install llm-agents from daily updating flake

fix syncthing proxy

.envrc

@@ -0,0 +1 @@
+use flake .

.gitea/workflows/build-images.yml

@@ -0,0 +1,38 @@
+name: Build Images
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: nixos-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Build aarch64 Image
+        run: nix build .#dockerImages.aarch64-linux.node --out-link ./image-aarch64.tar.gz --option build-hook ""
+
+      - name: Push to Gitea Registry
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          REGISTRY="${{ github.server_url }}"
+          REGISTRY="${REGISTRY#https://}"
+          REGISTRY="${REGISTRY#http://}"
+
+          # Push aarch64 image
+          skopeo copy \
+            --insecure-policy \
+            --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY_TOKEN }}" \
+            "docker-archive:./image-aarch64.tar.gz" \
+            "docker://${REGISTRY}/${{ github.repository }}/node:latest"
+
+          skopeo copy \
+            --insecure-policy \
+            --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY_TOKEN }}" \
+            "docker-archive:./image-aarch64.tar.gz" \
+            "docker://${REGISTRY}/${{ github.repository }}/node:latest-arm64"

.gitea/workflows/check.yml

@@ -0,0 +1,18 @@
+name: Check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    runs-on: nixos-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Check
+        run: nix flake check --all-systems

.gitignore

@@ -0,0 +1,4 @@
+/result
+/.direnv
+/.gcroots
+*.qcow2

.zed/tasks.json

@@ -0,0 +1,41 @@
+[
+  {
+    "label": "Apply local",
+    "command": "apply-local",
+    "use_new_terminal": false,
+    "allow_concurrent_runs": true,
+    "reveal": "no_focus",
+    "reveal_target": "dock",
+    "hide": "on_success",
+  },
+  {
+    "label": "Apply remote",
+    "command": "apply",
+    "args": ["--build-on-target"],
+    "use_new_terminal": false,
+    "allow_concurrent_runs": true,
+    "reveal": "no_focus",
+    "reveal_target": "dock",
+    "hide": "on_success",
+  },
+  {
+    "label": "Apply on freun-dev",
+    "command": "apply",
+    "args": ["--on", "freun-dev"],
+    "use_new_terminal": false,
+    "allow_concurrent_runs": true,
+    "reveal": "no_focus",
+    "reveal_target": "dock",
+    "hide": "on_success",
+  },
+  {
+    "label": "Apply on apu",
+    "command": "apply",
+    "args": ["--on", "apu"],
+    "use_new_terminal": false,
+    "allow_concurrent_runs": true,
+    "reveal": "no_focus",
+    "reveal_target": "dock",
+    "hide": "on_success",
+  },
+]

AGENTS.md

@@ -0,0 +1,23 @@
+# Agent Guidelines for NixOS Configuration
+
+## Build & Deploy Commands
+- `nix flake check` - Validate flake configuration
+- `build <host>` - Build configuration for specific host (e.g., `build radish`)
+- `apply <host>` - Deploy to remote host via colmena
+- `apply-local` - Apply configuration locally using nh
+- `nix build .#nixosConfigurations.<host>.config.system.build.toplevel` - Build specific host
+
+## Code Style
+- **Format**: Use `nixfmt-rfc-style` for all .nix files
+- **Imports**: List imports first, group by: local modules, external inputs (inputs.*)
+- **Function args**: Multi-line with trailing comma when >3 args: `{ config, lib, pkgs, ... }:`
+- **Options**: Define in `options.<service>` block, implement in `config = lib.mkIf cfg.enable { ... }`
+- **Types**: Use `lib.types.*` for option types (str, bool, int, etc.)
+- **String interpolation**: Use `"${}"` for Nix expressions, prefer lib.getExe for binaries
+- **Conditionals**: Use `lib.mkIf`, `lib.mkDefault`, `lib.mkMerge` for NixOS options
+
+## Structure
+- Host configs in `hosts/<name>/` with configuration.nix, default.nix, hardware-configuration.nix
+- Reusable modules in `modules/` and `modules/services/`
+- Custom packages in `custom-pkgs/` using util.package pattern
+- Secrets managed via agenix in `secrets/` directory

README.md

@@ -0,0 +1,3 @@
+# My NixOS Configurations
+
+[![check workflow status](https://git.freun.dev/repomaa/nixos/actions/workflows/check.yml/badge.svg)](https://git.freun.dev/repomaa/nixos/actions?workflow=check.yml) [![build images workflow status](https://git.freun.dev/repomaa/nixos/actions/workflows/build-images.yml/badge.svg)](https://git.freun.dev/repomaa/nixos/actions?workflow=build-images.yml)

custom-pkgs/default.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  inputs,
+  pkgs-unstable,
+  ...
+}:
+let
+  inherit (builtins) attrNames filter readDir;
+  dirs =
+    let
+      files = readDir ./.;
+    in
+    filter (name: files."${name}" == "directory") (attrNames files);
+  util = import ./util.nix;
+in
+lib.composeManyExtensions (
+  map (
+    dir:
+    import ./${dir} {
+      util = util dir;
+      inherit inputs lib pkgs-unstable;
+    }
+  ) dirs
+)

custom-pkgs/otp/default.nix

@@ -0,0 +1,7 @@
+{
+  util,
+  pkgs-unstable,
+  lib,
+  ...
+}:
+util.package { inherit pkgs-unstable lib; }

custom-pkgs/otp/otp.cr

@@ -0,0 +1,96 @@
+require "option_parser"
+
+NOTIFY_ICON         = {{env("NOTIFY_ICON")}}
+NOTIFY_SEND_COMMAND = {{env("NOTIFY_SEND")}}
+WL_COPY_COMMAND     = {{env("WL_COPY")}}
+YKMAN_COMMAND       = {{env("YKMAN")}}
+SKIM_COMMAND        = {{env("SKIM")}}
+WALKER_COMMAND      = {{env("WALKER")}}
+
+class OTP
+  private property dmenu_command : String = SKIM_COMMAND
+  private property dmenu_args = [] of String
+
+  def run
+    parser = OptionParser.new do |opts|
+      opts.banner = "Usage: #{PROGRAM_NAME} [options]"
+
+      opts.on("-h", "--help", "Display this help message") do
+        puts opts
+        exit
+      end
+
+      opts.on("-w", "--walker", "Use walker as dmenu") do
+        self.dmenu_command = WALKER_COMMAND
+        self.dmenu_args << "--dmenu" << "-p" << "Select account:"
+      end
+    end
+
+    parser.parse
+
+    self.dmenu_args += ["-q", *ARGV] unless ARGV.empty?
+
+    account = select_account
+    code = code_for(account)
+    copy(code)
+  end
+
+  private def notify_send(message, urgency = :normal)
+    return if message.chomp.empty?
+
+    Process.run(NOTIFY_SEND_COMMAND, ["-i", NOTIFY_ICON, "-u", urgency.to_s, "OTP", message.chomp])
+  end
+
+  private def list_accounts
+    error = IO::Memory.new
+    output = IO::Memory.new
+    status = Process.run(YKMAN_COMMAND, %w[oath accounts list], output: output, error: error)
+    errors = error.rewind.gets_to_end.try(&.chomp)
+    notify_send(errors, urgency: status.success? ? :normal : :critical) unless errors.empty?
+    exit status.exit_code unless status.success?
+
+    output.rewind.gets_to_end
+  end
+
+  private def select_account
+    output = IO::Memory.new
+    accounts = list_accounts
+    puts accounts
+    input = IO::Memory.new(accounts)
+    Process.run(dmenu_command, dmenu_args, output: output, input: input)
+
+    account = output.rewind.gets(chomp: true)
+    return account if account
+
+    notify_send("No account selected", urgency: :critical)
+    exit 1
+  end
+
+  private def code_for(account)
+    output = IO::Memory.new
+
+    Process.run(YKMAN_COMMAND, ["oath", "accounts", "code", "-s", account], output: output) do |process|
+      spawn do
+        while line = process.error.gets(chomp: true)
+          notify_send(line)
+        end
+      end
+    end
+
+    exit $?.exit_code unless $?.success?
+
+    code = output.rewind.gets(chomp: true)
+    return code if code
+
+    notify_send("No code generated", urgency: :critical)
+    exit 1
+  end
+
+  private def copy(code)
+    input = IO::Memory.new(code)
+    Process.run(WL_COPY_COMMAND, %w[-n], input: input)
+    notify_send("Copied to clipboard")
+  end
+end
+
+OTP.new.run

custom-pkgs/otp/package.nix

@@ -0,0 +1,22 @@
+{
+  pkgs,
+  lib,
+  pkgs-unstable,
+}:
+pkgs.runCommand "otp"
+  {
+    code = ./otp.cr;
+    env = {
+      YKMAN = lib.getExe pkgs-unstable.yubikey-manager;
+      SKIM = lib.getExe pkgs.skim;
+      WALKER = lib.getExe pkgs-unstable.walker;
+      WL_COPY = lib.getExe' pkgs.wl-clipboard "wl-copy";
+      NOTIFY_SEND = lib.getExe pkgs.libnotify;
+      NOTIFY_ICON = "${pkgs-unstable.yubioath-flutter}/share/pixmaps/com.yubico.yubioath.png";
+    };
+    nativeBuildInputs = [ pkgs.crystal ];
+  }
+  ''
+    mkdir -p $out/bin
+    crystal build $code --release -o $out/bin/otp
+  ''

custom-pkgs/util.nix

@@ -0,0 +1,5 @@
+dir: {
+  package = attrs: final: prev: {
+    "${dir}" = final.callPackage ./${dir}/package.nix (attrs // { pkgs = prev; });
+  };
+}

custom-pkgs/wl-copy-both/default.nix

@@ -0,0 +1 @@
+{ util, ... }: util.package { }

custom-pkgs/wl-copy-both/package.nix

@@ -0,0 +1,14 @@
+{ pkgs }:
+pkgs.writeShellScriptBin "wl-copy" ''
+  set -euo pipefail
+  copy="${pkgs.wl-clipboard}/bin/wl-copy"
+  paste="${pkgs.wl-clipboard}/bin/wl-paste"
+
+  "$copy" "$@"
+  args="$*"
+  if [[ "$args" =~ /(^| )(-p|--primary)($| )/ ]]; then
+    exit
+  fi
+
+  "$paste" -n | "$copy" -p "$@"
+''

flake.nix

@@ -1,26 +1,244 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-parts.url = "github:hercules-ci/flake-parts";
-    nextcloud = {
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
-      url = "github:onny/nixos-nextcloud-testumgebung";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     gtrackmap = {
       url = "github:gtrackmap/gtrackmap";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
-  outputs = { self, nixpkgs, gtrackmap, ... }@attrs: {
+    nixos-hardware = {
-    nixosConfigurations.freun-dev = nixpkgs.lib.nixosSystem {
+      url = "github:NixOS/nixos-hardware/master";
-      system = "x86_64-linux";
+      inputs.nixpkgs.follows = "nixpkgs";
-      specialArgs = attrs;
+    };
+    home-manager = {
+      url = "github:nix-community/home-manager/release-25.11";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    ketchup = {
+      url = "github:repomaa/ketchup";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    workout-sync = {
+      url = "sourcehut:~repomaa/workout-sync";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    hastebin = {
+      url = "sourcehut:~repomaa/hastebin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    ksoloti-pr.url = "github:repomaa/nixpkgs/pkg/ksoloti";
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    dnote = {
+      url = "github:dnote/dnote";
+      flake = false;
+    };
+    colmena = {
+      url = "github:zhaofengli/colmena";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    syntax-renderer = {
+      url = "sourcehut:~repomaa/syntax-renderer";
+      flake = false;
+    };
+    turny = {
+      url = "sourcehut:~repomaa/turny";
+      inputs.flake-parts.follows = "flake-parts";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    tonearm = {
+      url = "https://codeberg.org/dergs/Tonearm/archive/v1.0.0.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    voidauth = {
+      url = "github:repomaa/voidauth/feat/nix-packaging";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.flake-parts.follows = "flake-parts";
+    };
+    voxtype = {
+      url = "github:peteonrails/voxtype";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+    tree_hugger = {
+      url = "git+ssh://git@github.com/everii-Group/tree_hugger";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+    models-dev = {
+      url = "github:anomalyco/models.dev";
+      flake = false;
+    };
+    noctalia = {
+      url = "github:noctalia-dev/noctalia-shell";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+    niri-flake = {
+      url = "github:sodiboo/niri-flake";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+    nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
+    llm-agents = {
+      url = "github:numtide/llm-agents.nix";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+  };
+  outputs =
+    {
+      flake-parts,
+      agenix,
+      nixpkgs,
+      self,
+      colmena,
+      ...
+    }@inputs:
+    flake-parts.lib.mkFlake { inherit inputs; } (
+      { withSystem, ... }:
+      let
+        ssh.publicKeys = {
+          yubikey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIUkESu5NnBi1M0+ZjYrkp6/rIFuwc3aguspf98jmOydNce6l65cnS3GRzc9oWx4lu11ahi87ZuE+pYV+gaHm4=";
+          builder = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFuQaA6JKCOfsfUBI5tzoiYe3tdpLdPfVzeyByx/149C";
+        };
+        specialArgs = { inherit inputs ssh self; };
+
+      in
+      {
+        systems = [
+          "x86_64-linux"
+          "x86_64-darwin"
+          "aarch64-linux"
+          "aarch64-darwin"
+        ];
+        perSystem =
+          { pkgs, system, ... }:
+          {
+            devShells.default = pkgs.mkShell {
+              packages = with pkgs; [
+                agenix.packages.${system}.default
+                colmena.packages.${system}.colmena
+                colmena.packages.${system}.manual
+                (writeShellScriptBin "build" ''
+                  colmena build --keep-result "$@"
+                '')
+                (writeShellScriptBin "apply" ''
+                  colmena apply --keep-result "$@"
+                '')
+                (writeShellScriptBin "apply-local" ''
+                  nh os switch .
+                '')
+              ];
+            };
+          };
+        flake = {
+          nixosConfigurations =
+            let
+              mkConfiguration =
+                name:
+                nixpkgs.lib.nixosSystem {
+                  inherit specialArgs;
                   modules = [
-        ./hardware-configuration.nix
+                    ./modules
-        ./configuration.nix
+                    ./hosts/${name}
-        ./services.nix
+                  ];
-        gtrackmap.nixosModules.x86_64-linux.default
+                };
+            in
+            {
+              radish = mkConfiguration "radish";
+              freun-dev = mkConfiguration "freun-dev";
+              apu = mkConfiguration "apu";
+              turny = mkConfiguration "turny";
+            };
+
+          images.turny = self.nixosConfigurations.turny.config.system.build.sdImage;
+
+          dockerImages =
+            nixpkgs.lib.genAttrs
+              [
+                "x86_64-linux"
+                "aarch64-linux"
+              ]
+              (
+                system:
+                withSystem system (
+                  { pkgs, ... }:
+                  {
+                    node =
+                      let
+                        setupDirs = pkgs.runCommand "setup-dirs" { } ''
+                          mkdir -p $out/tmp $out/root $out/var/tmp
+                          chmod 1777 $out/tmp $out/var/tmp
+                        '';
+                      in
+                      pkgs.dockerTools.buildLayeredImage {
+                        name = "node";
+                        tag = "latest";
+                        contents = with pkgs; [
+                          nodejs
+                          nix
+                          busybox
+                          bash
+                          skopeo
+                          cacert
+                          git
+                          setupDirs
+                          (writeTextFile {
+                            name = "etc-nix-nix-conf";
+                            destination = "/etc/nix/nix.conf";
+                            text = ''
+                              build-users-group =
+                              experimental-features = nix-command flakes
+                            '';
+                          })
+                        ];
+                        config = {
+                          Env = [
+                            "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
+                            "NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-bundle.crt"
+                            "HOME=/root"
                           ];
                         };
                       };
                   }
+                )
+              );
+          colmenaHive = colmena.lib.makeHive self.outputs.colmena;
 
+          colmena =
+            let
+              deploymentOptions = {
+                freun-dev = {
+                  targetHost = "freun.dev";
+                  buildOnTarget = true;
+                };
+                radish = {
+                  allowLocalDeployment = true;
+                  targetHost = null;
+                };
+                turny = {
+                  targetHost = "10.10.1.233";
+                };
+              };
+            in
+            {
+              meta = {
+                inherit specialArgs;
+
+                nixpkgs = import nixpkgs {
+                  system = "x86_64-linux";
+                  overlays = [ ];
+                };
+              };
+            }
+            // builtins.mapAttrs (name: config: {
+              imports = config._module.args.modules;
+              deployment = if builtins.hasAttr name deploymentOptions then deploymentOptions.${name} else { };
+            }) self.nixosConfigurations;
+        };
+      }
+    );
+}

grafana.nix

@@ -1,60 +0,0 @@
-{ ... }:
-let
-  fqdn = "graph.freun.dev";
-  port = 3300;
-in
-{
-  services.grafana = {
-    enable = true;
-
-    settings = {
-      server = {
-      	root_url = "https://${fqdn}";
-        http_port = port;
-      };
-
-      database = {
-        host = "/var/run/postgresql";
-        type = "postgres";
-        user = "grafana";
-      };
-
-      smtp = {
-        enabled = true;
-        host = "horologium.uberspace.de";
-        from_address = "noreply@freun.dev";
-        from_name = "Vaultwarden";
-        user = "noreply@freun.dev";
-        password = "$__file{/var/secrets/smtp-password}";
-      };
-    };
-  };
-
-  services.prometheus = {
-    enable = true;
-    exporters.node.enable = true;
-    scrapeConfigs = [
-      {
-        job_name = "node";
-        static_configs = [
-          { targets = [ "localhost:9100" ]; }
-        ];
-      }
-    ];
-  };
-
-  services.caddy.virtualHosts = {
-    "${fqdn}".extraConfig = ''
-      reverse_proxy localhost:${builtins.toString port}
-    '';
-  };
-
-  services.postgresql = {
-    ensureDatabases = [ "grafana" ];
-    ensureUsers = [{
-      name = "grafana";
-      ensureDBOwnership = true;
-    }];
-  };
-}
-

gtrackmap.nix

@@ -1,16 +0,0 @@
-{ config, ... }:
-let
-  fqdn = "trackmap.freun.dev";
-in
-{
-  services.gtrackmap = {
-    enable = true;
-    port = 3200;
-  };
-
-  services.caddy.virtualHosts = {
-    "${fqdn}".extraConfig = ''
-      reverse_proxy localhost:${toString config.services.gtrackmap.port}
-    '';
-  };
-}

home/common/dnote.nix

@@ -0,0 +1,44 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  pkgs-unstable,
+  config,
+  ...
+}:
+let
+  completion = pkgs.stdenv.mkDerivation {
+    name = "dnote-completion";
+    phases = [
+      "unpackPhase"
+      "installPhase"
+    ];
+    src = inputs.dnote;
+    installPhase = ''
+      mkdir -p $out/lib/dnote/zsh-completion/completions
+      cp pkg/cli/dnote-completion.zsh $out/lib/dnote/zsh-completion/completions/_dnote
+    '';
+  };
+  client = pkgs.stdenv.mkDerivation {
+    name = "dnote-client";
+    phases = [ "installPhase" ];
+    installPhase = ''
+      mkdir -p $out/bin
+      cp ${pkgs-unstable.dnote}/bin/dnote-cli $out/bin/dnote
+    '';
+  };
+  cfg = config.programs.dnote;
+in
+{
+  options.programs.dnote = {
+    enable = pkgs.lib.mkEnableOption "Enable dnote";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ client ];
+    home.shellAliases.dn = "dnote";
+    programs.zsh.initContent = ''
+      fpath=(${completion}/lib/dnote/zsh-completion/completions $fpath)
+    '';
+  };
+}

home/common/dotfiles/tmux/tmux.conf

@@ -0,0 +1,69 @@
+# vim: ft=tmux
+# original from bl1nk
+# Styles
+setw -g mode-style "fg=yellow,bg=default,bright"
+setw -g window-status-style "fg=default,bg=default,dim"
+setw -g window-status-current-style "fg=yellow,bg=default,dim"
+set -g message-style "fg=red,bg=default,bright"
+set -g status-style "fg=default,bg=black,bright"
+set -g pane-active-border-style "fg=blue,bg=black"
+set -g allow-passthrough 1
+set-option -g set-titles on
+set-option -g focus-events on
+# set set-titles-string "#{session_name}"
+
+# Options
+set -g bell-action any
+set -g history-limit 50000
+set -g status on
+#set -g status-keys vi
+#set -g status-utf8 on
+set -g set-titles on
+
+set -g default-terminal "tmux-256color"
+set -as terminal-features ",foot*:RGB,alacritty*:RGB,gnome*:RGB"
+set -g set-titles-string "tmux:#I [ #W ]"
+set -g base-index 1
+set -g pane-base-index 1
+set -g @plugin 'base16-project/base16-tmux'
+
+set -g update-environment "DISPLAY SSH_ASKPASS SSH_AGENT_PID SSH_CONNECTION WINDOWID XAUTHORITY BASE16_SHELL"
+
+set -g status-left-length 30
+set -g status-left '[#[fg=white]#S]#[fg=black,bright] #[default]'
+set -sg escape-time 0
+
+#setw -g utf8 on
+setw -g automatic-rename on
+setw -g clock-mode-style 24
+#setw -g mode-keys vi
+setw -g mouse on
+
+bind-key q confirm kill-pane
+bind-key Q confirm kill-session
+bind-key Tab next-window
+
+bind-key > switchc -n
+bind-key > switchc -p
+
+bind-key C-n new-window -c "#{pane_current_path}"
+bind-key C-t new-window -c "#{pane_current_path}" "~/bin/share-tty $(tmux display -p '#S')"
+
+bind-key u run tmux-url-select
+
+bind-key o split-window -h -c '#{pane_current_path}'
+bind-key u split-window -v -c '#{pane_current_path}'
+bind-key C-o split-window -h -c '#{pane_current_path}'
+bind-key C-u split-window -v -c '#{pane_current_path}'
+
+bind-key -r C-h select-pane -L
+bind-key -r C-j select-pane -D
+bind-key -r C-k select-pane -U
+bind-key -r C-l select-pane -R
+
+bind-key f resize-pane -Z
+bind-key r source-file ~/.config/tmux/tmux.conf
+
+bind-key -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "xclip -i"
+bind -T root MouseDown2Pane select-pane -t =\; run -b "xclip -o | tmux load-buffer - && tmux paste-buffer -s ' '"
+run '~/.tmux/plugins/tpm/tpm'

