home/{hyprland,waybar}: init

package-overrides/{fcitx5-mozc,mozc}: remove
xps16/tlp: init
2024-12-05 19:43:58 +01:00 · 2024-12-05 19:06:53 +01:00 · 2024-12-05 19:06:52 +01:00 · 2024-12-05 19:06:52 +01:00 · 2024-12-05 18:22:02 +01:00 · 2024-12-05 10:30:30 +01:00
107 changed files with 2500 additions and 1167 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -4,6 +4,7 @@ keys:
  - &host_kasei age1eu2a6m3adakfzelfa9pqpl74a5dz0wkyr0v7gegm5ajnx7aqmqcqsp2ftc
  - &host_dosei age179y7apa80p9unvyjtsphpzyhve90ex986vlxkx43xt9n6m7en3csqnug7c
  - &host_europa age14mer45e52r2q4uz8n3fmv69tvk8gvwany4m4ndudud8ajv3jm4nqdj9m6a
+  - &host_xps16 age1np3fg9ue2tp4l47x7waapvjxh5zcaye2j54laapy7uklamve2c4qv3gytm
  - &home age10f4a5acpar8vwz3v298r3nv7gggfpmyh4wxpkc2hwq9paq0scf8qee8lau

 creation_rules:
@@ -16,6 +17,7 @@ creation_rules:
        - *host_kasei
        - *host_dosei
        - *host_europa
+        - *host_xps16
        - *home

  - path_regex: secrets/home.yaml
@@ -25,6 +27,13 @@ creation_rules:
        age:
        - *home

+  - path_regex: secrets/xps16.yaml
+    key_groups:
+      - pgp:
+        - *gpg_h7x4
+        age:
+        - *host_xps16
+
  - path_regex: secrets/kasei.yaml
    key_groups:
      - pgp:
--- a/README.md
+++ b/README.md
@@ -1,5 +1,6 @@
 [![built with nix](https://builtwithnix.org/badge.svg)](https://builtwithnix.org)

+
 # Nix Dotfiles

 These are my dotfiles for several nix machines.
@@ -16,6 +17,7 @@ Here are some of the interesting files and dirs:
 | `/secrets` | Encrypted [sops-nix][sops-nix] secrets. |
 | `flake.nix` | The root of everyting. Defines the inputs and outputs of the project. Also applies misc overlays and adds config-wide modules. See [Nix Flakes][nix-flakes] for more information. |

+
 ## Hosts

 | Host | Machine type | Purpose |
@@ -25,6 +27,7 @@ Here are some of the interesting files and dirs:
 | `Dosei` | Dell Optiplex | Work computer, mostly used for development and testing. |
 | `Europa` | Dell Optiplex | Other work computer, used as nix builder for `Dosei`. |

+
 ## home-manager configuration

 | Path | Purpose |
@@ -36,6 +39,28 @@ Here are some of the interesting files and dirs:
 | `/home/services` | Configuration for services/daemons that are user-specific. |
 | `/home/shell.nix` | Shell-agnostic configuration. This includes aliases, envvars, functions, etc. |

+
+## Some useful long commands
+
+Build configuration without switching:
+
+```
+nix build .#nixosConfigurations.tsuki.config.system.build.toplevel -L
+```
+
+Check why configuration depends on package:
+
+```
+NIXPKGS_ALLOW_INSECURE=1 nix why-depends .#nixosConfigurations.tsuki.config.system.build.toplevel .#pkgs.suspiciousPackage
+```
+
+Re-encrypt sops secrets with new key:
+
+```
+sops updatekeys secrets/hosts/file.yml
+```
+
+
 [home-manager]: https://github.com/nix-community/home-manager
 [nixos-search]: https://search.nixos.org/options
 [sops-nix]: https://github.com/Mic92/sops-nix
--- a/flake.lock
+++ b/flake.lock
@@ -69,19 +69,6 @@
        "type": "github"
      }
    },
-    "fonts": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1668957008,
-        "narHash": "sha256-er2eUfNSG9qdBh0JvtxtftQjFfTFjRqqD8dnk5nZ1qw=",
-        "path": "/home/h7x4/git/fonts",
-        "type": "path"
-      },
-      "original": {
-        "path": "/home/h7x4/git/fonts",
-        "type": "path"
-      }
-    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -89,40 +76,20 @@
        ]
      },
      "locked": {
-        "lastModified": 1718530513,
-        "narHash": "sha256-BmO8d0r+BVlwWtMLQEYnwmngqdXIuyFzMwvmTcLMee8=",
+        "lastModified": 1733050161,
+        "narHash": "sha256-lYnT+EYE47f5yY3KS/Kd4pJ6CO9fhCqumkYYkQ3TK20=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "a1fddf0967c33754271761d91a3d921772b30d0e",
+        "rev": "62d536255879be574ebfe9b87c4ac194febf47c5",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-24.11",
        "repo": "home-manager",
        "type": "github"
      }
    },
-    "home-manager-local": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ]
-      },
-      "locked": {
-        "lastModified": 1719170506,
-        "narHash": "sha256-AROqng7/S3mTByq8DBVR6r0iW1yZH+otJkqOwLHvELE=",
-        "ref": "refs/heads/fix-stalonetrayrc-path",
-        "rev": "0e5656163c2f9ac6e2cc4de3b44beb7a137abbe6",
-        "revCount": 3588,
-        "type": "git",
-        "url": "file:///home/h7x4/git/home-manager"
-      },
-      "original": {
-        "type": "git",
-        "url": "file:///home/h7x4/git/home-manager"
-      }
-    },
    "matrix-synapse-next": {
      "inputs": {
        "nixpkgs": [
@@ -191,11 +158,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1719278718,
-        "narHash": "sha256-gWQb4P9CZgKzTn4F4eWMYeUv2AQOXFlcFmFXh2apoyA=",
+        "lastModified": 1733363776,
+        "narHash": "sha256-3EZvm60PErALa91el3zRl+cJCuHmJfqiBzK+EEPnf84=",
        "owner": "infinidoge",
        "repo": "nix-minecraft",
-        "rev": "b6ff85f3b416a700ac35e33c214d7c9f4fe071fa",
+        "rev": "46d4b9024ccd2b36012ba074b330fd955a22295b",
        "type": "github"
      },
      "original": {
@@ -204,50 +171,51 @@
        "type": "github"
      }
    },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1733217105,
+        "narHash": "sha256-fc6jTzIwCIVWTX50FtW6AZpuukuQWSEbPiyg6ZRGWFY=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "cceee0a31d2f01bcc98b2fbd591327c06a4ea4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1719145550,
-        "narHash": "sha256-K0i/coxxTEl30tgt4oALaylQfxqbotTSNb1/+g+mKMQ=",
+        "lastModified": 1733261153,
+        "narHash": "sha256-eq51hyiaIwtWo19fPEeE0Zr2s83DYMKJoukNLgGGpek=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e4509b3a560c87a8d4cb6f9992b8915abf9e36d8",
+        "rev": "b681065d0919f7eb5309a93cea2cfa84dec9aa88",
        "type": "github"
      },
      "original": {
        "id": "nixpkgs",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
        "type": "indirect"
      }
    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1719099622,
-        "narHash": "sha256-YzJECAxFt+U5LPYf/pCwW/e1iUd2PF21WITHY9B/BAs=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5e8e3b89adbd0be63192f6e645e0a54080004924",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "release-23.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1719254875,
-        "narHash": "sha256-ECni+IkwXjusHsm9Sexdtq8weAq/yUyt1TWIemXt3Ko=",
+        "lastModified": 1733390065,
+        "narHash": "sha256-iB3dHF25/3kwBLwOHJaMp2JPq3iBLkcnHxWfemykRsg=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "2893f56de08021cffd9b6b6dfc70fd9ccd51eb60",
+        "rev": "59e0687dfe83e658efb399f903970abbf3a6730e",
        "type": "github"
      },
      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-unstable",
-        "type": "indirect"
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixpkgs",
+        "type": "github"
      }
    },
    "osuchan": {
@@ -273,52 +241,30 @@
    "root": {
      "inputs": {
        "dotfiles": "dotfiles",
-        "fonts": "fonts",
        "home-manager": "home-manager",
-        "home-manager-local": "home-manager-local",
        "matrix-synapse-next": "matrix-synapse-next",
        "maunium-stickerpicker": "maunium-stickerpicker",
        "minecraft": "minecraft",
+        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs",
        "nixpkgs-unstable": "nixpkgs-unstable",
        "osuchan": "osuchan",
-        "secrets": "secrets",
        "sops-nix": "sops-nix",
        "vscode-server": "vscode-server"
      }
    },
-    "secrets": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "dirtyRev": "1d1e3c1a3293e22be504749eb92ac3b050cd8622-dirty",
-        "dirtyShortRev": "1d1e3c1-dirty",
-        "lastModified": 1683506783,
-        "narHash": "sha256-iwnpd6v4tKXFDTRomzJxwYPr2mm2JR9DCCnkqsofX5c=",
-        "type": "git",
-        "url": "file:///home/h7x4/git/nix-secrets"
-      },
-      "original": {
-        "type": "git",
-        "url": "file:///home/h7x4/git/nix-secrets"
-      }
-    },
    "sops-nix": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable"
+        ]
      },
      "locked": {
-        "lastModified": 1719268571,
-        "narHash": "sha256-pcUk2Fg5vPXLUEnFI97qaB8hto/IToRfqskFqsjvjb8=",
+        "lastModified": 1733128155,
+        "narHash": "sha256-m6/qwJAJYcidGMEdLqjKzRIjapK4nUfMq7rDCTmZajc=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "c2ea1186c0cbfa4d06d406ae50f3e4b085ddc9b3",
+        "rev": "c6134b6fff6bda95a1ac872a2a9d5f32e3c37856",
        "type": "github"
      },
      "original": {
@@ -365,11 +311,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1713958148,
-        "narHash": "sha256-8PDNi/dgoI2kyM7uSiU4eoLBqUKoA+3TXuz+VWmuCOc=",
+        "lastModified": 1729422940,
+        "narHash": "sha256-DlvJv33ml5UTKgu4b0HauOfFIoDx6QXtbqUF3vWeRCY=",
        "owner": "nix-community",
        "repo": "nixos-vscode-server",
-        "rev": "fc900c16efc6a5ed972fb6be87df018bcf3035bc",
+        "rev": "8b6db451de46ecf9b4ab3d01ef76e59957ff549f",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -1,13 +1,16 @@
 {
  inputs = {
-    nixpkgs.url = "nixpkgs/nixos-24.05";
-    nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
+    nixpkgs.url = "nixpkgs/nixos-24.11";
+    # nixpkgs-unstable.url = "nixpkgs/nixpkgs-unstable";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";

    home-manager = {
-      url = "github:nix-community/home-manager/release-24.05";
+      url = "github:nix-community/home-manager/release-24.11";
      inputs.nixpkgs.follows = "nixpkgs";
    };

+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+
    dotfiles = {
      url = "git+https://git.pvv.ntnu.no/oysteikt/dotfiles?ref=master";
      flake = false;
@@ -49,16 +52,6 @@
      url = "github:nix-community/nixos-vscode-server";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-
-    # Nix expressions and keys (TODO: move keys to another solution like agenix)
-    # which should be kept from the main repo for privacy reasons.
-    #
-    # Includes stuff like usernames, emails, ports, other server users, ssh hosts, etc.
-    secrets = {
-      # TODO: Push this to a remote.
-      url = "git+file:///home/h7x4/git/nix-secrets";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
  };

  outputs = inputs@{
@@ -66,13 +59,13 @@
    nixpkgs,
    nixpkgs-unstable,
    home-manager,
+    nixos-hardware,

    dotfiles,
    matrix-synapse-next,
    maunium-stickerpicker,
    minecraft,
    osuchan,
-    secrets,
    sops-nix,
    vscode-server,
    # website
@@ -87,7 +80,7 @@
        android_sdk.accept_license = true;
        segger-jlink.acceptLicense = true;
        permittedInsecurePackages = [
-          "segger-jlink-qt4-794l"
+          "segger-jlink-qt4-796s"
        ];
      };

@@ -97,30 +90,11 @@
          config.allowUnfree = true;
          config.segger-jlink.acceptLicense = true;
          config.permittedInsecurePackages = [
-            "segger-jlink-qt4-794s"
+            "segger-jlink-qt4-796s"
          ];
        };
      in [
-        (self: super: {
-          inherit (nonrecursive-unstable-pkgs)
-            atuin
-            wstunnel
-            nrf-udev
-            nrfutil
-            ;
-        })
-
-        # https://github.com/NixOS/nixpkgs/pull/251706
-        (self: super: {
-          mozc = self.qt6Packages.callPackage ./package-overrides/mozc.nix { };
-          fcitx5-mozc = self.callPackage ./package-overrides/fcitx5-mozc.nix { };
-        })
-
-        (self: super: {
-          mpv-unwrapped = super.mpv-unwrapped.override {
-            ffmpeg = super.ffmpeg_6-full;
-          };
-        })
+        (import ./overlays/wayland-ime-integration.nix)
      ];
    };

@@ -131,9 +105,7 @@

    inherit pkgs;

-    packages.${system} = {
-      inherit (pkgs) kanidm pcloud;
-    };
+    inputs = pkgs.lib.mapAttrs (_: src: src.outPath) inputs;

    devShells.${system}.default = pkgs.mkShell {
      packages = with pkgs; [ sops ];
@@ -176,7 +148,6 @@
              inherit inputs;
              inherit unstable-pkgs;
              inherit (self) extendedLib;
-              secrets = secrets.outputs.settings;
            } // (extraConfig.specialArgs or { });

            modules = [
@@ -188,7 +159,6 @@
              ./modules/machineVars.nix
              ./modules/socketActivation.nix

-              secrets.outputs.nixos-config
              sops-nix.nixosModules.sops

              ({ config, ... }:
@@ -200,7 +170,6 @@
                    inherit unstable-pkgs;
                    inherit (self) extendedLib;
                    inherit (config) machineVars;
-                    secrets = secrets.outputs.settings;
                  };

                  sharedModules = [
@@ -221,9 +190,36 @@
            "specialArgs"
          ]));
    in {
-      dosei = nixSys "dosei" { };
+      dosei = nixSys "dosei" {
+        modules = [
+          {
+            home-manager.users.h7x4.home.uid = 1001;
+          }
+
+          nixos-hardware.nixosModules.common-pc
+          nixos-hardware.nixosModules.common-pc-ssd
+          nixos-hardware.nixosModules.common-cpu-intel
+          nixos-hardware.nixosModules.common-gpu-intel
+        ];
+      };
      kasei = nixSys "kasei" { };
-      europa = nixSys "europa" { };
+      xps16 = nixSys "xps16" {
+        modules = [
+          nixos-hardware.nixosModules.common-hidpi
+          nixos-hardware.nixosModules.common-pc-laptop
+          nixos-hardware.nixosModules.common-pc-laptop-ssd
+          nixos-hardware.nixosModules.common-cpu-intel
+          nixos-hardware.nixosModules.common-gpu-intel
+        ];
+      };
+      europa = nixSys "europa" {
+        modules = [
+          nixos-hardware.nixosModules.common-pc
+          nixos-hardware.nixosModules.common-pc-ssd
+          nixos-hardware.nixosModules.common-cpu-intel
+          nixos-hardware.nixosModules.common-gpu-intel
+        ];
+      };
      tsuki = nixSys "tsuki" {
        modules = [
          matrix-synapse-next.nixosModules.default
--- a/home/config/xdg/default.nix
+++ b/home/config/xdg/default.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, lib, ... }:
 {
  imports = [
    ./mimetypes.nix
@@ -8,14 +8,14 @@
    enable = true;
    userDirs = {
      enable = true;
-      desktop = "${config.home.homeDirectory}/Desktop";
-      documents = "${config.home.homeDirectory}/documents";
-      download = "${config.home.homeDirectory}/Downloads";
-      music = "${config.home.homeDirectory}/music";
-      pictures = "${config.home.homeDirectory}/pictures";
-      publicShare = "${config.home.homeDirectory}/public";
-      templates = "${config.home.homeDirectory}/templates";
-      videos = "${config.home.homeDirectory}/videos";
+      desktop = lib.mkDefault "${config.home.homeDirectory}/Desktop";
+      documents = lib.mkDefault "${config.home.homeDirectory}/documents";
+      download = lib.mkDefault "${config.home.homeDirectory}/Downloads";
+      music = lib.mkDefault "${config.home.homeDirectory}/music";
+      pictures = lib.mkDefault "${config.home.homeDirectory}/pictures";
+      publicShare = lib.mkDefault "${config.home.homeDirectory}/public";
+      templates = lib.mkDefault "${config.home.homeDirectory}/templates";
+      videos = lib.mkDefault "${config.home.homeDirectory}/videos";
    };
  };
 }
--- a/home/config/xdg/directory-spec-overrides.nix
+++ b/home/config/xdg/directory-spec-overrides.nix
@@ -4,6 +4,7 @@

  home.sessionVariables = let
    inherit (config.xdg) dataHome cacheHome configHome userDirs;
+    runtimeDir = "/run/user/${toString config.home.uid}";
  in {
    TEXMFHOME = "${dataHome}/texmf";
    TEXMFVAR = "${cacheHome}/texlive";
@@ -36,6 +37,9 @@
    ICEAUTHORITY = "${cacheHome}/ICEauthority";
    NIMBLE_DIR = "${dataHome}/nimble";
    NLTK_DATA = "${dataHome}/nltk_data";
+    NPM_CONFIG_CACHE="${cacheHome}/npm";
+    NPM_CONFIG_INIT_MODULE="${configHome}/npm/config/npm-init.js";
+    NPM_CONFIG_TMP="${runtimeDir}/npm";
    NRFUTIL_HOME = "${dataHome}/nrfutil";
    NUGET_PACKAGES = "${cacheHome}/nuget-packages";
    PARALLEL_HOME = "${configHome}/parallel";
--- a/home/home.nix
+++ b/home/home.nix
@@ -10,22 +10,34 @@ in {

