.direnv/bin/nix-direnv-reload

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-dir="$(realpath $(dirname ${BASH_SOURCE[0]})/../..)"
-_nix_direnv_force_reload=1 direnv exec "$dir" true
-direnv reload
-# direnv reload updates the mtime of .envrc. Also update the timestamp of the
-# profile_rc file to keep track that we actually are up to date.
-touch $dir/.direnv/{nix,flake}-profile-*.rc
-

.envrc

@@ -1,2 +0,0 @@
-export HE_PASSWORD=SuperDuper
-use flake

.gitignore

@@ -1 +0,0 @@
-.direnv/

dns/dnsconfig.js

@@ -4,27 +4,6 @@ var REG_NONE = NewRegistrar('none');    // No registrar.
 var DNS_BIND = NewDnsProvider('bind');  // ISC BIND.
 var DNS_HEDNS = NewDnsProvider('hedns');  
 
-D("lakhwara.com", REG_NONE,
-	DnsProvider(DNS_HEDNS),
-	DefaultTTL(300),
-	//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022041702, 86400, 7200, 3600000, 86400, TTL(172800)),
-	A('anish', '69.61.2.203'),
-	A('@', '69.61.2.203'),
-	//A('coaching', '103.16.130.98'),
-	TXT('anish', 'datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5'),
-	CNAME('fm1._domainkey', 'fm1.lakhwara.com.dkim.fmhosted.com.'),
-	CNAME('fm2._domainkey', 'fm2.lakhwara.com.dkim.fmhosted.com.'),
-	CNAME('fm3._domainkey', 'fm3.lakhwara.com.dkim.fmhosted.com.'),
-	MX('@', 10, 'in1-smtp.messagingengine.com.'),
-	MX('@', 20, 'in2-smtp.messagingengine.com.'),
-	//NAMESERVER('ns1.he.net.'),
-	//NAMESERVER('ns2.he.net.'),
-	//NAMESERVER('ns3.he.net.'),
-	//NAMESERVER('ns4.he.net.'),
-	//NAMESERVER('ns5.he.net.'),
-	TXT('@', 'v=spf1 include:spf.messagingengine.com ?all')
-)
-
 D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
 	DefaultTTL(86400),
 	//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)),
@@ -34,12 +13,9 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
 	//NAMESERVER('ns4.he.net.'),
 	//NAMESERVER('ns5.he.net.'),
 	// capsul: helix
-	A('bridge', '69.61.2.203', TTL(300)),
+	A('bridge', '69.61.38.225', TTL(300)),
-	A('rss', '69.61.2.203', TTL(300)),
+	A('rss', '69.61.38.225', TTL(300)),
-	A('git', '69.61.2.203', TTL(300)),
+	A('git', '69.61.38.225', TTL(300)),
-	A('bin', '69.61.2.203', TTL(300)),
-	A('ci', '69.61.2.203', TTL(300)),
-	A('write', '69.61.2.203', TTL(300)),
 	// vultr -> nulled: lituus
 	A('@', '45.77.48.108', TTL(300)),
 	A('jitsi', '45.77.48.108', TTL(300)),

dns/zones/lakhwara.com.zone

@@ -1,22 +0,0 @@
-; lakhwara.com Dumped Sun May 28 22:30:02 2023
-;
-lakhwara.com.	172800	IN	SOA	ns1.he.net. hostmaster.he.net. (
-					2022041702	;serial
-					86400		;refresh
-					7200		;retry
-					3600000		;expire
-					86400	)	;minimum
-anish.lakhwara.com.	86400	IN	A	103.16.130.98
-anish.lakhwara.com.	86400	IN	TXT	datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5
-fm1._domainkey.lakhwara.com.	86400	IN	CNAME	fm1.lakhwara.com.dkim.fmhosted.com.
-fm2._domainkey.lakhwara.com.	86400	IN	CNAME	fm2.lakhwara.com.dkim.fmhosted.com.
-fm3._domainkey.lakhwara.com.	86400	IN	CNAME	fm3.lakhwara.com.dkim.fmhosted.com.
-lakhwara.com.	86400	IN	A	103.16.130.98
-lakhwara.com.	86400	IN	MX	10 in1-smtp.messagingengine.com.
-lakhwara.com.	86400	IN	MX	20 in2-smtp.messagingengine.com.
-lakhwara.com.	86400	IN	NS	ns1.he.net.
-lakhwara.com.	86400	IN	NS	ns2.he.net.
-lakhwara.com.	86400	IN	NS	ns3.he.net.
-lakhwara.com.	86400	IN	NS	ns4.he.net.
-lakhwara.com.	86400	IN	NS	ns5.he.net.
-lakhwara.com.	86400	IN	TXT	"v=spf1 include:spf.messagingengine.com ?all"