home/common/dotfiles/zsh/completion

@@ -0,0 +1,30 @@
+#!/bin/zsh
+# The following lines were added by compinstall
+
+zstyle ':completion:*' completer _expand _complete _ignored _approximate
+zstyle ':completion:*' completions 1
+zstyle ':completion:*' expand prefix
+zstyle ':completion:*' format '%BCompleting %d%b'
+zstyle ':completion:*' glob 1
+zstyle ':completion:*' group-name ''
+zstyle ':completion:*' ignore-parents parent pwd
+zstyle ':completion:*' insert-unambiguous true
+zstyle ':completion:*' list-colors ${(s.:.)LS_COLORS}
+zstyle ':completion:*' list-prompt %SAt %p: Hit TAB for more, or the character to insert%s
+zstyle ':completion:*' list-suffixes true
+zstyle ':completion:*' matcher-list '' 'm:{[:lower:][:upper:]}={[:upper:][:lower:]}' 'r:|[._-]=** r:|=**' 'l:|=* r:|=*'
+zstyle ':completion:*' max-errors 1
+zstyle ':completion:*' menu select=3
+zstyle ':completion:*' original true
+zstyle ':completion:*' preserve-prefix '//[^/]##/'
+zstyle ':completion:*' prompt 'Did you mean...'
+zstyle ':completion:*' select-prompt %SScrolling active: current selection at %p%s
+zstyle ':completion:*' squeeze-slashes true
+zstyle ':completion:*' substitute 1
+zstyle ':completion:*' verbose true
+zstyle ':completion:*' word true
+zstyle :compinstall filename "$ZDOTDIR/completion"
+
+autoload -Uz compinit
+compinit
+# End of lines added by compinstall

home/common/dotfiles/zsh/functions

@@ -0,0 +1,64 @@
+#!/usr/bin/zsh
+
+scratch () {
+  nvim -c ":set ft=$1" $(mktemp)
+}
+
+tsessions() {
+	tmux list-sessions -F '#{session_name} #{?session_attached,,not_attached}' | \
+		awk '/not_attached/{print $1}'
+}
+
+tkill() {
+	tsessions | fzf | xargs tmux kill-session -t
+}
+
+tswitch() {
+	tsessions | fzf | xargs tmux switch-client -t
+}
+
+tnew() {
+	tmux new -d -s "$@"
+	tmux switch-client -t $1
+}
+
+asciirec() {
+	local tempfile=$(mktemp /tmp/asciirec.XXXXX.asciinema.json)
+	asciinema rec "$tempfile"
+	fb "$tempfile"
+	rm "$tempfile"
+}
+
+fbs() {
+	local url=$1
+	local time=${2-5}
+
+	fb <<-HTML | rev | cut -c 2- | rev | xclip
+	<html>
+	<head>
+		<meta http-equiv="refresh" content="${time}; url=${url}" />
+	</head>
+	<body>
+		<h3>Redirect</h3>
+		<p>Redirecting you to <a href="${url}">${url}</a></p>
+	</body>
+	</html>
+	HTML
+
+	xclip -o
+}
+
+qrshow() {
+	local url=$1
+	[[ -z "$url" ]] && read url
+	qrencode -o - "$url" | feh -
+}
+
+envy() {
+	env $(cat .env | sed '/^\s*#/d') "$@"
+}
+
+add-hash() {
+	hash -d "$@=$PWD"
+	echo "hash -d '$@=$PWD'" >> "$ZDOTDIR/hashes"
+}

home/common/dotfiles/zsh/init

@@ -0,0 +1,79 @@
+#!/bin/zsh
+
+# History {{{
+HISTFILE="$XDG_CACHE_HOME/zsh/history"
+HISTSIZE=100000
+SAVEHIST=100000
+setopt hist_ignore_dups
+setopt hist_ignore_space
+setopt share_history
+setopt autopushd
+
+mkdir -p $(dirname "$HISTFILE")
+# }}}
+
+# Various options {{{
+setopt autocd extendedglob nomatch notify histfindnodups
+unsetopt beep
+setopt interactive_comments
+# }}}
+
+# Vim mode
+bindkey -v
+
+# Keybindings {{{
+bindkey '^?' backward-delete-char
+bindkey '^h' backward-delete-char
+bindkey '^w' backward-kill-word
+bindkey '^r' history-incremental-pattern-search-backward
+bindkey '^k' history-beginning-search-backward
+bindkey '^j' history-beginning-search-forward
+bindkey '^p' push-input
+bindkey '^ ' fzf-cd-widget
+# }}}
+
+# Prompt {{{
+autoload -Uz vcs_info
+precmd_functions+=( vcs_info )
+setopt prompt_subst
+PROMPT="%#$([ -n "$IN_NIX_SHELL" ] && echo '%F{blue}ns%f') %1~%(0?..%F{red})>%f "
+RPROMPT=\$vcs_info_msg_0_
+zstyle ':vcs_info:git:*' check-for-changes true
+zstyle ':vcs_info:git:*' formats '<%b> [%u%c]'
+# }}}
+
+# Safe rm {{{
+alias rm='rm -I '
+setopt rm_star_silent
+# }}}
+
+for file in completion functions; do
+	[ -f "$XDG_CONFIG_HOME/zsh/$file" ] || touch "$XDG_CONFIG_HOME/zsh/$file"
+	. "$XDG_CONFIG_HOME/zsh/$file"
+done
+
+# GPG Agent {{{
+export GPG_TTY=$(tty)
+gpg-connect-agent updatestartuptty /bye >/dev/null
+# }}}
+
+# Base16 {{{
+export BASE16_SHELL="$HOME/.config/base16-shell/"
+[ -n "$PS1" ] && \
+	[ -s "$BASE16_SHELL/profile_helper.sh" ] && \
+		eval "$("$BASE16_SHELL/profile_helper.sh")"
+# }}}
+
+
+# NVM {{{
+#if [ -f /usr/share/nvm/init-nvm.sh ]; then
+#	source /usr/share/nvm/init-nvm.sh
+#fi
+# }}}
+
+# ENVS {{{
+#eval "$(rbenv init -)"
+#. /usr/share/nvm/nvm.sh
+# }}}
+
+# vim: set foldmethod=marker

home/common/secrets.nix

@@ -0,0 +1,15 @@
+{ lib, ... }:
+{
+  age.secrets = lib.listToAttrs (
+    map
+      (secret: {
+        name = secret;
+        value = {
+          file = ../../secrets/${secret}.age;
+        };
+      })
+      [
+        "context7"
+      ]
+  );
+}

home/default.nix

@@ -0,0 +1,18 @@
+{
+  inputs,
+  pkgs-unstable,
+  self,
+  ...
+}:
+{
+  home-manager = {
+    users = {
+      jokke = import ./jokke;
+      moco = import ./moco;
+    };
+    extraSpecialArgs = { inherit inputs self pkgs-unstable; };
+    sharedModules = [ (import ./common) ];
+    useUserPackages = true;
+    useGlobalPkgs = true;
+  };
+}

home/gnome/default.nix

@@ -0,0 +1,150 @@
+{
+  config,
+  lib,
+  osConfig,
+  ...
+}:
+let
+  cfg = config.gnome;
+in
+{
+  imports = [ ./extensions ];
+
+  options.gnome = with lib.types; {
+    profilePicture = lib.mkOption {
+      type = nullOr path;
+      default = null;
+    };
+    keyboard = {
+      sources = lib.mkOption {
+        type = listOf str;
+        default = [ "us" ];
+      };
+    };
+    keybindings = {
+      builtin = lib.mkOption {
+        type = attrsOf (listOf str);
+        default = { };
+      };
+      custom = lib.mkOption {
+        type = listOf (submodule {
+          options = {
+            binding = lib.mkOption { type = str; };
+            command = lib.mkOption { type = str; };
+            name = lib.mkOption { type = str; };
+          };
+        });
+        default = [ ];
+      };
+    };
+    scalingFactor = lib.mkOption {
+      type = numbers.positive;
+      default = 1;
+    };
+    power = {
+      powerButton = lib.mkOption {
+        type = enum [
+          "suspend"
+          "interactive"
+          "hibernate"
+          "nothing"
+        ];
+        default = "interactive";
+      };
+    };
+    nightLight = {
+      enable = lib.mkEnableOption { };
+      temperature = lib.mkOption {
+        type = ints.between 1700 4700;
+        default = 2700;
+      };
+      schedule = lib.mkOption {
+        type = nullOr (submodule {
+          options = {
+            from = lib.mkOption {
+              type = numbers.between 0 23.99;
+              default = 20.0;
+            };
+            to = lib.mkOption {
+              type = numbers.between 0 23.99;
+              default = 8.0;
+            };
+          };
+        });
+        default = null;
+      };
+    };
+    calendar = {
+      showWeekNumbers = lib.mkEnableOption { };
+    };
+    automaticTimeZone = lib.mkEnableOption { };
+    region = lib.mkOption {
+      type = str;
+      default = osConfig.i18n.defaultLocale;
+    };
+  };
+
+  config = {
+    dconf.settings =
+      with lib.hm.gvariant;
+      {
+        "org/gnome/shell/keybindings" = cfg.keybindings.builtin;
+        "org/gnome/settings-daemon/plugins/media-keys" = {
+          custom-keybindings = (
+            lib.lists.imap0 (
+              i: _: "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom${toString i}/"
+            ) cfg.keybindings.custom
+          );
+        };
+        "org/gnome/desktop/input-sources" = {
+          sources = map (
+            source:
+            mkTuple [
+              "xkb"
+              source
+            ]
+          ) cfg.keyboard.sources;
+        };
+        "org/gnome/mutter" = {
+          experimental-features = [ "scale-monitor-framebuffer" ];
+        };
+        "org/gnome/settings-daemon/plugins/xsettings" = {
+          overrides = [
+            (mkTuple [
+              "GdkWindowScalingFactor"
+              cfg.scalingFactor
+            ])
+          ];
+        };
+        "org/gnome/desktop/interface" = {
+          scaling-factor = cfg.scalingFactor;
+        };
+        "org/gnome/settings-daemon/plugins/power" = {
+          "power-button-action" = cfg.power.powerButton;
+        };
+        "org/gnome/settings-daemon/plugins/color" = with cfg.nightLight; {
+          night-light-enabled = enable;
+          night-light-temperature = temperature;
+          night-light-schedule-automatic = isNull schedule;
+          night-light-schedule-from = lib.mkIf (!isNull schedule) schedule.from;
+          night-light-schedule-to = lib.mkIf (!isNull schedule) schedule.to;
+        };
+        "org/gnome/desktop/calendar" = {
+          show-weekdate = cfg.calendar.showWeekNumbers;
+        };
+        "org/gnome/desktop/datetime" = {
+          automatic-timezone = cfg.automaticTimeZone;
+        };
+        "system/locale" = {
+          region = cfg.region;
+        };
+      }
+      // (builtins.listToAttrs (
+        lib.lists.imap0 (i: keybinding: {
+          name = "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom${toString i}";
+          value = keybinding;
+        }) cfg.keybindings.custom
+      ));
+    home.file.".face".source = lib.mkIf (!isNull cfg.profilePicture) cfg.profilePicture;
+  };
+}

home/gnome/extensions/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+let
+  inherit (builtins) attrNames filter readDir;
+  dirs =
+    let
+      files = readDir ./.;
+    in
+    filter (name: files."${name}" == "directory") (attrNames files);
+in
+{
+  imports = map (dir: ./${dir}) dirs;
+}

home/gnome/extensions/freon/default.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.gnome.extensions.freon;
+in
+{
+  options.gnome.extensions = with lib.types; {
+    freon = {
+      enable = lib.mkEnableOption { };
+      package = lib.mkOption {
+        type = package;
+        default = pkgs.gnomeExtensions.freon;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    dconf.settings = {
+      "org/gnome/shell".enabled-extensions = [
+        cfg.package.extensionUuid
+      ];
+    };
+    home.packages = [ cfg.package ];
+  };
+}

home/gnome/extensions/paperwm/default.nix

@@ -0,0 +1,97 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.gnome.extensions;
+in
+{
+  options.gnome.extensions = with lib.types; {
+    paperwm = {
+      enable = lib.mkEnableOption { };
+      package = lib.mkOption {
+        type = package;
+        default = pkgs.gnomeExtensions.paperwm;
+      };
+      cycle-height-steps = lib.mkOption {
+        type = listOf numbers.nonnegative;
+        default = [
+          0.33
+          0.5
+          0.67
+          1.0
+        ];
+      };
+      cycle-width-steps = lib.mkOption {
+        type = listOf numbers.nonnegative;
+        default = [
+          0.33
+          0.5
+          0.67
+          1.0
+        ];
+      };
+      horizontal-margin = lib.mkOption {
+        type = ints.unsigned;
+        default = 5;
+      };
+      vertical-margin = lib.mkOption {
+        type = ints.unsigned;
+        default = 5;
+      };
+      window-gap = lib.mkOption {
+        type = ints.unsigned;
+        default = 5;
+      };
+      winprops = lib.mkOption {
+        type = listOf (submodule {
+          options = {
+            wm_class = lib.mkOption {
+              type = str;
+              default = "";
+            };
+            title = lib.mkOption {
+              type = str;
+              default = "";
+            };
+            scratch_layer = lib.mkEnableOption { };
+            preferredWidth = lib.mkOption {
+              type = nullOr str;
+              default = null;
+            };
+          };
+        });
+        default = [ ];
+      };
+      keybindings = lib.mkOption {
+        type = attrsOf (listOf str);
+        default = { };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.paperwm.enable {
+    home.packages = [ cfg.paperwm.package ];
+    dconf.settings = {
+      "org/gnome/shell".enabled-extensions = lib.mkIf cfg.paperwm.enable [
+        cfg.paperwm.package.extensionUuid
+      ];
+      "org/gnome/shell/extensions/paperwm" =
+        with cfg.paperwm;
+        lib.mkIf cfg.paperwm.enable {
+          inherit
+            cycle-height-steps
+            cycle-width-steps
+            horizontal-margin
+            vertical-margin
+            window-gap
+            ;
+          winprops = map (props: builtins.toJSON props) winprops;
+        };
+      "org/gnome/shell/extensions/paperwm/keybindings" =
+        lib.mkIf cfg.paperwm.enable cfg.paperwm.keybindings;
+    };
+  };
+}

home/jokke/default.nix

@@ -0,0 +1,57 @@
+{
+  pkgs,
+  pkgs-unstable,
+  inputs,
+  ...
+}:
+{
+  config = {
+    # Home Manager needs a bit of information about you and the paths it should
+    # manage.
+    home.username = "jokke";
+    home.homeDirectory = "/home/jokke";
+    home.packages = with pkgs; [
+      ffmpeg
+      mediainfo
+      git-lfs
+      shards
+      deno
+      virt-manager
+      gimp
+      lftp
+      inkscape
+      wineWowPackages.waylandFull
+      reaper
+      inputs.ksoloti-pr.legacyPackages.${pkgs.stdenv.hostPlatform.system}.ksoloti
+      calibre
+      jellyfin-media-player
+      darktable
+      shutter
+      git-annex
+      hledger
+      hledger-ui
+      hledger-iadd
+    ];
+
+    gnome.profilePicture = ../assets/profile-pictures/jokke.png;
+
+    programs.ssh.matchBlocks = {
+      "alderaan" = {
+        hostname = "alderaan.space";
+        user = "root";
+      };
+      "base.alderaan" = {
+        hostname = "base.alderaan.space";
+        user = "luke";
+      };
+      "jokke.space" = {
+        user = "root";
+      };
+    };
+
+    programs.git.settings.user.email = "joakim@repomaa.com";
+    services.syncthing = {
+      enable = true;
+    };
+  };
+}

home/moco/default.nix

@@ -0,0 +1,220 @@
+{
+  pkgs,
+  pkgs-unstable,
+  lib,
+  ...
+}:
+let
+  homeDirectory = "/home/moco";
+  nmcli = lib.getExe' pkgs.networkmanager "nmcli";
+  ykman = lib.getExe pkgs.yubikey-manager;
+  isMocoVpnActive = lib.getExe (
+    pkgs.writeShellScriptBin "is-moco-vpn-active" ''
+      ${nmcli} -t -f NAME connection show --active | grep -q '^moco$'
+    ''
+  );
+in
+{
+  # Home Manager needs a bit of information about you and the paths it should
+  # manage.
+  home = {
+    username = "moco";
+    inherit homeDirectory;
+    packages = with pkgs; [
+      chromium
+      (slack.overrideAttrs (oldAttrs: {
+        fixupPhase = ''
+          sed -i -e 's/,"WebRTCPipeWireCapturer"/,"LebRTCPipeWireCapturer"/' $out/lib/slack/resources/app.asar
+
+          rm $out/bin/slack
+          makeWrapper $out/lib/slack/slack $out/bin/slack \
+            --prefix XDG_DATA_DIRS : $GSETTINGS_SCHEMAS_PATH \
+            --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+            --add-flags "--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer"
+        '';
+      }))
+      pkgs-unstable.chromedriver
+      kooha
+      gnome-pomodoro
+      mitmproxy
+      (writeShellScriptBin "moco-admin-pw" ''
+        password=$(op item get n5h4c237tqnnlr5gruxyqmmggy --reveal --fields label=Kennwort)
+        otp=$(ykman oath accounts code -s 'MOCO:Admin')
+        echo "''${password}''${otp}" | wl-copy -n
+      '')
+      (writeShellScriptBin "moco-reto-otp" ''
+        ykman oath accounts code -s 'MOCO Reto' | wl-copy -n
+      '')
+      (writeShellScriptBin "toggle-moco-vpn" ''
+        if ${isMocoVpnActive}; then
+          ${nmcli} c down moco
+        else
+          ${ykman} oath accounts code -s 'MOCO Reto' | ${nmcli} c up moco --ask
+        fi
+      '')
+    ];
+  };
+
+  gnome = {
+    profilePicture = ../assets/profile-pictures/moco.png;
+    calendar.showWeekNumbers = true;
+    extensions.paperwm.winprops = [
+      {
+        wm_class = "gnome-pomodoro";
+        scratch_layer = true;
+      }
+    ];
+  };
+
+  programs.poetry = {
+    enable = true;
+    settings = {
+      virtualenvs = {
+        create = true;
+        inProject = true;
+      };
+    };
+  };
+
+  programs.zsh = {
+    cdpath = [
+      "${homeDirectory}/Code/mocoapp"
+      "${homeDirectory}/Code/mocoapp-promo"
+      "${homeDirectory}/Code/mocoapp-llama"
+    ];
+    dirHashes = {
+      moco = "${homeDirectory}/Code/mocoapp";
+      promo = "${homeDirectory}/Code/mocoapp-promo";
+      llama = "${homeDirectory}/Code/mocoapp-llama";
+    };
+  };
+
+  programs.git.settings.user.email = "joakim.repomaa@mocoapp.com";
+
+  programs.ssh.matchBlocks =
+    let
+      aliases = [
+        "moco"
+        "mocoapp"
+        "mocoapp.com"
+      ];
+      matcher =
+        subdomains:
+        builtins.concatStringsSep " " (
+          map (
+            alias:
+            builtins.concatStringsSep " " (
+              map (subdomain: "*.${subdomain}.${alias} ${subdomain}.${alias}") subdomains
+            )
+          ) aliases
+        );
+    in
+    {
+      "console.*.moco" = {
+        extraOptions = {
+          RequestTTY = "force";
+          RemoteCommand = "./rails-console.sh";
+        };
+      };
+
+      "${matcher [
+        "reto"
+        "reto.intern"
+      ]}" =
+        {
+          hostname = "reto.intern.mocoapp.com";
+          user = "jokke";
+        };
+
+      "${matcher [ "web" ]}" = {
+        hostname = "mocoapp.com";
+      };
+      "${matcher [ "prod-inc" ]}" = {
+        hostname = "prod-inc.mocoapp.com";
+      };
+      "${matcher [ "prod" ]}" = {
+        hostname = "web02.mocoapp";
+      };
+      "${matcher [
+        "pfg"
+        "primeforcegroup"
+      ]}" =
+        {
+          hostname = "primeforcegroup.mocoapp.com";
+        };
+      "${matcher [ "crafft" ]}" = {
+        hostname = "crafft.mocoapp.com";
+      };
+      "${matcher [
+        "bd"
+        "businessdecision"
+      ]}" =
+        {
+          hostname = "businessdecision.mocoapp.com";
+        };
+      "${matcher [ "festland" ]}" = {
+        hostname = "festland.mocoapp.com";
+      };
+      "${matcher [
+        "oi"
+        "one-inside"
+      ]}" =
+        {
+          hostname = "one-inside.mocoapp.com";
+        };
+      "${matcher [
+        "se"
+        "scope-engineering"
+      ]}" =
+        {
+          hostname = "scope-engineering.mocoapp.com";
+        };
+      "${matcher [
+        "cpc"
+        "cpc-ag"
+      ]}" =
+        {
+          hostname = "cpc-ag.mocoapp.com";
+        };
+      "${matcher [ "weareact3" ]}" = {
+        hostname = "weareact3.mocoapp.com";
+      };
+      "${matcher [ "avenit" ]}" = {
+        hostname = "avenit.mocoapp.com";
+      };
+      "${matcher [ "staging" ]}" = {
+        hostname = "staging.mocoapp.com";
+      };
+      "${matcher [ "staging-v2" ]}" = {
+        hostname = "staging-v2.mocoapp.com";
+      };
+      "${matcher [ "staging-v3" ]}" = {
+        hostname = "staging-v3.mocoapp.com";
+      };
+      "${matcher [ "staging-v4" ]}" = {
+        hostname = "staging-v4.mocoapp.com";
+      };
+      "${matcher [ "staging-v5" ]}" = {
+        hostname = "staging-v5.mocoapp.com";
+      };
+      "${matcher [ "staging-v6" ]}" = {
+        hostname = "staging-v6.mocoapp.com";
+      };
+      "${matcher [
+        "prod-db"
+        "production-db"
+      ]}" =
+        {
+          hostname = "production-db.mocoapp";
+        };
+      "${matcher [ "pdf-renderer" ]}" = {
+        hostname = "mocoapp-pdf-renderer01.mocoapp.com";
+      };
+      "*.moco *.mocoapp *.mocoapp.com" = {
+        forwardAgent = true;
+      };
+      "*.moco !reto.moco *.mocoapp.com !reto.mocoapp.com" = {
+        user = "butler";
+      };
+    };
+}