    ./programs/aria2.nix
    ./programs/atuin.nix
+    ./programs/bash.nix
+    ./programs/bat.nix
    ./programs/beets.nix
+    ./programs/bottom.nix
    ./programs/comma.nix
    ./programs/direnv
+    ./programs/eza.nix
+    ./programs/fzf.nix
    ./programs/gdb.nix
-    ./programs/gh.nix
    ./programs/gh-dash.nix
+    ./programs/gh.nix
    ./programs/git
    ./programs/gpg
+    ./programs/home-manager.nix
    ./programs/jq.nix
    ./programs/less.nix
+    ./programs/man.nix
    ./programs/neovim
    ./programs/nix-index
+    ./programs/pandoc.nix
+    ./programs/ripgrep.nix
    ./programs/ssh
    ./programs/tealdeer
+    ./programs/texlive.nix
    ./programs/thunderbird.nix
-    ./programs/tmux.nix
+    ./programs/tmux
+    ./programs/yt-dlp.nix
+    ./programs/zoxide.nix
    ./programs/zsh

    ./services/nix-channel-update.nix
@@ -33,34 +45,47 @@ in {

    ./modules/colors.nix
    ./modules/shellAliases.nix
-  ] ++ optionals graphics [
+    ./modules/uidGid.nix
+  ] ++ (optionals graphics [
    ./config/gtk.nix

    ./programs/alacritty.nix
    ./programs/emacs
+    ./programs/feh.nix
    ./programs/firefox.nix
+    ./programs/mpv.nix
    ./programs/ncmpcpp.nix
    ./programs/newsboat
+    ./programs/obs-studio.nix
    ./programs/qutebrowser.nix
    ./programs/rofi.nix
    ./programs/taskwarrior.nix
    ./programs/vscode
-    # ./programs/xmobar
-    ./programs/xmonad
    ./programs/zathura.nix
-    ./programs/zed
+    # ./programs/zed

    ./services/copyq.nix
    ./services/dunst.nix
    ./services/fcitx5.nix
+    ./services/gnome-keyring.nix
+    ./services/keybase.nix
    ./services/mpd.nix
+    ./services/network-manager.nix
+    ./services/psd.nix
+    ./services/tumblerd.nix
+  ]) ++ (optionals machineVars.wayland [
+    ./programs/hyprland.nix
+    ./programs/waybar.nix
+  ]) ++ (optionals (!machineVars.wayland) [
+    ./programs/xmonad
+    # ./programs/xmobar
+
    ./services/picom.nix
    ./services/polybar.nix
    ./services/screen-locker.nix
    # ./services/stalonetray.nix
    ./services/sxhkd.nix
-    ./services/tumblerd.nix
-  ];
+  ]);

  sops.defaultSopsFile = ../secrets/home.yaml;
  sops.age.sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519_home_sops" ];
@@ -132,51 +157,6 @@ in {

  fonts.fontconfig.enable = mkForce true;

-  programs = {
-    home-manager.enable = true;
-
-    bash = {
-      enable = true;
-      historyFile = "${config.xdg.dataHome}/bash_history";
-      historySize = 100000;
-      bashrcExtra = ''
-        source "${config.xdg.configHome}/mutable_env.sh"
-      '';
-    };
-
-    bat.enable = true;
-    bottom = {
-      enable = true;
-      settings.flags.enable_gpu = true;
-    };
-    eza.enable = true;
-    feh.enable = mkIf graphics true;
-    fzf = {
-      enable = true;
-      defaultCommand = "fd --type f";
-    };
-    man = {
-      enable = true;
-      generateCaches = true;
-    };
-    mpv.enable = mkIf graphics true;
-    obs-studio.enable = mkIf graphics true;
-    ssh = {
-      enable = true;
-      includes = [ "mutable_config" ];
-    };
-    texlive = {
-      enable = true;
-      # packageSet = pkgs.texlive.combined.scheme-medium;
-    };
-    zoxide.enable = true;
-  };
-
-  services = {
-    gnome-keyring.enable = mkIf graphics true;
-    network-manager-applet.enable = mkIf graphics true;
-  };
-
  manual = {
    html.enable = true;
    manpages.enable = true;
--- a/home/modules/uidGid.nix
+++ b/home/modules/uidGid.nix
@@ -0,0 +1,13 @@
+{ lib, ... }:
+{
+  options.home = {
+    uid = lib.mkOption {
+      default = 1000;
+      type = lib.types.ints.between 0 60000;
+    };
+    gid = lib.mkOption {
+      default = 1000;
+      type = lib.types.ints.between 0 60000;
+    };
+  };
+}
--- a/home/packages.nix
+++ b/home/packages.nix
@@ -5,13 +5,14 @@
    cloc
    cyme
    czkawka
-    delta
    diskonaut
    duf
    duff
    ffmpeg
    file
    glances
+    gpauth
+    gpclient
    gpg-tui
    gping
    graphviz
@@ -19,7 +20,6 @@
    httpie
    imagemagick
    kepubify
-    # keybase
    keymapviz
    libwebp
    lnav
@@ -39,18 +39,15 @@
    # nixops
    nmap
    ouch
-    pandoc
    parallel
    progress
    pwntools
    python3
    rclone
-    ripgrep
    rsync
    # sc-im
    slack-term
    tea
-    tealdeer
    terminal-parrot
    termtosvg
    toilet
@@ -62,7 +59,6 @@
    waifu2x-converter-cpp
    wavemon
    wiki-tui
-    yt-dlp
    yubico-pam
    yubikey-agent
    yubikey-manager
@@ -89,8 +85,8 @@
      geogebra
      ghidra
      gimp
-      gnome.gnome-font-viewer
-      gnome.seahorse
+      gnome-font-viewer
+      seahorse
      google-chrome
      imhex
      inkscape
@@ -124,7 +120,6 @@

      tenacity
      # transcribe
-      wireshark
      xcalib
      xclip
      xdotool
--- a/home/programs/alacritty.nix
+++ b/home/programs/alacritty.nix
@@ -43,9 +43,9 @@
        duration = 20;
      };

-      live_config_reload = true;
+      general.live_config_reload = true;

-      shell = {
+      terminal.shell = {
        program = "${pkgs.zsh}/bin/zsh";
        args = [ "--login" ];
      };
--- a/home/programs/atuin.nix
+++ b/home/programs/atuin.nix
@@ -1,9 +1,7 @@
 { config, ... }:
 let
  cfg = config.programs.atuin;
-
-  # TODO: retrieve this in a more dynamic and correct manner
-  xdg_runtime_dir = "/run/user/1000";
+  xdg_runtime_dir = "/run/user/${toString config.home.uid}";
 in
 {
  programs.atuin = {
--- a/home/programs/bash.nix
+++ b/home/programs/bash.nix
@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  programs.bash = {
+    enable = true;
+    historyFile = "${config.xdg.dataHome}/bash_history";
+    historySize = 100000;
+    bashrcExtra = ''
+      source "${config.xdg.configHome}/mutable_env.sh"
+    '';
+  };
+}
--- a/home/programs/bat.nix
+++ b/home/programs/bat.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.bat.enable = true;
+}
--- a/home/programs/bottom.nix
+++ b/home/programs/bottom.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.bottom = {
+    enable = true;
+    settings.flags.enable_gpu = true;
+  };
+}
--- a/home/programs/direnv/auto-prune.nix
+++ b/home/programs/direnv/auto-prune.nix
@@ -8,6 +8,7 @@ in
      Unit = {
        Description = "Prune unused allowed directories for direnv";
        Documentation = [ "man:direnv(1)" ];
+        ConditionPathExists = "${config.xdg.dataHome}/direnv/allow";
      };

      Service = {
--- a/home/programs/eza.nix
+++ b/home/programs/eza.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.eza.enable = true;
+}
--- a/home/programs/feh.nix
+++ b/home/programs/feh.nix
@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  programs.feh.enable = !machineVars.headless;
+}
--- a/home/programs/fzf.nix
+++ b/home/programs/fzf.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.fzf = {
+    enable = true;
+    defaultCommand = "fd --type f";
+  };
+}
--- a/home/programs/git/default.nix
+++ b/home/programs/git/default.nix
@@ -48,15 +48,71 @@ in
      aliases = {
        aliases = "!git config --get-regexp alias | sed -re 's/alias\\.(\\S*)\\s(.*)$/\\1 = \\2/g'";
        delete-merged = "!git branch --merged | grep -v '\\*' | xargs -n 1 git branch -d";
-        graph = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all";
-        graphv = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold cyan)%aD%C(reset) %C(bold green)(%ar)%C(reset)%C(bold yellow)%d%C(reset)%n''          %C(white)%s%C(reset) %C(dim white)- %an%C(reset)' --all";
        forcepush = "push --force-with-lease --force-if-includes";
        authors = "shortlog --summary --numbered --email";
        si = "switch-interactive";
+        ff = "fixup-fixup";
+        fi = "fixup-interactive";
+        rf = "rebase-fixups";
+        pp = "post-pr";
        subs = "submodule update --init --recursive";
        rebase-author = "rebase -i -x \"git commit --amend --reset-author -CHEAD\"";
        git = "!git";
-      };
+      } // (let
+        c = c: s: "%C(${c})${s}%C(reset)";
+      in {
+        graph = let
+          fmt = lib.concatStringsSep "" [
+            " - "
+            (c "bold blue" "%h")
+            " - "
+            (c "bold green" "(%ar)")
+            " "
+            (c "white" "> %s")
+            " "
+            (c "dim white" "- %an")
+            (c "bold yellow" "%d")
+          ];
+        in "log --graph --abbrev-commit --decorate --format=format:'${fmt}' --all";
+
+        graphv = let
+          fmt = lib.concatStringsSep "" [
+            (c "bold blue" "%h")
+            " - "
+            (c "bold cyan" "%aD")
+            " "
+            (c "bold green" "(%ar)")
+            (c "bold yellow" "%d")
+            "%n"
+            "          "
+            (c "white" "%s")
+            " "
+            (c "dim white" "- %an")
+          ];
+        in "log --graph --abbrev-commit --decorate --format=format:'${fmt}' --all";
+
+        l = let
+          fmt = lib.concatStringsSep "%n" (map (x: if builtins.isList x then lib.concatStringsSep " " x else x) [
+            [ (c "bold yellow" "%H") (c "auto" "%d") ]
+            [ (c "bold white" "Author:") (c "bold cyan" "%aN <%aE>") (c "bold green" "(%ah)") ]
+            [ (c "bold white" "Committer:") (c "bold cyan" "%cN <%cE>") (c "bold green" "(%ah)") ]
+            [ (c "bold white" "GPG: (%G?)") (c "bold magenta" "%GF") "-" (c "bold cyan" "%GS") (c "bold blue" "(%GT) ") ]
+            ""
+            (c "bold white" "# %s")
+            "%+b"
+            (c "dim yellow" "%+N")
+          ]);
+          # sedExpressions = let
+          #   colorExpr = "\\x1B\\[([0-9]{1,3}(;[0-9]{1,2};?)?)?[mGK]";
+          #   colorEndExpr = "\\x1B\\[m";
+          #   colored = x: "${colorExpr}${x}${colorEndExpr}";
+          # in lib.concatMapStringsSep " " (x: "-e '${x}'") [
+          #   "s|${colored "GPG: \\(N\\)"} ${colored "F3CDA86CC55A9F10D7A069819F2F7D8250F35146"} - ${colored "h7x4 <h7x4@nani.wtf>"} ${colored "\\(ultimate\\)"}|GPG: h7x4|"
+          #   "s|${colored "GPG: \\(N\\)"} ${colored ""} - ${colored ""} ${colored "\\(undefined\\)"}||"
+          # ];
+        in "log --decorate --format=tformat:'${fmt}'";
+        # in "!git log --color=always --format=format:'${fmt}' | sed -E ${sedExpressions} | $PAGER";
+      });

      extraConfig = {
        core = {
@@ -270,6 +326,21 @@ in
        (builtins.replaceStrings ["hours" "tcommit"] ["minutes" "tmcommit"])
      ];
    })
+    (pkgs.writeShellApplication {
+      name = "git-fixup-fixup";
+      runtimeInputs = with pkgs; [ cfg.package ];
+      text = lib.fileContents ./scripts/git-fixup-fixup.sh;
+    })
+    (pkgs.writeShellApplication {
+      name = "git-rebase-fixups";
+      runtimeInputs = with pkgs; [ cfg.package gnused ];
+      text = lib.fileContents ./scripts/git-rebase-fixups.sh;
+    })
+    (pkgs.writeShellApplication {
+      name = "git-fixup-interactive";
+      runtimeInputs = with pkgs; [ cfg.package gnused gnugrep fzf ];
+      text = lib.fileContents ./scripts/git-fixup-interactive.sh;
+    })
    (pkgs.writeShellApplication {
      name = "git-switch-interactive";
      runtimeInputs = with pkgs; [ cfg.package fzf gnused coreutils ];
@@ -278,6 +349,21 @@ in
        "SC2001" # (style): See if you can use ${variable//search/replace} instead. (sed invocation)
      ];
    })
+    ((pkgs.writers.writePython3Bin "git-post-pr" {
+      libraries = with pkgs.python3Packages; [
+        tkinter
+      ];
+      flakeIgnore = [
+        "E501" # I like long lines grr
+      ];
+    } (lib.fileContents ./scripts/git-post-pr.py)).overrideAttrs (_: {
+      postFixup = ''
+        wrapProgram $out/bin/git-post-pr \
+          --prefix PATH : ${lib.makeBinPath [
+            pkgs.github-cli
+          ]}
+      '';
+    }))