flake.lock

@@ -2,19 +2,16 @@
   "nodes": {
     "agenix": {
       "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
         "nixpkgs": [
           "nixpkgs"
-        ],
+        ]
-        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1723293904,
+        "lastModified": 1665870395,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "a630400067c6d03c9b3e0455347dc8559db14288",
         "type": "github"
       },
       "original": {
@@ -34,11 +31,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1682226636,
+        "lastModified": 1663665682,
-        "narHash": "sha256-fmETHfUtQ5zOVr/4MT5wE7eNALCSQCnEUYZYmV3UEwg=",
+        "narHash": "sha256-YB+vmQB3N9RyeshHAO4GjIFebA7NPY2jlkdvGGZtM64=",
         "ref": "main",
-        "rev": "095d14ff2469c8f3de7cbf45d229c0f46a733aae",
+        "rev": "36bda6965ab2e1a206f8c2b7a74f3b022c873662",
-        "revCount": 77,
+        "revCount": 65,
         "type": "git",
         "url": "ssh://gitea@git.sealight.xyz/aynish/basant"
       },
@@ -48,28 +45,6 @@
         "url": "ssh://gitea@git.sealight.xyz/aynish/basant"
       }
     },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1700795494,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -79,11 +54,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1718194053,
+        "lastModified": 1668797197,
-        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
+        "narHash": "sha256-0w6iD3GSSQbIeSFVDzAAQZB+hDq670ZTms3d9XI+BtM=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
+        "rev": "2a3c5f70eee04a465aa534d8bd4fcc9bb3c4a8ce",
         "type": "github"
       },
       "original": {
@@ -92,65 +67,55 @@
         "type": "github"
       }
     },
-    "devshell": {
-      "locked": {
-        "lastModified": 1642188268,
-        "narHash": "sha256-DNz4xScpXIn7rSDohdayBpPR9H9OWCMDOgTYegX081k=",
-        "owner": "numtide",
-        "repo": "devshell",
-        "rev": "696acc29668b644df1740b69e1601119bf6da83b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "devshell",
-        "type": "github"
-      }
-    },
     "dirt-samples-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1698439458,
+        "lastModified": 1588278411,
-        "narHash": "sha256-Mp8qBpsOvW9Zguv95Kv7EU6S3ICaF2aO02Wz6xGURtE=",
+        "narHash": "sha256-h8vQxRym6QzNLOTZU7A43VCHuG0H77l+BFwXnC0L1CE=",
         "owner": "tidalcycles",
         "repo": "dirt-samples",
-        "rev": "9a6dff8f9ec3cd55b287290cf04e01afa6b8f532",
+        "rev": "66d432418c9a7d82cf049d9246adfa62f46df2a6",
         "type": "github"
       },
       "original": {
         "owner": "tidalcycles",
+        "ref": "master",
         "repo": "dirt-samples",
         "type": "github"
       }
     },
-    "disko": {
+    "eww": {
       "inputs": {
+        "flake-compat": "flake-compat_2",
         "nixpkgs": [
           "nixpkgs"
+        ],
+        "rust-overlay": [
+          "rust-overlay"
         ]
       },
       "locked": {
-        "lastModified": 1724031427,
+        "lastModified": 1669643151,
-        "narHash": "sha256-o1HdAf+7IGv9M13R3c+zc/sJ0QgeEnhsvHBcodI4UpM=",
+        "narHash": "sha256-39/l57QusriyNr426kXNqtub0ciZna+t20VKPYUAgsM=",
-        "owner": "nix-community",
+        "owner": "elkowar",
-        "repo": "disko",
+        "repo": "eww",
-        "rev": "4e719b38fa7c85f4f65d0308ca7084c91e7bdd6d",
+        "rev": "ec4c2d1a4f12e9c3664e9f53ad99007b4a10a16a",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "elkowar",
-        "repo": "disko",
+        "repo": "eww",
         "type": "github"
       }
     },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1648199409,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
         "type": "github"
       },
       "original": {
@@ -162,11 +127,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1641205782,
+        "lastModified": 1650374568,
-        "narHash": "sha256-4jY7RCWUoZ9cKD8co0/4tFARpWB+57+r1bLLvXNJliY=",