home/modules/elephant/default.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  pkgs-unstable,
+  ...
+}:
+let
+  cfg = config.services.elephant;
+  wrappedPackage = pkgs.symlinkJoin {
+    inherit (cfg.package) name meta;
+    paths = [ cfg.package ];
+    nativeBuildInputs = [ pkgs.makeBinaryWrapper ];
+    postBuild = ''
+      wrapProgram $out/bin/elephant \
+        --prefix PATH : ${lib.makeBinPath [ pkgs.bash ]}
+    '';
+  };
+in
+{
+  options.services.elephant = {
+    enable = lib.mkEnableOption "Enable Elephant";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs-unstable.elephant;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.user.services.elephant = {
+      Unit = {
+        Description = "Elephant";
+        After = [ "niri.service" ];
+        Wants = [ "niri.service" ];
+      };
+      Service = {
+        ExecStart = lib.getExe wrappedPackage;
+        Restart = "on-failure";
+      };
+      Install.WantedBy = [ "graphical-session.target" ];
+    };
+  };
+}

home/modules/voxtype/default.nix

@@ -0,0 +1,100 @@
+{
+  config,
+  osConfig,
+  lib,
+  pkgs,
+  pkgs-unstable,
+  ...
+}:
+let
+  cfg = config.programs.voxtype;
+  postProcessUnwrapped =
+    pkgs.runCommand "voxtype-post-process-unwrapped"
+      {
+        code = ./post-process.cr;
+        nativeBuildInputs = [
+          pkgs-unstable.crystal
+        ];
+      }
+      ''
+        mkdir -p $out/bin
+        crystal build $code -o $out/bin/voxtype-post-process
+      '';
+
+  postProcess = pkgs.symlinkJoin {
+    name = "voxtype-post-process";
+    paths = [ postProcessUnwrapped ];
+    nativeBuildInputs = [ pkgs.makeBinaryWrapper ];
+    postBuild = ''
+      wrapProgram $out/bin/voxtype-post-process \
+        --set OLLAMA_PORT ${toString osConfig.services.ollama.port} \
+        --set WALKER_BIN ${lib.getExe config.services.walker.package}
+    '';
+    meta.mainProgram = "voxtype-post-process";
+  };
+
+  postProcessingConfig = pkgs.writeText "voxtype-post-processing.json" (
+    builtins.toJSON cfg.postProcessing.settings
+  );
+in
+{
+  options.programs.voxtype = {
+    postProcessing = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Enable post-processing of transcriptions";
+          settings = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                model = lib.mkOption {
+                  type = lib.types.str;
+                  description = "The ollama model to use for post-processing";
+                };
+                commonInstructions = lib.mkOption {
+                  type = lib.types.str;
+                  default = "no quotes, no emojis, no explanations";
+                  description = "Instructions to include in every post-processing prompt";
+                };
+                prompts = lib.mkOption {
+                  type = lib.types.listOf (
+                    lib.types.submodule {
+                      options = {
+                        title = lib.mkOption {
+                          type = lib.types.str;
+                          description = "A title for this prompt, used in the selector";
+                        };
+                        instructions = lib.mkOption {
+                          type = lib.types.str;
+                          description = "Instructions to include in the post-processing prompt, in addition to the common instructions";
+                        };
+                      };
+                    }
+                  );
+                  default = [
+                    {
+                      title = "Clean up";
+                      instructions = "Clean up this dictation. Remove filler words, fix grammar and punctuation. Output ONLY the cleaned text";
+                    }
+                  ];
+                };
+              };
+            };
+            default = { };
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.postProcessing.enable {
+    xdg.configFile."voxtype/post-processing.json".source = postProcessingConfig;
+    programs.voxtype.settings.output.post_process = {
+      command = lib.getExe postProcess;
+      timeout_ms = 5 * 60 * 1000; # 5 minutes
+    };
+
+    systemd.user.services.voxtype.Service.X-Reload-If-Changed = [
+      postProcess
+    ];
+  };
+}

home/modules/voxtype/post-process.cr

@@ -0,0 +1,54 @@
+require "json"
+require "http/client"
+
+struct OllamaResponse
+  include JSON::Serializable
+
+  getter response : String
+end
+
+struct Prompt
+  include JSON::Serializable
+
+  getter title : String
+  getter instructions : String
+end
+
+struct Config
+  include JSON::Serializable
+
+  getter model : String
+  getter prompts : Array(Prompt)
+  @[JSON::Field(key: "commonInstructions")]
+  getter common_instructions : String
+end
+
+config_path = "#{ENV.fetch("XDG_CONFIG_HOME", "~/.config")}/voxtype/post-processing.json"
+config = File.open(config_path) { |file| Config.from_json(file) }
+client = HTTP::Client.new("localhost", ENV.fetch("OLLAMA_PORT", "11434").to_i)
+
+prompt_selection = Process.run(ENV["WALKER_BIN"], ["--dmenu"]) do |process|
+  config.prompts.each do |prompt|
+    process.input.puts prompt.title
+  end
+
+  process.input.close
+  process.output.gets_to_end.chomp
+end
+
+instructions = config.prompts.find { |prompt| prompt.title == prompt_selection }.try(&.instructions) || prompt_selection
+
+payload = {
+  model:  config.model,
+  prompt: "#{instructions} - #{config.common_instructions}:\n\n#{STDIN.gets_to_end.chomp}",
+  think:  false,
+  stream: false,
+}
+
+client.post("/api/generate", body: payload.to_json) do |response|
+  if response.status_code == 200
+    puts OllamaResponse.from_json(response.body_io).response.strip
+  else
+    abort "Ollama API error: #{response.status_code} #{response.body}"
+  end
+end

home/modules/zed/default.nix

@@ -0,0 +1,374 @@
+{
+  config,
+  lib,
+  pkgs,
+  pkgs-unstable,
+  inputs,
+  ...
+}:
+let
+  cfg = config.programs.zed-editor;
+  models-dev = inputs.models-dev;
+
+  getModelsFromProvider =
+    provider:
+    let
+      providerPath = "${models-dev}/providers/${provider}";
+      modelsPath = "${providerPath}/models";
+      providerToml = builtins.fromTOML (builtins.readFile "${providerPath}/provider.toml");
+
+      findAllTomlFiles =
+        path:
+        let
+          entries = builtins.readDir path;
+          files = builtins.filter (name: builtins.match ".*\\.toml$" name != null) (
+            builtins.attrNames (lib.filterAttrs (_: type: type == "regular") entries)
+          );
+          dirs = builtins.attrNames (lib.filterAttrs (_: type: type == "directory") entries);
+          nestedFiles = builtins.concatMap (
+            dir:
+            let
+              nestedPath = "${path}/${dir}";
+              nestedTomlFiles = findAllTomlFiles nestedPath;
+            in
+            map (file: "${dir}/${file}") nestedTomlFiles
+          ) dirs;
+        in
+        files ++ nestedFiles;
+
+      modelFiles = findAllTomlFiles modelsPath;
+      modelEntries = map (
+        file:
+        let
+          filePath = "${modelsPath}/${file}";
+          parsed = builtins.fromTOML (builtins.readFile filePath);
+          modelName = builtins.substring 0 (builtins.stringLength file - 5) file;
+        in
+        {
+          name = modelName;
+          display_name = parsed.name or modelName;
+          max_tokens = parsed.limit.context or parsed.limit.output or 128000;
+        }
+      ) modelFiles;
+    in
+    {
+      api_url = providerToml.api;
+      available_models = builtins.sort (a: b: a.name < b.name) modelEntries;
+      name = providerToml.name;
+    };
+
+  opencodeProviders = map getModelsFromProvider [
+    "opencode"
+    "opencode-go"
+    "fireworks-ai"
+    "firepass"
+  ];
+
+  openaiCompatibleProviders = builtins.listToAttrs (
+    map (p: lib.nameValuePair p.name p) opencodeProviders
+  );
+
+  ameba-ls = pkgs.stdenv.mkDerivation rec {
+    pname = "ameba-ls";
+    version = "0.1.0";
+
+    src =
+      let
+        selectSystem =
+          attrs:
+          attrs.${pkgs.stdenv.hostPlatform.system}
+            or (throw "Unsupported system: ${pkgs.stdenv.hostPlatform.system}");
+      in
+      pkgs.fetchurl (selectSystem {
+        x86_64-linux = {
+          url = "https://github.com/crystal-lang-tools/ameba-ls/releases/download/v${version}/ameba-ls-${version}-x86_64-linux-musl.tar.gz";
+          hash = "sha256-NtqR8NHytuHT1XIhRVvnp7Lo4Ed9UGbISbTn/BfLGA8=";
+        };
+        aarch64-linux = {
+          url = "https://github.com/crystal-lang-tools/ameba-ls/releases/download/v${version}/ameba-ls-${version}-aarch64-linux-musl.tar.gz";
+          hash = "sha256-77iqdaI+Mqivk0/9jkNdGpluDbz297vsY9wzuipcPOU=";
+        };
+        aarch64-darwin = {
+          url = "https://github.com/crystal-lang-tools/ameba-ls/releases/download/v${version}/ameba-ls-${version}-aarch64-apple-darwin.tar.gz";
+          hash = "sha256-tDB+ZjgjlGjNg3DjX09z1dJnqTv9h/1sXiauBj7uHNc=";
+        };
+      });
+
+    sourceRoot = ".";
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin
+      cp ameba-ls $out/bin/
+      chmod +x $out/bin/ameba-ls
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      description = "Language server for the Ameba linter for Crystal lang";
+      homepage = "https://github.com/crystal-lang-tools/ameba-ls";
+      license = licenses.mit;
+      platforms = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "aarch64-darwin"
+      ];
+      mainProgram = "ameba-ls";
+    };
+  };
+in
+{
+  options.programs.zed-editor = {
+    defaultEditor = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.zed-editor = {
+      package = pkgs-unstable.zed-editor;
+      extensions = [
+        "ruby"
+        "crystal"
+        "nix"
+        "svelte"
+      ];
+      userSettings = {
+        node = {
+          path = lib.getExe pkgs.nodejs_latest;
+          npm_path = lib.getExe' pkgs.nodejs_latest "npm";
+        };
+        agent = {
+          enabled = true;
+          default_model = {
+            provider = "opencode-go";
+            model = "glm-5";
+          };
+        };
+        agent_servers = {
+          OpenCode = {
+            command = "opencode";
+            args = [ "acp" ];
+            type = "custom";
+          };
+        };
+        auto_update = false;
+        telemetry = {
+          diagnostics = false;
+          metrics = false;
+        };
+        vim_mode = true;
+        languages = {
+          Ruby = {
+            language_servers = [
+              "ruby-lsp"
+              "rubocop"
+              "!solargraph"
+            ];
+            formatter.external = {
+              command = pkgs.writeShellScript "rufo" ''
+                bundle exec rufo "$@"
+                if [ $? -eq 1 ]; then
+                  exit 1
+                fi
+              '';
+              arguments = [
+                "--filename"
+                "{buffer_path}"
+              ];
+            };
+          };
+          Nix = {
+            formatter.external = {
+              command = lib.getExe pkgs.nixfmt-rfc-style;
+              arguments = [ "-q" ];
+            };
+          };
+          Rust = {
+            formatter.external = {
+              command = lib.getExe pkgs.rustfmt;
+              arguments = [
+                "--edition"
+                "2018"
+              ];
+            };
+          };
+          Crystal = {
+            language_servers = [
+              "crystalline"
+              "ameba-ls"
+            ];
+            formatter.external = {
+              command = lib.getExe pkgs.crystal;
+              arguments = [
+                "tool"
+                "format"
+                "--no-color"
+                "-"
+              ];
+            };
+          };
+          TypeScript.language_servers = [
+            "tsgo"
+            "vtsls"
+          ];
+        };
+        lsp = with pkgs; {
+          nixd.binary.path = lib.getExe nixd;
+          nil.binary.path = lib.getExe nil;
+          ruby-lsp = {
+            initialization_options = {
+              enabledFeatures = {
+                codeActions = true;
+                codeLens = true;
+                completion = true;
+                definition = true;
+                diagnostics = true;
+                documentHighlights = true;
+                documentLink = true;
+                documentSymbols = true;
+                foldingRanges = true;
+                formatting = false;
+                hover = true;
+                inlayHint = true;
+                onTypeFormatting = true;
+                selectionRanges = true;
+                semanticHighlighting = true;
+                signatureHelp = true;
+                typeHierarchy = true;
+                workspaceSymbol = true;
+              };
+              linters = [ "standard" ];
+            };
+            settings.use_bundler = true;
+          };
+          rubocop.binary = {
+            path = "bundle";
+            arguments = [
+              "exec"
+              "rubocop"
+              "--lsp"
+            ];
+          };
+          yaml-language-server.binary = {
+            path = lib.getExe yaml-language-server;
+            arguments = [ "--stdio" ];
+          };
+          json-language-server.binary = {
+            path = lib.getExe nodePackages.vscode-json-languageserver;
+            arguments = [ "--stdio" ];
+          };
+          package-version-server.binary.path = lib.getExe pkgs-unstable.package-version-server;
+          eslint.settings.onIgnoredFiles = "off";
+          crystalline.binary.path = lib.getExe crystalline;
+          ameba-ls.binary.path = lib.getExe ameba-ls;
+          rust-analyzer.binary.path = lib.getExe rust-analyzer;
+        };
+        load_direnv = "shell_hook";
+        theme = {
+          mode = "system";
+          light = "One Light";
+          dark = "One Dark";
+        };
+        terminal = {
+          line_height = "standard";
+          font_family = "IosevkaTerm Nerd Font";
+        };
+        edit_predictions = {
+          mode = "eager";
+          provider = "copilot";
+        };
+        buffer_font_family = "Iosevka Nerd Font";
+        buffer_font_size = 16;
+        ui_font_size = 17;
+        relative_line_numbers = "enabled";
+        file_types = {
+          JSONC = [
+            "tsconfig.json"
+            "tsconfig.*.json"
+          ];
+        };
+        language_models = {
+          openai_compatible = openaiCompatibleProviders;
+        };
+      };
+      userKeymaps = [
+        {
+          context = "VimControl && !menu";
+          bindings = {
+            "space g" = [
+              "task::Spawn"
+              {
+                task_name = "lazygit";
+                reveal_target = "center";
+              }
+            ];
+            "space o" = [
+              "task::Spawn"
+              {
+                task_name = "opencode";
+                reveal_target = "center";
+              }
+            ];
+            "space r" = "pane::DeploySearch";
+            "space f" = [
+              "file_finder::Toggle"
+              { separate_history = true; }
+            ];
+            "space :" = "task::Spawn";
+            "g R" = "editor::FindAllReferences";
+          };
+        }
+        {
+          context = "Dock || Pane || Editor";
+          bindings = {
+            "ctrl-h" = "workspace::ActivatePaneLeft";
+            "ctrl-j" = "workspace::ActivatePaneDown";
+            "ctrl-k" = "workspace::ActivatePaneUp";
+            "ctrl-l" = "workspace::ActivatePaneRight";
+          };
+        }
+        {
+          context = "Terminal";
+          bindings = {
+            "ctrl-p" = [
+              "terminal::SendKeystroke"
+              "ctrl-p"
+            ];
+          };
+        }
+      ];
+
+      userTasks = [
+        {
+          label = "lazygit";
+          command = lib.getExe config.programs.lazygit.package;
+          env = {
+            EDITOR = lib.getExe cfg.package;
+          };
+          args = [
+            "-p"
+            "$ZED_WORKTREE_ROOT"
+          ];
+          reveal = "always";
+          allow_concurrent_runs = true;
+          use_new_terminal = false;
+          hide = "on_success";
+        }
+        {
+          label = "opencode";
+          command = "opencode";
+          reveal = "always";
+          allow_concurrent_runs = true;
+          use_new_terminal = false;
+          hide = "on_success";
+        }
+      ];
+    };
+
+    home.sessionVariables = lib.mkIf cfg.defaultEditor {
+      EDITOR = "${lib.getExe cfg.package} -w";
+    };
+  };
+}