    pkgs.git-absorb
  ];
--- a/home/programs/git/scripts/git-fixup-fixup.sh
+++ b/home/programs/git/scripts/git-fixup-fixup.sh
@@ -0,0 +1,14 @@
+if [ -n "${1:-}" ]; then
+  TARGET_COMMIT="$1"
+  shift
+else
+  TARGET_COMMIT="HEAD"
+fi
+
+COMMIT_MESSAGE=$(git log -1 --pretty=format:'%s' "$TARGET_COMMIT")
+
+if [[ $COMMIT_MESSAGE =~ ^fixup!* ]]; then
+  git commit -m "$COMMIT_MESSAGE" "$@"
+else
+  git commit --fixup "$TARGET_COMMIT" "$@"
+fi
--- a/home/programs/git/scripts/git-fixup-interactive.sh
+++ b/home/programs/git/scripts/git-fixup-interactive.sh
@@ -0,0 +1,18 @@
+if [ -n "${1:-}" ]; then
+  TARGET_BRANCH="$1"
+  shift
+else
+  TARGET_BRANCH=$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')
+fi
+
+FORK_POINT=$(git merge-base --fork-point "$TARGET_BRANCH")
+
+COMMITS_SINCE_FORK_POINT=$(git log --format=format:'%s' "$FORK_POINT"..HEAD | grep -v -E '^fixup!')
+
+RESULT=$(fzf <<<"$COMMITS_SINCE_FORK_POINT")
+
+if [ "$RESULT" == "" ]; then
+  echo "Doing nothing..."
+else
+  git commit -m "fixup! $RESULT" "$@"
+fi
--- a/home/programs/git/scripts/git-post-pr.py
+++ b/home/programs/git/scripts/git-post-pr.py
@@ -0,0 +1,130 @@
+import argparse
+import json
+import subprocess
+import tkinter
+
+# TODO: add support for gitea, and maybe other git hosting options.
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        prog="post-pr",
+        description="Post links to PRs",
+    )
+
+    parser.add_argument("-n", "--no-clipboard", action="store_true", help="do not copy the message to the clipboard")
+
+    pr_id = parser.add_mutually_exclusive_group()
+    pr_id.add_argument("-c", "--current-branch", action="store_true", help="generate post for the PR for the current branch")
+    pr_id.add_argument("-l", "--latest", action="store_true", help="generate post for the latest PR for the current user")
+    pr_id.add_argument("pr_id", nargs="?", default=None, help="generate post for the PR with the given ID")
+    args = parser.parse_args()
+
+    if not any([args.current_branch, args.latest, args.pr_id,]):
+        args.current_branch = True
+
+    return args
+
+
+def _gh(args: list[str]) -> str:
+    try:
+        return subprocess.check_output(["gh"] + args).decode("utf8")
+    except subprocess.CalledProcessError as e:
+        raise RuntimeError(f"GitHub CLI command failed: 'gh {' '.join(args)}'") from e
+
+
+def _gh_retcode(args: list[str]) -> int:
+    return subprocess.run(["gh"] + args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode
+
+
+def ensure_gh_installed():
+    try:
+        if _gh_retcode(["--version"]) != 0:
+            raise RuntimeError("GitHub CLI (gh) is not installed, please install it")
+    except FileNotFoundError:
+        raise RuntimeError("GitHub CLI (gh) is not installed, please install it")
+
+
+def ensure_gh_authenticated():
+    if _gh_retcode(["auth", "status"]) != 0:
+        raise RuntimeError("Failed to authenticate with GitHub, please run 'gh auth login'")
+
+
+GH_PR_JSON_FIELDS = ",".join([
+    "additions",
+    "deletions",
+    "state",
+    "title",
+    "url",
+])
+
+
+def fetch_pr_data(current_branch: bool, latest: bool, pr_id: str | None) -> dict[str, any]:
+    if pr_id:
+        pr_data = _gh(["pr", "view", pr_id, "--json", GH_PR_JSON_FIELDS])
+        pr_data = json.loads(pr_data)
+
+    elif latest:
+        pr_list = _gh(["pr", "list", "--author", "@me", "--limit", "1", "--json", GH_PR_JSON_FIELDS])
+        pr_list = json.loads(pr_list)
+
+        if len(pr_list) == 0:
+            raise RuntimeError("Failed to find PR, are you sure you have any open PRs?")
+
+        pr_data = pr_list[0]
+
+    elif current_branch:
+        pr_data = _gh(["pr", "view", "--json", GH_PR_JSON_FIELDS])
+        pr_data = json.loads(pr_data)
+
+    return pr_data
+
+
+def format_message(pr_data: dict[str, any]) -> str:
+    additions = pr_data["additions"]
+    deletions = pr_data["deletions"]
+
+    title = pr_data["title"]
+    pr_url = pr_data["url"]
+    pr_state = pr_data["state"]
+
+    state_html = f"({pr_state.lower()}) " if pr_state != "OPEN" else ""
+    additions_html = f"+{additions}" if additions > 0 else str(additions)
+    deletions_html = f"-{deletions}" if deletions > 0 else str(deletions)
+
+    return f"""{state_html}{pr_url} {title} [diff: {additions_html}/{deletions_html}]"""
+
+
+def copy_to_clipboard(message: str):
+    r = tkinter.Tk()
+    r.withdraw()
+    r.clipboard_clear()
+    r.clipboard_append(message)
+    r.update()
+    r.destroy()
+
+
+def main():
+    args = parse_args()
+
+    ensure_gh_installed()
+    ensure_gh_authenticated()
+
+    pr_data = fetch_pr_data(args.current_branch, args.latest, args.pr_id)
+    message = format_message(pr_data)
+
+    print("Message:\n")
+    print(f"    {message}\n")
+
+    if not args.no_clipboard:
+        copy_to_clipboard(message)
+        print("Copied to clipboard")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as e:
+        print(f"Error: {e}")
+        exit(1)
+
--- a/home/programs/git/scripts/git-rebase-fixups.sh
+++ b/home/programs/git/scripts/git-rebase-fixups.sh
@@ -0,0 +1,10 @@
+if [ -n "${1:-}" ]; then
+  TARGET_BRANCH="$1"
+  shift
+else
+  TARGET_BRANCH=$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')
+fi
+
+FORK_POINT=$(git merge-base --fork-point "$TARGET_BRANCH")
+
+git rebase "$FORK_POINT" --autosquash "$@"
--- a/home/programs/home-manager.nix
+++ b/home/programs/home-manager.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.home-manager.enable = true;
+}
--- a/home/programs/hyprland.nix
+++ b/home/programs/hyprland.nix
@@ -0,0 +1,323 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.wayland.windowManager.hyprland;
+in
+{
+  home.sessionVariables = {
+    WLR_NO_HARDWARE_CURSORS = "1";
+    WLR_RENDERER_ALLOW_SOFTWARE = "1";
+    XDG_CURRENT_DESKTOP = "Hyprland";
+    XDG_SESSION_DESKTOP = "Hyprland";
+    XDG_SESSION_TYPE = "wayland";
+    GDK_BACKEND = "wayland,x11,*";
+    QT_QPA_PLATFORM = "wayland;xcb";
+    NIXOS_OZONE_WL = "1";
+    MOZ_ENABLE_WAYLAND = "1";
+    SDL_VIDEODRIVER = "wayland";
+    OZONE_PLATFORM = "wayland";
+    CLUTTER_BACKEND = "wayland";
+    QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
+    # QT_QPA_PLATFORMTHEME = "qt6ct";
+    QT_AUTO_SCREEN_SCALE_FACTOR = "1";
+
+    LIBVA_DRIVER_NAME = "nvidia";
+    GBM_BACKEND = "nvidia-drm";
+    __GLX_VENDOR_LIBRARY_NAME = "nvidia";
+  };
+
+  home.packages = with pkgs; [
+    wl-clipboard-rs
+  ];
+
+  programs.hyprlock = {
+    enable = true;
+    settings = {
+      general = {
+        disable_loading_bar = true;
+        grace = 300;
+        hide_cursor = true;
+        no_fade_in = false;
+      };
+
+      background = [
+        {
+          path = "screenshot";
+          blur_passes = 3;
+          blur_size = 8;
+        }
+      ];
+
+      input-field = [
+        {
+          size = "200, 50";
+          position = "0, -80";
+          monitor = "";
+          dots_center = true;
+          fade_on_empty = false;
+          font_color = "rgb(202, 211, 245)";
+          inner_color = "rgb(91, 96, 120)";
+          outer_color = "rgb(24, 25, 38)";
+          outline_thickness = 5;
+          placeholder_text = ''Password...'';
+          shadow_passes = 2;
+        }
+      ];
+    };
+  };
+
+  services.hypridle = {
+    enable = true;
+    settings = {
+      general = {
+        ignore_dbus_inhibit = false;
+        lock_cmd = "pidof hyprlock || ${config.programs.hyprlock.package}/bin/hyprlock";
+        before_sleep_cmd = "${pkgs.systemd}/bin/loginctl lock-session";
+        after_sleep_cmd = "${cfg.finalPackage}/bin/hyprctl dispatch dpms on";
+      };
+
+      listener = [
+        {
+          timeout = 900;
+          on-timeout = "${config.programs.hyprlock.package}/bin/hyprlock";
+        }
+        {
+          timeout = 1200;
+          on-timeout = "${cfg.finalPackage}/bin/hyprctl dispatch dpms off";
+          on-resume = "${cfg.finalPackage}/bin/hyprctl dispatch dpms on";
+        }
+      ];
+    };
+  };
+
+  wayland.windowManager.hyprland = {
+    enable = true;
+
+    settings = let
+      scratchpads = [
+        (rec {
+          title = "Floating terminal";
+          class = "floatingTerminal";
+          command = "${pkgs.alacritty}/bin/alacritty --class ${class} -e ${pkgs.tmux}/bin/tmux new-session -A -s f";
+          size = { h = 90; w = 95; };
+          keys = [
+            "$mod, RETURN"
+            "$mod, SPACE"
+          ];
+        })
+        (rec {
+          title = "Ncmpcpp";
+          class = "floatingNcmpcpp";
+          command = "${pkgs.alacritty}/bin/alacritty --class ${class} -e ${pkgs.ncmpcpp}/bin/ncmpcpp";
+          size = { h = 95; w = 95; };
+          keys = [ "$mod, Q" ];
+        })
+        # "$mod, W, emacs"
+        # "$mod, E, filebrowser"
+        # "$mod, X, taskwarriortui"
+      ];
+    in {
+      "$mod" = "SUPER";
+
+      # https://github.com/xkbcommon/libxkbcommon/blob/master/include/xkbcommon/xkbcommon-keysyms.h
+      bind = [
+        "$mod SHIFT, Q, exit"
+        "$mod, R, exec, ${pkgs.rofi}/bin/rofi -show drun"
+        "$mod, T, togglefloating"
+
+        # TODO: fix this for upcoming releases
+        "$mod, F, fullscreen, 2"
+        "$mod, C, exec, ${cfg.finalPackage}/bin/hyprctl reload"
+
+        "$mod, BACKSPACE, killactive"
+
+        "$mod SHIFT, RETURN, exec, ${pkgs.alacritty}/bin/alacritty --class termTerminal -e ${pkgs.tmux}/bin/tmux new-session -A -s term"
+        "$mod SHIFT, SPACE, exec, ${pkgs.alacritty}/bin/alacritty --class termTerminal -e ${pkgs.tmux}/bin/tmux new-session -A -s term"
+
+        "$mod, j, layoutmsg,cyclenext"
+        "$mod, k, layoutmsg,cycleprev"
+        "$mod SHIFT, j, layoutmsg, swapnext"
+        "$mod SHIFT, k, layoutmsg, swapprev"
+
+        "$mod, 1, focusworkspaceoncurrentmonitor, 1"
+        "$mod, 2, focusworkspaceoncurrentmonitor, 2"
+        "$mod, 3, focusworkspaceoncurrentmonitor, 3"
+        "$mod, 4, focusworkspaceoncurrentmonitor, 4"
+        "$mod, 5, focusworkspaceoncurrentmonitor, 5"
+        "$mod, 6, focusworkspaceoncurrentmonitor, 6"
+        "$mod, 7, focusworkspaceoncurrentmonitor, 7"
+        "$mod, 8, focusworkspaceoncurrentmonitor, 8"
+        "$mod, 9, focusworkspaceoncurrentmonitor, 9"
+
+        "$mod SHIFT, 1, movetoworkspacesilent, 1"
+        "$mod SHIFT, 2, movetoworkspacesilent, 2"
+        "$mod SHIFT, 3, movetoworkspacesilent, 3"
+        "$mod SHIFT, 4, movetoworkspacesilent, 4"
+        "$mod SHIFT, 5, movetoworkspacesilent, 5"
+        "$mod SHIFT, 6, movetoworkspacesilent, 6"
+        "$mod SHIFT, 7, movetoworkspacesilent, 7"
+        "$mod SHIFT, 8, movetoworkspacesilent, 8"
+        "$mod SHIFT, 9, movetoworkspacesilent, 9"
+
+        "$mod, b, exec, ${pkgs.fcitx5}/bin/fcitx5-remote -s mozc"
+        "$mod, n, exec, ${pkgs.fcitx5}/bin/fcitx5-remote -s keyboard-no"
+        "$mod, m, exec, ${pkgs.fcitx5}/bin/fcitx5-remote -s keyboard-us"
+
+        # TODO: ensure exists in environment
+        "$mod, l, exec, ${pkgs.systemd}/bin/loginctl lock-session"
+
+        # TODO: fix
+        # "super + minus" = "${pkgs.xcalib}/bin/xcalib -invert -alter"
+
+        # TODO: fix
+        ", Print, exec, ${lib.getExe pkgs.grimblast} copy area"
+
+        # "SHIFT, Print, exec, ${lib.getExe pkgs.grimblast} copy area"
+        # "shift + @Print" = "${pkgs.maim}/bin/maim --hidecursor --nokeyboard $SCREENSHOT_DIR/$(date +%s).png"
+
+        # TODO: Add boomer as package
+        # "super + @Print" = "boomer"
+      ]
+      ++
+      (lib.pipe scratchpads [
+        (map ({ keys, command, class, ... }:
+          (map (key: let
+            # TODO: rewrite this to take arguments instead of creating n copies
+            invokeIfNotRunningAndToggleWorkspace = pkgs.writeShellApplication {
+              name = "hyprland-toggle-scratchpad-${class}";
+              runtimeInputs = [ cfg.finalPackage pkgs.jq ];
+              text = ''
+                SCRATCHPAD_PROGRAM_EXISTS=$(hyprctl clients -j | jq -r '[.[].class]|any(. == "${class}")')
+                CURRENT_WORKSPACE_ID=$(hyprctl activeworkspace -j | jq -r '.id')
+
+                if [ "$SCRATCHPAD_PROGRAM_EXISTS" != "true" ]; then
+                  ${command} &
+                  hyprctl dispatch movetoworkspacesilent "''${CURRENT_WORKSPACE_ID},class:${class}"
+                  hyprctl dispatch focuswindow "class:${class}"
+                else
+                  SCRATCHPAD_PROGRAM_WORKSPACE_ID=$(hyprctl clients -j | jq '.[] | select( .class == "${class}") | .workspace.id')
+                  if [ "$SCRATCHPAD_PROGRAM_WORKSPACE_ID" != "$CURRENT_WORKSPACE_ID" ]; then
+                    hyprctl dispatch movetoworkspacesilent "''${CURRENT_WORKSPACE_ID},class:${class}"
+                    hyprctl dispatch focuswindow "class:${class}"
+                  else
+                    hyprctl dispatch movetoworkspacesilent "special:${class}Ws,class:${class}"
+                  fi
+                fi
+              '';
+            };
+          in "${key}, exec, ${lib.getExe invokeIfNotRunningAndToggleWorkspace}"
+          ) keys)
+        ))
+        lib.flatten
+      ]);
+
+      bindl = [
+        "$mod, p, exec, ${pkgs.mpc_cli}/bin/mpc toggle"
+        ",XF86AudioPlay, exec, ${pkgs.mpc_cli}/bin/mpc toggle"
+        ",XF86AudioPrev, exec, ${pkgs.mpc_cli}/bin/mpc prev"
+        ",XF86AudioNext, exec, ${pkgs.mpc_cli}/bin/mpc next"
+      ];
+
+      bindle = [
+        ",XF86MonBrightnessUp, exec, ${lib.getExe pkgs.brightnessctl} s +5%"
+        ",XF86MonBrightnessDown, exec, ${lib.getExe pkgs.brightnessctl} s 5%-"
+        ",XF86AudioLowerVolume, exec, ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%-"
+        ",XF86AudioRaiseVolume, exec, ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%+"
+        "$mod ,F7, exec, ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%-"
+        "$mod ,F8, exec, ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%+"
+      ];
+
+      windowrulev2 = [
+        "float,class:(Rofi)"
+
+        "workspace 2,class:(firefox)"
+        "workspace 2,class:(google-chrome)"
+
+        "workspace 3,class:(Emacs)"
+        "workspace 3,class:(Code)"
+        "workspace 3,class:(code-url-handler)"
+
+        "workspace 5,class:(discord)"
+        "workspace 5,class:(Element)"
+      ]
+      ++
+      (lib.pipe scratchpads [
+        (map ({ class, size, ... }: [
+          "workspace special:${class}Ws, class:^${class}$"
+          "float, class:^${class}$"
+          "size ${toString size.w}% ${toString size.h}%, class:^${class}$"
+          "move ${toString ((100 - size.w) / 2)}% ${toString ((100 - size.h) / 2)}%, class:^${class}$"
+        ]))
+        lib.flatten
+      ]);
+
+      monitor = [
+        # TODO: host specific
+        "eDP-1, 3840x2400@90.00Hz, 0x0, 2"
+        ",preferred,auto,1"
+      ];
+
+      general = {
+        gaps_in = 5;
+        gaps_out = 15;
+
+        border_size = 2;
+
+        "col.active_border" = "rgba(33ccffee) rgba(00ff99ee) 45deg";
+        "col.inactive_border" = "rgba(595959aa)";
+
+        resize_on_border = false;
+        allow_tearing = false;
+        layout = "master";
+      };
+
+      decoration = {
+        rounding = 10;
+
+        # Change transparency of focused and unfocused windows
+        active_opacity = 1.0;
+        inactive_opacity = 1.0;
+
+        # drop_shadow = true;
+        # shadow_range = 4;
+        # shadow_render_power = 3;
+        # "col.shadow" = "rgba(1a1a1aee)";
+
+        # https://wiki.hyprland.org/Configuring/Variables/#blur
+        blur = {
+          enabled = true;
+          size = 3;
+          passes = 1;
+
+          vibrancy = 0.1696;
+        };
+      };
+
+      animations.enabled = false;
+
+      master = {
+          new_status = "slave";
+      };
+
+      misc = {
+        force_default_wallpaper = 0; # Set to 0 or 1 to disable the anime mascot wallpapers
+        disable_hyprland_logo = false; # If true disables the random hyprland logo / anime girl background. :(
+      };
+
+      input ={
+        kb_layout = "us";
+        kb_variant = "";
+        kb_model = "";
+        kb_options = "caps:escape";
+        kb_rules = "";
+
+        follow_mouse = 1;
+
+        sensitivity = 0; # -1.0 - 1.0, 0 means no modification.
+
+        touchpad = {
+          natural_scroll = false;
+        };
+      };
+    };
+  };
+}
--- a/home/programs/man.nix
+++ b/home/programs/man.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.man = {
+    enable = true;
+    generateCaches = true;
+  };
+}
--- a/home/programs/mpv.nix
+++ b/home/programs/mpv.nix
@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  programs.mpv.enable = !machineVars.headless;
+}
--- a/home/programs/ncmpcpp.nix
+++ b/home/programs/ncmpcpp.nix
@@ -1,4 +1,4 @@
-{pkgs, ...}:
+{ config, pkgs, ... }:
 {
  programs.ncmpcpp = {
    enable = true;
@@ -332,11 +332,11 @@
      window_border_color = "green";
      active_window_border = "red";