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "b7547d3eed6f32d06102ead8991ec52ab0a4f1a7",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
         "type": "github"
       },
       "original": {
@@ -192,11 +157,26 @@
     },
     "flake-utils_2": {
       "locked": {
-        "lastModified": 1667395993,
+        "lastModified": 1652372896,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "narHash": "sha256-lURGussfF3mGrFPQT3zgW7+RC0pBhbHzco0C7I+ilow=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "0d347c56f6f41de822a4f4c7ff5072f3382db121",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
         "type": "github"
       },
       "original": {
@@ -208,16 +188,17 @@
     "grasp": {
       "inputs": {
         "flake-utils": "flake-utils_2",
+        "grasp": "grasp_2",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1682644301,
+        "lastModified": 1652615971,
-        "narHash": "sha256-gMBFZLf41s3+cnhxgZVRvj2JSAFYv4jn2xBKwEESthE=",
+        "narHash": "sha256-e8fvTQCR/At2jgenuY71WXN13XawYRiMpKiHSGgGSkY=",
         "ref": "main",
-        "rev": "a2d85675b930ffc26f6891b2e14491795907be4e",
+        "rev": "ef605857248ec1b60cece250f98d2964164d48db",
-        "revCount": 137,
+        "revCount": 19,
         "type": "git",
         "url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
       },
@@ -227,13 +208,29 @@
         "url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
       }
     },
+    "grasp_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1586706168,
+        "narHash": "sha256-xLkxE24xtTghQpAfAqAsOvsGpz0coACXjNT8bHZhcxM=",
+        "owner": "karlicoss",
+        "repo": "grasp",
+        "rev": "4bc8f011227d1baa18b4e98543561534065490d8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "karlicoss",
+        "repo": "grasp",
+        "type": "github"
+      }
+    },
     "hardware": {
       "locked": {
-        "lastModified": 1723310128,
+        "lastModified": 1670174919,
-        "narHash": "sha256-IiH8jG6PpR4h9TxSGMYh+2/gQiJW9MwehFvheSb5rPc=",
+        "narHash": "sha256-XdQr3BUnrvVLRFunLWrZORhwYHDG0+9jUUe0Jv1pths=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "c54cf53e022b0b3c1d3b8207aa0f9b194c24f0cf",
+        "rev": "9d87bc030a0bf3f00e953dbf095a7d8e852dab6b",
         "type": "github"
       },
       "original": {
@@ -245,16 +242,16 @@
     "home-manager": {
       "inputs": {
         "nixpkgs": [
-          "agenix",
           "nixpkgs"
-        ]
+        ],
+        "utils": "utils_2"
       },
       "locked": {
-        "lastModified": 1703113217,
+        "lastModified": 1670280307,
-        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "narHash": "sha256-3x+0whP1nCz5adQMIsBA3L9fI/ABOpRUJdbw0AmxBnU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "rev": "2af0d07678fc15612345e0dd55337550dcf6465f",
         "type": "github"
       },
       "original": {
@@ -263,118 +260,44 @@
         "type": "github"
       }
     },
-    "home-manager_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1720042825,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-24.05",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "nix-matrix-appservices": {
-      "inputs": {
-        "devshell": "devshell",
-        "flake-compat": "flake-compat_2",
-        "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1683490239,
-        "narHash": "sha256-QKzpvl2XrqbobWq/I/smDa9hEniwctjJybXPVILHP0w=",
-        "owner": "coffeetables",
-        "repo": "nix-matrix-appservices",
-        "rev": "e795d2fbc61da45d49802bb3e8f8d0c70ddc1e68",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "coffeetables",
-        "repo": "nix-matrix-appservices",
-        "type": "gitlab"
-      }
-    },
-    "nixlib": {
-      "locked": {
-        "lastModified": 1643502816,
-        "narHash": "sha256-Wrbt6Gs+hjXD3HUICPBJHKnHEUqiyx8rzHCgvqC1Bok=",
-        "owner": "divnix",
-        "repo": "nixpkgs.lib",
-        "rev": "ebed7ec5bcb5d01e298535989c6c321df18b631a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "divnix",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixos-hardware": {