hosts/apu/configuration.nix

@@ -0,0 +1,283 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is availanodev";
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{
+  ssh,
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+{
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+
+  networking.hostName = "apu";
+  networking.useNetworkd = true;
+
+  nix = {
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      auto-optimise-store = true;
+    };
+
+    gc = {
+      automatic = true;
+      dates = "daily";
+      options = "--delete-older-than 7d";
+    };
+  };
+
+  modules.vlans = {
+    enable = true;
+    networks = {
+      koti = {
+        id = 10;
+        ipv6 = true;
+      };
+
+      gast = {
+        id = 20;
+        ipv6 = true;
+        staticLeases = {
+          "dc:a6:32:05:08:5d" = "10.20.1.235";
+        };
+      };
+
+      iot = {
+        id = 30;
+      };
+
+      cfg = {
+        id = 40;
+        staticLeases = {
+          "8c:3b:ad:c5:b8:ee" = "10.40.0.10";
+        };
+      };
+    };
+
+    bridge = {
+      enable = true;
+      pvid = config.modules.vlans.networks.cfg.id;
+      netdev = "20-lan";
+      network = "30-lan";
+      bindNetwork = "30-bind-lan";
+    };
+  };
+
+  modules.firewall = {
+    enable = true;
+    interfaces = {
+      koti = [
+        "dhcp"
+        "dns"
+        "ssh"
+        "web"
+      ];
+      gast = [
+        "dhcp"
+        "dns"
+      ];
+      iot = [
+        "dhcp"
+        "dns"
+      ];
+      cfg = [
+        "dhcp"
+        "dns"
+      ];
+      "tailscale*" = [
+        "ssh"
+        "web"
+      ];
+    };
+    allInterfaces = [ ];
+  };
+
+  systemd.network = {
+    enable = true;
+    config.networkConfig.IPv6Forwarding = true;
+
+    links = {
+      "10-extern0" = {
+        matchConfig.Path = "pci-0000:01:00.0";
+        linkConfig.Name = "extern0";
+      };
+      "10-intern0" = {
+        matchConfig.Path = "pci-0000:02:00.0";
+        linkConfig.Name = "intern0";
+      };
+      "10-intern1" = {
+        matchConfig.Path = "pci-0000:03:00.0";
+        linkConfig.Name = "intern1";
+      };
+    };
+
+    netdevs = {
+      "20-lan" = {
+        netdevConfig = {
+          Name = "lan";
+          Kind = "bridge";
+        };
+      };
+    };
+
+    networks = {
+      "30-bind-lan" = {
+        matchConfig = {
+          Name = "intern*";
+        };
+        networkConfig = {
+          Bridge = "lan";
+        };
+      };
+
+      "30-lan" = {
+        matchConfig = {
+          Name = "lan";
+        };
+        networkConfig = {
+          IPv6AcceptRA = false;
+          ConfigureWithoutCarrier = true;
+        };
+      };
+
+      "30-wan" = {
+        matchConfig = {
+          Name = "extern0";
+        };
+        networkConfig = {
+          DHCP = true;
+          DNS = "127.0.0.1";
+          IPv6AcceptRA = true;
+          IPv4Forwarding = true;
+        };
+        dhcpV6Config = {
+          PrefixDelegationHint = "::/56";
+        };
+        dhcpV4Config = {
+          Use6RD = true;
+        };
+      };
+    };
+  };
+
+  services.networkd-dispatcher = {
+    enable = true;
+    rules."50-tailscale" = {
+      onState = [ "routable" ];
+      script = ''
+        #!${pkgs.runtimeShell}
+        ${pkgs.ethtool}/bin/ethtool -K ${
+          config.systemd.network.links."10-extern0".linkConfig.Name
+        } rx-udp-gro-forwarding on rx-gro-list off
+      '';
+    };
+  };
+
+  time.timeZone = "Europe/Helsinki";
+
+  users.users.jokke = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    packages = [ pkgs.nh ];
+    openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
+    initialPassword = "change-me";
+  };
+
+  environment.systemPackages = with pkgs; [
+    wget
+    curl
+    dig
+    neovim
+    vim
+    htop
+  ];
+
+  services.openssh = {
+    enable = true;
+    openFirewall = false;
+    settings.PasswordAuthentication = false;
+  };
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "both";
+  };
+
+  services.resolved.enable = false;
+
+  modules.services.dhcp-dns-sync = {
+    enable = true;
+    interface = "koti";
+    domain = "home.arpa";
+    interval = "30s";
+  };
+
+  services.unbound = {
+    enable = true;
+    settings = {
+      server = {
+        interface =
+          (lib.map (name: config.systemd.network.networks."30-${name}".dhcpServerConfig.DNS) (
+            lib.attrNames config.modules.vlans.networks
+          ))
+          ++ [
+            "127.0.0.1"
+            "::1"
+          ];
+        access-control = [
+          "10.0.0.0/8 allow"
+          "127.0.0.0/8 allow"
+          "::1/128 allow"
+        ];
+        verbosity = 2;
+      };
+
+      forward-zone = [
+        {
+          name = ".";
+          forward-addr = "100.84.105.63#dns.freun.dev";
+          forward-tls-upstream = true;
+        }
+      ];
+
+      remote-control.control-enable = true;
+    };
+  };
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    reflector = true;
+    allowInterfaces = [ "lan" ];
+    openFirewall = true;
+  };
+
+  services.invidious-companion = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 8282;
+    secretKeyFile = config.age.secrets.invidious-companion.path;
+    binaryHash = "sha256-nZXKpExKCc2zgSdVT3qo05NyFdpM9H9NJB5UWo+MVWI=";
+  };
+
+  networking.firewall = {
+    enable = true;
+    interfaces.tailscale0.allowedTCPPorts = [ 8282 ];
+  };
+
+  security.acme.defaults.environmentFile = config.age.secrets.hetzner.path;
+
+  networking = {
+    nftables.enable = true;
+    useDHCP = false;
+    domain = "apu.home.arpa";
+  };
+
+  system.stateVersion = "24.05";
+}

hosts/apu/default.nix

@@ -0,0 +1,12 @@
+{ inputs, ... }:
+let
+  inherit (inputs) nixos-hardware;
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./secrets.nix
+    nixos-hardware.nixosModules.pcengines-apu
+  ];
+}

hosts/apu/hardware-configuration.nix

@@ -0,0 +1,69 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/f221c6a7-e05e-40dc-bc85-7970d7c8f22b";
+    fsType = "btrfs";
+    options = [ "subvol=@" ];
+  };
+
+  fileSystems."/var/log" = {
+    device = "/dev/disk/by-uuid/f221c6a7-e05e-40dc-bc85-7970d7c8f22b";
+    fsType = "btrfs";
+    options = [ "subvol=@var_log" ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/14D2-F8F4";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-uuid/f221c6a7-e05e-40dc-bc85-7970d7c8f22b";
+    fsType = "btrfs";
+    options = [ "subvol=@swap" ];
+  };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/apu/secrets.nix

@@ -0,0 +1,16 @@
+{ lib, ... }:
+{
+  age.secrets = lib.listToAttrs (
+    map
+      (secret: {
+        name = secret;
+        value = {
+          file = ../../secrets/${secret}.age;
+        };
+      })
+      [
+        "hetzner"
+        "invidious-companion"
+      ]
+  );
+}

hosts/freun-dev/configuration.nix

@@ -2,51 +2,87 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running `nixos-help`).
 
-{ config, pkgs, self, ... }:
+{
-
+  config,
+  pkgs,
+  ssh,
+  ...
+}:
+let
+  ipv4Address = "65.21.145.150";
+  ipv6Address = "2a01:4f9:c011:9ac1::1";
+in
 {
   nix = {
     settings = {
-      experimental-features = [ "nix-command" "flakes" ];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
       auto-optimise-store = true;
     };
     gc = {
       automatic = true;
       dates = "weekly";
-      options = "--delete-older-than 30d";
+      options = "--delete-older-than 7d";
     };
   };
 
-  system.autoUpgrade = {
+  boot.loader.systemd-boot.enable = true;
-    enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
-    flake = "/etc/nixos";
+  boot.binfmt.emulatedSystems = [ "x86_64-linux" ];
-    flags = [
-      "--update-input"
-      "nixpkgs"
-      "-L" # print build logs
-    ];
-    dates = "02:00";
-    randomizedDelaySec = "45min";
-  };
-
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.efiSupport = false;
-  # boot.loader.grub.efiInstallAsRemovable = true;
-  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
-  # Define on which hard drive you want to install Grub.
-  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
 
   networking.hostName = "freun-dev"; # Define your hostname.
+  networking.domain = "freun.dev";
   networking.useDHCP = false;
+  networking.nftables.enable = true;
+
+  services.octodns.records = {
+    "" = {
+      A = {
+        ttl = 86400;
+        values = [ ipv4Address ];
+      };
+      AAAA = {
+        ttl = 86400;
+        values = [ ipv6Address ];
+      };
+      TXT = {
+        ttl = 86400;
+        values = [
+          "v=spf1 include:spf.uberspace.de ~all"
+        ];
+      };
+    };
+    "_dmarc".TXT = {
+      ttl = 86400;
+      values = [ "v=DMARC1\\; p=reject" ];
+    };
+    "uberspace._domainkey".TXT = {
+      ttl = 86400;
+      values = [
+        "v=DKIM1\\;t=s\\;n=core\\;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArjZrrWhFn/xSH3+aPA3G1eGD5yAeyn7ZhHSCBM7b/9A5Fny9URjEf1La7dcU+oF/d7outgmTCs/umItBCB7ybkMriaLC+RBZJY0blf35bMYWL9NLpbKzVVAZQPgDZJm7R/grbg0nJgb5RCGLYu9iPcRjJtpu2vYaitkNh8WJ4q+iA/YOos2pQmP+6I5zLTVenFfEWJccdtfhJcORSuONN+Xi1+dQxpQzlwxUWz4DgOsfVaE3woDH3RAAQCtiMyk8ZQhhrL85pHH6zT3sNXzzVphJdIIYA+VYAgYYOTkRbdDhYSd5zCDX5f4L1UmBsJS2ommBGvw2qMDhagXsaN32BwIDAQAB"
+      ];
+    };
+    "ts" = {
+      A = {
+        ttl = 86400;
+        values = [ "100.84.105.63" ];
+      };
+      AAAA = {
+        ttl = 86400;
+        values = [ "fd7a:115c:a1e0::7901:693f" ];
+      };
+    };
+  };
 
   systemd.network = {
     enable = true;
     networks.static = {
       name = "enp1s0";
       address = [
-        "95.217.223.61/32"
+        "${ipv4Address}/32"
-        "2a01:4f9:c012:5e97::1/64"
+        "${ipv6Address}/64"
       ];
       routes = [
         { Gateway = "fe80::1"; }
@@ -70,6 +106,23 @@
     };
   };
 
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
+  };
+
+  services.networkd-dispatcher = {
+    enable = true;
+    rules."50-tailscale" = {
+      onState = [ "routable" ];
+      script = ''
+        #!${pkgs.runtimeShell}
+        ${pkgs.ethtool}/bin/ethtool -K ${config.systemd.network.networks.static.name} rx-udp-gro-forwarding on rx-gro-list off
+      '';
+    };
+  };
+
   # Set your time zone.
   time.timeZone = "Europe/Helsinki";
 
@@ -85,30 +138,39 @@
   #   useXkbConfig = true; # use xkbOptions in tty.
   # };
 
-
   # Configure keymap in X11
   services.xserver.xkb.layout = "us";
   services.xserver.xkb.options = "eurosign:e,caps:escape";
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.jokke = {
+  users.users = {
+    jokke = {
       isNormalUser = true;
       extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-    # packages = with pkgs; [
+      packages = [ pkgs.nh ];
-    #   firefox
+      openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
-    #   tree
-    # ];
-    openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLIUkESu5NnBi1M0+ZjYrkp6/rIFuwc3aguspf98jmOydNce6l65cnS3GRzc9oWx4lu11ahi87ZuE+pYV+gaHm4="
-    ];
     };
 
+    builder = {
+      isNormalUser = true;
+      openssh.authorizedKeys.keys = [ ssh.publicKeys.builder ];
+    };
+
+    root.openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
+  };
+
+  nix.settings.trusted-users = [
+    "jokke"
+    "builder"
+  ];
+
   # List packages installed in system profile. To search, run:
   # $ nix search wget
   environment.systemPackages = with pkgs; [
     vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
     wget
     htop
+    git
   ];
 
   # Some programs need SUID wrappers, can be configured further or are
@@ -127,11 +189,10 @@
     settings.PasswordAuthentication = false;
   };
 
-  # Open ports in the firewall.
+  modules.firewall = {
-  networking.firewall.allowedTCPPorts = [ 22 ];
+    enable = true;
-  # networking.firewall.allowedUDPPorts = [ ... ];
+    allInterfaces = [ "ssh" ];
-  # Or disable the firewall altogether.
+  };
-  # networking.firewall.enable = false;
 
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you
@@ -144,6 +205,5 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
+  system.stateVersion = "24.11"; # Did you read the comment?
 }
-

hosts/freun-dev/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./services.nix
+    ./secrets.nix
+  ];
+}

hosts/freun-dev/glance.nix

@@ -0,0 +1,339 @@
+{ config, ... }:
+let
+  secrets = config.age.secrets;
+in
+{
+  services.tailscaledGlance = {
+    enable = true;
+    subdomain = "glance";
+    settings = {
+      server.port = 4114;
+      pages = [
+        {
+          name = "Home";
+          columns = [
+            {
+              size = "small";
+              widgets = [
+                {
+                  type = "clock";
+                  hour-format = "24h";
+                  timezones = [
+                    {
+                      timezone = "Europe/Zurich";
+                      label = "Zürich";
+                    }
+                  ];
+                }
+                {
+                  type = "group";
+                  title = "Weather";
+                  widgets =
+                    let
+                      buildWeatherWidget =
+                        { location, title }:
+                        {
+                          type = "weather";
+                          hide-location = true;
+                          hour-format = "24h";
+                          units = "metric";
+                          inherit location title;
+                        };
+                    in
+                    builtins.map buildWeatherWidget [
+                      {
+                        title = "Espoo";
+                        location = "Espoo, Finland";
+                      }
+                      {
+                        title = "Mökki";
+                        location = "Pellosniemi, Finland";
+                      }
+                      {
+                        title = "Frankfurt";
+                        location = "Frankfurt, Germany";
+                      }
+                    ];
+                }
+                {
+                  type = "markets";
+                  markets = [
+                    {
+                      symbol = "KOZ0.F";
+                      name = "Kongsberg Gruppen";
+                    }
+                    {
+                      symbol = "AMD";
+                      name = "AMD";
+                    }
+                  ];
+                }
+                {
+                  type = "group";
+                  widgets = [
+                    {
+                      type = "rss";
+                      title = "News";
+                      limit = 10;
+                      collapse-after = 3;
+                      cache = "12h";
+                      feeds = [
+                        {
+                          url = "https://yle.fi/rss/uutiset/paauutiset";
+                          title = "Yle";
+                        }
+                      ];
+                    }
+                    {
+                      type = "rss";
+                      title = "Tech";
+                      limit = 10;
+                      collapse-after = 3;
+                      cache = "12h";
+                      feeds = [
+                        {
+                          url = "https://nixos.org/blog/announcements-rss.xml";
+                          title = "NixOS";
+                        }
+                        {
+                          url = "https://selfh.st/rss";
+                          title = "selfh.st";
+                        }
+                      ];
+                    }
+                    {
+                      type = "rss";
+                      title = "Blogs";
+                      limit = 10;
+                      collapse-after = 3;
+                      cache = "12h";
+                      feeds = [
+                        {
+                          url = "https://samharris.substack.com/feed";
+                          title = "Sam Harris";
+                        }
+                      ];
+                    }
+                  ];
+                }
+                {
+                  type = "custom-api";
+                  title = "Steam Specials";
+                  cache = "12h";
+                  url = "https://store.steampowered.com/api/featuredcategories?cc=fi";
+                  template = ''
+                    <ul class="list list-gap-10 collapsible-container" data-collapse-after="5">
+                    {{ range .JSON.Array "specials.items" }}
+                      <li>
+                        <a class="size-h4 color-highlight block text-truncate" href="https://store.steampowered.com/app/{{ .Int "id" }}/">{{ .String "name" }}</a>
+                        <ul class="list-horizontal-text">
+                          <li>{{ div (.Int "final_price" | toFloat) 100 | printf "$%.2f" }}</li>
+                          {{ $discount := .Int "discount_percent" }}
+                          <li{{ if ge $discount 40 }} class="color-positive"{{ end }}>{{ $discount }}% off</li>
+                        </ul>
+                      </li>
+                    {{ end }}
+                    </ul>
+                  '';
+                }
+              ];
+            }
+            {
+              size = "full";
+              widgets = [
+                {
+                  type = "group";
+                  widgets = [
+                    { type = "hacker-news"; }
+                    { type = "lobsters"; }
+                  ];
+                }
+                {
+                  type = "videos";
+                  channels = [
+                    "UCXuqSBlHAE6Xw-yeJA0Tunw" # Linus Tech Tips
+                    "UCshObcm-nLhbu8MY50EZ5Ng" # Benn Jordan
+                  ];
+                }
+                {
+                  type = "group";
+                  widgets =
+                    let
+                      type = "reddit";
+                      show-thumbnails = true;
+                      app-auth = {
+                        name = "Glance";
+                        id = {
+                          _secret = secrets."glance/reddit/app-id".path;
+                        };
+                        secret = {
+                          _secret = secrets."glance/reddit/app-secret".path;
+                        };
+                      };
+                    in
+                    [
+                      {
+                        inherit type app-auth show-thumbnails;
+                        subreddit = "nixos";
+                      }
+                      {
+                        inherit type app-auth show-thumbnails;
+                        subreddit = "technology";
+                      }
+                      {
+                        inherit type app-auth show-thumbnails;
+                        subreddit = "selfhosted";
+                      }
+                    ];
+                }
+              ];
+            }
+            {
+              size = "small";
+              widgets = [
+                {
+                  type = "server-stats";
+                  servers = [
+                    {
+                      type = "local";
+                      name = "freun.dev";
+                    }
+                  ];
+                }
+                {
+                  type = "group";
+                  title = "Services";
+                  widgets =
+                    let
+                      buildSite =
+                        domain:
+                        {
+                          subdomain,
+                          title,
+                          alt-status-codes ? [ ],
+                        }:
+                        {
+                          inherit title alt-status-codes;
+                          url = "https://${subdomain}.${domain}";
+                        };
+                      buildMonitor =
+                        { domain, sites }:
+                        {
+                          type = "monitor";
+                          cache = "1m";
+                          title = domain;
+                          style = "compact";
+                          sites = builtins.map (buildSite domain) sites;
+                        };
+                    in
+                    builtins.map buildMonitor [
+                      {
+                        domain = "freun.dev";
+                        sites = [
+                          {
+                            subdomain = "img";
+                            title = "Immich";
+                          }
+                          {
+                            subdomain = "pw";
+                            title = "Vaultwarden";
+                          }
+                          {
+                            subdomain = "social";
+                            title = "Gotosocial";
+                          }
+                          {
+                            subdomain = "graph";
+                            title = "Grafana";
+                          }
+                          {
+                            subdomain = "home";
+                            title = "Home Assistant";
+                          }
+                          {
+                            subdomain = "cook";
+                            title = "Mealie";
+                          }
+                          {
+                            subdomain = "sync";
+                            title = "Syncthing";
+                          }
+                          {
+                            subdomain = "bin";
+                            title = "Hastebin";
+                            alt-status-codes = [ 404 ];
+                          }
+                          {
+                            subdomain = "ledger";
+                            title = "Ledger";
+                          }
+                          {
+                            subdomain = "note";
+                            title = "Dnote";
+                          }
+                          {
+                            subdomain = "trackmap";
+                            title = "Trackmap";
+                          }
+                          {
+                            subdomain = "fit";
+                            title = "Workout Tracker";
+                          }
+                          {
+                            subdomain = "stream";
+                            title = "Owncast";
+                          }
+                          {
+                            subdomain = "read";
+                            title = "Readeck";
+                          }
+                        ];
+                      }
+                      {
+                        domain = "alderaan.space";
+                        sites = [
+                          {
+                            subdomain = "jelly";
+                            title = "Jellyfin";
+                          }
+                          {
+                            subdomain = "radarr";
+                            title = "Radarr";
+                          }
+                          {
+                            subdomain = "sonarr";
+                            title = "Sonarr";
+                          }
+                          {
+                            subdomain = "deluge";
+                            title = "qBittorrent";
+                          }
+                          {
+                            subdomain = "lidarr";
+                            title = "Lidarr";
+                          }
+                          {
+                            subdomain = "bazarr";
+                            title = "Bazarr";
+                          }
+                          {
+                            subdomain = "req";
+                            title = "Jellyseer";
+                          }
+                        ];
+                      }
+                    ];
+                }
+                {
+                  type = "dns-stats";
+                  service = "adguard";
+                  url = "http://localhost:3006";
+                }
+              ];
+            }
+          ];
+        }
+      ];
+    };
+  };
+}

hosts/freun-dev/hardware-configuration.nix

@@ -1,33 +1,41 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "virtio_scsi"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/8456c7de-2116-4cbe-8deb-76cafbd3e6dd";
+    device = "/dev/disk/by-uuid/f594ffbc-4553-42e4-8206-4d762c94b4c3";
-      fsType = "btrfs";
+    fsType = "ext4";
-      options = [ "subvol=@" ];
   };
 
-  fileSystems."/var" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/8456c7de-2116-4cbe-8deb-76cafbd3e6dd";
+    device = "/dev/disk/by-uuid/46F1-18E3";
-      fsType = "btrfs";
+    fsType = "vfat";
-      options = [ "subvol=@var" ];
+    options = [
-    };
+      "fmask=0077"
-
+      "dmask=0077"
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/614a1b7f-04aa-478c-9011-8b81f133da98"; }
     ];
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-uuid/d9955575-d4e0-4a49-a3c5-41f54110d12b"; } ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
@@ -36,5 +44,5 @@
   networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
 