-      visualizer_data_source = "/tmp/mpd.fifo";
+      visualizer_data_source = "/run/user/${toString config.home.uid}/mpd/visualizer.fifo";
      visualizer_output_name = "Visualizer feed";
      visualizer_in_stereo = "no";
-      visualizer_type = "spectrum"; # spectrum, ellipse, wave_filled, wave
-      visualizer_look = "+█"; # wave | spectrum, ellipse, wave_filled
+      # visualizer_type = "spectrum"; # spectrum, ellipse, wave_filled, wave
+      # visualizer_look = "+█"; # wave | spectrum, ellipse, wave_filled
    };
  };
 }
--- a/home/programs/neovim/default.nix
+++ b/home/programs/neovim/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, home, ... }:
+{ pkgs, lib, machineVars, ... }:
 {
  imports = [
    ./auto-clean-swapfiles.nix
@@ -21,6 +21,9 @@
      vim-surround
      vim-fugitive
      vim-css-color
+    ] ++ (lib.optionals machineVars.wayland [
+      vim-wayland-clipboard
+    ]) ++ [
      semshi
      {
        plugin = goyo-vim;
@@ -66,25 +69,58 @@
      }
      limelight-vim
      vim-tmux-navigator
-      vim-polyglot
      lightline-vim
+      vim-better-whitespace
      {
-        plugin = rainbow;
+        plugin = nvim-treesitter.withAllGrammars;
        config = ''
-          let g:rainbow_active = 1
+        packadd! nvim-treesitter
+        lua << EOF
+          require'nvim-treesitter.configs'.setup {
+            highlight = {
+              enable = true,
+            },
+          }
+        EOF
+        '';
+      }
+      {
+        plugin = rainbow-delimiters-nvim;
+        config = ''
+        lua << EOF
+          local rainbow_delimiters = require 'rainbow-delimiters'
+          vim.g.rainbow_delimiters = {
+            ["highlight"] = {
+              'RainbowDelimiterRed',
+              'RainbowDelimiterYellow',
+              'RainbowDelimiterBlue',
+              'RainbowDelimiterGreen',
+              'RainbowDelimiterViolet',
+              'RainbowDelimiterCyan',
+            },
+          }
+        EOF
        '';
      }
      {
        plugin = vim-monokai;
        config = ''
          colorscheme monokai
-          autocmd ColorScheme * highlight Normal ctermbg=0
-          autocmd ColorScheme * highlight LineNr ctermbg=0
-          autocmd ColorScheme * highlight CursorLineNR ctermbg=0 ctermfg=208
-          autocmd ColorScheme * highlight SignColumn ctermbg=0
-          autocmd ColorScheme * highlight GitGutterAdd ctermbg=0
-          autocmd ColorScheme * highlight GitGutterChange ctermbg=0
-          autocmd ColorScheme * highlight GitGutterDelete ctermbg=0
+
+          autocmd ColorScheme monokai highlight Normal ctermbg=0
+          autocmd ColorScheme monokai highlight LineNr ctermbg=0
+          autocmd ColorScheme monokai highlight CursorLineNR ctermbg=0 ctermfg=208
+          autocmd ColorScheme monokai highlight SignColumn ctermbg=0
+          autocmd ColorScheme monokai highlight GitGutterAdd ctermbg=0
+          autocmd ColorScheme monokai highlight GitGutterChange ctermbg=0
+          autocmd ColorScheme monokai highlight GitGutterDelete ctermbg=0
+
+          autocmd ColorScheme monokai highlight RainbowDelimiterRed    { fg = g:terminal_color_9 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterYellow { fg = g:terminal_color_11 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterBlue   { fg = g:terminal_color_12 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterGreen  { fg = g:terminal_color_10 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterViolet { fg = g:terminal_color_13 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterCyan   { fg = g:terminal_color_14 }
        '';
      }
    ];
--- a/home/programs/newsboat/sources.nix
+++ b/home/programs/newsboat/sources.nix
@@ -37,6 +37,7 @@ in {
    (mkSource [ "japanese" "language" ] "https://www.outlier-linguistics.com/blogs/japanese.atom")
    (mkSource [ "language" ] "https://feeds.feedburner.com/blogspot/Ckyi")
    (mkSource [ "japanese" "language" "old" ] "http://feeds.feedburner.com/LocalizingJapan")
+    (mkSource [ "japanese" "language" ] "https://wesleycrobertson.wordpress.com/feed/")
    (mkSource [ "tech" "vim" "old" ] "https://castel.dev/rss.xml")
    (mkSource [ "tech" "functional-programming" "old" ] "https://skilpat.tumblr.com/rss")
    (mkSource [ "tech" ] "https://resocoder.com/feed/")
--- a/home/programs/obs-studio.nix
+++ b/home/programs/obs-studio.nix
@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  programs.obs-studio.enable = !machineVars.headless;
+}
--- a/home/programs/pandoc.nix
+++ b/home/programs/pandoc.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.pandoc.enable = true;
+}
--- a/home/programs/ripgrep.nix
+++ b/home/programs/ripgrep.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.ripgrep.enable = true;
+}
--- a/home/programs/ssh/default.nix
+++ b/home/programs/ssh/default.nix
@@ -10,5 +10,11 @@
    mode = "0444";
  };

-  programs.ssh.includes = [ config.sops.secrets."ssh/secret-config".path ];
+  programs.ssh = {
+    enable = true;
+    includes = [
+      config.sops.secrets."ssh/secret-config".path
+      "mutable_config"
+    ];
+  };
 }
--- a/home/programs/ssh/pvv.nix
+++ b/home/programs/ssh/pvv.nix
@@ -1,12 +1,13 @@
 { pkgs, lib, ... }:
-let
-  adminUser = "root";
-  normalUser = "oysteikt";
-
-  # http://www.pvv.ntnu.no/pvv/Maskiner
+let # http://www.pvv.ntnu.no/pvv/Maskiner
  normalMachines = [
    {
-      names = [ "hildring" "pvv-login" "pvv" ];
+      names = [ "hildring" "pvv-login" ];
+      proxyJump = lib.mkDefault null;
+      addressFamily = "inet";
+    }
+    {
+      names = [ "drolsum" "pvv-login2" "pvv" ];
      proxyJump = lib.mkDefault null;
      addressFamily = "inet";
    }
@@ -17,7 +18,6 @@ let
    "buskerud"
    "dagali"
    "demiurgen"
-    "drolsum"
    "eirin"
    "georg"
    "ildkule"
@@ -38,59 +38,38 @@ let
    "ludvigsen"
    [ "principal" "pvv-backup" ]
    [ "skrott" "dibbler" ]
-    [ "sleipner" "pvv-salt" ]
+    {
+      names = [ "sleipner" "pvv-salt" ];
+      user = "oysteikt/admin";
+    }
  ];

-  # Either( String [String] AttrSet{String} ) -> AttrSet{String}
-  coerceToSSHMatchBlock =
-    machine:
-    if builtins.isString machine then { names = [machine]; }
-    else if builtins.isList machine then { names = machine; }
-    else machine;
+  overrideIfNotExists = b: a: a // (builtins.removeAttrs b (builtins.attrNames a));

-  # ListOf(String) -> AttrSet
-  machineWithNames = let
-    inherit (lib.lists) head;
-    inherit (lib.strings) split;
-  in
-    names: { hostname = "${head names}.pvv.ntnu.no"; };
+  coerce = user: machines: lib.pipe machines [
+    (m: if builtins.isString m then { names = [m]; } else m)
+    (m: if builtins.isList m then { names = m; } else m)
+    (overrideIfNotExists { inherit user; })
+  ];

-  # AttrSet -> AttrSet -> AttrSet
-  convertMachineWithDefaults = defaults: normalizedMachine: let
-    inherit (lib.attrsets) nameValuePair;
-    inherit (lib.strings) concatStringsSep;
-    inherit (normalizedMachine) names;
+  normalUser = "oysteikt";

-    name = concatStringsSep " " names;
-    value =
-      (machineWithNames names)
-      // defaults
-      // removeAttrs normalizedMachine ["names"];
-  in
-    nameValuePair name value;
+  matchConfig = let
+    machines = (map (coerce normalUser) normalMachines) ++ (map (coerce "root") rootMachines);
+    setVars = orig@{ names, ... }: {
+      name = builtins.concatStringsSep " " names;
+      value = overrideIfNotExists {
+        hostname = "${builtins.head names}.pvv.ntnu.no";
+        proxyJump = "pvv";
+        addressFamily = "inet";
+      } (builtins.removeAttrs orig ["names"]);
+    };
+  in builtins.listToAttrs (map setVars machines);

-  # AttrSet -> AttrSet
-  convertNormalMachine = convertMachineWithDefaults { user = normalUser; proxyJump = "pvv"; };
-  # AttrSet -> AttrSet
-  convertAdminMachine =
-    convertMachineWithDefaults { user = adminUser; proxyJump = "pvv"; };
-
-  # ListOf (Either(String ListOf(String) AttrsOf(String))) -> (AttrSet -> AttrSet) -> AttrSet
-  convertMachinesWith = convertMachineFunction: let
-    inherit (lib.attrsets) listToAttrs;
-    inherit (lib.trivial) pipe;
-    pipeline = [
-      (map coerceToSSHMatchBlock)
-      (map convertMachineFunction)
-      listToAttrs
-    ];
-  in
-    machines: pipe machines pipeline;
 in
  {
    programs.ssh.matchBlocks = lib.mergeAttrsList [
-      (convertMachinesWith convertNormalMachine normalMachines)
-      (convertMachinesWith convertAdminMachine rootMachines)
+      matchConfig
      {
        "pvv-git git.pvv.ntnu.no" = {
          hostname = "git.pvv.ntnu.no";
--- a/home/programs/texlive.nix
+++ b/home/programs/texlive.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.texlive = {
+    enable = true;
+    # packageSet = pkgs.texlive.combined.scheme-medium;
+  };
+}
--- a/home/programs/tmux/default.nix
+++ b/home/programs/tmux/default.nix
@@ -1,4 +1,4 @@
-{pkgs, ...}:
+{ pkgs, lib, ... }:
 {
  programs.tmux = {
    enable = true;
@@ -19,7 +19,25 @@
      tmux-fzf
      urlview
    ];
-    extraConfig = ''
+    extraConfig = let
+      fileContentsWithoutShebang = script: lib.pipe script [
+        lib.fileContents
+        (lib.splitString "\n")
+        (lib.drop 3) # remove shebang
+        (lib.concatStringsSep "\n")
+      ];
+
+      fcitx5-status = (pkgs.writeShellApplication {
+        name = "tmux-fcitx5-status";
+        runtimeInputs = with pkgs; [ dbus ];
+        text = fileContentsWithoutShebang ./scripts/fcitx5-status.sh;
+      });
+      mpd-status = (pkgs.writeShellApplication {
+        name = "tmux-mpd-status";
+        runtimeInputs = with pkgs; [ mpc-cli gawk gnugrep ];
+        text = fileContentsWithoutShebang ./scripts/mpd-status.sh;
+      });
+    in ''
      # Don't rename windows automatically after rename with ','
      set-option -g allow-rename off

@@ -91,8 +109,8 @@
      ### DESIGN CHANGES ###
      ######################

-      set-option -g status-left '#{prefix_highlight} #[bg=blue]#[fg=black,bold] ###S #[bg=default]  #[fg=green]#(~/.scripts/tmux/fcitx)  #[fg=red]%H:%M   '
-      set-option -g status-right '#[fg=red]#(~/.scripts/tmux/mpd)'
+      set-option -g status-left '#{prefix_highlight} #[bg=blue]#[fg=black,bold] ###S #[bg=default]  #[fg=green]#(${lib.getExe fcitx5-status})  #[fg=red]%H:%M   '
+      set-option -g status-right '#[fg=red]#(${lib.getExe mpd-status})'
      set-window-option -g window-status-current-style fg=magenta
      set-option -g status-style 'bg=black fg=default'
      set-option -g default-shell '${pkgs.zsh}/bin/zsh'
--- a/home/programs/tmux/scripts/fcitx5-status.sh
+++ b/home/programs/tmux/scripts/fcitx5-status.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p dbus
+
+printState() {
+  STATUS=$(dbus-send --session --print-reply=literal --dest='org.fcitx.Fcitx5' '/controller' 'org.fcitx.Fcitx.Controller1.CurrentInputMethod' | tr -d '[:space:]')
+
+  case $STATUS in
+    keyboard-us)
+      echo 'US'
+    ;;
+    keyboard-no)
+      echo 'NO'
+    ;;
+    mozc)
+      echo '日本語'
+    ;;
+    *)
+      echo "$STATUS?"
+    ;;
+  esac
+}
+
+while :; do
+  printState
+  sleep 1
+done
--- a/home/programs/tmux/scripts/mpd-status.sh
+++ b/home/programs/tmux/scripts/mpd-status.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i sh -p mpc-cli gawk gnugrep
+
+while true; do
+  MPC_OUTPUT=$(mpc --format '[[%artist% - ]%title%]|[%file%]')
+
+  TITLE=$(head -n 1 <<<"$MPC_OUTPUT")
+
+  if [ ${#TITLE} -gt 60 ]; then
+    TITLE=$(awk '{print substr($0,0,57) "..."}' <<<"$TITLE")
+  fi
+
+  LINE2=$(head -n 2 <<<"$MPC_OUTPUT" | tail -n 1)
+
+  PLAY_STATUS_RAW=$(awk '{print $1}' <<<"$LINE2")
+
+  if [ "$PLAY_STATUS_RAW" == "[playing]" ]; then
+    PLAY_STATUS="▶"
+  elif [ "$PLAY_STATUS_RAW" == "[paused]" ]; then
+    PLAY_STATUS="⏸"
+  else
+    PLAY_STATUS="??"
+  fi
+
+  TIME=$(awk '{print $3}' <<<"$LINE2")
+
+  echo -e "$PLAY_STATUS $TITLE | [$TIME]"
+  sleep 1
+done
--- a/home/programs/vscode/default.nix
+++ b/home/programs/vscode/default.nix
@@ -27,7 +27,15 @@ in
  programs.vscode = {
    enable = true;

-    package = pkgs.vscode;
+    package = pkgs.vscode.overrideAttrs (prev: {
+      # NOTE: this messes up zsh's tab completion in the terminal whenever code is started
+      #       from within a shell
+      preFixup = prev.preFixup + ''
+        gappsWrapperArgs+=(
+          --unset TMUX_PANE
+        )
+      '';
+    });

    userSettings = let
      editor = mapPrefixToSet "editor" {
--- a/home/programs/waybar.nix
+++ b/home/programs/waybar.nix
@@ -0,0 +1,245 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.programs.waybar;
+  cfgs = cfg.settings.mainBar;
+in
+{
+  programs.waybar = {
+    enable = true;
+    systemd.enable = true;
+
+    settings = {
+      mainBar = {
+        layer = "top";
+        position = "top";
+        height = 30;
+
+        # TODO: configure this per machine
+        # output = [ "DP-2" ];
+
+        modules-left = [ "hyprland/workspaces"  ];
+        modules-center = [ "clock" ];
+        modules-right = [ "mpd" "cpu" "memory" "wireplumber" "pulseaudio/slider" "battery" "tray" ];
+
+        "hyprland/workspaces" = {
+          all-outputs = true;
+          disable-scroll = true;
+          persistent-workspaces = {
+            ${lib.head cfgs.output} = [ 1 2 3 4 5 6 7 8 ];
+          };
+        };
+
+        "mpd" = {
+          format = "{filename}";
+        };
+
+        "cpu" = {
+          format = "[#] {usage}%";
+        };
+
+        "memory" = {
+          format = "{used}/{total}Gb";
+        };
+
+        "wireplumber" = {
+          format = "{volume}% {icon}";
+          format-muted = "[M]";
+        };
+
+        "pulseaudio/slider" = {
+          orientation = "horizontal";
+        };
+
+        "tray" = {
+          icon-size = 20;
+          spacing = 8;
+        };
+      };
+    };
+
+    style = let
+      c = config.colors.defaultColorSet;
+    in ''
+      * {
+          font-family: FiraCode, FontAwesome, Roboto, Helvetica, Arial, sans-serif;
+          font-size: 13px;
+      }
+
+      window#waybar {
+          background-color: ${c.background};
+          color: ${c.foreground};
+      }
+
+      #pulseaudio-slider trough {
+          min-height: 10px;
+          min-width: 100px;
+      }
+
+      /**** DEFAULT ****/
+
+      window#waybar.hidden {
+          opacity: 0.2;
+      }
+
+      button {
+          /* Use box-shadow instead of border so the text isn't offset */
+          box-shadow: inset 0 -3px transparent;
+          /* Avoid rounded borders under each button name */
+          border: none;
+          border-radius: 0;
+      }
+
+      /* https://github.com/Alexays/Waybar/wiki/FAQ#the-workspace-buttons-have-a-strange-hover-effect */
+      button:hover {
+          background: inherit;
+          box-shadow: inset 0 -3px #ffffff;
+      }
+
+
+      #workspaces button.empty {
+          color: ${c.yellow};
+      }
+
+      #workspaces button {
+          padding: 0 5px;
+          color: ${c.magenta};
+          background-color: transparent;
+      }
+
+      #workspaces button.visible {
+          color: ${c.green};
+      }
+
+      #workspaces button.urgent {
+          background-color: ${c.red};
+      }
+
+      #workspaces button:hover {
+          background: rgba(0, 0, 0, 0.2);
+      }
+
+      #mode {
+          background-color: #64727D;
+          box-shadow: inset 0 -3px #ffffff;
+      }
+
+      #clock,
+      #battery,
+      #cpu,
+      #memory,
+      #disk,
+      #temperature,
+      #backlight,
+      #network,
+      #pulseaudio,
+      #wireplumber,
+      #custom-media,
+      #tray,
+      #mode,
+      #idle_inhibitor,
+      #scratchpad,
+      #power-profiles-daemon,
+      #mpd {
+          padding: 0 10px;
+          color: ${c.foreground};
+      }
+
+      #window,
+      #workspaces {
+          margin: 0 4px;
+      }
+
+      /* If workspaces is the leftmost module, omit left margin */
+      .modules-left > widget:first-child > #workspaces {
+          margin-left: 0;
+      }
+
+      /* If workspaces is the rightmost module, omit right margin */
+      .modules-right > widget:last-child > #workspaces {
+          margin-right: 0;
+      }
+
+      #clock {
+          background-color: #64727D;
+      }
+
+      #cpu {
+          background-color: ${c.cyan};
+          color: #000000;
+      }
+
+      #memory {
+          background-color: ${c.yellow};
+          color: #000000;
+      }
+
+      #network {
+          background-color: #2980b9;
+      }
+
+      #network.disconnected {
+          background-color: #f53c3c;
+      }
+
+      #pulseaudio {
+          background-color: #f1c40f;
+          color: #000000;
+      }
+
+      #pulseaudio.muted {
+          background-color: #90b1b1;
+          color: #2a5c45;
+      }
+
+      #wireplumber {
+          background-color: #fff0f5;
+          color: #000000;
+      }
+
+      #wireplumber.muted {
+          background-color: #f53c3c;
+      }
+
+      #tray {
+          background-color: #2980b9;
+      }
+
+      #tray > .passive {
+          -gtk-icon-effect: dim;
+      }
+
+      #tray > .needs-attention {
+          -gtk-icon-effect: highlight;
+          background-color: #eb4d4b;
+      }
+
+      #mpd {
+          background-color: #66cc99;
+          color: #2a5c45;
+      }
+
+      #mpd.disconnected {
+          background-color: #f53c3c;
+      }
+
+      #mpd.stopped {
+          background-color: #90b1b1;
+      }
+
+      #mpd.paused {
+          background-color: #51a37a;
+      }
+    '';
+    # background-color: rgba(0,0,0,0);
+    # border-bottom: 3px solid rgba(100, 114, 125, 0.5);
+
+    #style = ''
+    #'';
+  };
+
+  systemd.user.services.waybar = {
+    Service.Environment = [
+      "DISPLAY=:0"
+    ];
+  };
+}
--- a/home/programs/xmonad/xmonad.hs
+++ b/home/programs/xmonad/xmonad.hs
@@ -168,7 +168,7 @@ myKeys conf@(XConfig {XMonad.modMask = modm}) = M.fromList $
    , ((modm .|. shiftMask , xK_space ),    spawn $ myTerminal ++ " -e tmux")

