
-  services = {
-    pcscd.enable = true; # Required for Yubikey
-    udev.packages = with pkgs; [ yubikey-personalization ];
-  };
-}

overlays.nix

@@ -1,7 +1,11 @@
 { inputs, ... }:
 
 {
-  nixpkgs.overlays = with inputs; [
+  # Gives access to unstable packages everywhere
-    hyprpanel.overlay
+  unstable-packages = final: _prev: {
-  ];
+    unstable = import inputs.nixpkgs-unstable {
+      system = final.system;
+      config.allowUnfree = true;
+    };
+  };
 }

shared/base/home-manager/default.nix

@@ -0,0 +1,12 @@
+{ inputs, ... }:
+
+{
+  imports = [
+    inputs.catppuccin.homeModules.catppuccin
+    ./development
+    ./shell
+    ./gpg.nix
+    ./home-manager.nix
+    ./ssh.nix
+  ];
+}

shared/base/home-manager/development/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./git.nix
+    ./helix.nix
+  ];
+}

shared/base/home-manager/development/git.nix

@@ -1,7 +1,10 @@
-{ pkgs, ... }:
+{ pkgs, common, ... }:
 
 {
-  home.packages = with pkgs; [ git-crypt ];
+  home.packages = with pkgs; [
+    git-crypt
+    gitmoji-cli
+  ];
 
   programs.git =
     let
@@ -11,20 +14,19 @@
       enable = true;
       package = package;
       userName = "Martin Berg Alstad";
-      userEmail = "git@martials.no";
+      userEmail = "git@${common.domain}";
 
       aliases = {
         amend = "commit --amend";
         cm = "commit";
         s = "status";
+        p = "push";
       };
 
-      signing = {
+      signing.signByDefault = true;
-        signByDefault = true;
-        key = "848D71DE0590C199";
-      };
 
       extraConfig = {
+        pull.rebase = true;
         push.autoSetupRemote = true;
         safe.directory = "/etc/nixos";
         credential.helper = "${package}/bin/git-credential-libsecret";

shared/base/home-manager/development/helix.nix

@@ -0,0 +1,103 @@
+{
+  pkgs,
+  lib,
+  theme,
+  ...
+}:
+
+{
+  catppuccin.helix = {
+    enable = true;
+    flavor = theme.flavor;
+  };
+
+  programs = {
+    fish.shellAliases.edit = "hx";
+    helix =
+      let
+        prettier = format: {
+          command = "prettier";
+          args = [
+            "--stdin-filepath"
+            "file.${format}"
+          ];
+        };
+      in
+      {
+        enable = true;
+        defaultEditor = true;
+        extraPackages = with pkgs; [
+          # Markdown
+          marksman
+          markdown-oxide
+          # Html, css, Json, Eslint
+          vscode-langservers-extracted
+          # Yaml
+          ansible-language-server
+          yaml-language-server
+        ];
+        settings = {
+          editor = {
+            auto-save = {
+              after-delay.enable = true;
+              focus-lost = true;
+            };
+            cursor-shape = {
+              normal = "block";
+              insert = "bar";
+              select = "underline";
+            };
+            lsp = {
+              display-inlay-hints = true;
+              display-messages = true;
+            };
+          };
+          keys.normal = {
+            C-f = ":format";
+          };
+        };
+
+        languages.language = [
+          {
+            name = "css";
+            formatter = prettier "css";
+            auto-format = true;
+          }
+          {
+            name = "json";
+            language-servers = [
+              "vscode-json-language-server"
+            ];
+            formatter = prettier "json";
+            auto-format = true;
+          }
+          {
+            name = "jsonc";
+            language-servers = [
+            ];
+            formatter = prettier "jsonc";
+            file-types = [
+              "jsonc"
+            ];
+            auto-format = true;
+          }
+          {
+            name = "markdown";
+            formatter = prettier "md";
+            auto-format = true;
+          }
+          {
+            name = "nix";
+            formatter.command = lib.getExe pkgs.nixfmt-rfc-style;
+            auto-format = true;
+          }
+          {
+            name = "yaml";
+            formatter = prettier "yaml";
+            auto-format = true;
+          }
+        ];
+
+      };
+  };
+}