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
 }

hosts/freun-dev/secrets.nix

@@ -0,0 +1,62 @@
+{ lib, config, ... }:
+{
+  age.secrets =
+    lib.listToAttrs (
+      map
+        (secret: {
+          name = secret;
+          value = {
+            file = ../../secrets/${secret}.age;
+          };
+        })
+        [
+          "gotosocial"
+          "immich"
+          "readeck"
+          "storage-box-credentials"
+          "vaultwarden"
+          "donetick"
+          "dnote"
+          "mealie"
+          "mosquitto/homie"
+          "mosquitto/telegraf"
+          "mosquitto/openhab"
+          "mosquitto/shelly"
+          "mosquitto/mokkimaatti"
+          "gitlab-runner/default"
+          "gitlab-runner/docker"
+          "glance/reddit/app-id"
+          "glance/reddit/app-secret"
+          "hetzner"
+          "actual"
+          "voidauth"
+          "gitea"
+          "gitea-actions-runner"
+          "searx"
+          "open-webui"
+          "open-terminal-api-key"
+        ]
+    )
+    // {
+      smtp-password = {
+        file = ../../secrets/smtp-password.age;
+        owner =
+          if (config.services.grafana.enable) then
+            config.systemd.services.grafana.serviceConfig.User
+          else
+            "root";
+      };
+      hastebin-tokens = {
+        file = ../../secrets/hastebin-tokens.age;
+        owner = if (config.services.hastebin.enable) then config.users.users.hastebin.name else "root";
+      };
+      hledger-basic-auth = {
+        file = ../../secrets/hledger-basic-auth.age;
+        owner = if (config.services.hledger-web.enable) then "nginx" else "root";
+      };
+      invidious = lib.mkIf config.services.invidious.enable {
+        file = ../../secrets/invidious.age;
+        owner = config.systemd.services.invidious.serviceConfig.User;
+      };
+    };
+}

hosts/freun-dev/services.nix

@@ -0,0 +1,478 @@
+{
+  pkgs,
+  pkgs-unstable,
+  config,
+  inputs,
+  lib,
+  ...
+}:
+let
+  immichDataDir = "/mnt/storage/immich";
+  syncthingDataDir = "/mnt/storage/syncthing";
+  smtp = {
+    host = "horologium.uberspace.de";
+    port = 587;
+    username = "noreply@${config.networking.domain}";
+    from = "noreply@${config.networking.domain}";
+    heloName = config.networking.domain;
+  };
+  secrets = config.age.secrets;
+in
+{
+  nixpkgs.config.allowUnfree = true;
+  imports = [
+    ./glance.nix
+  ];
+  virtualisation.podman.enable = true;
+  virtualisation.oci-containers.backend = "podman";
+  security.acme.defaults.environmentFile = secrets.hetzner.path;
+
+  modules.storageBoxMounts = {
+    ${immichDataDir} = {
+      path = "/backup/immich";
+      user = "u407959";
+      uid = config.users.users.${config.services.immich.user}.uid;
+      gid = config.users.groups.${config.services.immich.user}.gid;
+    };
+
+    ${syncthingDataDir} = {
+      path = "/backup/syncthing";
+      user = "u407959";
+      uid = config.users.users.${config.services.syncthing.user}.uid;
+      gid = config.users.groups.${config.services.syncthing.user}.gid;
+    };
+  };
+
+  services = {
+    postgresql.package = pkgs.postgresql_16;
+    octodns = {
+      enable = true;
+      records."".MX = {
+        ttl = 86400;
+        values = [ { exchange = "${smtp.host}."; } ];
+      };
+      defaults.CNAME.ttl = 60;
+    };
+
+    hastebin = {
+      enable = true;
+      subdomain = "bin";
+      renderers =
+        with pkgs;
+        let
+          hl = rustPlatform.buildRustPackage {
+            name = "syntax-renderer";
+            src = inputs.syntax-renderer;
+            cargoHash = "sha256-kZy+HVPcUfPDTBQZ8TQ/xlEEqmSIttzdGeRwX9EF4xU=";
+          };
+        in
+        {
+          hl = "${hl}/bin/syntax-renderer";
+          sha = writeShellScript "sha-renderer" ''
+            echo "Content-Type: text/plain"
+            echo "---"
+            ${coreutils}/bin/sha256sum - | cut -d' ' -f1
+          '';
+          stl = writeShellScript "stl-renderer" ''
+            echo "Content-Type: model/stl"
+            echo "Content-Disposition: attachment; filename=$(basename "$1" .scad).stl"
+            echo "---"
+            ${openscad}/bin/openscad --export-format stl -o - -
+          '';
+        };
+      cleanup.enable = true;
+    };
+
+    readeck = {
+      enable = true;
+      subdomain = "read";
+      settings.email = {
+        host = smtp.host;
+        port = smtp.port;
+        username = smtp.username;
+        encryption = "starttls";
+        from = smtp.from;
+        from_noreply = smtp.from;
+      };
+    };
+
+    donetick = {
+      enable = true;
+      subdomain = "do";
+      settings = {
+        email = {
+          host = smtp.host;
+          port = smtp.port;
+          email = smtp.username;
+        };
+      };
+    };
+
+    grafana = {
+      enable = true;
+      subdomain = "graph";
+      settings = {
+        server.http_port = 3005;
+        smtp = {
+          enabled = true;
+          host = smtp.host;
+          port = smtp.port;
+          user = smtp.username;
+          from_address = smtp.from;
+        };
+      };
+    };
+
+    owncast = {
+      enable = true;
+      subdomain = "stream";
+    };
+
+    gtrackmap = {
+      enable = false;
+      subdomain = "trackmap";
+      port = 3001;
+    };
+
+    invidious = {
+      enable = true;
+      subdomain = "vid";
+      extraSettingsFile = secrets.invidious.path;
+      settings = {
+        invidious_companion = [
+          { private_url = "http://apu:8282/companion"; }
+        ];
+      };
+    };
+
+    syncthing = {
+      enable = true;
+      subdomain = "sync";
+      dataDir = syncthingDataDir;
+      configDir = "/var/lib/syncthing";
+    };
+
+    tailscale.enable = true;
+
+    gotosocial = {
+      enable = true;
+      subdomain = "social";
+      settings = {
+        port = 3002;
+        smtp-host = smtp.host;
+        smtp-port = smtp.port;
+        smtp-username = smtp.username;
+        smtp-from = smtp.from;
+        instance-languages = [
+          "de"
+          "fi"
+          "en"
+        ];
+      };
+    };
+
+    vaultwarden = {
+      enable = true;
+      subdomain = "pw";
+      config = {
+        YUBICO_CLIENT_ID = 86799;
+        SMTP_HOST = smtp.host;
+        SMTP_FROM = smtp.from;
+        SMTP_FROM_NAME = "Vaultwarden";
+        SMTP_USERNAME = smtp.username;
+        SMTP_PORT = smtp.port;
+        HELO_NAME = smtp.heloName;
+      };
+    };
+
+    workout-tracker = {
+      enable = true;
+      subdomain = "fit";
+      port = 3004;
+    };
+
+    workout-sync = {
+      enable = true;
+      subdomain = "ws";
+    };
+
+    immich = {
+      enable = true;
+      subdomain = "img";
+      mediaLocation = immichDataDir;
+      timezone = "Europe/Helsinki";
+      settings.job = {
+        thumbnailGeneration.concurrency = 8;
+        videoConversion.concurrency = 2;
+      };
+    };
+
+    dnote = {
+      enable = true;
+      subdomain = "note";
+      environment = {
+        SmtpHost = smtp.host;
+        SmtpPort = smtp.port;
+        SmtpUsername = smtp.username;
+      };
+      environmentFile = secrets.dnote.path;
+    };
+
+    tailscaledAdguardhome = {
+      enable = true;
+      subdomain = "dns";
+      port = 3006;
+    };
+
+    mealie = {
+      enable = true;
+      package = pkgs-unstable.mealie;
+      subdomain = "cook";
+      credentialsFile = secrets.mealie.path;
+      settings = {
+        SMTP_HOST = smtp.host;
+        SMTP_FROM_EMAIL = smtp.from;
+        SMTP_USER = smtp.username;
+        SMTP_PORT = smtp.port;
+      };
+    };
+
+    uptime-kuma = {
+      enable = true;
+      subdomain = "status";
+      settings = {
+        PORT = "3007";
+      };
+    };
+
+    mosquitto = {
+      enable = true;
+      subdomain = "mqtt";
+      listeners = [
+        {
+          users = {
+            homie = {
+              acl = [
+                "readwrite homie/#"
+              ];
+              hashedPasswordFile = secrets."mosquitto/homie".path;
+            };
+          };
+          port = 8084;
+          settings = {
+            protocol = "websockets";
+            cafile = "/run/credentials/mosquitto.service/fullchain.pem";
+            certfile = "/run/credentials/mosquitto.service/fullchain.pem";
+            keyfile = "/run/credentials/mosquitto.service/key.pem";
+          };
+        }
+        {
+          users = {
+            homie = {
+              acl = [
+                "readwrite homie/#"
+              ];
+              hashedPasswordFile = secrets."mosquitto/homie".path;
+            };
+            telegraf = {
+              acl = [
+                "read openhab/#"
+                "read homie/#"
+                "read shellies/#"
+                "read mokkimaatti/#"
+              ];
+              hashedPasswordFile = secrets."mosquitto/telegraf".path;
+            };
+            openhab = {
+              acl = [
+                "readwrite openhab/#"
+              ];
+              hashedPasswordFile = secrets."mosquitto/openhab".path;
+            };
+            shelly = {
+              acl = [
+                "readwrite shellies/#"
+              ];
+              hashedPasswordFile = secrets."mosquitto/shelly".path;
+            };
+            mokkimaatti = {
+              acl = [
+                "readwrite mokkimaatti/#"
+              ];
+              hashedPasswordFile = secrets."mosquitto/mokkimaatti".path;
+            };
+          };
+        }
+      ];
+      openFirewall = true;
+    };
+
+    gitlab-runner = {
+      enable = true;
+      services = {
+        default = {
+          dockerImage = "alpine";
+          authenticationTokenConfigFile = secrets."gitlab-runner/default".path;
+        };
+        docker = {
+          dockerImage = "docker:stable";
+          dockerVolumes = [ "/var/run/docker.sock:/var/run/docker.sock" ];
+          authenticationTokenConfigFile = secrets."gitlab-runner/docker".path;
+        };
+      };
+    };
+
+    weechat = {
+      enable = true;
+      subdomain = "irc";
+    };
+
+    sillytavern = {
+      enable = true;
+      subdomain = "st";
+      listen = true;
+      whitelist = false;
+      port = 3100;
+    };
+
+    nginx.virtualHosts."isarepomaa.com" = {
+      forceSSL = true;
+      enableACME = true;
+      http2 = true;
+      locations."/".root = "/var/www/isas-portfolio";
+    };
+
+    hledger-web = {
+      enable = true;
+      subdomain = "ledger";
+      stateDir = "${syncthingDataDir}/ledger";
+      user = config.systemd.services.syncthing.serviceConfig.User;
+      group = config.systemd.services.syncthing.serviceConfig.Group;
+      extraOptions = [ "--forecast" ];
+      journalFiles = [
+        "main.ldg"
+      ];
+    };
+
+    actual = {
+      enable = true;
+      package = pkgs-unstable.actual-server;
+      subdomain = "actual";
+      environmentFile = secrets.actual.path;
+      settings = {
+        port = 3200;
+        openId = {
+          discoveryURL = "https://${config.services.voidauth.subdomain}.${config.networking.domain}/oidc/.well-known/openid-configuration";
+          server_hostname = "https://${config.services.actual.subdomain}.${config.networking.domain}";
+        };
+        loginMethod = "openid";
+        allowedLoginMethods = [ "openid" ];
+        enforceOpenId = true;
+        userCreationMode = "login";
+      };
+    };
+
+    voidauth = {
+      enable = true;
+      subdomain = "auth";
+      environmentFile = secrets.voidauth.path;
+      settings = {
+        APP_PORT = 3300;
+        SMTP_HOST = smtp.host;
+        SMTP_FROM = smtp.from;
+        SMTP_PORT = smtp.port;
+        SMTP_USER = smtp.username;
+      };
+    };
+
+    gitea = {
+      enable = true;
+      subdomain = "git";
+      secrets = secrets.gitea.path;
+    };
+
+    gitea-actions-runner.instances = {
+      default = {
+        enable = true;
+        name = config.networking.domain;
+        labels = [
+          "linux_arm64"
+          "ubuntu-latest:docker://node:latest"
+          "nixos-latest:docker://git.freun.dev/repomaa/nixos/node:latest"
+        ];
+        tokenFile = secrets.gitea-actions-runner.path;
+        url = "https://${config.services.gitea.subdomain}.${config.networking.domain}";
+        settings.container.network = "bridge";
+      };
+    };
+
+    searx = {
+      enable = true;
+      subdomain = "q";
+      port = 3400;
+      environmentFile = secrets.searx.path;
+      settings = {
+        general = {
+          instance_name = "freun.dev SearXNG";
+        };
+        server = {
+          public_instance = true;
+          image_proxy = true;
+          method = "GET";
+          secret_key = "$SEARX_SECRET_KEY";
+        };
+        engines = lib.mapAttrsToList (name: value: { inherit name; } // value) {
+          "google".disabled = true;
+          "duckduckgo".disabled = false;
+          "duckduckgo images".disabled = false;
+          "wolframalpha".disabled = false;
+        };
+        search = {
+          formats = [
+            "html"
+            "json"
+          ];
+        };
+        enabled_plugins = [
+          "Basic Calculator"
+          "Hash plugin"
+          "Open Access DOI rewrite"
+          "Hostnames plugin"
+          "Unit converter plugin"
+          "Tracker URL remover"
+        ];
+      };
+    };
+
+    open-webui = {
+      enable = true;
+      port = 3500;
+      environmentFile = secrets.open-webui.path;
+      environment = {
+        ENABLE_WEB_SEARCH = "True";
+        ENABLE_OLLAMA_API = "False";
+      };
+      subdomain = "owu";
+    };
+
+    webserver = {
+      acme.dnsChallenge = true;
+      tailscaleAuth.expectedTailnet = "tempel-vibes.ts.net";
+    };
+  };
+
+  virtualisation.oci-containers.containers.open-terminal = {
+    image = "ghcr.io/open-webui/open-terminal:latest";
+    autoStart = true;
+    ports = [ "127.0.0.1:3700:8000" ];
+    environmentFiles = [ config.age.secrets."open-terminal-api-key".path ];
+    environment = {
+      OPEN_TERMINAL_MULTI_USER = "true";
+    };
+    volumes = [
+      "open-terminal-data:/home/user"
+    ];
+  };
+
+  virtualisation.docker.autoPrune.enable = true;
+}

hosts/radish/boot.nix

@@ -0,0 +1,31 @@
+{ lib, pkgs, ... }:
+{
+  boot = {
+    loader.systemd-boot.enable = lib.mkForce false;
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/etc/secureboot";
+      configurationLimit = 10;
+      settings = {
+        editor = false;
+      };
+    };
+    loader.efi.canTouchEfiVariables = true;
+    bootspec.enable = true;
+    kernelPackages = pkgs.linuxPackages_latest;
+    kernelParams = [
+      "amdgpu.sg_display=0"
+      "resume_offset=533760"
+    ];
+
+    resumeDevice = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+    tmp.useTmpfs = true;
+    kernel.sysctl = {
+      "vm.max_map_count" = 262144;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    efibootmgr
+  ];
+}

hosts/radish/configuration.nix

@@ -0,0 +1,55 @@
+{ ... }:
+{
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "freun.dev";
+        maxJobs = 8;
+        protocol = "ssh";
+        sshUser = "builder";
+        systems = [
+          "aarch64-linux"
+        ];
+        supportedFeatures = [
+          "kvm"
+          "big-parallel"
+          "nixos-test"
+        ];
+      }
+    ];
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      auto-optimise-store = true;
+    };
+
+    gc = {
+      automatic = true;
+      dates = "daily";
+      options = "--delete-older-than 7d";
+    };
+  };
+
+  networking.nftables.enable = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "23.11"; # Did you read the comment?
+}

hosts/radish/containers.nix

@@ -0,0 +1,20 @@
+{ pkgs-unstable, ... }:
+{
+  virtualisation = {
+    containers = {
+      enable = true;
+      storage.settings.storage.driver = "btrfs";
+      containersConf.settings.compose_warning_logs = false;
+    };
+
+    oci-containers.backend = "podman";
+
+    podman = {
+      enable = true;
+      autoPrune.enable = true;
+      defaultNetwork.settings.dns_enabled = true;
+      package = pkgs-unstable.podman;
+      dockerCompat = true;
+    };
+  };
+}

hosts/radish/default.nix

@@ -0,0 +1,26 @@
+{ inputs, ... }:
+let
+  inherit (inputs)
+    lanzaboote
+    nixos-hardware
+    home-manager
+    ;
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./host.nix
+    ./boot.nix
+    ./hardware.nix
+    ./packages.nix
+    ./containers.nix
+    ./desktop.nix
+    ./users.nix
+    ./secrets.nix
+    lanzaboote.nixosModules.lanzaboote
+    nixos-hardware.nixosModules.framework-13-7040-amd
+    home-manager.nixosModules.home-manager
+    ../../home
+  ];
+}

hosts/radish/desktop.nix

@@ -0,0 +1,38 @@
+{ pkgs-unstable, ... }:
+{
+  services.displayManager.gdm.enable = true;
+  services.desktopManager.gnome.enable = true;
+  services.displayManager.sessionPackages = [ pkgs-unstable.niri ];
+
+  services.printing.enable = true;
+  services.keyd = {
+    enable = true;
+    keyboards.default = {
+      ids = [ "*" ];
+      settings = {
+        global = {
+          overload_tap_timeout = 200;
+        };
+        main = {
+          leftmeta = "overload(meta, macro(leftmeta+z))";
+        };
+      };
+    };
+  };
+
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+  services.pulseaudio.enable = false;
+
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+  };
+}

hosts/radish/hardware-configuration.nix

@@ -0,0 +1,77 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+    fsType = "btrfs";
+    options = [ "subvol=@" ];
+  };
+
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-uuid/43895585-8899-4e94-a413-889127c214f8";
+    allowDiscards = true;
+  };
+
+  fileSystems."/var/log" = {
+    device = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+    fsType = "btrfs";
+    options = [ "subvol=@var_log" ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+    fsType = "btrfs";
+    options = [ "subvol=@home" ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/01E6-6258";
+    fsType = "vfat";
+  };
+
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-uuid/a331b669-f5c5-42f7-be58-434873c1b689";
+    fsType = "btrfs";
+    options = [ "subvol=@swap" ];
+  };
+
+  swapDevices = [
+    {
+      device = "/swap/swapfile";
+      size = 64 * 1024;
+    }
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/radish/hardware.nix

@@ -0,0 +1,141 @@
+{
+  pkgs,
+  pkgs-unstable,
+  inputs,
+  lib,
+  config,
+  ...
+}:
+{
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+
+  services.udev.packages = [
+    pkgs.zsa-udev-rules
+    pkgs-unstable.yubikey-personalization
+    inputs.ksoloti-pr.legacyPackages.${pkgs.stdenv.hostPlatform.system}.ksoloti
+  ];
+  services.usbmuxd = {
+    enable = true;
+    package = pkgs.usbmuxd;
+  };
+  services.fwupd = {
+    enable = true;
+  };
+  services.fprintd.enable = true;
+  services.fstrim.enable = true;
+
+  security.pam.services.login.fprintAuth = false;
+  # similarly to how other distributions handle the fingerprinting login
+  security.pam.services.gdm-fingerprint = lib.mkIf (config.services.fprintd.enable) {
+    text = ''
+      auth       required                    pam_shells.so
+      auth       requisite                   pam_nologin.so
+      auth       requisite                   pam_faillock.so      preauth
+      auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
+      auth       optional                    pam_permit.so
+      auth       required                    pam_env.so
+      auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
+      auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
+
+      account    include                     login
+
+      password   required                    pam_deny.so
+
+      session    include                     login
+      session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
+    '';
+  };
+
+  hardware.keyboard.zsa.enable = true;
+
+  services.logind = {
+    settings.Login = {
+      IdleAction = "suspend";
+      HandleLidSwitch = "suspend";
+      HandlePowerKey = "suspend";
+    };
+  };
+
+  powerManagement = {
+    enable = true;
+    powerDownCommands = "${pkgs.networkmanager}/bin/nmcli radio wifi off";
+    powerUpCommands = "${pkgs.networkmanager}/bin/nmcli radio wifi on";
+  };
+
+  services.power-profiles-daemon.enable = true;
+  hardware.amdgpu.opencl.enable = true;
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [ rocmPackages.clr.icd ];
+  };
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
+  };
+  networking.networkmanager = {
+    enable = true;
+    wifi.backend = "iwd";
+    dns = "systemd-resolved";
+    plugins = with pkgs; [
+      networkmanager-openvpn
+    ];
+  };
+  security.tpm2.enable = true;
+
+  services.nqptp.enable = true;
+  networking.firewall.allowedTCPPortRanges = [
+    {
+      from = 7000;
+      to = 7010;
+    }
+  ];
+  networking.firewall.allowedUDPPorts = [ 5353 ];
+
+  networking.wg-quick.interfaces = lib.mkMerge (
+    lib.map
+      (
+        {
+          region,
+          ipOctet,
+          publicKey,
+        }:
+        {
+          "everii-${region}" = {
+            address = [ "10.${toString ipOctet}.8.48/22" ];
+            dns = [ "10.${toString ipOctet}.1.1" ];
+            privateKeyFile = config.age.secrets."everii-vpn/${region}.key".path;
+            peers = [
+              {
+                allowedIPs = [ "10.${toString ipOctet}.0.0/16" ];
+                endpoint = "vpn.${region}.infra.everii.io:51821";
+                inherit publicKey;
+              }
+            ];
+            postUp = ''
+              ${pkgs.systemd}/bin/resolvectl domain everii-${region} ~${region}.everii ~${toString ipOctet}.10.in-addr.arpa
+              ${pkgs.systemd}/bin/resolvectl dnssec everii-${region} no
+            '';
+          };
+        }
+      )
+      [
+        {
+          region = "de1";
+          ipOctet = 13;
+          publicKey = "uBUgSTZb6WbfE960S3qFP/UUMtdsgNWqtkTaBkp6Xxo=";
+        }
+        {
+          region = "fi1";
+          ipOctet = 14;
+          publicKey = "Yoakl0lrL6IK1nT8x5SGpaS39fQxRAsP9Zjpu8/1RRs=";
+        }
+        {
+          region = "ch1";
+          ipOctet = 15;
+          publicKey = "gfciqAk+X02zoEKXSvRamx5+TGL3i4GpT7oUvHMD0xo=";
+        }
+      ]
+  );
+}