    -- , ((modm               , xK_v ),        spawn "rofi -modi lpass:$HOME/.scripts/rofi/lpass//rofi-lpass -show lpass")
-    , ((modm .|. shiftMask, xK_d     ), viewDropboxStatus)
+    -- , ((modm .|. shiftMask, xK_d     ), viewDropboxStatus)
    ]

 termIsOpen :: X Bool
--- a/home/programs/yt-dlp.nix
+++ b/home/programs/yt-dlp.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.yt-dlp.enable = true;
+}
--- a/home/programs/zoxide.nix
+++ b/home/programs/zoxide.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.zoxide.enable = true;
+}
--- a/home/services/dunst.nix
+++ b/home/services/dunst.nix
@@ -1,9 +1,9 @@
-{ pkgs, config, ... }:
+{ config, pkgs, lib, machineVars, ... }:
 {
  services.dunst = {
    enable = true;
    iconTheme = {
-      package = pkgs.gnome.adwaita-icon-theme;
+      package = pkgs.adwaita-icon-theme;
      name = "Adwaita";
      size = "32x32";
    };
@@ -13,9 +13,9 @@
        class = "Dunst";
        browser = "${pkgs.xdg-utils}/bin/xdg-open";

-        offset = let 
+        offset = lib.mkIf (!machineVars.wayland) (let
          status-bar-height = config.services.polybar.settings."bar/top".height;
-        in "15x${toString (status-bar-height + 10)}";
+        in "15x${toString (status-bar-height + 10)}");

        corner_radius = 0;
        font = "Droid Sans 9";
@@ -47,14 +47,14 @@
        background = config.colors.defaultColorSet.background;
        timeout = 4;
      };
-      
+
      urgency_normal = {
        frame_color = config.colors.defaultColorSet.green;
        foreground = config.colors.defaultColorSet.foreground;
        background = config.colors.defaultColorSet.background;
        timeout = 6;
      };
-      
+
      urgency_critical = {
        frame_color = config.colors.defaultColorSet.red;
        foreground = config.colors.defaultColorSet.red;
--- a/home/services/gnome-keyring.nix
+++ b/home/services/gnome-keyring.nix
@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  services.gnome-keyring.enable = !machineVars.headless;
+}
--- a/home/services/keybase.nix
+++ b/home/services/keybase.nix
@@ -0,0 +1,5 @@
+{ ... }:
+{
+  services.keybase.enable = true;
+  services.kbfs.enable = true;
+}
--- a/home/services/mpd.nix
+++ b/home/services/mpd.nix
@@ -1,28 +1,141 @@
-{ config, ... }:
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.mpd;
+in
 {
-  services.mpd = rec {
+  services.mpd = {
    enable = true;
    musicDirectory = config.xdg.userDirs.music;
-    playlistDirectory = "${musicDirectory}/playlists/MPD";
+    playlistDirectory = "${cfg.musicDirectory}/playlists/MPD";
    network.startWhenNeeded = true;

-    # TODO: make the path specific to the user unit
    extraConfig = ''
-      audio_output {
-        type "fifo"
-        name "Visualizer feed"
-        path "/tmp/mpd.fifo"
-        format "44100:16:2"
-      }
+      pid_file "/run/user/${toString config.home.uid}/mpd/pid"
+
+      zeroconf_enabled "no"
+
+      replaygain "auto"
+
+      restore_paused "yes"
+
+      auto_update "no"

      audio_output {
        type "pipewire"
        name "PipeWire Sound Server"
      }
+
+      audio_output {
+        type "fifo"
+        name "Visualizer feed"
+        path "/run/user/${toString config.home.uid}/mpd/visualizer.fifo"
+        format "44100:16:2"
+      }
+
+      resampler {
+        plugin "soxr"
+        quality "very high"
+      }
+
+      playlist_plugin {
+        name "cue"
+        enabled "true"
+      }
+
+      playlist_plugin {
+        name "m3u"
+        enabled "true"
+      }
+
+      playlist_plugin {
+        name "extm3u"
+        enabled "true"
+      }
+
+      playlist_plugin {
+        name "flac"
+        enabled "true"
+      }
+
+      playlist_plugin {
+        name "rss"
+        enabled "true"
+      }
    '';
  };

-  # TODO: disable auto_update and use systemd path to listen for changes
  # TODO: upstream unix socket support to home-manager
+
+  systemd.user.services.mpd = {
+    Unit = {
+      Documentation = [
+        "man:mpd(1)"
+        "man:mpd.conf(5)"
+      ];
+    };
+    Service = {
+      WatchdogSec = 120;
+
+      # for io_uring
+      LimitMEMLOCK = "64M";
+
+      # allow MPD to use real-time priority 40
+      LimitRTPRIO = 40;
+      LimitRTTIME = "infinity";
+
+      PrivateUsers = true;
+      ProtectSystem = true;
+      NoNewPrivileges = true;
+      ProtectKernelTunables = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+    };
+  };
+
+  systemd.user.paths.mpd-update-library = {
+    Unit = {
+      Description = "Watchdog that updates the mpd library whenever the files are modified";
+      Documentation = [
+        "man:mpd(1)"
+        "man:mpd.conf(5)"
+      ];
+      WantedBy = [ "paths.target" ];
+    };
+    Path = {
+      PathChanged = cfg.musicDirectory;
+      Unit = "mpd-update-library.service";
+      TriggerLimitIntervalSec = "1s";
+      TriggerLimitBurst = "1";
+    };
+  };
+
+  systemd.user.services.mpd-update-library = {
+    Unit = {
+      Description = "Watchdog that updates the mpd library whenever the files are modified";
+      Documentation = [
+        "man:mpd(1)"
+        "man:mpd.conf(5)"
+      ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = "${lib.getExe pkgs.mpc-cli} update --wait";
+
+      PrivateUsers = true;
+      ProtectSystem = true;
+      NoNewPrivileges = true;
+      ProtectKernelTunables = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+    };
+  };
 }

--- a/home/services/network-manager.nix
+++ b/home/services/network-manager.nix
@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  services.network-manager-applet.enable = !machineVars.headless;
+}
--- a/home/services/psd.nix
+++ b/home/services/psd.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.psd.enable = true;
+}
--- a/home/services/sxhkd.nix
+++ b/home/services/sxhkd.nix
@@ -22,11 +22,11 @@ in

      # Volume

-      "super + {@F7,@F8}" = "${pkgs.alsaUtils}/bin/amixer set Master 2%{-,+}";
+      "super + {@F7,@F8}" = "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%{-,+}";

-      "{XF86AudioLowerVolume,XF86AudioRaiseVolume}" = "${pkgs.alsaUtils}/bin/amixer set Master 2%{-,+}";
+      "{XF86AudioLowerVolume,XF86AudioRaiseVolume}" = "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%{-,+}";

-      "XF86AudioMute" = "${pkgs.pulseaudio}/bin/pactl set-sink-mute @DEFAULT_SINK@ toggle";
+      "XF86AudioMute" = "${pkgs.wireplumber}/bin/wpctl set-mute toggle";

      # Music

--- a/home/shell.nix
+++ b/home/shell.nix
@@ -14,6 +14,19 @@
      exe = if pkg.meta ? mainProgram then pkg.meta.mainProgram else name;
    in "${pkg}/bin/${exe}";
 in {
+  sops.secrets."nordicsemi/envvars" = {
+    sopsFile = ../secrets/home.yaml;
+  };
+
+
+  programs.bash.bashrcExtra = ''
+    source "${config.sops.secrets."nordicsemi/envvars".path}"
+  '';
+
+  programs.zsh.envExtra = ''
+    source "${config.sops.secrets."nordicsemi/envvars".path}"
+  '';
+
  local.shell.aliases = {

    # ░█▀▄░█▀▀░█▀█░█░░░█▀█░█▀▀░█▀▀░█▄█░█▀▀░█▀█░▀█▀░█▀▀
@@ -290,6 +303,11 @@ in {
      view-latex = "${pkgs.texlive.combined.scheme-full}/bin/latexmk -pdf -pvc main.tex";

      reload-tmux = "${p "tmux"} source $HOME/.config/tmux/tmux.conf";
+
+      nordic-vpn = lib.concatStringsSep " | " [
+        "${p "gpauth"} \"$NORDIC_VPN_ENDPOINT\" --gateway --browser default 2>/dev/null"
+        "sudo ${p "gpclient"} connect \"$NORDIC_VPN_ENDPOINT\" --as-gateway --cookie-on-stdin"
+      ];
    };

    # ░█▀▀░█▀▀░█▀█░█▀▀░█▀▄░█▀█░▀█▀░█▀▀░█▀▄
--- a/hosts/common/default.nix
+++ b/hosts/common/default.nix
@@ -11,10 +11,14 @@ in {
    ./programs/nix-ld.nix
    ./programs/ssh.nix
    ./programs/usbtop.nix
+    ./programs/wireshark.nix

-    ./services/cups.nix
    ./services/dbus.nix
-    ./services/logrotate.nix
+    ./services/fwupd.nix
+    ./services/irqbalance.nix
+    ./services/journald.nix
+    ./services/libinput.nix
+    ./services/logind.nix
    ./services/openssh.nix
    ./services/pcscd.nix
    ./services/pipewire.nix
@@ -22,16 +26,20 @@ in {
    ./services/resolved.nix
    ./services/smartd.nix
    ./services/systemd-lock-handler.nix
+    ./services/uptimed.nix
+    ./services/userborn.nix
    ./services/xserver.nix
  ];

+  # systemd.enableStrictShellChecks = true;
+
  sops.defaultSopsFile = ./../.. + "/secrets/${config.networking.hostName}.yaml";

  time.timeZone = "Europe/Oslo";

  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "us";
+    font = lib.mkDefault "Lat2-Terminus16";
+    keyMap = lib.mkDefault "us";
  };

  networking = {
@@ -105,6 +113,7 @@ in {
        "media"
        "minecraft"
        "networkmanager"
+        "rtkit"
        "scanner"
        "video"
        "wheel"
@@ -125,15 +134,6 @@ in {
      android-udev-rules
      light
    ];
-
-    libinput = {
-      enable = !config.machineVars.headless;
-      touchpad.disableWhileTyping = true;
-    };
-
-    irqbalance.enable = true;
-
-    displayManager.defaultSession = "none+xmonad";
  };

  programs = {
@@ -141,6 +141,11 @@ in {
    git.enable = true;
    tmux.enable = true;
    zsh.enable = true;
+    hyprland.enable = config.machineVars.wayland;
+  };
+
+  security.pam.services = lib.mkIf (config.machineVars.wayland) {
+    hyprlock = { };
  };

  system.extraDependencies =
@@ -182,12 +187,48 @@ in {
      sqlite-web
    ]);

+  # Realtime scheduling for pipewire and mpd
  security.rtkit.enable = !config.machineVars.headless;

+  security.tpm2.enable = lib.mkDefault true;
+  security.tpm2.abrmd.enable = lib.mkDefault config.security.tpm2.enable;
  security.sudo.extraConfig = let
    sudoLecture = pkgs.writeText "sudo-lecture.txt" (extendedLib.termColors.front.red "Be careful or something, idk...\n");
  in ''
    Defaults    lecture = always
    Defaults    lecture_file = ${sudoLecture}
  '';
+
+  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
+
+  # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/profiles/hardened.nix
+  boot.blacklistedKernelModules = [
+    # Obscure network protocols
+    "ax25"
+    "netrom"
+    "rose"
+
+    # Old or rare or insufficiently audited filesystems
+    "adfs"
+    "affs"
+    "bfs"
+    "befs"
+    "cramfs"
+    "efs"
+    # "erofs" // used by systemd
+    "exofs"
+    "freevxfs"
+    "f2fs"
+    "hfs"
+    "hpfs"
+    "jfs"
+    "minix"
+    "nilfs2"
+    "ntfs"
+    "omfs"
+    "qnx4"
+    "qnx6"
+    "sysv"
+    "ufs"
+  ];
 }
--- a/hosts/common/fonts.nix
+++ b/hosts/common/fonts.nix
@@ -35,10 +35,24 @@

    fontconfig = {
      defaultFonts = {
-        serif = [ "Droid Sans Serif" "Ubuntu" ];
-        sansSerif = [ "Droid Sans" "Ubuntu" ];
-        monospace = [ "Fira Code" "Ubuntu" ];
-        emoji = [ "Noto Sans Emoji" ];
+        serif = [
+          "Droid Sans Serif"
+          "Noto Serif CJK JP"
+          "Ubuntu"
+        ];
+        sansSerif = [
+          "Droid Sans"
+          "Noto Sans Serif CJK JP"
+          "Ubuntu"
+        ];
+        monospace = [
+          "Fira Code"
+          "Noto Sans Mono CJK JP"
+          "Ubuntu"
+        ];
+        emoji = [
+          "Noto Sans Emoji"
+        ];
      };
    };
  };
--- a/hosts/common/nix-builders/bob.nix
+++ b/hosts/common/nix-builders/bob.nix
@@ -3,7 +3,6 @@
  sops.secrets."ssh/nix-builders/bob/key" = { sopsFile = ./../../../secrets/common.yaml; };

  nix.buildMachines = [{
-    # Login details configured in ssh module in nix-secrets
    hostName = "nix-builder-bob";
    system = "x86_64-linux";
    speedFactor = 5;
@@ -14,8 +13,8 @@
      "big-paralell"
    ];
    mandatoryFeatures = [ ];
-    # sshUser = secrets.ssh.users.pvv.normalUser;
-    # sshKey = config.sops.secrets."ssh/nix-builders/bob/key".path;
+    sshUser = "oysteikt";
+    sshKey = config.sops.secrets."ssh/nix-builders/bob/key".path;
  }];

  programs.ssh = {
--- a/hosts/common/nix-builders/isvegg.nix
+++ b/hosts/common/nix-builders/isvegg.nix
@@ -1,16 +1,15 @@
-{ config, secrets, ... }:
+{ config, ... }:
 {
  sops.secrets."ssh/nix-builders/isvegg/key" = { sopsFile = ./../../../secrets/common.yaml; };

  nix.buildMachines = [{
-    # Login details configured in ssh module in nix-secrets
    hostName = "nix-builder-isvegg";
    system = "x86_64-linux";
    speedFactor = 1;
    maxJobs = 8;
    supportedFeatures = [ ];
    mandatoryFeatures = [ ];
-    sshUser = secrets.ssh.users.pvv.normalUser;
+    sshUser = "oysteikt";
    sshKey = config.sops.secrets."ssh/nix-builders/isvegg/key".path;
  }];

--- a/hosts/common/nix-builders/tsuki.nix
+++ b/hosts/common/nix-builders/tsuki.nix
@@ -1,4 +1,4 @@
-{ config, secrets, ... }:
+{ config, ... }:
 {
  # TODO: install public key on tsuki declaratively
  sops.secrets = {
@@ -7,7 +7,6 @@
  };

  nix.buildMachines = [{
-    # Login details configured in ssh module in nix-secrets
    hostName = "nix-builder-tsukir";
    system = "x86_64-linux";
    speedFactor = 2;
@@ -26,7 +25,8 @@
    extraConfig = ''
      Host nix-builder-tsukir
        HostName gingakei.loginto.me
-        Port ${toString secrets.ports.ssh.home-in}
+        Port 45497
+        IdentityFile ${config.sops.secrets."ssh/nix-builders/tsuki/key".path}
    '';