-      "locked": {
-        "lastModified": 1723310128,
-        "narHash": "sha256-IiH8jG6PpR4h9TxSGMYh+2/gQiJW9MwehFvheSb5rPc=",
-        "owner": "NixOS",
-        "repo": "nixos-hardware",
-        "rev": "c54cf53e022b0b3c1d3b8207aa0f9b194c24f0cf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "master",
-        "repo": "nixos-hardware",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1662099760,
+        "lastModified": 1670193339,
-        "narHash": "sha256-MdZLCTJPeHi/9fg6R9fiunyDwP3XHJqDd51zWWz9px0=",
+        "narHash": "sha256-oHTAhX4p6+uxcabq0rKL4EyKWPbDLGKec88ocPIU/2Y=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "67e45078141102f45eff1589a831aeaa3182b41e",
+        "rev": "e169cf5b3b1e6cc4a25ff15087c2621605f83409",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
-        "ref": "nixos-22.05",
+        "ref": "nixos-22.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1723938990,
+        "lastModified": 1662446902,
-        "narHash": "sha256-9tUadhnZQbWIiYVXH8ncfGXGvkNq3Hag4RCBEMUk7MI=",
+        "narHash": "sha256-Dmsd3jSG2ldZUlhFaIwunqgMf14EEK7ylXpw+OPDLxE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c42fcfbdfeae23e68fc520f9182dde9f38ad1890",
+        "rev": "3bfaf06b12253ddaafe64a67f4ed39b547d41667",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nur": {
       "locked": {
-        "lastModified": 1724040334,
+        "lastModified": 1670315682,
-        "narHash": "sha256-Ia4gRRmhFn4oJ4SJKJPDNPomsRRFWU+bqCK7yuiLW4E=",
+        "narHash": "sha256-/v0RgZZIjvsFuJbJLUlzRbzSlYFXq3olgJTuJBNtcoY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "24471a48600e18669d13d24c9640b9859357d2cf",
+        "rev": "af814db16c89385c65e758608296440555f61ccc",
         "type": "github"
       },
       "original": {
@@ -385,16 +308,15 @@
     },
     "poonam": {
       "inputs": {
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_2",
-          "nixpkgs"
+        "vimwiki-cli": "vimwiki-cli"
-        ]
       },
       "locked": {
-        "lastModified": 1731920409,
+        "lastModified": 1671357603,
-        "narHash": "sha256-bMjdNGoWJXaWIGtfxcODmmrNoONnwN3hS73cDTRC1Pk=",
+        "narHash": "sha256-LIathTJK9ElWdjlT+zI+CJFB5adORTM9kYeWqEbKwiU=",
         "ref": "main",
-        "rev": "a87e348a46fd04dbe35ee9accf710eeec42ecbb6",
+        "rev": "ea3d0f9a8146f1985dec0b0348a79e3a3038d9b7",
-        "revCount": 1530,
+        "revCount": 465,
         "type": "git",
         "url": "ssh://gitea@git.sealight.xyz/aynish/kitaab"
       },
@@ -409,33 +331,31 @@
         "agenix": "agenix",
         "basant": "basant",
         "deploy-rs": "deploy-rs",
-        "disko": "disko",
+        "eww": "eww",
         "grasp": "grasp",
         "hardware": "hardware",
-        "home-manager": "home-manager_2",
+        "home-manager": "home-manager",
-        "nix-matrix-appservices": "nix-matrix-appservices",
+        "nixpkgs": "nixpkgs",
-        "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_2",
         "nur": "nur",
         "poonam": "poonam",
         "rust-overlay": "rust-overlay",
         "tidalcycles": "tidalcycles",
-        "unstable": "unstable",
+        "unstable": "unstable"
-        "vimwikicli": "vimwikicli"
       }
     },
     "rust-overlay": {
       "inputs": {
+        "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1724034091,
+        "lastModified": 1670293639,
-        "narHash": "sha256-b1g7w0sw+MDAhUAeCoX1vlTghsqcDZkxr+k9OZmxPa8=",
+        "narHash": "sha256-RkPLwza77YkFgxKHGzfYAYVKiD9SeIvsOA7+ihiySwI=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "c7d36e0947826e0751a5214ffe82533fbc909bc0",
+        "rev": "9767af967a0becaa3bb79eeda838dbf81295eb62",
         "type": "github"
       },
       "original": {
@@ -447,62 +367,33 @@
     "superdirt-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1697377840,
+        "lastModified": 1611740180,