hosts/radish/host.nix

@@ -0,0 +1,17 @@
+{ lib, ... }:
+{
+  networking.hostName = "radish";
+  time.timeZone = lib.mkForce null; # allow TZ to be set by desktop user
+  i18n.defaultLocale = "de_DE.UTF-8";
+  i18n.supportedLocales = map (locale: "${locale}.UTF-8/UTF-8") [
+    "C"
+    "en_US"
+    "de_DE"
+    "fi_FI"
+  ];
+  i18n.extraLocaleSettings.LANG = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "us";
+  };
+}

hosts/radish/packages.nix

@@ -0,0 +1,173 @@
+{
+  pkgs,
+  pkgs-unstable,
+  lib,
+  inputs,
+  config,
+  ...
+}:
+let
+  secrets = config.age.secrets;
+in
+{
+  nixpkgs.config.allowUnfree = true;
+  nixpkgs.overlays = [ (import ../../custom-pkgs { inherit lib inputs pkgs-unstable; }) ];
+
+  environment = {
+    systemPackages = with pkgs; [
+      vim
+      wget
+      curl
+      htop
+      tmux
+      libimobiledevice
+      ripgrep
+      fd
+    ];
+
+    pathsToLink = [ "/share/zsh" ];
+  };
+
+  fonts.packages = with pkgs-unstable; [
+    nerd-fonts.iosevka
+    nerd-fonts.iosevka-term
+  ];
+  services = {
+    gnome.evolution-data-server.enable = true;
+    flatpak.enable = true;
+    pcscd = {
+      enable = true;
+      plugins = [ pkgs.ccid ];
+    };
+
+    openssh = {
+      enable = true;
+      openFirewall = false;
+    };
+
+    tailscale = {
+      enable = true;
+      useRoutingFeatures = "client";
+      package = pkgs-unstable.tailscale;
+    };
+
+    ollama = {
+      enable = true;
+      package = pkgs-unstable.ollama-vulkan;
+      syncModels = true;
+      loadModels = [
+        "qwen3:4b-instruct"
+        "qwen3:8b"
+      ];
+    };
+
+    borgbackup.jobs.root = {
+      paths = "/";
+      exclude = [
+        "/nix"
+        "/var/cache"
+        "/run"
+        "/sys"
+        "/etc"
+        "/swap"
+        "/proc"
+        "**/node_modules"
+        "**/.cargo"
+        "**/ruby/*/gems"
+        "**/.cache"
+        "**/.meteor"
+        "**/.next"
+        "**/.local/share/containers/cache"
+        "**/.local/share/containers/storage/overlay"
+        "**/.local/share/docker/overlay2"
+        "**/log/*.log"
+        "**/.local/share/Trash"
+      ];
+      environment = {
+        BORG_RSH = "ssh -i /root/.ssh/id_ed25519.borg";
+      };
+      repo = "ssh://u324815-sub2@u324815.your-storagebox.de:23/./backup";
+      encryption = {
+        mode = "repokey";
+        passphrase = "will be overridden from environment file";
+      };
+      extraCreateArgs = [
+        "--stats"
+        "--progress"
+      ];
+      inhibitsSleep = true;
+      compression = "auto,zstd";
+      startAt = "daily";
+      persistentTimer = true;
+      preHook = with pkgs; ''
+        ${coreutils}/bin/timeout 60 ${bash}/bin/sh -c '
+          until ${iputils}/bin/ping -c1 your-storagebox.de; do
+            sleep 1
+          done
+        '
+      '';
+      postCreate = with pkgs; ''
+        ${curl}/bin/curl "https://status.freun.dev/api/push/''${UPTIME_KUMA_TOKEN}?status=up&msg=OK&ping="
+      '';
+      prune.keep = {
+        within = "3d";
+        daily = 14;
+        weekly = 8;
+        monthly = -1;
+      };
+    };
+
+    locate = {
+      enable = true;
+      package = pkgs.plocate;
+    };
+
+    protonmail-bridge = {
+      enable = true;
+      package = pkgs-unstable.protonmail-bridge;
+      path = [ pkgs.gnome-keyring ];
+    };
+  };
+
+  systemd.services.borgbackup-job-root.serviceConfig.EnvironmentFile = secrets.borgbackup-radish.path;
+
+  programs = {
+    zsh.enable = true;
+    _1password-gui = {
+      enable = true;
+      polkitPolicyOwners = [ "moco" ];
+    };
+    _1password.enable = true;
+  };
+
+  environment.etc."1password/custom_allowed_browsers".text = ''
+    vivaldi
+  '';
+
+  systemd.services.ollama-keep-alive =
+    let
+      ollamaURL = "http://localhost:${toString config.services.ollama.port}/api/generate";
+      payload = {
+        model = lib.elemAt config.services.ollama.loadModels 0;
+        keep_alive = -1;
+      };
+    in
+    {
+      enable = true;
+      description = "Keep Ollama primary model loaded by pinging it";
+      after = [
+        "ollama.service"
+        "network-online.target"
+      ];
+      wants = [ "network-online.target" ];
+      bindsTo = [ "ollama.service" ];
+      wantedBy = [
+        "multi-user.target"
+        "ollama.service"
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.curl}/bin/curl -s '${ollamaURL}' -d '${builtins.toJSON payload}'";
+      };
+    };
+}

hosts/radish/secrets.nix

@@ -0,0 +1,18 @@
+{ lib, ... }:
+{
+  age.secrets = lib.listToAttrs (
+    map
+      (secret: {
+        name = secret;
+        value = {
+          file = ../../secrets/${secret}.age;
+        };
+      })
+      [
+        "borgbackup-radish"
+        "everii-vpn/de1.key"
+        "everii-vpn/ch1.key"
+        "everii-vpn/fi1.key"
+      ]
+  );
+}

hosts/radish/users.nix

@@ -0,0 +1,37 @@
+{ pkgs, ... }:
+{
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.jokke = {
+    uid = 1001;
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+    ];
+    shell = pkgs.zsh;
+    initialPassword = "changeme";
+  };
+
+  users.users.moco = {
+    uid = 1000;
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+    ];
+    shell = pkgs.zsh;
+    initialPassword = "changeme";
+    subUidRanges = [
+      {
+        startUid = 10000;
+        count = 65536;
+      }
+    ];
+    subGidRanges = [
+      {
+        startGid = 10000;
+        count = 65536;
+      }
+    ];
+  };
+}

hosts/turny/configuration.nix

@@ -0,0 +1,98 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{
+  pkgs,
+  ssh,
+  config,
+  inputs,
+  ...
+}:
+let
+  secrets = config.age.secrets;
+in
+{
+  nix = {
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  networking = {
+    hostName = "turny"; # Define your hostname.
+    useDHCP = true;
+    useNetworkd = true;
+    nftables.enable = true;
+    wireless = {
+      enable = true;
+      networks = {
+        KotiWLANi.pskRaw = "ext:psk_kotiwlani";
+      };
+      secretsFile = secrets.wpa_supplicant.path;
+    };
+  };
+
+  services.avahi = {
+    publish.enable = true;
+  };
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Helsinki";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.jokke = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    packages = [ pkgs.nh ];
+    openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
+    initialPassword = "changeme";
+  };
+  users.users.root.openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
+
+  nix.settings.trusted-users = [ "jokke" ];
+
+  environment.systemPackages = with pkgs; [
+    vim
+    wget
+    htop
+    git
+    inputs.turny.packages.${stdenv.hostPlatform.system}.default
+  ];
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+
+  modules.firewall = {
+    enable = true;
+    allInterfaces = [ "ssh" ];
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/turny/default.nix

@@ -0,0 +1,10 @@
+{ inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./secrets.nix
+    inputs.nixos-hardware.nixosModules.raspberry-pi-3
+    "${inputs.nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
+  ];
+}

hosts/turny/hardware-configuration.nix

@@ -0,0 +1,4 @@
+{ lib, ... }:
+{
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/turny/secrets.nix

@@ -0,0 +1,15 @@
+{ lib, ... }:
+{
+  age.secrets = lib.listToAttrs (
+    map
+      (secret: {
+        name = secret;
+        value = {
+          file = ../../secrets/${secret}.age;
+        };
+      })
+      [
+        "wpa_supplicant"
+      ]
+  );
+}

hydra.nix

@@ -1,21 +0,0 @@
-{ ... }:
-let
-  fqdn = "ci.freun.dev";
-  port = 3400;
-in
-{
-  services.hydra = {
-    enable = true;
-    hydraURL = "https://${fqdn}";
-    notificationSender = "Hydra <noreply@freun.dev>";
-    buildMachinesFiles = [];
-    useSubstitutes = true;
-    inherit port;
-  };
-
-  services.caddy.virtualHosts = {
-    "${fqdn}".extraConfig = ''
-      reverse_proxy localhost:${builtins.toString port}
-    '';
-  };
-}

immich.nix

@@ -1,202 +0,0 @@
-{ pkgs, lib, ... }:
-
-let
-  immich_version = "release";
-  storage_dir = "/mnt/storage/syncthing";
-  immich_data_dir = "/mnt/storage/immich";
-
-  volumeServices = names: (
-    lib.lists.foldl (services: name:
-      services // {
-        "podman-volume-immich_${name}" = {
-          path = [ pkgs.podman ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-          };
-          script = ''
-            podman volume inspect immich_${name} || podman volume create immich_${name}
-          '';
-          partOf = [ "podman-compose-immich-root.target" ];
-          wantedBy = [ "podman-compose-immich-root.target" ];
-        };
-      }
-    ) {} names
-  );
-
-  containerServices = services: (
-    lib.lists.foldl (acc: { name, volumes ? [], ... }:
-      let
-        volume_services = map (volume: "podman-volume-immich_${volume}.service") volumes;
-        dependent_services = [ "podman-network-immich_default.service" ] ++ volume_services;
-      in
-
-      acc // {
-        "podman-immich_${name}" = {
-          serviceConfig = {
-            Restart = lib.mkOverride 500 "always";
-          };
-          after = dependent_services;
-          requires = dependent_services;
-          partOf = [
-            "podman-compose-immich-root.target"
-          ];
-          wantedBy = [
-            "podman-compose-immich-root.target"
-          ];
-        };
-      }
-    )
-    {} services
-  );
-in {
-  # Containers
-  virtualisation.oci-containers.containers = {
-    "immich_machine_learning" = {
-      image = "ghcr.io/immich-app/immich-machine-learning:${immich_version}";
-      environmentFiles = [
-        "/var/secrets/immich.env"
-      ];
-      volumes = [
-        "immich_model_cache:/cache:rw"
-      ];
-      log-driver = "journald";
-      extraOptions = [
-        "--network-alias=immich-machine-learning"
-        "--network=immich_default"
-      ];
-    };
-
-    "immich_microservices" = {
-      image = "ghcr.io/immich-app/immich-server:${immich_version}";
-      environmentFiles = [
-        "/var/secrets/immich.env"
-      ];
-      volumes = [
-        "/etc/localtime:/etc/localtime:ro"
-        "${immich_data_dir}:/usr/src/app/upload:rw"
-        "${storage_dir}:${storage_dir}:ro"
-      ];
-      cmd = [ "start.sh" "microservices" ];
-      dependsOn = [
-        "immich_postgres"
-        "immich_redis"
-      ];
-      log-driver = "journald";
-      extraOptions = [
-        "--network-alias=immich-microservices"
-        "--network=immich_default"
-      ];
-    };
-
-    "immich_postgres" = {
-      image = "registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0";
-      environmentFiles = [
-        "/var/secrets/immich.env"
-      ];
-      environment = {
-        POSTGRES_INITDB_ARGS = "--data-checksums";
-      };
-      volumes = [
-        "immich_db_data:/var/lib/postgresql/data:rw"
-      ];
-      cmd = [ "postgres" "-c" "shared_preload_libraries=vectors.so" "-c" "search_path=\"$user\", public, vectors" "-c" "logging_collector=on" "-c" "max_wal_size=2GB" "-c" "shared_buffers=512MB" "-c" "wal_compression=on" ];
-      log-driver = "journald";
-      extraOptions = [
-        "--network-alias=database"
-        "--network=immich_default"
-      ];
-    };
-
-    "immich_redis" = {
-      image = "registry.hub.docker.com/library/redis:6.2-alpine";
-      environmentFiles = [
-        "/var/secrets/immich.env"
-      ];
-      log-driver = "journald";
-      extraOptions = [
-        "--network-alias=redis"
-        "--network=immich_default"
-      ];
-    };
-
-    "immich_server" = {
-      image = "ghcr.io/immich-app/immich-server:${immich_version}";
-      environmentFiles = [
-        "/var/secrets/immich.env"
-      ];
-      volumes = [
-        "/etc/localtime:/etc/localtime:ro"
-        "${immich_data_dir}:/usr/src/app/upload:rw"
-        "${storage_dir}:${storage_dir}:ro"
-      ];
-      ports = [
-        "2283:3001/tcp"
-      ];
-      cmd = [ "start.sh" "immich" ];
-      dependsOn = [
-        "immich_postgres"
-        "immich_redis"
-      ];
-      log-driver = "journald";
-      extraOptions = [
-        "--network-alias=immich-server"
-        "--network=immich_default"
-      ];
-    };
-  };
-
-  systemd.services = (containerServices [
-    { name = "machine_learning"; volumes = [ "model_cache" ]; }
-    { name = "postgres"; volumes = [ "db_data" ]; }
-    { name = "redis"; }
-    { name = "server"; }
-    { name = "microservices"; }
-  ]) // {
-    # Networks
-    "podman-network-immich_default" = {
-      path = [ pkgs.podman ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStop = "${pkgs.podman}/bin/podman network rm -f immich_default";
-      };
-      script = ''
-        podman network inspect immich_default || podman network create immich_default
-      '';
-      partOf = [ "podman-compose-immich-root.target" ];
-      wantedBy = [ "podman-compose-immich-root.target" ];
-    };
-  } // (volumeServices [
-    "db_data"
-    "model_cache"
-  ]);
-
-  # Root service
-  # When started, this will automatically create all resources and start
-  # the containers. When stopped, this will teardown all resources.
-  systemd.targets."podman-compose-immich-root" = {
-    unitConfig = {
-      Description = "Root target generated by compose2nix.";
-    };
-    wantedBy = [ "multi-user.target" ];
-  };
-
-  services.caddy.virtualHosts = {
-    "img.freun.dev".extraConfig = ''
-      reverse_proxy localhost:2283
-    '';
-  };
-
-  fileSystems."${immich_data_dir}" = {
-    device = "//u407959.your-storagebox.de/backup/immich";
-    fsType = "cifs";
-    options = let
-      # this line prevents hanging on network split
-      automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
-
-    in ["${automount_opts},credentials=/var/secrets/smb-storage"];
-  };
-
-  environment.systemPackages = [ pkgs.cifs-utils ];
-}

invidious.nix

@@ -1,25 +0,0 @@
-{ ... }:
-let
-  fqdn = "vid.freun.dev";
-in
-{
-  services.invidious = {
-    enable = true;
-    domain = fqdn;
-
-    settings = {
-      external_port = 443;
-      db = {
-        dbname = "invidious";
-        user = "invidious";
-      };
-    };
-  };
-
-  services.caddy.virtualHosts = {
-    "${fqdn}".extraConfig = ''
-      reverse_proxy localhost:3000
-    '';
-  };
-
-}

modules/default.nix

@@ -0,0 +1,17 @@
+{ inputs, config, ... }:
+{
+  _module.args = {
+    pkgs-unstable = import inputs.nixpkgs-unstable {
+      system = config.nixpkgs.hostPlatform.system;
+      config = config.nixpkgs.config;
+    };
+  };
+
+  imports = [
+    ./vlans.nix
+    ./firewall.nix
+    ./storage-box-mounts.nix
+    ./services
+    inputs.agenix.nixosModules.default
+  ];
+}

modules/firewall.nix

@@ -0,0 +1,69 @@
+{ lib, config, ... }:
+let
+  services = {
+    ssh = {
+      tcp = [ 22 ];
+    };
+    dhcp = {
+      udp = [
+        67
+        68
+      ];
+    };
+    dns = {
+      udp = [
+        53
+        853
+      ];
+      tcp = [
+        53
+        853
+      ];
+    };
+    web = {
+      tcp = [
+        80
+        443
+      ];
+    };
+  };
+
+  rulesForServices =
+    enabledServices:
+    lib.foldr
+      (
+        service:
+        { allowedUDPPorts, allowedTCPPorts }:
+        {
+          allowedUDPPorts = allowedUDPPorts ++ services.${service}.udp or [ ];
+          allowedTCPPorts = allowedTCPPorts ++ services.${service}.tcp or [ ];
+        }
+      )
+      {
+        allowedUDPPorts = [ ];
+        allowedTCPPorts = [ ];
+      }
+      enabledServices;
+
+  cfg = config.modules.firewall;
+in
+{
+  options.modules.firewall = {
+    enable = lib.mkEnableOption "Enable the firewall";
+    interfaces = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.listOf (lib.types.enum (lib.attrNames services)));
+      default = { };
+    };
+    allInterfaces = lib.mkOption {
+      type = lib.types.listOf (lib.types.enum (lib.attrNames services));
+      default = [ ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall = {
+      enable = true;
+      interfaces = lib.mapAttrs (_: enabledServices: rulesForServices enabledServices) cfg.interfaces;
+    } // rulesForServices cfg.allInterfaces;
+  };
+}

modules/services/actual.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.actual;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.actual = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn}.locations."/".proxyPort = cfg.settings.port;
+      };
+    };
+
+    systemd.services.actual = {
+      serviceConfig.EnvironmentFile = cfg.environmentFile;
+    };
+  };
+}

modules/services/adguardhome.nix

@@ -0,0 +1,74 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.tailscaledAdguardhome;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+  tailscaleIps = [
+    "100.84.105.63"
+    "fd7a:115c:a1e0::7901:693f"
+  ];
+  acme = config.security.acme;
+in
+{
+  imports = [
+    (lib.mkAliasOptionModule
+      [ "services" "tailscaledAdguardhome" "settings" ]
+      [ "services" "adguardhome" "settings" ]
+    )
+    (lib.mkAliasOptionModule
+      [ "services" "tailscaledAdguardhome" "port" ]
+      [ "services" "adguardhome" "port" ]
+    )
+  ];
+
+  options.services.tailscaledAdguardhome = {
+    enable = lib.mkEnableOption "Enable tailscaled adguardhome";
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale.enable = true;
+    modules.firewall.interfaces.${config.services.tailscale.interfaceName} = [ "dns" ];
+
+    systemd.services.adguardhome.serviceConfig.LoadCredential = [
+      "fullchain.pem:${acme.certs.${fqdn}.directory}/fullchain.pem"
+      "key.pem:${acme.certs.${fqdn}.directory}/key.pem"
+    ];
+
+    services.adguardhome = {
+      enable = cfg.enable;
+      settings = {
+        tls = {
+          enabled = true;
+          server_name = fqdn;
+          port_https = 4443;
+          certificate_chain_path = "/run/credentials/adguardhome.service/fullchain.pem";
+          private_key_path = "/run/credentials/adguardhome.service/key.pem";
+        };
+        dns = {
+          bind_hosts = tailscaleIps;
+          upstream_dns = [
+            "https://dns10.quad9.net/dns-query"
+            "https://cloudflare-dns.com/dns-query"
+            "https://dns.google/dns-query"
+          ];
+          fallback_dns = [
+            "https://cloudflare-dns.com/dns-query"
+            "https://dns.google/dns-query"
+          ];
+        };
+      };
+    };
+
+    systemd.services.adguardhome = {
+      requires = [ "tailscaled.service" ];
+      after = [ "tailscaled.service" ];
+    };
+
+    services.webserver.vHosts.${fqdn} = {
+      tailscaleAuth = true;
+      locations."/".proxyPort = cfg.port;
+    };
+  };
+}

modules/services/default.nix

@@ -0,0 +1,39 @@
+{ ... }:
+{
+  imports = [
+    ./webserver.nix
+    ./vaultwarden.nix
+    ./immich.nix
+    ./syncthing.nix
+    ./invidious.nix
+    ./grafana.nix
+    ./gtrackmap.nix
+    ./owncast.nix
+    ./tailscale.nix
+    ./workout-tracker.nix
+    ./gotosocial.nix
+    ./hastebin.nix
+    ./workout-sync.nix
+    ./readeck.nix
+    ./donetick.nix
+    ./dnote.nix
+    ./octodns.nix
+    ./adguardhome.nix
+    ./mealie.nix
+    ./uptime-kuma.nix
+    ./mosquitto.nix
+    ./home-assistant.nix
+    ./weechat.nix
+    ./hledger-web.nix
+    ./glance.nix
+    ./sillytavern.nix
+    ./nqptp.nix
+    ./actual.nix
+    ./voidauth.nix
+    ./gitea.nix
+    ./dhcp-dns-sync
+    ./invidious-companion.nix
+    ./searx.nix
+    ./open-webui.nix
+  ];
+}