    # knownHosts.tsukir = {
--- a/hosts/common/nix.nix
+++ b/hosts/common/nix.nix
@@ -43,6 +43,11 @@
        type = "path";
        path = "/home/h7x4/git/nixpkgs-tools";
      };
+      shells.to = {
+        type = "git";
+        url = "https://git.pvv.ntnu.no/oysteikt/shells.git";
+        ref = "main";
+      };
    };
  };
 }
--- a/hosts/common/programs/wireshark.nix
+++ b/hosts/common/programs/wireshark.nix
@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+let
+  inherit (config) machineVars;
+in
+{
+  programs.wireshark = {
+    enable = !config.machineVars.headless;
+    package = pkgs.wireshark;
+  };
+}
--- a/hosts/common/services/cups.nix
+++ b/hosts/common/services/cups.nix
@@ -1,71 +0,0 @@
-{ config, lib, ... }:
-{
-  systemd.services = lib.mkIf config.services.printing.enable {
-    cups.serviceConfig = {
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectClock= true;
-      ProtectControlGroups = true;
-      ProtectHostname = true; 
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      PrivateDevices = true;
-      NoNewPrivileges = true;
-      # User =
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DevicePolicy = "closed";
-      KeyringMode = "private";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      PrivateUsers = true;
-      RemoveIPC = true;
-      # RestrictAddressFamilies = [ "" ];
-      RestrictNamespaces=true;
-      RestrictRealtime=true;
-      RestrictSUIDSGID=true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0077";
-    };
-    cups-browsed.serviceConfig = {
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectClock= true;
-      ProtectControlGroups = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      PrivateDevices = true;
-      NoNewPrivileges = true;
-      # User =
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DevicePolicy = "closed";
-      KeyringMode = "private";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      PrivateUsers = true;
-      RemoveIPC = true;
-      # RestrictAddressFamilies = [ "" ];
-      RestrictNamespaces=true;
-      RestrictRealtime=true;
-      RestrictSUIDSGID=true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0077";
-    };
-  };
-}
--- a/hosts/common/services/fwupd.nix
+++ b/hosts/common/services/fwupd.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.fwupd.enable = true;
+}
--- a/hosts/common/services/irqbalance.nix
+++ b/hosts/common/services/irqbalance.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.irqbalance.enable = true;
+}
--- a/hosts/common/services/journald.nix
+++ b/hosts/common/services/journald.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  services.journald.extraConfig = ''
+    MaxFileSec=30day
+  '';
+}
--- a/hosts/common/services/libinput.nix
+++ b/hosts/common/services/libinput.nix
@@ -0,0 +1,7 @@
+{ config, ...}:
+{
+  services.libinput = {
+    enable = !config.machineVars.headless;
+    touchpad.disableWhileTyping = true;
+  };
+}
--- a/hosts/common/services/logind.nix
+++ b/hosts/common/services/logind.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  services.logind = {
+    powerKeyLongPress = "poweroff";
+  };
+}
--- a/hosts/common/services/logrotate.nix
+++ b/hosts/common/services/logrotate.nix
@@ -1,42 +0,0 @@
-{ ... }:
-{
-  # source: https://github.com/logrotate/logrotate/blob/main/examples/logrotate.service
-  systemd.services.logrotate = {
-    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
-    unitConfig.RequiresMountsFor = "/var/log";
-    serviceConfig = {
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      ReadWritePaths = [ "/var/log" ];
-
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true; # disable for third party rotate scripts
-      PrivateDevices = true;
-      PrivateNetwork = true; # disable for mail delivery
-      PrivateTmp = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true; # disable for userdir logs
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "full";
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true; # disable for creating setgid directories
-      SocketBindDeny = [ "any" ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-      ];
-    };
-  };
-}
--- a/hosts/common/services/printing.nix
+++ b/hosts/common/services/printing.nix
@@ -1,4 +1,77 @@
-{ config, ... }:
+{ config, lib, ... }:
+let
+  cfg = config.services.printing;
+in
 {
-  services.printing.enable = !config.machineVars.headless;
+  # services.printing.enable = !config.machineVars.headless;
+  services.printing.enable = false;
+
+  systemd.services = lib.mkIf cfg.enable {
+    cups.serviceConfig = {
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ProtectClock= true;
+      ProtectControlGroups = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      PrivateDevices = true;
+      NoNewPrivileges = true;
+      # User =
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DevicePolicy = "closed";
+      KeyringMode = "private";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateUsers = true;
+      RemoveIPC = true;
+      # RestrictAddressFamilies = [ "" ];
+      RestrictNamespaces=true;
+      RestrictRealtime=true;
+      RestrictSUIDSGID=true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+      UMask = "0077";
+    };
+    cups-browsed.serviceConfig = lib.mkIf cfg.enable {
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ProtectClock= true;
+      ProtectControlGroups = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      PrivateDevices = true;
+      NoNewPrivileges = true;
+      # User =
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DevicePolicy = "closed";
+      KeyringMode = "private";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateUsers = true;
+      RemoveIPC = true;
+      # RestrictAddressFamilies = [ "" ];
+      RestrictNamespaces=true;
+      RestrictRealtime=true;
+      RestrictSUIDSGID=true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+      UMask = "0077";
+    };
+  };
 }
--- a/hosts/common/services/uptimed.nix
+++ b/hosts/common/services/uptimed.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.uptimed.enable = true;
+}
--- a/hosts/common/services/userborn.nix
+++ b/hosts/common/services/userborn.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.userborn.enable = true;
+}
--- a/hosts/common/services/xserver.nix
+++ b/hosts/common/services/xserver.nix
@@ -1,19 +1,38 @@
-{ config, ... }:
+{ config, pkgs, lib, ... }:
 {
-  services.xserver = {
-    enable = !config.machineVars.headless;
+  services.displayManager = lib.mkIf (!config.machineVars.headless) {
+    enable = true;
+    defaultSession = "none+xmonad";
+    sddm = {
+      enable = true;
+      wayland.enable = config.machineVars.wayland;
+      package = pkgs.kdePackages.sddm;
+      theme = "sddm-astronaut-theme";
+      # extraPackages = [ pkgs.sddm-astronaut ];
+    };
+  };
+
+  environment.systemPackages = [
+    (pkgs.sddm-astronaut.override {
+      themeConfig = {
+        PartialBlur = false;
+        # Background = "Backgrounds/";
+      };
+    })
+  ];
+
+  services.xserver = lib.mkIf (!config.machineVars.headless) {
+    enable = true;

    xkb = {
      layout = "us";
      options = "caps:escape";
    };

-    # desktopManager = {
-    #   xterm.enable = false;
-    #   xfce.enable = !config.machineVars.headless;
-    # };
-
-    displayManager.lightdm.enable = !config.machineVars.headless;
+    desktopManager = {
+      xterm.enable = true;
+      xfce.enable = true;
+    };

    windowManager.xmonad = {
      enable = true;
--- a/hosts/dosei/configuration.nix
+++ b/hosts/dosei/configuration.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 {
  imports = [
    ./hardware-configuration.nix
@@ -77,14 +77,11 @@
    fstrim.enable = true;
  };

+  nix.buildMachines = lib.mkForce [ ];
+
  hardware = {
    bluetooth.enable = true;
    enableRedistributableFirmware = true;
    keyboard.zsa.enable = true;
-    opengl = {
-      enable = true;
-      driSupport = true;
-      driSupport32Bit = true;
-    };
  };
 }
--- a/hosts/dosei/home/default.nix
+++ b/hosts/dosei/home/default.nix
@@ -9,7 +9,8 @@
      port = 10022;
    };

-    "hildring pvv-login pvv".proxyJump = "tsuki-ws";
+    "hildring pvv-login".proxyJump = "tsuki-ws";
+    "drolsum pvv-login2 pvv".proxyJump = "tsuki-ws";
  };

  sops.secrets."git/nordicsemi-maintenance-repos-config" = { };
--- a/hosts/dosei/services/wstunnel.nix
+++ b/hosts/dosei/services/wstunnel.nix
@@ -7,11 +7,16 @@
    "services/networking/wstunnel.nix"
  ];

-  # NOTE: Contains
-  # - WSTUNNEL_HTTP_UPGRADE_PATH_PREFIX
-  # - WSTUNNEL_RESTRICT_HTTP_UPGRADE_PATH_PREFIX
-  sops.secrets."wstunnel/http-upgrade-path-prefix-envvars" = {
-    sopsFile = ../../../secrets/common.yaml;
+  sops = {
+    secrets."wstunnel/http-upgrade-path-prefix" = {
+      sopsFile = ../../../secrets/common.yaml;
+    };
+    templates."wstunnel-environment.env".content = let
+      inherit (config.sops) placeholder;
+    in ''
+      WSTUNNEL_HTTP_UPGRADE_PATH_PREFIX=${placeholder."wstunnel/http-upgrade-path-prefix"}
+      WSTUNNEL_RESTRICT_HTTP_UPGRADE_PATH_PREFIX=${placeholder."wstunnel/http-upgrade-path-prefix"}
+    '';
  };

  services.wstunnel = {
@@ -21,7 +26,7 @@
      localToRemote = [
        "tcp://10022:localhost:22"
      ];
-      environmentFile = config.sops.secrets."wstunnel/http-upgrade-path-prefix-envvars".path;
+      environmentFile = config.sops.templates."wstunnel-environment.env".path;
    };
  };
 }
--- a/hosts/kasei/configuration.nix
+++ b/hosts/kasei/configuration.nix
@@ -12,6 +12,8 @@
    ./services/keybase.nix

    ./nspawn-containers/arch.nix
+
+    ./testconfig.nix
  ];

  system.stateVersion = "22.05";
@@ -76,10 +78,7 @@
  };

  services = {
-    openssh = {
-      enable = true;
-      settings.X11Forwarding = true;
-    };
+    openssh.enable = true;
    xserver.videoDrivers = [ "amdgpu" ];
    tailscale.enable = true;
    avahi = {
--- a/hosts/kasei/testconfig.nix
+++ b/hosts/kasei/testconfig.nix
@@ -0,0 +1,6 @@
+{ ... }:
+# NOTE: this file is a space where i put new configuration while i'm testing it.
+#       There shouldn't really be anything here, I'm not planning to commit any config here.
+{
+
+}
--- a/hosts/tsuki/configuration.nix
+++ b/hosts/tsuki/configuration.nix
@@ -1,4 +1,4 @@
-{ config, lib, secrets, modulesPath, ... }:
+{ config, lib, modulesPath, ... }:
 {
  imports = [
    ./hardware-configuration.nix
@@ -71,12 +71,6 @@
        isSystemUser = true;
        group = "media";
      };
-      nix-builder = {
-        description = "User for executing distributed builds via SSH";
-        isSystemUser = true;
-        group = "nix-builder";
-        openssh.authorizedKeys.keyFiles = [ secrets.keys.ssh.nixBuilders.tsuki.public ];
-      };
    };
    groups = {
      media = {};
@@ -84,7 +78,11 @@
    };
  };

-  sops.secrets."drives/cirno/credentials" = {};
+  sops.secrets."drives/cirno/password" = { };
+  sops.templates."drive-cirno.creds".content = ''
+    username=h7x4
+    password=${config.sops.placeholder."drives/cirno/password"}
+  '';


  virtualisation = {
--- a/hosts/tsuki/services/hedgedoc.nix
+++ b/hosts/tsuki/services/hedgedoc.nix
@@ -1,71 +1,80 @@
-{ pkgs, lib, config, options, ... }: let
+{ pkgs, lib, config, ... }: let
  cfg = config.services.hedgedoc;
 in {
-  config = {
-    # Contains CMD_SESSION_SECRET and CMD_OAUTH2_CLIENT_SECRET
-    sops.secrets."hedgedoc/env" = {
+  sops = {
+    secrets = {
+      "hedgedoc/env/cmd_session_secret" = { };
+      "hedgedoc/env/cmd_oauth2_client_secret" = { };
+    };
+    templates."hedgedoc.env" = {
      restartUnits = [ "hedgedoc.service" ];
      owner = "hedgedoc";
      group = "hedgedoc";
-    };
-
-    users.groups.hedgedoc.members = [ "nginx" ];
-
-    services.hedgedoc = {
-      enable = true;
-      environmentFile = config.sops.secrets."hedgedoc/env".path;
-      settings = {
-        domain = "docs.nani.wtf";
-        email = false;
-        allowAnonymous = false;
-        allowAnonymousEdits = true;
-        protocolUseSSL = true;
-
-        path = "/run/hedgedoc/hedgedoc.sock";
-
-        db = {
-          username = "hedgedoc";
-          # TODO: set a password
-          database = "hedgedoc";
-          host = "/var/run/postgresql";
-          dialect = "postgres";
-        };
-
-        oauth2 = let
-          authServerUrl = config.services.kanidm.serverSettings.origin;
-        in rec {
-          baseURL = "${authServerUrl}/oauth2";
-          tokenURL = "${authServerUrl}/oauth2/token";
-          authorizationURL = "${authServerUrl}/ui/oauth2";
-          userProfileURL = "${authServerUrl}/oauth2/openid/${clientID}/userinfo";
-
-          clientID = "hedgedoc";
-
-          scope = "openid email profile";
-          userProfileUsernameAttr = "name";
-          userProfileEmailAttr = "email";
-          userProfileDisplayNameAttr = "displayname";
-
-          providerName = "KaniDM";
-        };
-      };
-    };
-
-    services.postgresql = {
-      ensureDatabases = [ "hedgedoc" ];
-
-      ensureUsers = [{
-        name = "hedgedoc";
-        ensureDBOwnership = true;
-      }];
-    };
-
-    systemd.services.hedgedoc = rec {
-      requires = [
-        "postgresql.service"
-        "kanidm.service"
-      ];
-      after = requires;
+      content = let
+        inherit (config.sops) placeholder;
+      in ''
+        CMD_SESSION_SECRET=${placeholder."hedgedoc/env/cmd_session_secret"}
+        CMD_OAUTH2_CLIENT_SECRET=${placeholder."hedgedoc/env/cmd_oauth2_client_secret"}
+      '';
    };
  };
+
+  users.groups.hedgedoc.members = [ "nginx" ];
+
+  services.hedgedoc = {
+    enable = true;
+    environmentFile = config.sops.templates."hedgedoc.env".path;
+    settings = {
+      domain = "docs.nani.wtf";
+      email = false;
+      allowAnonymous = false;
+      allowAnonymousEdits = true;
+      protocolUseSSL = true;
+
+      path = "/run/hedgedoc/hedgedoc.sock";
+
+      db = {
+        username = "hedgedoc";
+        # TODO: set a password
+        database = "hedgedoc";
+        host = "/var/run/postgresql";
+        dialect = "postgres";
+      };
+
+      oauth2 = let
+        authServerUrl = config.services.kanidm.serverSettings.origin;
+      in rec {
+        baseURL = "${authServerUrl}/oauth2";
+        tokenURL = "${authServerUrl}/oauth2/token";
+        authorizationURL = "${authServerUrl}/ui/oauth2";
+        userProfileURL = "${authServerUrl}/oauth2/openid/${clientID}/userinfo";
+
+        clientID = "hedgedoc";
+
+        scope = "openid email profile";
+        userProfileUsernameAttr = "name";
+        userProfileEmailAttr = "email";
+        userProfileDisplayNameAttr = "displayname";
+
+        providerName = "KaniDM";
+      };
+    };
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "hedgedoc" ];
+
+    ensureUsers = [{
+      name = "hedgedoc";
+      ensureDBOwnership = true;
+    }];
+  };
+
+  systemd.services.hedgedoc = rec {
+    requires = [
+      "postgresql.service"
+      "kanidm.service"
+    ];
+    after = requires;
+  };
 }
--- a/hosts/tsuki/services/kanidm.nix
+++ b/hosts/tsuki/services/kanidm.nix
@@ -27,6 +27,7 @@ in {
      tls_chain = "${credsDir}/fullchain.pem";
      tls_key = "${credsDir}/key.pem";
      bindaddress = "127.0.0.1:8300";
+      # log_level = "debug";
      online_backup = {
        path = "/data/backup/kanidm";
        schedule = "00 22 * * *";
--- a/hosts/tsuki/services/matrix/bridges/matrix-appservice-irc.nix
+++ b/hosts/tsuki/services/matrix/bridges/matrix-appservice-irc.nix
@@ -1,6 +1,54 @@
-{ config, ... }: let
+{ config, pkgs, lib, ... }: let
  cfg = config.services.matrix-appservice-irc;
 in {
+  sops = {
+    secrets = {
+      "matrix/bridges/irc/id" = {};
+      "matrix/bridges/irc/hs_token" = {};
+      "matrix/bridges/irc/as_token" = {};
+    };
+
+    templates."matrix-appservice-irc-registration.yml" = {
+      owner = "matrix-appservice-irc";
+      group = "matrix-synapse";
+      mode = "0440";
+      file = let
+        inherit (config.sops) placeholder;
+      in (pkgs.formats.yaml {}).generate "matrix-appservice-irc-registration.yml" {
+        id = placeholder."matrix/bridges/irc/id";
+        hs_token = placeholder."matrix/bridges/irc/hs_token";
+        as_token = placeholder."matrix/bridges/irc/as_token";
+        url = cfg.registrationUrl;
+        sender_localpart = cfg.localpart;
+        "de.sorunome.msc2409.push_ephemeral" = true;
+        protocols = [ "irc" ];
+        namespaces = {
+          aliases = [
+            {
+              exclusive = true;
+              regex = "#lainchanirc_.*:nani\\.wtf";
+            }
+            {
+              exclusive = true;
+              regex = "#liberairc_.*:nani\\.wtf";
+            }
+          ];
+          users = [
+            {
+              exclusive = true;
+              regex = "@lainanon_.*:nani\\.wtf";
+            }
+            {
+              exclusive = true;
+              regex = "@liberauser_.*:nani\\.wtf";
+            }
+          ];
+        };
+        rate_limited = false;
+      };
+    };
+  };
+
  services.matrix-appservice-irc = {
    enable = true;
    registrationUrl = "http://localhost:${toString cfg.port}";
@@ -14,64 +62,145 @@ in {

      database = {
        engine = "postgres";
+        # TODO: use unix socket
        connectionString = "postgres://matrix-appservice-irc:@localhost:${toString config.services.postgresql.port}/matrix-appservice-irc?sslmode=disable";
      };

-      ircService.servers."irc.lainchan.org" = {
-        name = "lainchan";
-        port = 6697;
-        ssl = true;
-        networkId = "ircLainchanOrg";
+      ircService = {
+        mediaProxy.publicUrl = "https://irc-matrix.nani.wtf/media";

-        botConfig.enable = false;
+        servers = {
+          "irc.libera.chat" = {
+            name = "libera";
+            port = 6697;
+            ssl = true;
+            networkId = "ircLiberaChat";

-        dynamicChannels = {
-          enabled = true;
-          createAlias = true;
-          aliasTemplate = "#lainchanirc_$CHANNEL";
-          published = true;
-          useHomeserverDirectory = true;
-          joinRule = "public";
-          federate = true;
-        };
+            botConfig.enable = false;