shared/base/home-manager/gpg.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  programs.gpg.enable = true;
+  services.gpg-agent = {
+    enable = true;
+    enableFishIntegration = true;
+    pinentry.package = pkgs.pinentry-curses;
+  };
+}

shared/base/home-manager/home-manager.nix

@@ -0,0 +1,16 @@
+{
+  systemConfig,
+  common,
+  ...
+}:
+
+{
+  home = {
+    username = systemConfig.username;
+    homeDirectory = common.dir.home;
+    stateVersion = systemConfig.version;
+  };
+
+  # Let Home Manager install and manage itself.
+  programs.home-manager.enable = true;
+}

shared/base/home-manager/shell/bat.nix

@@ -0,0 +1,13 @@
+{ theme, ... }:
+
+{
+  catppuccin.bat = {
+    enable = true;
+    flavor = theme.flavor;
+  };
+
+  programs = {
+    bat.enable = true;
+    fish.shellAliases.cat = "bat";
+  };
+}

shared/base/home-manager/shell/btop.nix

@@ -1,9 +1,10 @@
-let
+{ theme, ... }:
-  theme = import ../theme.nix;
+
-in
 {
   catppuccin.btop = {
     enable = true;
     flavor = theme.flavor;
   };
+
+  programs.btop.enable = true;
 }

shared/base/home-manager/shell/default.nix

@@ -0,0 +1,11 @@
+{
+  imports = [
+    ./bat.nix
+    ./btop.nix
+    ./eza.nix
+    ./fastfetch.nix
+    ./fish.nix
+    ./fzf.nix
+    ./zoxide.nix
+  ];
+}

shared/base/home-manager/shell/eza.nix

@@ -0,0 +1,12 @@
+{
+  programs = {
+    eza = {
+      enable = true;
+      colors = "always";
+      enableFishIntegration = true;
+      git = true;
+      icons = "always";
+    };
+    fish.shellAliases.ls = "eza";
+  };
+}

shared/base/home-manager/shell/fastfetch.nix

@@ -1,11 +1,14 @@
+{ lib, ... }:
+
 {
   programs = {
     fish.shellAliases.fetch = "fastfetch";
+
     fastfetch = {
       enable = true;
       settings = {
         logo = {
-          source = "${../Catppuccin.png}";
+          source = "${lib.custom.relativeToRoot "shared/assets/Catppuccin.png"}";
           type = "kitty";
           height = 18;
           padding.top = 2;

shared/base/home-manager/shell/fish.nix

@@ -1,7 +1,5 @@
-{ pkgs, ... }:
+{ pkgs, theme, ... }:
-let
+
-  theme = import ../theme.nix;
-in
 {
   catppuccin = {
     fish = {
@@ -36,7 +34,7 @@ in
         }
       ];
       shellAliases = {
-        nix-shell = "nix-shell --run fish"; # Start nix-shells using fishcd
+        nix-shell = "nix-shell --run fish"; # Start nix-shells using fish
       };
     };
 

shared/base/home-manager/shell/fzf.nix

@@ -0,0 +1,13 @@
+{ theme, ... }:
+
+{
+  catppuccin.fzf = {
+    enable = true;
+    flavor = theme.flavor;
+  };
+
+  programs.fzf = {
+    enable = true;
+    enableFishIntegration = true;
+  };
+}

shared/base/home-manager/shell/zoxide.nix

@@ -0,0 +1,10 @@
+# cd alternative
+{
+  programs = {
+    fish.shellAliases.cd = "z";
+    zoxide = {
+      enable = true;
+      enableFishIntegration = true;
+    };
+  };
+}

shared/base/home-manager/ssh.nix

@@ -0,0 +1,32 @@
+# ~/.ssh/config
+{
+  systemConfig,
+  systems,
+  common,
+  ...
+}:
+with builtins;
+
+{
+  programs.ssh = {
+    enable = true;
+    matchBlocks = listToAttrs (
+      map (system: {
+        name = system.hostName;
+        value =
+          let
+            hostName =
+              if (system ? address && system.address ? tailnet) then
+                system.address.tailnet
+              else
+                common.tailnetAddr system.hostName;
+          in
+          {
+            port = 22;
+            user = systemConfig.username;
+            hostname = hostName;
+          };
+      }) systems
+    );
+  };
+}