-        "narHash": "sha256-9qU9CHYAXbN1IE3xXDqGipuroifVaSVXj3c/cDfwM80=",
+        "narHash": "sha256-GtnqZeMFqFkVhgx2Exu0wY687cHa7mNnVCgjQd6fiIA=",
         "owner": "musikinformatik",
         "repo": "superdirt",
-        "rev": "c7f32998572984705d340e7c1b9ed9ad998a39b6",
+        "rev": "7abb62e89649daa1232b9cbd6427241868abd30e",
         "type": "github"
       },
       "original": {
         "owner": "musikinformatik",
+        "ref": "master",
         "repo": "superdirt",
         "type": "github"
       }
     },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "tidal-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1712519522,
+        "lastModified": 1654350756,
-        "narHash": "sha256-LbvxQmVxHElidCgvt+w0g1k+QQbNLebK46vtRCgsLeQ=",
+        "narHash": "sha256-tONM5SYYBca0orTLH1EUOilSC1FCluWrFt8AetUx+YQ=",
         "owner": "tidalcycles",
         "repo": "tidal",
-        "rev": "88f09edf6bef2228d5f530dea872b08a9d803066",
+        "rev": "fda9c1ecb3722698935245e5409ef8ccdfca16c8",
         "type": "github"
       },
       "original": {
         "owner": "tidalcycles",
-        "ref": "v1.9.5",
+        "ref": "main",
         "repo": "tidal",
         "type": "github"
       }
@@ -515,15 +406,16 @@
         ],
         "superdirt-src": "superdirt-src",
         "tidal-src": "tidal-src",
+        "utils": "utils_3",
         "vim-tidal-src": "vim-tidal-src",
         "vowel-src": "vowel-src"
       },
       "locked": {
-        "lastModified": 1723223284,
+        "lastModified": 1664760044,
-        "narHash": "sha256-NAT+g5nsaJZkpR0sCZjerd1xx233ZUdRH3ZWwZhzq/c=",
+        "narHash": "sha256-e5LGk/tDnphory1mYhADgPnVtShofY2w/3xY09jEE2A=",
         "owner": "mitchmindtree",
         "repo": "tidalcycles.nix",
-        "rev": "82f3e8e8d02eb9f0c9dfe9ab3773b825c6bc1982",
+        "rev": "3f3a820cd43709077d15a24fa6062de7d623a6bf",
         "type": "github"
       },
       "original": {
@@ -534,11 +426,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1723637854,
+        "lastModified": 1670152712,
-        "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
+        "narHash": "sha256-LJttwIvJqsZIj8u1LxVRv82vwUtkzVqQVi7Wb8gxPS4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
+        "rev": "14ddeaebcbe9a25748221d1d7ecdf98e20e2325e",
         "type": "github"
       },
       "original": {
@@ -549,15 +441,42 @@
       }
     },
     "utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
       "locked": {
-        "lastModified": 1701680307,
+        "lastModified": 1648297722,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "narHash": "sha256-W+qlPsiZd8F3XkzXOzAoR+mpFqzm3ekQkJNa+PIh1BQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "0f8662f1319ad6abf89b3380dd2722369fc51ade",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "utils_2": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "utils_3": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
         "type": "github"
       },
       "original": {
@@ -569,22 +488,24 @@
     "vim-tidal-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1685703852,
+        "lastModified": 1664252474,
-        "narHash": "sha256-8gyk17YLeKpLpz3LRtxiwbpsIbZka9bb63nK5/9IUoA=",
+        "narHash": "sha256-hleiK2Q7xYndpB+tIbyyXIM2sk4NunUh9DPgMqmf/Wc=",
         "owner": "tidalcycles",
         "repo": "vim-tidal",
-        "rev": "e440fe5bdfe07f805e21e6872099685d38e8b761",
+        "rev": "b07f5c12986fb837e055d7fcf0acf3b7e248148f",
         "type": "github"
       },
       "original": {
         "owner": "tidalcycles",
+        "ref": "master",
         "repo": "vim-tidal",
         "type": "github"
       }
     },
-    "vimwikicli": {
+    "vimwiki-cli": {
       "inputs": {
         "nixpkgs": [
+          "poonam",
           "nixpkgs"
         ]
       },
@@ -615,6 +536,7 @@
       },
       "original": {
         "owner": "supercollider-quarks",
+        "ref": "master",
         "repo": "vowel",
         "type": "github"
       }