-        matrixClients = {
-          userTemplate = "@lainanon_$NICK";
-        };
-
-        ircClients = {
-          nickTemplate = "$LOCALPART[m]";
-          allowNickChanges = true;
-        };
-
-        membershipLists = {
-          enabled = true;
-          global = {
-            ircToMatrix = {
-              initial = true;
-              incremental = true;
+            dynamicChannels = {
+              enabled = true;
+              createAlias = true;
+              aliasTemplate = "#liberairc_$CHANNEL";
+              published = true;
+              useHomeserverDirectory = true;
+              joinRule = "public";
+              federate = true;
            };
-            matrixToIrc = {
-              initial = true;
-              incremental = true;
+
+            matrixClients = {
+              userTemplate = "@liberauser_$NICK";
            };
+
+            ircClients = {
+              nickTemplate = "$LOCALPART[m]";
+              allowNickChanges = true;
+            };
+
+            membershipLists = {
+              enabled = true;
+              global = {
+                ircToMatrix = {
+                  initial = true;
+                  incremental = true;
+                };
+                matrixToIrc = {
+                  initial = true;
+                  incremental = true;
+                };
+              };
+            };
+
+            permissions."@h7x4:nani.wtf" = "admin";
+
+            # TODO: Port forward
+            ident.enable = true;
+
+            # TODO: Metrics
+          };
+
+          "irc.lainchan.org" = {
+            name = "lainchan";
+            port = 6697;
+            ssl = true;
+            networkId = "ircLainchanOrg";
+
+            botConfig.enable = false;
+
+            dynamicChannels = {
+              enabled = true;
+              createAlias = true;
+              aliasTemplate = "#lainchanirc_$CHANNEL";
+              published = true;
+              useHomeserverDirectory = true;
+              joinRule = "public";
+              federate = true;
+            };
+
+            matrixClients = {
+              userTemplate = "@lainanon_$NICK";
+            };
+
+            ircClients = {
+              nickTemplate = "$LOCALPART[m]";
+              allowNickChanges = true;
+            };
+
+            membershipLists = {
+              enabled = true;
+              global = {
+                ircToMatrix = {
+                  initial = true;
+                  incremental = true;
+                };
+                matrixToIrc = {
+                  initial = true;
+                  incremental = true;
+                };
+              };
+            };
+
+            permissions."@h7x4:nani.wtf" = "admin";
+
+            # TODO: Port forward
+            ident.enable = true;
+
+            # TODO: Metrics
          };
        };
-
-        permissions."@h7x4:nani.wtf" = "admin";
-
-        # TODO: Port forward
-        ident.enable = true;
-
-        # TODO: Metrics
      };
    };
  };

+  services.matrix-synapse-next.settings.app_service_config_files = [
+    config.sops.templates."matrix-appservice-irc-registration.yml".path
+  ];
+
  systemd.services.matrix-appservice-irc = {
+    enableStrictShellChecks = false;
    requires = [
      "matrix-synapse.service"
      "postgresql.service"
    ];
+
+    serviceConfig.BindReadOnlyPaths = [
+      "${config.sops.templates."matrix-appservice-irc-registration.yml".path}:/var/lib/matrix-appservice-irc/registration.yml"
+    ];
+
+    preStart = lib.mkForce ''
+      umask 077
+      # Generate key for crypting passwords
+      if ! [ -f "${cfg.settings.ircService.passwordEncryptionKeyPath}" ]; then
+        ${pkgs.openssl}/bin/openssl genpkey \
+            -out "${cfg.settings.ircService.passwordEncryptionKeyPath}" \
+            -outform PEM \
+            -algorithm RSA \
+            -pkeyopt "rsa_keygen_bits:${toString cfg.passwordEncryptionKeyLength}"
+      fi
+
+      if ! [ -f "${cfg.settings.ircService.mediaProxy.signingKeyPath}"]; then
+        ${lib.getExe pkgs.nodejs} ${pkgs.matrix-appservice-irc}/lib/generate-signing-key.js > "${cfg.settings.ircService.mediaProxy.signingKeyPath}"
+      fi
+    '';
  };
 }
--- a/hosts/tsuki/services/matrix/coturn.nix
+++ b/hosts/tsuki/services/matrix/coturn.nix
@@ -1,16 +1,25 @@
-{ secrets, ... }:
+{ config, lib, ... }:
+let
+  cfg = config.services.coturn;
+in
 {
-  services.coturn = rec {
-    enable = true;
+  sops.secrets."matrix_synapse/turn_shared_secret" = { };
+
+  services.coturn = let
+    # certName = config.services.nginx.virtualHosts.${cfg.realm}.useACMEHost;
+    certName = "nani.wtf";
+    certDir = config.security.acme.certs.${certName}.directory;
+  in rec {
+    enable = false;
    no-cli = true;
    no-tcp-relay = true;
-    min-port = secrets.ports.matrix.coturn.min;
-    max-port = secrets.ports.matrix.coturn.max;
+    min-port = 46000;
+    max-port = 47000;
    use-auth-secret = true;
-    static-auth-secret = secrets.keys.matrix.static-auth-secret;
+    static-auth-secret-file = config.sops.secrets."matrix_synapse/turn_shared_secret".path;
    realm = "turn.nani.wtf";
-    cert = "${secrets.keys.certificates.server.crt}";
-    pkey = "${secrets.keys.certificates.server.key}";
+    cert = "${certDir}/cert.pem";
+    pkey = "${certDir}/key.pem";
    extraConfig = ''
      # for debugging
      verbose
@@ -40,4 +49,19 @@
      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
    '';
  };
+
+  networking.firewall = lib.mkIf cfg.enable {
+    interfaces.enp2s0 = let
+      range = [{
+        from = cfg.min-port;
+        to = cfg.max-port;
+      }];
+    in
+    {
+      allowedUDPPortRanges = range;
+      allowedUDPPorts = [ cfg.listening-port ];
+      allowedTCPPortRanges = range;
+      allowedTCPPorts = [ cfg.listening-port ];
+    };
+  };
 }
--- a/hosts/tsuki/services/matrix/default.nix
+++ b/hosts/tsuki/services/matrix/default.nix
@@ -1,5 +1,4 @@
-{ pkgs, lib, config, secrets, ... }: {
-
+{ pkgs, lib, config, ... }: {
  imports = [
    ./bridges/matrix-appservice-irc.nix

@@ -9,6 +8,12 @@
    ./coturn.nix
  ];

+  sops.secrets."matrix_synapse/registration_secret" = {
+    owner = "matrix-synapse";
+    group = "matrix-synapse";
+    mode = "0440";
+  };
+
  services.matrix-synapse-next = {
    enable = true;
    enableNginx = true;
@@ -25,9 +30,11 @@

    settings = {
      turn_uris = let
-        inherit (config.services.coturn) realm;
-        p = toString secrets.ports.matrix.default;
-      in ["turn:${realm}:${p}?transport=udp" "turn:${realm}:${p}?transport=tcp"];
+        inherit (config.services.coturn) realm listening-port;
+      in [
+        "turn:${realm}:${toString listening-port}?transport=udp"
+        "turn:${realm}:${toString listening-port}?transport=tcp"
+      ];
      turn_shared_secret = config.services.coturn.static-auth-secret;
      turn_user_lifetime = "1h";

@@ -56,7 +63,7 @@
      # with the registration shared secret
      enable_registration = false;

-      registration_shared_secret = secrets.keys.matrix.registration-shared-secret;
+      registration_shared_secret_path = config.sops.secrets."matrix_synapse/registration_secret".path;
      allow_public_rooms_over_federation = true;

      # password_config.enabled = lib.mkForce false;
@@ -67,16 +74,10 @@
          user = "matrix-synapse";
          database = "matrix-synapse";
          host = "/var/run/postgresql";
-          port = secrets.ports.postgres;
+          port = config.services.postgresql.settings.port;
        };
      };

-      # TODO: Figure out a way to do this declaratively.
-      #       The files need to be owned by matrix-synapse
-      app_service_config_files = [
-        "/var/lib/matrix-synapse/irc-registration.yml"
-      ];
-
      # redis.enabled = true;
      max_upload_size = "100M";
      dynamic_thumbnails = true;
@@ -92,19 +93,4 @@
  };

  services.redis.servers."".enable = true;
-
-  networking.firewall = {
-    interfaces.enp2s0 = let
-      range = with config.services.coturn; [ {
-      from = secrets.ports.matrix.coturn.min;
-      to = secrets.ports.matrix.coturn.max;
-    } ];
-    in
-    {
-      allowedUDPPortRanges = range;
-      allowedUDPPorts = [ secrets.ports.matrix.default ];
-      allowedTCPPortRanges = range;
-      allowedTCPPorts = [ secrets.ports.matrix.default ];
-    };
-  };
 }
--- a/hosts/tsuki/services/minecraft/default.nix
+++ b/hosts/tsuki/services/minecraft/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, config, inputs, secrets, ... }:
+{ pkgs, lib, config, inputs, ... }:
 let
  cfg = config.services.minecraft-servers;

@@ -145,8 +145,9 @@ in
      in {
        "server-icon.png" = rawFile ./extraFiles/server-icon.png;

-        "plugins/dynmap/configuration.txt" = 
-          yamlConfig "dynmap" ./pluginConfigs/dynmap.nix { inherit secrets; };
+        # TODO: pull this through a sops template to render the secret before readding it here.
+        # "plugins/dynmap/configuration.txt" = 
+        #   yamlConfig "dynmap" ./pluginConfigs/dynmap.nix { inherit secrets; };

        "plugins/VeinMiner/config.yml" =
          yamlConfig "VeinMiner" ./pluginConfigs/veinMiner.nix { };
--- a/hosts/tsuki/services/nginx/default.nix
+++ b/hosts/tsuki/services/nginx/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, config, secrets, inputs, ... }:
+{ config, pkgs, lib, inputs, ... }:
 {
  sops.secrets."cloudflare/api-key" = {};

@@ -36,20 +36,31 @@
    recommendedTlsSettings = true;
    recommendedZstdSettings = true;

+    appendConfig = ''
+      pcre_jit on;
+      worker_processes auto;
+      worker_rlimit_nofile 100000;
+    '';
+    eventsConfig = ''
+      worker_connections 2048;
+      use epoll;
+      multi_accept on;
+    '';
+
    upstreams = let
-      inherit (secrets) ips ports;
      srv = config.services;
      sa = config.local.socketActivation;
    in {
      "atuin".servers."unix:${sa.atuin.newSocketAddress}" = { };
-      "dynmap".servers."localhost:${s ports.minecraft.dynmap}" = { };
+      "dynmap".servers."localhost:8123" = { };
      "grafana".servers."unix:/run/grafana/grafana.sock" = { };
      "headscale".servers."localhost:${s srv.headscale.port}" = { };
      "hedgedoc".servers."unix:${srv.hedgedoc.settings.path}" = { };
-      "idrac".servers."${ips.idrac}" = { };
+      "idrac".servers."10.0.0.201" = { };
+      "irc-matrix-bridge-media".servers."localhost:${s srv.matrix-appservice-irc.settings.ircService.mediaProxy.bindPort}" = { };
      "kanidm".servers."localhost:8300" = { };
-      "osuchan".servers."localhost:${s ports.osuchan}" = { };
-      "plex".servers."localhost:${s ports.plex}" = { };
+      "osuchan".servers."localhost:${s srv.osuchan.port}" = { };
+      "plex".servers."localhost:32400" = { };
      "vaultwarden".servers."unix:${sa.vaultwarden.newSocketAddress}" = { };
      "wstunnel".servers = let
        inherit (config.services.wstunnel.servers."ws-tsuki".listen) host port;
@@ -61,7 +72,7 @@
    virtualHosts = let
      inherit (lib.attrsets) nameValuePair listToAttrs recursiveUpdate;
      inherit (lib.lists) head drop;
-      inherit (secrets) domains keys;
+      domains = [ "nani.wtf" ];

      cloudflare-origin-pull-ca = builtins.fetchurl {
        url = "https://developers.cloudflare.com/ssl/static/authenticated_origin_pull_ca.pem";
@@ -70,7 +81,7 @@

      # nonCFHost =
      #   subdomains: extraSettings: let
-      #     settings = with keys.certificates; {
+      #     settings = {
      #       useACMEHost = "nani.wtf";
      #       forceSSL = true;
      #       kTLS = true;
@@ -84,7 +95,7 @@

      host =
        subdomains: extraSettings: let
-          settings = with keys.certificates; {
+          settings = {
            serverAliases = drop 1 (generateServerAliases domains subdomains);
            useACMEHost = "nani.wtf";
            forceSSL = true;
@@ -133,11 +144,12 @@
      (host ["testmap"] {
        root = "/var/lib/mcmap";
        locations = {
-          "~* ^/maps/[^/]*/tiles/[^/]*.json$".extraConfig = ''
-            error_page 404 =200 /assets/emptyTile.json;
+          "@empty".return = "204";
+
+          "~* ^/maps/[^/]*/tiles/".extraConfig = ''
+            error_page 404 = @empty;
            gzip_static always;
          '';
-          "~* ^/maps/[^/]*/tiles/[^/]*.png$".tryFiles = "$uri =204";
        };
      })
      (host ["www"] {
@@ -151,7 +163,9 @@
        enableACME = lib.mkForce false;
        locations."/_synapse".proxyPass = "http://$synapse_backend";
      })
-      (host ["madmin"] { root = "${pkgs.synapse-admin}/"; })
+      (proxy ["irc-matrix"] "http://irc-matrix-bridge-media" {})
+      
+      # (host ["madmin"] { root = "${pkgs.synapse-admin}/"; })
      # (host ["cache"] { root = "/var/lib/nix-cache"; })
      # (proxy ["slack-bot"] "http://localhost:9898" {})
      (proxy ["atuin"] "http://atuin" {})
--- a/hosts/tsuki/services/osuchan.nix
+++ b/hosts/tsuki/services/osuchan.nix
@@ -1,12 +1,26 @@
 { config, ... }:
 {
-  sops.secrets."osuchan/envfile" = {
-    restartUnits = [ "osuchan.service" ];
+  sops = {
+    secrets = {
+      "osuchan/env/channel_access_token" = { };
+      "osuchan/env/channel_id" = { };
+      "osuchan/env/channel_secret" = { };
+    };
+    templates."osuchan.env" = {
+      restartUnits = [ "osuchan.service" ];
+      content = let
+        inherit (config.sops) placeholder;
+      in ''
+        CHANNEL_ACCESS_TOKEN=${placeholder."osuchan/env/channel_access_token"}
+        CHANNEL_ID=${placeholder."osuchan/env/channel_id"}
+        CHANNEL_SECRET=${placeholder."osuchan/env/channel_secret"}
+      '';
+    };
  };

  services.osuchan = {
    enable = true;
    port = 9283;
-    secretFile = config.sops.secrets."osuchan/envfile".path;
+    secretFile = config.sops.templates."osuchan.env".path;
  };
 }
--- a/hosts/tsuki/services/postgres.nix
+++ b/hosts/tsuki/services/postgres.nix
@@ -48,32 +48,7 @@ in {
    requires = [ "postgresql.service" ];
  };

-  systemd.services.postgresql = {
-    serviceConfig = {
-      Restart = "always";
-      RestartSec = 3;
-      ReadWritePaths = [ cfg.dataDir ];
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      ProtectClock = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      # PrivateMounts = true;
-      RestrictSUIDSGID = true;
-      ProtectHostname = true;
-      LockPersonality = true;
-      ProtectKernelTunables = true;
-      ProtectSystem = "strict";
-      ProtectProc = "invisible";
-      ProtectHome = true;
-      # PrivateNetwork = true;
-      PrivateUsers = true;
-      PrivateTmp = true;
-      UMask = "0077";
-      # RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
-      SystemCallArchitectures = "native";
-    };
-  };
+  systemd.services.postgresql.serviceConfig.ReadWritePaths = [ cfg.dataDir ];

  environment.systemPackages = [ config.services.postgresql.package ];
 }
--- a/hosts/tsuki/services/samba.nix
+++ b/hosts/tsuki/services/samba.nix
@@ -5,26 +5,25 @@
    enable = true;
    # openFirewall = true;

-    extraConfig = ''
-      workgroup = TSUKI
-      server string = smbnix
-      netbios name = smbnix
+    settings = {
+      global = {
+        "workgroup" = "TSUKI";
+        "server string" = "smbnix";
+        "netbios name" = "smbnix";

-      security = user
+        "security" = "user";

-      use sendfile = yes
-      min protocol = SMB2
-      smb encrypt = desired
+        "use sendfile" = "yes";
+        "min protocol" = "SMB2";
+        "smb encrypt" = "desired";

-      # note: localhost is the ipv6 localhost ::1
-      hosts allow = 100.107.69.8 100.100.65.88
-      hosts deny = 0.0.0.0/0
+        # note: localhost is the ipv6 localhost ::1
+        "hosts allow" = "100.107.69.8 100.100.65.88";
+        "hosts deny" = "0.0.0.0/0";

-      guest ok = no
-      map to guest = never
-    '';
-
-    shares = {
+        "guest ok" = "no";
+        "map to guest" = "never";
+      };
      cirno = {
        path = "/data/cirno";
        browseable = "yes";
@@ -66,15 +65,4 @@

  networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 139 445 ];
  networking.firewall.interfaces."tailscale0".allowedUDPPorts = [ 137 138 ];
-
-
-  systemd.slices.system-samba = {
-    description = "Samba slice";
-    after = [ "system.slice" ];
-    requires = [ "system.slice" ];
-  };
-
-  systemd.services.samba-smbd.serviceConfig.Slice = "system-samba.slice";
-  systemd.services.samba-nmbd.serviceConfig.Slice = "system-samba.slice";
-  systemd.services.samba-winbindd.serviceConfig.Slice = "system-samba.slice";
 }
--- a/hosts/tsuki/services/vaultwarden.nix
+++ b/hosts/tsuki/services/vaultwarden.nix
@@ -21,39 +21,6 @@ in {

  systemd.services.vaultwarden = lib.mkIf cfg.enable {
    requires = [ "postgresql.service" ];
-
-    serviceConfig = {
-      # Extra hardening
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      NoNewPrivileges = true;
-      # MemoryDenyWriteExecute = true;
-      PrivateMounts = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0007";
-    };
  };

  services.postgresql = lib.mkIf cfg.enable {
--- a/hosts/tsuki/services/wstunnel.nix
+++ b/hosts/tsuki/services/wstunnel.nix
@@ -7,11 +7,16 @@
    "services/networking/wstunnel.nix"
  ];