modules/services/dhcp-dns-sync/default.nix

@@ -0,0 +1,125 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.modules.services.dhcp-dns-sync;
+  ownAddress = (
+    lib.elemAt (lib.splitString "/"
+      config.systemd.network.networks."30-${cfg.interface}".networkConfig.Address
+    ) 0
+  );
+
+  dhcp-leases-to-unbound =
+    pkgs.runCommand "dhcp-leases-to-unbound"
+      {
+        code = ./dhcp-leases-to-unbound.cr;
+        nativeBuildInputs = [ pkgs.crystal ];
+        meta.mainProgram = "dhcp-leases-to-unbound";
+      }
+      ''
+        mkdir -p $out/bin
+        crystal build $code --release -o $out/bin/dhcp-leases-to-unbound
+      '';
+in
+{
+  options.modules.services.dhcp-dns-sync = {
+    enable = lib.mkEnableOption "Enable DHCP to DNS synchronization";
+
+    interface = lib.mkOption {
+      type = lib.types.str;
+      default = "koti";
+      description = "Network interface to monitor for DHCP leases";
+    };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "home.arpa";
+      description = "Domain suffix for DHCP hostnames";
+    };
+
+    unboundConfigPath = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/unbound/dhcp-hosts.conf";
+      description = "Path to write Unbound include file";
+    };
+
+    interval = lib.mkOption {
+      type = lib.types.str;
+      default = "30s";
+      description = "Interval for checking DHCP lease updates";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Create user and group for the service
+    users.users.dhcp-dns-sync = {
+      isSystemUser = true;
+      group = "dhcp-dns-sync";
+      description = "DHCP DNS sync service user";
+    };
+
+    users.groups.dhcp-dns-sync = { };
+
+    # Ensure directories and files exist with proper permissions
+    # Directory needs to be group-writable for unbound group
+    systemd.tmpfiles.rules = [
+      "d /var/lib/unbound 0775 unbound unbound -"
+      "f ${cfg.unboundConfigPath} 0644 dhcp-dns-sync unbound -"
+    ];
+
+    # Extend Unbound configuration to include generated file
+    services.unbound.settings = {
+      server = {
+        local-zone = [ "${cfg.domain}. static" ];
+        include = cfg.unboundConfigPath;
+        local-data = [ ''"apu.home.arpa. IN A ${ownAddress}"'' ];
+        local-data-ptr = [ ''"${ownAddress} apu.home.arpa."'' ];
+      };
+    };
+
+    # Make sure Unbound control is enabled
+    services.unbound.settings.remote-control.control-enable = true;
+
+    # Systemd service
+    systemd.services.dhcp-dns-sync = {
+      description = "Sync DHCP leases to Unbound DNS";
+      after = [
+        "systemd-networkd.service"
+        "unbound.service"
+      ];
+      requires = [ "unbound.service" ];
+      wants = [ "unbound-control.socket" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = "dhcp-dns-sync";
+        Group = "unbound";
+        # Allow access to networkctl via D-Bus
+        SupplementaryGroups = [ "systemd-network" ];
+        # Read/write paths
+        ReadWritePaths = [ "/var/lib/unbound" ];
+        ExecStart = lib.concatStringsSep " " [
+          (lib.getExe dhcp-leases-to-unbound)
+          "-i ${cfg.interface}"
+          "-d ${cfg.domain}"
+          "-o ${cfg.unboundConfigPath}"
+          "--networkctl ${lib.getExe' pkgs.systemd "networkctl"}"
+          "--unbound-control ${lib.getExe' pkgs.unbound "unbound-control"}"
+        ];
+      };
+    };
+
+    # Systemd timer
+    systemd.timers.dhcp-dns-sync = {
+      description = "Periodic DHCP to DNS sync";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "10s";
+        OnUnitActiveSec = cfg.interval;
+      };
+    };
+  };
+}

modules/services/dhcp-dns-sync/dhcp-leases-to-unbound.cr

@@ -0,0 +1,187 @@
+#!/usr/bin/env crystal
+
+require "json"
+require "file_utils"
+require "option_parser"
+
+struct Lease
+  include JSON::Serializable
+
+  @[JSON::Field(key: "Address")]
+  property address_bytes : Array(Int32)
+
+  @[JSON::Field(key: "HardwareAddress")]
+  property hardware_address : Array(Int32)?
+
+  @[JSON::Field(key: "Hostname")]
+  property hostname : String?
+
+  @[JSON::Field(key: "ExpirationUSec")]
+  property expiration_usec : Int64?
+
+  def address : String
+    address_bytes.join('.')
+  end
+end
+
+struct DHCPServer
+  include JSON::Serializable
+
+  @[JSON::Field(key: "Leases")]
+  property leases : Array(Lease)?
+end
+
+struct NetworkStatus
+  include JSON::Serializable
+
+  @[JSON::Field(key: "DHCPServer")]
+  property dhcp_server : DHCPServer?
+end
+
+def sanitize_hostname(hostname : String) : String?
+  # Lowercase and strip invalid characters
+  sanitized = hostname.downcase.gsub(/[^a-z0-9-]/, "-")
+
+  # Collapse multiple dashes into one
+  sanitized = sanitized.gsub(/-+/, "-")
+
+  # Strip leading/trailing dashes
+  sanitized = sanitized.strip('-')
+
+  # Ensure non-empty and not too long (max 63 chars for DNS label)
+  return nil if sanitized.empty?
+  return nil if sanitized.size > 63
+
+  # Ensure starts with letter or number (not dash)
+  return nil if sanitized.starts_with?('-')
+
+  sanitized
+end
+
+def generate_unbound_config(leases : Array(Lease), domain : String) : String
+  lines = [] of String
+
+  lines << "# Auto-generated DHCP leases for #{domain}"
+  lines << "# Generated at #{Time.utc}"
+  lines << ""
+
+  leases.each do |lease|
+    next unless hostname = lease.hostname
+    sanitized = sanitize_hostname(hostname)
+    next unless sanitized
+
+    fqdn = "#{sanitized}.#{domain}."
+
+    # A record
+    lines << %{local-data: "#{fqdn} IN A #{lease.address}"}
+
+    # PTR record - local-data-ptr expects IP in normal form, unbound reverses it
+    lines << %{local-data-ptr: "#{lease.address} #{fqdn}"}
+  end
+
+  lines.join("\n") + "\n"
+end
+
+def get_leases(interface : String, networkctl_path : String? = nil) : Array(Lease)
+  cmd = networkctl_path ? "#{networkctl_path}" : "networkctl"
+  args = ["status", interface, "--json=short"]
+
+  Process.run(cmd, args, output: Process::Redirect::Pipe, error: Process::Redirect::Pipe) do |process|
+    result = process.wait
+    output = process.output.to_s
+
+    unless result.success?
+      error = process.error.to_s
+      raise "networkctl failed (exit code #{result.exit_code}): #{error.empty? ? output : error}"
+    end
+
+    status = NetworkStatus.from_json(output)
+    status.dhcp_server.try(&.leases) || [] of Lease
+  end
+end
+
+def write_if_changed(content : String, path : String) : Bool
+  # Check if content is the same
+  if File.exists?(path)
+    current = File.read(path)
+    return false if current == content
+  end
+
+  # Write to temp file and atomically move
+  temp_path = "#{path}.tmp"
+  File.write(temp_path, content)
+  FileUtils.mv(temp_path, path)
+  true
+end
+
+# Configuration
+interface = "koti"
+domain = "home.arpa"
+output_path = "/var/lib/unbound/dhcp-hosts.conf"
+networkctl_path : String? = nil
+unbound_control_path : String? = nil
+
+OptionParser.parse do |parser|
+  parser.banner = "Usage: dhcp-leases-to-unbound [options]"
+
+  parser.on("-i INTERFACE", "Network interface to monitor (default: koti)") do |i|
+    interface = i
+  end
+
+  parser.on("-d DOMAIN", "Domain suffix (default: home.arpa)") do |d|
+    domain = d
+  end
+
+  parser.on("-o PATH", "Output path for unbound config (default: /var/lib/unbound/dhcp-hosts.conf)") do |o|
+    output_path = o
+  end
+
+  parser.on("--networkctl PATH", "Path to networkctl binary (default: networkctl from PATH)") do |path|
+    networkctl_path = path
+  end
+
+  parser.on("--unbound-control PATH", "Path to unbound-control binary (default: unbound-control from PATH)") do |path|
+    unbound_control_path = path
+  end
+
+  parser.on("-h", "--help", "Show this help") do
+    puts parser
+    exit
+  end
+end
+
+def reload_unbound(unbound_control_path : String?)
+  cmd = unbound_control_path ? "#{unbound_control_path}" : "unbound-control"
+  puts "Reloading Unbound..."
+
+  Process.run(cmd, ["reload"], output: Process::Redirect::Pipe, error: Process::Redirect::Pipe) do |process|
+    result = process.wait
+
+    unless result.success?
+      raise "unbound reload failed (exit code #{result.exit_code}): #{process.error}"
+    end
+  end
+
+  puts "Unbound reloaded successfully."
+end
+
+begin
+  # Get leases from networkd
+  leases = get_leases(interface, networkctl_path)
+
+  # Generate Unbound config
+  config = generate_unbound_config(leases, domain)
+
+  # Write Unbound config if changed
+  changed = write_if_changed(config, output_path)
+
+  # Reload Unbound if config changed
+  if changed
+    reload_unbound(unbound_control_path)
+  else
+    puts "No DHCP lease changes detected."
+  end
+rescue ex : Exception
+  STDERR.puts "Error: #{ex.message}"
+  exit 1
+end

modules/services/dnote.nix

@@ -0,0 +1,125 @@
+{
+  lib,
+  config,
+  pkgs,
+  pkgs-unstable,
+  ...
+}:
+let
+  cfg = config.services.dnote;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+
+  types = {
+    environment = lib.types.submodule {
+      options = {
+        DBName = lib.mkOption {
+          type = lib.types.str;
+          default = "dnote";
+        };
+        SmtpHost = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+        SmtpPort = lib.mkOption {
+          type = lib.types.nullOr lib.types.int;
+          default = null;
+        };
+        SmtpUsername = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+        SmtpPassword = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+      };
+    };
+  };
+
+  immutableEnvironment = {
+    HOME = "/var/lib/dnote";
+    XDG_DATA_HOME = "/var/lib/dnote";
+    XDG_CONFIG_HOME = "/var/lib/dnote";
+    GO_ENV = "PRODUCTION";
+    OnPremises = true;
+    DBHost = "/var/run/postgresql";
+    DBPort = config.services.postgresql.settings.port;
+    DBUser = cfg.user;
+    WebURL = "https://${fqdn}";
+  };
+
+  serializeEnvVar =
+    value: if (lib.isBool value) then if value then "true" else "false" else toString value;
+in
+{
+  options.services.dnote = {
+    enable = lib.mkEnableOption "Enable dnote server";
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "dnote";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 3040;
+    };
+    environment = lib.mkOption {
+      type = types.environment;
+      default = { };
+    };
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      users.${cfg.user} = {
+        isSystemUser = true;
+        group = cfg.user;
+      };
+      groups.${cfg.user} = { };
+    };
+
+    systemd.services.dnote = {
+      enable = true;
+      description = "Dnote server";
+      environment = lib.mapAttrs (_: value: serializeEnvVar value) (
+        cfg.environment // immutableEnvironment
+      );
+      after = [ "postgresql.service" ];
+      requires = [ "postgresql.service" ];
+      serviceConfig = {
+        ExecStart = "${pkgs-unstable.dnote}/bin/dnote-server start --port ${toString cfg.port}";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        User = cfg.user;
+        StateDirectory = "dnote";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    services = {
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ cfg.environment.DBName ];
+        ensureUsers = [
+          {
+            name = cfg.user;
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn} = {
+          proxyBuffering = false;
+          locations."/".proxyPort = cfg.port;
+        };
+      };
+    };
+  };
+}

modules/services/donetick.nix

@@ -0,0 +1,217 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  types = {
+    jwtSettings = {
+      session_time = lib.mkOption {
+        type = lib.types.str;
+        default = "168h";
+      };
+      max_refresh = lib.mkOption {
+        type = lib.types.str;
+        default = "168h";
+      };
+    };
+    serverSettings = {
+      port = lib.mkOption {
+        type = lib.types.int;
+        default = 2021;
+      };
+      read_timeout = lib.mkOption {
+        type = lib.types.str;
+        default = "10s";
+      };
+      write_timeout = lib.mkOption {
+        type = lib.types.str;
+        default = "10s";
+      };
+      rate_period = lib.mkOption {
+        type = lib.types.str;
+        default = "60s";
+      };
+      rate_limit = lib.mkOption {
+        type = lib.types.int;
+        default = 300;
+      };
+      cors_allow_origins = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [
+          "http://localhost:5173"
+          "http://localhost:7926"
+          "https://localhost"
+          "capacitor://localhost"
+        ];
+      };
+      serve_frontend = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+      };
+    };
+    schedulerSettings = {
+      due_job = lib.mkOption {
+        type = lib.types.str;
+        default = "30m";
+      };
+      overdue_job = lib.mkOption {
+        type = lib.types.str;
+        default = "3h";
+      };
+      pre_due_job = lib.mkOption {
+        type = lib.types.str;
+        default = "3h";
+      };
+    };
+    emailSettings = {
+      host = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      port = lib.mkOption {
+        type = lib.types.int;
+        default = 587;
+      };
+      email = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      key = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+    };
+    oauth2Settings = {
+      client_id = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      client_secret = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      auth_url = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      token_url = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      user_info_url = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      redirect_url = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+      };
+    };
+    settings = lib.types.submodule {
+      options = {
+        is_user_creation_disabled = lib.mkEnableOption "Disable user creation";
+        telegram.token = lib.mkOption {
+          type = lib.types.str;
+          default = "";
+        };
+        pushover.token = lib.mkOption {
+          type = lib.types.str;
+          default = "";
+        };
+        jwt = types.jwtSettings;
+        server = types.serverSettings;
+        scheduler_jobs = types.schedulerSettings;
+        email = types.emailSettings;
+        oauth2 = types.oauth2Settings;
+      };
+    };
+  };
+  version = "0.0.33";
+
+  package = pkgs.stdenv.mkDerivation {
+    name = "donetick";
+    src = pkgs.fetchurl {
+      url = "https://github.com/donetick/donetick/releases/download/v${version}/donetick_Linux_arm64.tar.gz";
+      hash = "sha256-o5PcONv+fxBMToOCwBcr2fnSpsHn5bdfujyUTuMKTbI=";
+    };
+    nativeBuildInputs = [
+      pkgs.autoPatchelfHook
+    ];
+    sourceRoot = ".";
+    installPhase = ''
+      runHook preInstall
+      install -Dm755 donetick $out/bin/donetick
+      runHook postInstall
+    '';
+    meta = with pkgs.lib; {
+      description = "A self-hosted task and chore manager";
+      license = licenses.mit;
+      mainProgram = "donetick";
+    };
+  };
+  cfg = config.services.donetick;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+
+  immutableSettings = {
+    name = "selfhosted";
+    is_done_tick_dot_com = false;
+    email.appHost = "https://${fqdn}";
+    database = {
+      type = "sqlite";
+      migration = true;
+    };
+  };
+  settings = (pkgs.formats.yaml { }).generate "selfhosted.yaml" (cfg.settings // immutableSettings);
+  secrets = config.age.secrets;
+in
+{
+  options.services.donetick = {
+    enable = lib.mkEnableOption "Enable donetick";
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    settings = lib.mkOption {
+      type = types.settings;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.donetick = {
+      enable = true;
+      environment = {
+        DT_ENV = "selfhosted";
+      };
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${package}/bin/donetick";
+        BindReadOnlyPaths = [
+          "${settings}:/var/lib/donetick/config/selfhosted.yaml"
+          /run/systemd/resolve/stub-resolv.conf
+          /etc/ssl
+          /etc/static/ssl
+          /etc/resolv.conf
+          /etc/static/resolv.conf
+          /etc/nsswitch.conf
+          /etc/static/nsswitch.conf
+          /etc/hosts
+        ];
+        WorkingDirectory = "/var/lib/donetick";
+        StateDirectory = "donetick";
+        EnvironmentFile = secrets.donetick.path;
+      };
+      wantedBy = [ "multi-user.target" ];
+      confinement.enable = true;
+    };
+
+    services.webserver = {
+      enable = lib.mkDefault true;
+      vHosts.${fqdn}.locations."/".proxyPort = cfg.settings.server.port;
+    };
+  };
+}

modules/services/gitea.nix

@@ -0,0 +1,74 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.gitea;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.gitea = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    secrets = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.gitea = {
+      database = {
+        type = "postgres";
+        socket = "/run/postgresql";
+      };
+      settings = {
+        server = {
+          ROOT_URL = "https://${fqdn}/";
+          HTTP_ADDR = "127.0.0.1";
+          HTTP_PORT = 3008;
+          SSH_DOMAIN = fqdn;
+          SSH_PORT = 2222;
+          SSH_LISTEN_PORT = 2222;
+          START_SSH_SERVER = true;
+        };
+        service = {
+          DISABLE_REGISTRATION = false;
+        };
+        mailer = {
+          ENABLED = true;
+        };
+      };
+    };
+
+    services = {
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn}.locations."/" = {
+          proxyPort = 3008;
+          extraConfig = "client_max_body_size 0;";
+        };
+      };
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ "gitea" ];
+        ensureUsers = [
+          {
+            name = "gitea";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+
+    systemd.services.gitea = {
+      serviceConfig = lib.mkIf (cfg.secrets != null) {
+        EnvironmentFile = cfg.secrets;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 2222 ];
+  };
+}

modules/services/glance.nix

@@ -0,0 +1,45 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.tailscaledGlance;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+  acme = config.security.acme;
+in
+{
+  imports = [
+    (lib.mkAliasOptionModule
+      [ "services" "tailscaledGlance" "settings" ]
+      [ "services" "glance" "settings" ]
+    )
+  ];
+
+  options.services.tailscaledGlance = {
+    enable = lib.mkEnableOption "Enable tailscaled glance";
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale.enable = true;
+    modules.firewall.interfaces.${config.services.tailscale.interfaceName} = [ "dns" ];
+
+    systemd.services.glance.serviceConfig.LoadCredential = [
+      "fullchain.pem:${acme.certs.${fqdn}.directory}/fullchain.pem"
+      "key.pem:${acme.certs.${fqdn}.directory}/key.pem"
+    ];
+
+    services.glance = {
+      enable = cfg.enable;
+    };
+
+    systemd.services.glance = {
+      requires = [ "tailscaled.service" ];
+      after = [ "tailscaled.service" ];
+    };
+
+    services.webserver.vHosts.${fqdn} = {
+      tailscaleAuth = true;
+      locations."/".proxyPort = cfg.settings.server.port;
+    };
+  };
+}

modules/services/gotosocial.nix

@@ -0,0 +1,53 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.gotosocial;
+  secrets = config.age.secrets;
+  domain = config.networking.domain;
+  fqdn = "${cfg.subdomain}.${domain}";
+  port = cfg.settings.port;
+in
+{
+  options.services.gotosocial = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      gotosocial = {
+        environmentFile = secrets.gotosocial.path;
+        settings = {
+          host = fqdn;
+          account-domain = domain;
+          protocol = "https";
+          bind-address = "localhost";
+          instance-inject-mastodon-version = true;
+          accounts-registration-open = true;
+          instance-expose-public-timeline = true;
+          letsencrypt-enabled = false;
+        };
+        setupPostgresqlDB = true;
+      };
+
+      webserver.vHosts = {
+        ${domain}.locations = lib.listToAttrs (
+          lib.map
+            (path: {
+              name = "/.well-known/${path}";
+              value.extraConfig = ''
+                rewrite ^.*$ https://${fqdn}/.well-known/${path} permanent;
+              '';
+            })
+            [
+              "host-meta"
+              "webfinger"
+              "nodeinfo"
+            ]
+        );
+
+        "${fqdn}".locations."/".proxyPort = port;
+      };
+    };
+  };
+}

modules/services/grafana.nix

@@ -0,0 +1,62 @@
+{ lib, config, ... }:
+let
+  cfg = config.services.grafana;
+  secrets = config.age.secrets;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.grafana = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.grafana = {
+      settings = {
+        server = {
+          root_url = "https://${fqdn}";
+        };
+
+        database = {
+          host = "/var/run/postgresql";
+          type = "postgres";
+          user = "grafana";
+        };
+
+        smtp = {
+          from_name = "Grafana";
+          password = "$__file{${secrets.smtp-password.path}}";
+        };
+      };
+    };
+
+    services = {
+      prometheus = {
+        enable = true;
+        exporters.node.enable = true;
+        scrapeConfigs = [
+          {
+            job_name = "node";
+            static_configs = [
+              { targets = [ "localhost:9100" ]; }
+            ];
+          }
+        ];
+      };
+
+      webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.settings.server.http_port;
+
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ "grafana" ];
+        ensureUsers = [
+          {
+            name = "grafana";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+  };
+}