flake.nix

@@ -1,17 +1,13 @@
 {
-  description = "Sealight NixOS Config";
+  description = "Your new nix config";
 
   inputs = {
     # Nixpkgs
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-22.11";
     unstable.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-
-    # ngipkgs.url = "github:Chickensoupwithrice/ngipkgs?ref=aynish/atomic-server-module";
-    # ngipkgs-local.url = "path:/home/anish/usr/ngipkgs";
 
     # Home manager
-    home-manager.url = "github:nix-community/home-manager/release-24.05";
+    home-manager.url = "github:nix-community/home-manager";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
     hardware.url = "github:nixos/nixos-hardware";
 
@@ -20,30 +16,25 @@
     agenix.inputs.nixpkgs.follows = "nixpkgs";
     deploy-rs.url = "github:serokell/deploy-rs";
     deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
-    disko.url = "github:nix-community/disko";
-    disko.inputs.nixpkgs.follows = "nixpkgs";
 
-    # My Packages
+    # Packages
     poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
-    poonam.inputs.nixpkgs.follows = "nixpkgs";
     basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
-    vimwikicli.url =
-      "git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main";
     basant.inputs.nixpkgs.follows = "nixpkgs";
     basant.inputs.poonam.follows = "poonam";
-    vimwikicli.inputs.nixpkgs.follows = "nixpkgs";
     grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
     grasp.inputs.nixpkgs.follows = "nixpkgs";
-
-    # Matrix
-    nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
-
     # Others
     nur.url = "github:nix-community/NUR";
     rust-overlay = {
       url = "github:oxalica/rust-overlay";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    eww = {
+      url = "github:elkowar/eww";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.rust-overlay.follows = "rust-overlay";
+    };
     tidalcycles.url = "github:mitchmindtree/tidalcycles.nix";
     tidalcycles.inputs.nixpkgs.follows = "unstable";
     # TODO hundred rabbits software
@@ -55,9 +46,21 @@
     # muneem.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { self, nixpkgs, unstable, nixos-hardware, home-manager, deploy-rs
+  outputs =
-    , agenix, disko, basant, grasp, nix-matrix-appservices, nur, tidalcycles
+    { self
-    , rust-overlay, vimwikicli, ... }@inputs:
+    , nixpkgs
+    , unstable
+    , home-manager
+    , deploy-rs
+    , agenix
+    , basant
+    , grasp
+    , nur
+    , tidalcycles
+    , rust-overlay
+    , eww
+    , ...
+    }@inputs:
     let
       forAllSystems = nixpkgs.lib.genAttrs [
         "aarch64-linux"
@@ -71,63 +74,52 @@
         unstable = unstable.legacyPackages.${prev.system};
         deploy = deploy-rs.packages.${prev.system}.deploy-rs;
       };
-      vimwikiOverlay = final: prev: {
-        vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli;
-      };
 
-      nixpkgsFor = forAllSystems (system:
+      nixpkgsFor = forAllSystems (system: import nixpkgs {
-        import nixpkgs {
+        inherit system;
-          inherit system;
+        config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [
-          config.allowUnfreePredicate = pkg:
+          "ripcord"
-            builtins.elem (nixpkgs.lib.getName pkg) [
+          "VCV-Rack"
-              "ripcord"
+          "SunVox"
-              "vcv-rack"
+          "renoise"
-              "SunVox"
+        ];
-              "renoise"
+        # config.permittedInsecurePackages = [
-            ];
+        #   "python3.10-django-3.1.14" # Needed for archivebox deployments on curve
-          # config.permittedInsecurePackages = [
+        #   # Check when archive box updates it's dependeny
-          #   "python3.10-django-3.1.14" # Needed for archivebox deployments on curve
+        # ];
-          #   # Check when archive box updates it's dependeny
+        overlays = [
-          # ];
+          rust-overlay.overlays.default
-          overlays = [
+          tidalcycles.overlays.default
-            rust-overlay.overlays.default
+          agenix.overlay
-            tidalcycles.overlays.default
+          nur.overlay
-            agenix.overlays.default
+          unstableOverlay
-            nur.overlay
+          self.overlays.additions
-            nix-matrix-appservices.overlay
+          self.overlays.modifications
-            unstableOverlay
+        ];
-            vimwikiOverlay
+      });
-            self.overlays.additions
-            self.overlays.modifications
-          ];
-        });
 
       # for when space matters
-      litePkgsFor = forAllSystems (system:
+      litePkgsFor = forAllSystems (system: import nixpkgs {
-        import nixpkgs {
+        inherit system;
-          inherit system;
+        overlays = [
-          # config.permittedInsecurePackages = [
+          agenix.overlay
-          #   "forgejo-1.19.4-0" # Needed for archivebox deployments on curve
+          tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
-          #   # Check when archive box updates it's dependeny
+        ];
-          # ];
+      });
-          overlays = [
+    in
-            agenix.overlays.default
+    {
-            self.overlays.additions
-            self.overlays.modifications
-            tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
-          ];
-        });
-    in {
       # Your custom packages
       # Acessible through 'nix build', 'nix shell', etc
       packages = forAllSystems (system:
         let pkgs = nixpkgsFor.${system};
-        in import ./pkgs { pkgs = pkgs; });
+        in import ./pkgs { pkgs = pkgs; }
+      );
       # Devshell for bootstrapping
       # Acessible through 'nix develop' or 'nix-shell' (legacy)
       devShells = forAllSystems (system:
         let pkgs = nixpkgsFor.${system};
-        in import ./shell.nix { pkgs = pkgs; });
+        in import ./shell.nix { pkgs = pkgs; }
+      );
 