-  # NOTE: Contains
-  # - WSTUNNEL_HTTP_UPGRADE_PATH_PREFIX
-  # - WSTUNNEL_RESTRICT_HTTP_UPGRADE_PATH_PREFIX
-  sops.secrets."wstunnel/http-upgrade-path-prefix-envvars" = {
-    sopsFile = ../../../secrets/common.yaml;
+  sops = {
+    secrets."wstunnel/http-upgrade-path-prefix" = {
+      sopsFile = ../../../secrets/common.yaml;
+    };
+    templates."wstunnel-environment.env".content = let
+      inherit (config.sops) placeholder;
+    in ''
+      WSTUNNEL_HTTP_UPGRADE_PATH_PREFIX=${placeholder."wstunnel/http-upgrade-path-prefix"}
+      WSTUNNEL_RESTRICT_HTTP_UPGRADE_PATH_PREFIX=${placeholder."wstunnel/http-upgrade-path-prefix"}
+    '';
  };

  services.wstunnel = {
@@ -22,7 +27,7 @@
        port = 8789;
      };
      enableHTTPS = false;
-      environmentFile = config.sops.secrets."wstunnel/http-upgrade-path-prefix-envvars".path;
+      environmentFile = config.sops.templates."wstunnel-environment.env".path;
    };
  };
 }
--- a/hosts/xps16/configuration.nix
+++ b/hosts/xps16/configuration.nix
@@ -0,0 +1,96 @@
+{ config, lib, pkgs, inputs, specialArgs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+
+    ./services/btrfs.nix
+    ./services/docker.nix
+    ./services/keybase.nix
+    ./services/libvirtd.nix
+    ./services/logiops.nix
+    ./services/tailscale.nix
+    ./services/thermald.nix
+    ./services/tlp.nix
+
+    ./testconfig.nix
+  ];
+
+  sops.age.keyFile = "/var/lib/sops/age-key.txt";
+
+  system.stateVersion = "24.11";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.binfmt.emulatedSystems = [
+    "x86_64-windows"
+    "aarch64-linux"
+    "armv7l-linux"
+    "i686-linux"
+  ];
+
+  nix.settings.system-features = [
+    "kvm"
+    "benchmark"
+    "big-parallel"
+    "nixos-test"
+  ];
+
+  i18n.extraLocaleSettings = {
+    LC_ALL = "en_US.UTF-8";
+  };
+
+  console = {
+    earlySetup = true;
+    font = "${pkgs.terminus_font}/share/consolefonts/ter-132n.psf.gz";
+    packages = with pkgs; [ terminus_font ];
+  };
+
+  boot.loader.systemd-boot.consoleMode = "1";
+
+  machineVars = {
+    headless = false;
+    gaming = true;
+    development = true;
+    creative = true;
+    wayland = true;
+  };
+
+  networking = {
+    hostName = "xps16";
+    networkmanager.enable = true;
+    firewall.enable = true;
+    # hostId = "f0660cef";
+  };
+
+  services = {
+    xserver.upscaleDefaultCursor = true;
+    xserver.dpi = 192;
+    displayManager.sddm = {
+      enableHidpi = true;
+      settings = {
+        X11.ServerArguments = "-nolisten tcp -dpi 192";
+      };
+    };
+    libinput.touchpad.accelSpeed = "0.5";
+  };
+
+  environment.systemPackages = [
+    pkgs.webcamoid
+  ];
+
+  hardware = {
+    bluetooth.enable = true;
+    enableRedistributableFirmware = true;
+    keyboard.zsa.enable = true;
+    sane.enable = true;
+    graphics = {
+      enable = true;
+      enable32Bit = true;
+    };
+    # ipu6 = {
+    #   enable = true;
+    #   platform = "ipu6epmtl";
+    # };
+  };
+}
--- a/hosts/xps16/hardware-configuration.nix
+++ b/hosts/xps16/hardware-configuration.nix
@@ -0,0 +1,119 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "vmd" "nvme" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=root" "compress=zstd" "noatime" ];
+    };
+
+  boot.initrd.luks.devices."crypted".device = "/dev/disk/by-uuid/88bbd92a-88b5-4175-9d6f-c14033607b70";
+  
+  fileSystems."/boot" =
+  { device = "/dev/disk/by-uuid/34BA-6EA6";
+    fsType = "vfat";
+  };
+
+  fileSystems."/home/h7x4" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=home/h7x4/active" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/home/h7x4/.snapshots" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=home/h7x4/snapshots" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/home/h7x4/git" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=home/h7x4/git/active" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/home/h7x4/ctf" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=home/h7x4/ctf/active" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/home/h7x4/downloads" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=home/h7x4/downloads/active" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/home/h7x4/pictures" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=home/h7x4/pictures/active" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/home/h7x4/music" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=home/h7x4/music/active" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/home/h7x4/music/.snapshots" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=home/h7x4/music/snapshots" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/var/log" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=var/log/active" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/var/log/.snapshots" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=var/log/snapshots" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/var/lib" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=var/lib/active" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/var/lib/.snapshots" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=var/lib/snapshots" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/var/lib/docker" =
+    { device = "/dev/disk/by-uuid/178502e0-0481-47ed-842c-2d6b1cf81ac5";
+      fsType = "btrfs";
+      options = [ "subvol=var/lib/docker" "compress=zstd" "noatime" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s13f0u1u4.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp2s0f0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/hosts/xps16/home/default.nix
+++ b/hosts/xps16/home/default.nix
@@ -0,0 +1,6 @@
+{ config, ... }:
+{
+  home.stateVersion = "24.11";
+
+  programs.waybar.settings.mainBar.output = [ "eDP-1" ];
+}
--- a/hosts/xps16/services/btrfs.nix
+++ b/hosts/xps16/services/btrfs.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.btrfs.autoScrub.enable = true;
+}
--- a/hosts/xps16/services/docker.nix
+++ b/hosts/xps16/services/docker.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  virtualisation.docker.enable = true;
+}
--- a/hosts/xps16/services/keybase.nix
+++ b/hosts/xps16/services/keybase.nix
@@ -0,0 +1,15 @@
+{ config, pkgs, lib, ... }:
+{
+  services.keybase.enable = true;
+
+  services.kbfs = {
+    enable = true;
+    extraFlags = [
+      "-label kbfs"
+      "-mount-type normal"
+    ];
+    # enableRedirector = true;
+  };
+
+  environment.systemPackages = with pkgs; [ keybase keybase-gui kbfs ];
+}
--- a/hosts/xps16/services/libvirtd.nix
+++ b/hosts/xps16/services/libvirtd.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  virtualisation.libvirtd.enable = true;
+}
--- a/hosts/xps16/services/logiops.nix
+++ b/hosts/xps16/services/logiops.nix
@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  # TODO: remove when merged: https://github.com/NixOS/nixpkgs/pull/167388
+  systemd.services = {
+    logid = {
+      description = "Logitech Configuration Daemon";
+      startLimitIntervalSec = 0;
+      wants = [ "multi-user.target" ];
+      after = [ "multi-user.target" ];
+      wantedBy = [ "graphical-session.target" ];
+    
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.logiops}/bin/logid";
+        User = "root";
+        ExecReload = "/bin/kill -HUP $MAINPID";
+        Restart="on-failure";
+      };
+    };
+  };
+
+  hardware.logitech.wireless.enable = true;
+}
--- a/hosts/xps16/services/tailscale.nix
+++ b/hosts/xps16/services/tailscale.nix
@@ -0,0 +1,10 @@
+{ config, ... }:
+{
+  services.tailscale.enable = true;
+
+  networking.firewall = {
+    allowedUDPPorts = [ config.services.tailscale.port ];
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+  };
+}
--- a/hosts/xps16/services/thermald.nix
+++ b/hosts/xps16/services/thermald.nix
@@ -0,0 +1,46 @@
+{ config, lib, ... }:
+{
+  services.thermald.enable = true;
+
+    systemd.services.thermald = lib.mkIf config.services.thermald.enable {
+    documentation = [ "man:thermald(8)" "man:thermal-conf.xml(5)" ];
+    unitConfig.ConditionVirtualization = "no";
+
+    serviceConfig = {
+      PrivateUsers = true;
+      PrivateNetwork = true;
+
+      # AmbientCapabilities = [ "" ];
+      # CapabilityBoundingSet = [ "" ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      # PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = "yes";
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true; #?
+      ProtectProc = "invisible"; #?
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      UMask = "0777";
+      RestrictNamespaces = true;
+      # RestrictRealtime = true; #?
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SocketBindDeny = [ "any" ];
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+    };
+  };
+}
+
--- a/hosts/xps16/services/tlp.nix
+++ b/hosts/xps16/services/tlp.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.tlp.enable = true;
+}
--- a/hosts/xps16/testconfig.nix
+++ b/hosts/xps16/testconfig.nix
@@ -0,0 +1,6 @@
+{ ... }:
+# NOTE: this file is a space where i put new configuration while i'm testing it.
+#       There shouldn't really be anything here, I'm not planning to commit any config here.
+{
+
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
h7x4	3c6bb656e9	home/{hyprland,waybar}: init	2024-12-05 19:43:58 +01:00
h7x4	19e89266a7	package-overrides/{fcitx5-mozc,mozc}: remove	2024-12-05 19:06:53 +01:00
h7x4	fe50198759	xps16/tlp: init	2024-12-05 19:06:52 +01:00
h7x4	a2a0356bf6	thermald: move from common to xps16	2024-12-05 19:06:52 +01:00
h7x4	ffee26da2b	common/nix: add `shells` to registry	2024-12-05 18:22:02 +01:00
h7x4	101f0f6ca0	flake.nix: remove fcitx5-mozc from unstable overlay	2024-12-05 10:30:30 +01:00
h7x4	acd1ac89e5	flake.lock: bump	2024-12-05 10:20:46 +01:00
h7x4	cb3318bc93	home/vscode: fix zsh tab completion in other terminal issue	2024-12-05 10:10:02 +01:00
h7x4	e9fb3d71d8	common: use latest linux kernel by default	2024-12-05 10:09:18 +01:00
h7x4	c17b068aae	common/fwupd: init	2024-12-05 10:08:52 +01:00
h7x4	ec0b505f7b	{dosei,europa}: add nixos-hardware imports	2024-12-05 10:07:23 +01:00
h7x4	abb5ae9473	flake.nix: expose input sources as packages	2024-12-05 10:06:36 +01:00
h7x4	b41c16e234	common/fonts: add noto fonts into default queue	2024-12-04 23:07:04 +01:00
h7x4	a1f48392ed	common/sddm: init	2024-12-04 23:07:01 +01:00
h7x4	f0a869d49b	treewide: misc optimizations for xps	2024-12-04 23:05:47 +01:00
h7x4	3315535a2f	xps16: init	2024-12-04 20:06:57 +01:00
h7x4	3bf91d810f	common/libinput: move to own nix file	2024-12-03 13:32:15 +01:00
h7x4	67f156c3b2	common/irqbalance: move to own nix file	2024-12-03 13:30:24 +01:00
h7x4	020bc31713	common/thermald: enable	2024-12-03 13:21:59 +01:00
h7x4	8a41a97bbf	home/xdg: set base dirs for npm	2024-12-03 13:20:41 +01:00
h7x4	6a70c086f9	common: add h7x4 to rtkit group	2024-12-03 13:20:09 +01:00
h7x4	e75bba4e36	common/xfce: enable by default	2024-12-03 13:19:33 +01:00
h7x4	9393d47390	home/psd: init	2024-12-02 16:11:16 +01:00
h7x4	5f8001dc86	common: fix global wireshark permissions	2024-12-02 12:07:39 +01:00
h7x4	f9d175fc43	common: disable a bunch of kernel modules by default	2024-12-02 08:42:46 +01:00
h7x4	387ff505b5	common: enable tpm by default	2024-12-02 08:42:45 +01:00
h7x4	967ebc0bba	common/journald: store logs for 30 days	2024-12-02 08:23:17 +01:00
h7x4	430a223a63	common/userborn: init	2024-12-02 08:22:14 +01:00
h7x4	32077bf639	common/uptimed: init	2024-12-02 08:20:57 +01:00
h7x4	967d92ae48	{tsuki,dosei}: use sops templates for wstunnel	2024-12-02 08:14:49 +01:00
h7x4	cf90dd577c	home: fix pvv ssh jumps for dosei	2024-12-02 08:13:06 +01:00
h7x4	265ba953f0	common: temporarily disable systemd strictShellChecks	2024-11-29 01:36:34 +01:00
h7x4	82bba20e46	home/zed: temporarily disable	2024-11-29 01:35:44 +01:00
h7x4	0abd0c6251	home/ssh: simplify pvv ssh config	2024-11-29 01:35:14 +01:00
h7x4	e0683af8eb	flake.nix: remove overlayed calibre	2024-11-29 01:32:44 +01:00
h7x4	8aaad61fd3	flake.lock: bump	2024-11-29 01:32:04 +01:00
h7x4	1301e848ed	tsuki/hedgedoc: use sops templates for env, dedent	2024-11-29 00:41:30 +01:00
h7x4	fac13db8cb	tsuki/configuration: use sops templates for cirno drive creds	2024-11-29 00:27:44 +01:00
h7x4	edf81976ac	tsuki/osuchan: use sops template for secrets	2024-11-29 00:17:35 +01:00
h7x4	1d42923e3e	flake.nix: remove `inputs.secrets`	2024-11-28 23:56:39 +01:00
h7x4	c332f5dff6	tsuki/minecraft: remove usage of `secrets` module	2024-11-28 23:53:57 +01:00
h7x4	908c48be89	tsuki/matrix: remove usage of `secrets` module	2024-11-28 23:49:50 +01:00
h7x4	8ef308d3e6	tsuki/configuration: remove usage of `secrets` module	2024-11-28 16:47:33 +01:00
h7x4	219d364353	tsuki/kanidm: add toggleable debug flag	2024-11-28 16:36:45 +01:00
h7x4	4082011c98	tsuki/coturn: remove usage of `secrets` module	2024-11-28 16:36:03 +01:00
h7x4	45c51639ca	tsuki/nginx: fix minecraft map hosting	2024-11-28 16:34:43 +01:00
h7x4	ec628240b0	README: add a few useful commands	2024-11-28 16:33:51 +01:00
h7x4	596d5429ba	tsuki/nginx: general optimizations	2024-11-28 16:32:07 +01:00
h7x4	0ceeb49c23	home/direnv-auto-prune: only run if direnv has prunable state	2024-11-28 16:31:28 +01:00
h7x4	e6d429a970	tsuki/matrix-appservice-irc: reinit	2024-11-28 16:31:27 +01:00
h7x4	7c36272914	home/neovim: remove unused plugin	2024-11-19 13:54:37 +01:00
h7x4	3efeeed023	home/mpd: misc upgrades	2024-11-19 13:54:15 +01:00
h7x4	4e1eb31336	home: split programs/services into their own modules	2024-11-19 10:42:23 +01:00
h7x4	b8bd8612bb	home: prefer modules over direct package imports	2024-11-19 10:26:21 +01:00
h7x4	dc79a237b3	tsuki: fixes for nixos 24.11	2024-11-18 15:18:52 +01:00
h7x4	a4cc770a08	home/neovim: misc plugin changes	2024-11-18 14:29:27 +01:00
h7x4	9526c31c23	common: enable systemd strict shellchecks	2024-11-18 14:28:44 +01:00
h7x4	03aa1c3c39	dosei: disable nix-builders	2024-11-18 14:28:21 +01:00
h7x4	e341e72875	treewide: update to nixos 24.11	2024-11-18 14:27:31 +01:00
h7x4	d65273e67a	home/tmux: add missing scripts	2024-11-18 14:27:30 +01:00
h7x4	2b8a661288	tsuki/coturn: use default certificate	2024-11-15 12:15:32 +01:00
h7x4	4371bf9bd0	mozc/jawiki: bump	2024-11-15 12:10:50 +01:00
h7x4	2c325cf540	treewide: remove more usage of nix-secrets repository	2024-11-15 10:20:32 +01:00
h7x4	e0a957e448	home/git: add fixup-interactive script	2024-11-14 14:03:36 +01:00
h7x4	35e75ec9ad	home/git: unroll log alias format strings	2024-11-13 17:09:49 +01:00
h7x4	fb6cb3f09d	home: add uid/gid options, correctly configure atuin	2024-11-13 17:04:21 +01:00
h7x4	84c9562bfc	home/git: add rebase-fixups script	2024-11-13 16:57:47 +01:00
h7x4	a5cad921ff	home/git: add git-post-pr script	2024-11-13 16:57:47 +01:00
h7x4	49f0a457e5	home/git: add git-fixup-fixup script	2024-11-13 16:32:36 +01:00
h7x4	61a22b96cd	flake.lock: bump	2024-10-08 01:15:59 +02:00
h7x4	822ec8cb95	home/newsboat: add sources	2024-10-08 01:14:15 +02:00
h7x4	01ad63a473	home/xmonad: compile :)	2024-10-08 01:13:50 +02:00
h7x4	942c99b0f6	home/packages: add VPN stuff to packages	2024-10-08 01:13:25 +02:00
h7x4	0b54e2c090	home/shell: create alias for connecting to work VPN	2024-10-08 01:13:00 +02:00
h7x4	50d845a772	kasei: add testconfig file	2024-10-05 12:19:26 +02:00