modules/services/gtrackmap.nix

@@ -0,0 +1,25 @@
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
+let
+  cfg = config.services.gtrackmap;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  imports = [
+    inputs.gtrackmap.nixosModules.default
+  ];
+
+  options.services.gtrackmap = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+  };
+}

modules/services/hastebin.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
+let
+  cfg = config.services.hastebin;
+  secrets = config.age.secrets;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  imports = [
+    inputs.hastebin.nixosModules.default
+  ];
+
+  options.services.hastebin.subdomain = lib.mkOption {
+    type = lib.types.str;
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.hastebin.settings = lib.mkDefault {
+      max_size = "1 GiB";
+      host = "::1";
+      port = 3600;
+      mime_overrides = {
+        "text/plain" = [
+          "log"
+          "txt"
+          "diff"
+          "sh"
+          "rs"
+          "toml"
+          "cr"
+          "nix"
+          "rb"
+          "ts"
+          "tsx"
+          "jsx"
+        ];
+      };
+      auth_tokens_file = secrets.hastebin-tokens.path;
+    };
+
+    services.webserver = {
+      enable = lib.mkDefault true;
+      vHosts.${fqdn} = {
+        proxyBuffering = false;
+        locations."/" = {
+          proxyPort = cfg.settings.port;
+          extraConfig = ''
+            client_max_body_size   0;
+            proxy_send_timeout   300;
+            proxy_read_timeout   300;
+            send_timeout         300;
+          '';
+        };
+      };
+    };
+  };
+}

modules/services/hledger-web.nix

@@ -0,0 +1,72 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.hledger-web;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.hledger-web = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    user = lib.mkOption {
+      type = lib.types.str;
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      hledger-web = {
+        allow = lib.mkDefault "edit";
+        baseUrl = "https://${fqdn}";
+        serveApi = true;
+        extraOptions = [
+          "--exchange=€"
+        ];
+      };
+
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn} = {
+          tailscaleAuth = true;
+          extraConfig = ''
+            root /var/www/ledgio;
+            add_header Access-Control-Allow-Origin $http_origin always;
+            add_header Access-Control-Allow-Methods 'OPTIONS, GET, PUT' always;
+            add_header Access-Control-Allow-Headers 'Content-Type' always;
+
+            location ~ \.(html|js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+              try_files $uri =404;
+            }
+          '';
+
+          locations = {
+            "@api" = {
+              proxyPort = cfg.port;
+            };
+
+            "/".extraConfig = ''
+              if ($request_method = OPTIONS) {
+                add_header Content-Type text/plain;
+                add_header Content-Length 0;
+                add_header Access-Control-Allow-Origin $http_origin;
+                add_header Access-Control-Allow-Methods 'OPTIONS, GET, PUT';
+                add_header Access-Control-Allow-Headers 'Content-Type';
+                return 204;
+              }
+
+              try_files $uri $uri/ @api;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.hledger-web.serviceConfig = {
+      User = lib.mkForce cfg.user;
+      Group = lib.mkForce cfg.group;
+    };
+  };
+}

modules/services/home-assistant.nix

@@ -0,0 +1,20 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.home-assistant;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.home-assistant = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "The subdomain to use for Home Assistant";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.webserver = {
+      enable = lib.mkDefault true;
+      vHosts.${fqdn}.locations."/".proxyPort = cfg.config.http.server_port;
+    };
+  };
+}

modules/services/immich.nix

@@ -0,0 +1,52 @@
+{ lib, config, ... }:
+let
+  cfg = config.services.immich;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.immich = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    timezone = lib.mkOption {
+      type = lib.types.str;
+      default = "UTC";
+    };
+    uid = lib.mkOption {
+      type = lib.types.int;
+      default = 990;
+    };
+    gid = lib.mkOption {
+      type = lib.types.int;
+      default = 997;
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services = {
+      immich = {
+        environment = {
+          TZ = cfg.timezone;
+        };
+        settings.server.externalDomain = "https://${fqdn}";
+      };
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn} = {
+          proxyBuffering = false;
+          locations."/" = {
+            proxyPort = cfg.port;
+            extraConfig = ''
+              client_max_body_size   0;
+              proxy_send_timeout   300;
+              proxy_read_timeout   300;
+              send_timeout         300;
+            '';
+          };
+        };
+      };
+    };
+
+    users.users.${cfg.user}.uid = cfg.uid;
+    users.groups.${cfg.user}.gid = cfg.gid;
+  };
+}

modules/services/invidious-companion.nix

@@ -0,0 +1,99 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.invidious-companion;
+  companionRelease = "release-master";
+  hostPlatform = pkgs.stdenv.hostPlatform.system;
+
+  # Invidious Companion package - fetches binary release and patches for NixOS
+  unwrappedCompanion = pkgs.stdenv.mkDerivation {
+    pname = "unwrapped-invidious-companion";
+    version = companionRelease;
+
+    src =
+      let
+        archMap = {
+          x86_64-linux = "x86_64-unknown-linux-gnu";
+          aarch64-linux = "aarch64-unknown-linux-gnu";
+        };
+        platform = archMap.${hostPlatform} or (throw "Unsupported platform: ${hostPlatform}");
+      in
+      pkgs.fetchzip {
+        url = "https://github.com/iv-org/invidious-companion/releases/download/${companionRelease}/invidious_companion-${platform}.tar.gz";
+        sha256 = cfg.binaryHash;
+      };
+
+    dontStrip = true;
+    dontPatchELF = true;
+
+    installPhase = ''
+      mkdir -p $out/bin
+      cp invidious_companion $out/bin/invidious_companion
+      chmod +x $out/bin/invidious_companion
+    '';
+  };
+
+  invidiousCompanion = pkgs.buildFHSEnv {
+    name = "invidious-companion";
+    targetPkgs = pkgs: [ unwrappedCompanion ];
+    runScript = "invidious_companion";
+    meta = {
+      description = "Invidious companion for handling video streams";
+      homepage = "https://github.com/iv-org/invidious-companion";
+      license = lib.licenses.agpl3Only;
+    };
+  };
+in
+{
+  options.services.invidious-companion = {
+    enable = lib.mkEnableOption "Enable Invidious Companion service";
+    host = lib.mkOption {
+      type = lib.types.str;
+      default = "localhost";
+    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8282;
+      description = "Port for Invidious Companion to listen on";
+    };
+    secretKeyFile = lib.mkOption {
+      type = lib.types.str;
+      description = "Path to file containing the companion secret key";
+    };
+    binaryHash = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "SHA256 hash of the invidious companion binary release";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.invidious-companion = {
+      description = "Invidious Companion - video stream handler";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = "invidious";
+        Group = "invidious";
+        DynamicUser = true;
+        ExecStart = lib.getExe invidiousCompanion;
+        Environment = [
+          "HOST=${cfg.host}"
+          "PORT=${toString cfg.port}"
+          "TMPDIR=/var/cache/invidious-companion"
+        ];
+        EnvironmentFile = [ cfg.secretKeyFile ];
+        CacheDirectory = "invidious-companion";
+        WorkingDirectory = "%C/invidious-companion";
+        Restart = "always";
+        RestartSec = 5;
+      };
+    };
+  };
+}

modules/services/invidious.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.invidious;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.invidious = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      invidious = {
+        domain = fqdn;
+        address = "127.0.0.1";
+
+        settings = {
+          external_port = 443;
+          db = {
+            dbname = "invidious";
+            user = "invidious";
+          };
+        };
+      };
+
+      postgresql.enable = lib.mkDefault true;
+
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+      };
+    };
+
+    systemd.services.invidious.serviceConfig.DynamicUser = lib.mkForce false;
+
+    users.groups.invidious = { };
+    users.users.invidious = {
+      isSystemUser = true;
+      group = "invidious";
+      description = "Invidious user";
+    };
+  };
+}

modules/services/mealie.nix

@@ -0,0 +1,37 @@
+{ lib, config, ... }:
+let
+  cfg = config.services.mealie;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.mealie = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      mealie.settings = {
+        BASE_URL = "https://${fqdn}";
+        ALLOW_SIGNUP = true;
+        DB_ENGINE = "postgres";
+        POSTGRES_URL_OVERRIDE = "postgresql://mealie:@mealie?host=/var/run/postgresql";
+        SMTP_FROM_NAME = "Mealie";
+      };
+
+      webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ "mealie" ];
+        ensureUsers = [
+          {
+            name = "mealie";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+  };
+}

modules/services/mosquitto.nix

@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.mosquitto;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+  acme = config.security.acme;
+in
+{
+  options = {
+    services.mosquitto = {
+      openFirewall = lib.mkEnableOption "Open firewall port for Mosquitto";
+      subdomain = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      { networking.firewall.allowedTCPPorts = map ({ port, ... }: port) cfg.listeners; }
+      (lib.mkIf (cfg.subdomain != null) {
+        security.acme.certs.${fqdn}.postRun = ''
+          systemctl restart mosquitto
+        '';
+
+        systemd.services.mosquitto = {
+          requires = [ "acme-${fqdn}.service" ];
+          serviceConfig.LoadCredential = [
+            "fullchain.pem:${acme.certs.${fqdn}.directory}/fullchain.pem"
+            "key.pem:${acme.certs.${fqdn}.directory}/key.pem"
+          ];
+        };
+      })
+    ]
+  );
+}

modules/services/network-status.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.modules.services.network-status;
+in
+{
+  options.modules.services.network-status = {
+    enable = lib.mkEnableOption "Enable network status socket service";
+
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 8473;
+      description = "TCP port to listen on for network status requests";
+    };
+
+    interface = lib.mkOption {
+      type = lib.types.str;
+      default = "koti";
+      description = "Network interface to allow access from";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.network-status = {
+      isSystemUser = true;
+      group = "network-status";
+      description = "Network status socket service user";
+    };
+
+    users.groups.network-status = { };
+
+    systemd.sockets.network-status = {
+      description = "Network Status Socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = cfg.port;
+        Accept = true;
+      };
+    };
+
+    systemd.services."network-status@" = {
+      description = "Network Status Service";
+      serviceConfig = {
+        Type = "simple";
+        User = "network-status";
+        Group = "systemd-network";
+        SupplementaryGroups = [ "systemd-network" ];
+        StandardOutput = "socket";
+        StandardInput = "socket";
+        ExecStart = lib.concatStringsSep " " [
+          (lib.getExe' pkgs.systemd "networkctl")
+          "status"
+          "--json=short"
+        ];
+      };
+    };
+
+    modules.firewall.interfaces.${cfg.interface} = lib.mkDefault [ "network-status" ];
+  };
+}

modules/services/nqptp.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.nqptp;
+in
+{
+  options.services.nqptp = {
+    enable = lib.mkEnableOption "nqptp service for shairport-sync";
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.nqptp = {
+      description = "Network Queued PCM Transport Protocol";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.getExe pkgs.nqptp;
+        Restart = "on-failure";
+      };
+    };
+  };
+}

modules/services/octodns.nix

@@ -0,0 +1,249 @@
+{
+  pkgs,
+  pkgs-unstable,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.octodns;
+  secrets = config.age.secrets;
+
+  types = {
+    ttlOptions = default: {
+      ttl = lib.mkOption {
+        type = lib.types.int;
+        default = default;
+      };
+    };
+    defaults = lib.types.submodule {
+      options = {
+        A = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+        AAAA = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+        CNAME = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+        MX = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+        TXT = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+      }
+      // (types.ttlOptions 3600);
+    };
+    aRecord = lib.types.submodule {
+      options = {
+        values = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.A.ttl;
+        };
+      };
+    };
+    aaaaRecord = lib.types.submodule {
+      options = {
+        values = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.AAAA.ttl;
+        };
+      };
+    };
+    cnameRecord = lib.types.submodule {
+      options = {
+        target = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+        toRoot = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.CNAME.ttl;
+        };
+      };
+    };
+    mxValue = lib.types.submodule {
+      options = {
+        exchange = lib.mkOption {
+          type = lib.types.str;
+        };
+        preference = lib.mkOption {
+          type = lib.types.int;
+          default = 10;
+        };
+      };
+    };
+    mxRecord = lib.types.submodule {
+      options = {
+        values = lib.mkOption {
+          type = lib.types.listOf types.mxValue;
+          default = [ ];
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.MX.ttl;
+        };
+      };
+    };
+    txtRecord = lib.types.submodule {
+      options = {
+        values = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.AAAA.ttl;
+        };
+      };
+    };
+    records = lib.types.submodule {
+      options = {
+        A = lib.mkOption {
+          type = types.aRecord;
+          default = { };
+        };
+        AAAA = lib.mkOption {
+          type = types.aaaaRecord;
+          default = { };
+        };
+        CNAME = lib.mkOption {
+          type = types.cnameRecord;
+          default = { };
+        };
+        MX = lib.mkOption {
+          type = types.mxRecord;
+          default = { };
+        };
+        TXT = lib.mkOption {
+          type = types.txtRecord;
+          default = { };
+        };
+      };
+    };
+  };
+
+  yamlFormat = pkgs.formats.yaml { };
+
+  zoneFile = yamlFormat.generate "octodns-zone" (
+    lib.filterAttrs (_: records: (lib.length records) > 0) (
+      lib.mapAttrs (
+        _: types:
+        lib.filter
+          (
+            {
+              values ? [ ],
+              value ? null,
+              ...
+            }:
+            (lib.length values) > 0 || !(builtins.isNull value)
+          )
+          (
+            lib.mapAttrsToList (
+              type:
+              { ttl, ... }@options:
+              if (type == "CNAME") then
+                let
+                  inherit (options) target toRoot;
+                  value = if toRoot then "${config.networking.domain}." else target;
+                in
+                {
+                  inherit type ttl value;
+                }
+              else
+                {
+                  inherit type ttl;
+                  inherit (options) values;
+                }
+            ) types
+          )
+      ) cfg.records
+    )
+  );
+
+  zonesDir = pkgs.linkFarm "octodns-zones" {
+    "${config.networking.domain}.yaml" = zoneFile;
+  };
+
+  configFile = yamlFormat.generate "octodns-config.yaml" {
+    providers = {
+      config = {
+        class = "octodns.provider.yaml.YamlProvider";
+        directory = zonesDir;
+        default_ttl = cfg.defaults.ttl;
+      };
+      hetzner = {
+        class = "octodns_hetzner.HetznerProvider";
+        token = "env/HETZNER_API_TOKEN";
+        backend = "hcloud";
+      };
+    };
+
+    zones."*" = {
+      sources = [ "config" ];
+      targets = [ "hetzner" ];
+    };
+  };
+
+  octodns = pkgs-unstable.octodns.withProviders (_: [
+    pkgs-unstable.octodns-providers.hetzner
+  ]);
+in
+{
+  options.services.octodns = {
+    enable = lib.mkEnableOption "Enable octodns";
+    records = lib.mkOption {
+      type = lib.types.attrsOf types.records;
+      default = { };
+    };
+    defaults = lib.mkOption {
+      type = types.defaults;
+      default = { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.octodns = {
+      enable = true;
+      description = "OctoDNS";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${octodns}/bin/octodns-sync --config-file ${configFile} --doit";
+        DynamicUser = true;
+        EnvironmentFile = secrets.hetzner.path;
+        RemainAfterExit = true;
+      };
+      wantedBy = lib.optionals config.services.nginx.enable [ "nginx.service" ];
+      before = lib.optionals config.services.nginx.enable [ "nginx.service" ];
+    };
+  };
+}

modules/services/open-webui.nix

@@ -0,0 +1,78 @@
+{
+  lib,
+  config,
+  pkgs-unstable,
+  ...
+}:
+let
+  cfg = config.services.open-webui;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+
+  open-webui-pkg = pkgs-unstable.open-webui.overridePythonAttrs (oldAttrs: {
+    dependencies =
+      oldAttrs.dependencies
+      ++ (with pkgs-unstable.python3Packages; [
+        pgvector
+        psycopg2
+      ])
+      ++ [
+        pkgs-unstable.ffmpeg
+      ];
+  });
+in
+{
+  options.services.open-webui = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      open-webui = {
+        package = open-webui-pkg;
+        environment = {
+          ANONYMIZED_TELEMETRY = "False";
+          DO_NOT_TRACK = "True";
+          SCARF_NO_ANALYTICS = "True";
+          WEBUI_URL = "https://${fqdn}";
+          VECTOR_DB = "pgvector";
+          PGVECTOR_CREATE_EXTENSION = "False";
+          DATABASE_URL = "postgresql:///open-webui?host=/var/run/postgresql";
+          CORS_ALLOW_ORIGIN = "https://${fqdn};http://localhost";
+        };
+      };
+
+      webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ "open-webui" ];
+        ensureUsers = [
+          {
+            name = "open-webui";
+            ensureDBOwnership = true;
+          }
+        ];
+        extensions = ps: with ps; [ pgvector ];
+      };
+    };
+
+    systemd.services.open-webui-pgvector-setup = {
+      description = "Ensure pgvector extension exists for open-webui";
+      wantedBy = [ "open-webui.service" ];
+      before = [ "open-webui.service" ];
+      after = [
+        "postgresql.service"
+        "postgresql-setup.service"
+      ];
+      requires = [ "postgresql.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "postgres";
+        Group = "postgres";
+        ExecStart = "${config.services.postgresql.package}/bin/psql -d open-webui -c 'CREATE EXTENSION IF NOT EXISTS vector;'";
+        RemainAfterExit = true;
+      };
+    };
+  };
+}

modules/services/owncast.nix

@@ -0,0 +1,22 @@
+{ lib, config, ... }:
+let
+  cfg = config.services.owncast;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.owncast = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      owncast = {
+        openFirewall = true;
+      };
+
+      webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+    };
+  };
+}

modules/services/readeck.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.readeck;
+  secrets = config.age.secrets;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.readeck = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      readeck = {
+        package = pkgs.readeck;
+        environmentFile = secrets.readeck.path;
+        settings = {
+          server.port = lib.mkDefault 8090;
+          database.source = "postgres://readeck:@readeck?host=/var/run/postgresql";
+        };
+      };
+
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn} = {
+          proxyBuffering = false;
+          locations."/" = {
+            proxyPort = cfg.settings.server.port;
+          };
+        };
+      };
+
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ "readeck" ];
+        ensureUsers = [
+          {
+            name = "readeck";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+  };
+}

modules/services/searx.nix

@@ -0,0 +1,70 @@
+{
+  pkgs-unstable,
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  cfg = config.services.searx;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  disabledModules = [ "services/networking/searx.nix" ];
+
+  imports = [
+    "${inputs.nixpkgs-unstable}/nixos/modules/services/networking/searx.nix"
+  ];
+
+  options.services.searx = {
+    port = lib.mkOption {
+      type = lib.types.int;
+    };
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.searx = {
+      redisCreateLocally = true;
+      package = pkgs-unstable.searxng;
+      limiterSettings = {
+        botdetection = {
+          ipv4_prefix = 32;
+          ipv6_prefix = 56;
+          ip_limit = {
+            filter_link_local = true;
+            link_token = false;
+          };
+          ip_lists = {
+            pass_ip = [
+              "127.0.0.1/32"
+              "::1"
+            ];
+          };
+          trusted_proxies = [
+            "127.0.0.0/8"
+            "::1"
+          ];
+        };
+      };
+      settings = {
+        server = {
+          bind_address = "localhost";
+          port = cfg.port;
+          limiter = true;
+        };
+      };
+    };
+
+    services.webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+
+    # searx expects limiter.toml in the same directory as settings.yml (/run/searx)
+    systemd.services.searx-init.script = lib.mkAfter ''
+      ln -sf /etc/searxng/limiter.toml /run/searx/limiter.toml
+    '';
+
+    users.groups.searx.members = [ "nginx" ];
+  };
+}

modules/services/sillytavern.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.sillytavern;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.sillytavern = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      default = "sillytavern";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.webserver = {
+      enable = lib.mkDefault true;
+      vHosts.${fqdn} = {
+        tailscaleAuth = true;
+        proxyBuffering = false;
+        locations."/".proxyPort = cfg.port;
+      };
+    };
+  };
+}

modules/services/syncthing.nix

@@ -0,0 +1,40 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.syncthing;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.syncthing = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 8384;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      syncthing = {
+        openDefaultPorts = true;
+        guiAddress = "[::1]:${toString cfg.port}";
+        settings.gui.insecureSkipHostCheck = true;
+      };
+
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+      };
+    };
+
+    systemd.services.syncthing.serviceConfig =
+      lib.mkIf
+        (
+          cfg.dataDir == "/var/lib/syncthing" || cfg.dataDir == null || cfg.configDir == "/var/lib/syncthing"
+        )
+        {
+          StateDirectory = "syncthing";
+        };
+  };
+}

modules/services/tailscale.nix

@@ -0,0 +1,9 @@
+{ lib, config, ... }:
+let
+  cfg = config.services.tailscale;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.tailscale.useRoutingFeatures = lib.mkDefault "server";
+  };
+}

modules/services/uptime-kuma.nix

@@ -0,0 +1,16 @@
+{ lib, config, ... }:
+let
+  cfg = config.services.uptime-kuma;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.uptime-kuma = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.webserver.vHosts.${fqdn}.locations."/".proxyPort = lib.toInt cfg.settings.PORT;
+  };
+}