       # Your custom packages and modifications, exported as overlays
       overlays = import ./overlays;
@@ -149,12 +141,8 @@
             agenix.nixosModules.age
             self.nixosModules.backup
             self.nixosModules.wireguard
-            self.nixosModules.wallabag
-            nixos-hardware.nixosModules.lenovo-thinkpad-x270
             home-manager.nixosModules.home-manager
             {
-              nix.registry.nixpkgs.flake = nixpkgs;
-              nix.registry.unstable.flake = unstable;
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
               home-manager.users.anish = import ./home/gui;
@@ -165,18 +153,17 @@
         helix = nixpkgs.lib.nixosSystem rec {
           specialArgs = { inherit inputs self; };
           system = "x86_64-linux";
-          pkgs = litePkgsFor.${system};
+          pkgs = nixpkgsFor.${system};
           modules = [
             ./hosts/helix
             agenix.nixosModules.age
             self.nixosModules.backup
             self.nixosModules.wireguard
-            basant.nixosModule
+            home-manager.nixosModules.home-manager
-            # self.nixosModules.microbin
-            disko.nixosModules.disko
             {
-              nixpkgs.flake.setNixPath = false;
+              home-manager.useGlobalPkgs = true;
-              nixpkgs.flake.setFlakeRegistry = false;
+              home-manager.useUserPackages = true;
+              home-manager.users.anish = import ./home/core;
             }
           ];
         };
@@ -190,7 +177,6 @@
             agenix.nixosModules.age
             self.nixosModules.backup
             self.nixosModules.hesienbridge
-            nix-matrix-appservices.nixosModule
             home-manager.nixosModules.home-manager
             {
               home-manager.useGlobalPkgs = true;
@@ -200,6 +186,19 @@
           ];
         };
 
+        cube = nixpkgs.lib.nixosSystem rec {
+          specialArgs = { inherit inputs self; };
+          system = "x86_64-linux";
+          pkgs = litePkgsFor.${system};
+          modules = [
+            ./hosts/cube
+            agenix.nixosModules.age
+            self.nixosModules.backup
+            self.nixosModules.wireguard
+            basant.nixosModule
+          ];
+        };
+
         box = nixpkgs.lib.nixosSystem rec {
           specialArgs = { inherit inputs self; };
           system = "x86_64-linux";
@@ -209,17 +208,14 @@
             agenix.nixosModules.age
             self.nixosModules.backup
             self.nixosModules.wireguard
-            self.nixosModules.gonic
-            self.nixosModules.gpodder2go
             self.nixosModules.wallabag
-            self.nixosModules.ulogger-server
+            self.nixosModules.gonic
             grasp.nixosModule
             home-manager.nixosModules.home-manager
             {
-              nix.registry.nixpkgs.flake = nixpkgs;
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
-              home-manager.users.anish = import ./home/dev;
+              home-manager.users.anish = import ./home/core;
             }
           ];
         };
@@ -229,47 +225,46 @@
       # Available through 'home-manager --flake .#your-username@your-hostname'
       homeConfigurations = {
         "anish@work" = home-manager.lib.homeManagerConfiguration {
-          pkgs =
+          pkgs = nixpkgsFor."x86_64-linux"; # Home-manager requires 'pkgs' instance
-            nixpkgsFor."x86_64-linux"; # Home-manager requires 'pkgs' instance
           extraSpecialArgs = { inherit inputs; };
-          modules = [ ./home/core.nix ./home/profiles/firefox ];
+          modules = [
+            ./home/core.nix
+            ./home/profiles/firefox
+          ];
         };
       };
 
       deploy.nodes = {
         box = {
           hostname = "mossnet.lan";
-          autoRollback = false;
-          magicRollback = false;
-          remoteBuild = true;
           profiles.system = {
             user = "root";
-            path = deploy-rs.lib.x86_64-linux.activate.nixos
+            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;
-              self.nixosConfigurations.box;
           };
         };
         lituus = {
           hostname = "sealight.xyz";
-          # autoRollback = false;
           profiles.system = {
             user = "root";
-            path = deploy-rs.lib.x86_64-linux.activate.nixos
+            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus;
-              self.nixosConfigurations.lituus;
           };
         };
         helix = {
           hostname = "git.sealight.xyz";
-          autoRollback = false;
-          magicRollback = false;
           profiles.system = {
             user = "root";
-            path = deploy-rs.lib.x86_64-linux.activate.nixos
+            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;
-              self.nixosConfigurations.helix;
+          };
+        };
+        cube = {
+          hostname = "lakhwara.com";
+          profiles.system = {
+            user = "root";
+            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.cube;
           };
         };
       };
 
-      checks = builtins.mapAttrs
+      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
-        (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
     };
 }

home/core/default.nix

@@ -1,9 +1,11 @@
 { self, pkgs, ... }:
 {
   imports = [
+    ../profiles/nvim
     ../profiles/cli
     ../profiles/direnv
     ../profiles/git
+    ../profiles/task
   ];
   home.stateVersion = "22.05";
 }

home/dev/default.nix

@@ -1,5 +0,0 @@
-{ self, pkgs, ... }: {
-  imports =
-    [ ../profiles/cli ../profiles/nvim ../profiles/direnv ../profiles/git ];
-  home.stateVersion = "22.05";
-}

home/gui/default.nix

@@ -2,13 +2,9 @@
 {
   imports = [
     ../core
-    ../profiles/nvim
     ../profiles/firefox
     ../profiles/desktop
     ../profiles/email
     ../profiles/cal
-    ../profiles/sync/kitaab
-    ../profiles/ssh
-    ../profiles/task
   ];
 }

home/profiles/cli/bin/clear-vim-trash.sh

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-
-working_directory=$(pwd)
-vim_directory="${working_directory//\//%}.vim"
-trash "$HOME/.local/share/nvim/sessions/${vim_directory}"

home/profiles/cli/dasht-queries.txt

@@ -1,19 +0,0 @@
-`dasht-docsets-intstall`
-
-Bash
-Clojure
-Docker
-Elixir
-HTML
-JavaScript
-Jinja
-Lua_5.4
-Nginx
-OpenGL_4
-PostgreSQL
-Processing
-Python_3
-React
-Rust
-TypeScript
-Vim

home/profiles/cli/default.nix

@@ -7,7 +7,6 @@
     dasht
     dosfstools
     #git
-    git-machete
     bottom
     gptfdisk
     starship
@@ -27,12 +26,10 @@
     iftop
     wget
     curl
-    eza 
+    exa
     bat
     fd
     ncdu
-    du-dust 
-    # dia-cli
     duf
     trash-cli
     nix-index
@@ -54,19 +51,16 @@
     gdb
     xxd
     taskwarrior
+    yt-dlp
     gnupg
     syncthing
     dijo
     #ssb-patchwork
     fontconfig
     pandoc
-    taskwarrior-tui
-    python3Packages.howdoi
-    vimwiki-cli
-
     (pkgs.writeScriptBin "jq-repl" ''
       #!/usr/bin/env bash
-      if [[ -z $1 ]] || [[ $1 == "-" ]]; then 
+      if [[ -z $1 ]] || [[ $1 == "-" ]] then 
         input=$(mktemp)
         trap "rm -f $input" EXIT
         cat /dev/stdin > $input
@@ -76,64 +70,27 @@
 
       echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
     '')
-    (pkgs.writeScriptBin "clear-vim-trash" (builtins.readFile ./bin/clear-vim-trash.sh))
-    (pkgs.writeScriptBin "flakify" ''
-      #!/usr/bin/env zsh
-      if [ ! -e flake.nix ]; then
-        nix flake new -t github:nix-community/nix-direnv .
-      elif [ ! -e .envrc ]; then
-        echo "use flake" > .envrc
-        direnv allow
-      fi
-      vim flake.nix
-    '')
-    (pkgs.writeScriptBin "mx" ''
-      #!/usr/bin/env bash
-      manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview="manix '{}'" | xargs manix
-    '')
-    (pkgs.writeScriptBin "monitor" ''
-      # hotplug
-      connect() {
-          # Turn it on if it was off
-          xrandr --output HDMI-2 --auto
-          xrandr --output HDMI-2 --same-as eDP-1
-      }
-
-      disconnect() {
-          xrandr --output HDMI-2 --off
-      }
-
-      xrandr | grep "HDMI-2 connected" &>>/dev/null && connect || disconnect
-    '')
-    (pkgs.writeScriptBin "disconnect-keyboard" ''
-      # keyboard on curve is busted
-      get_keyboard_id() {
-        xinput list | grep 'AT Translated Set' | cut -f2 | cut -d'=' -f2 | xinput float 
-      }
-
-      disconnect_keyboard() {
-        id=$(get_keyboard_id)
-        xinput float $id
-        unset id
-      }
-
-      attach_keyboard() {
-        id=$(get_keyboard_id)
-        xinput reattach $id 3
-        unset id
-      }
-
-      disconnect_keyboard
-    '')
   ];
 
   programs.zsh = {
     enable = true;
     enableCompletion = true;
-    autosuggestion.enable = false;
+    enableAutosuggestions = true;
 
     initExtra = ''
       bindkey -v
+      flakify() {
+        if [ ! -e flake.nix ]; then
+          nix flake new -t github:nix-community/nix-direnv .
+        elif [ ! -e .envrc ]; then
+          echo "use flake" > .envrc
+          direnv allow
+        fi
+        vim flake.nix
+      }
+      mx() {
+        manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview="manix '{}'" | xargs manix
+      }
       autopair-init
     '';
     sessionVariables = {
@@ -141,6 +98,15 @@
       TERMINFO_DIRS = "${pkgs.kitty.terminfo.outPath}/share/terminfo"; # Needed to run home-manager switch on non-nixOS
     };
     plugins = [
+      # {
+      #   name = "zsh-autocomplete";
+      #   src = pkgs.fetchFromGitHub {
+      #     owner = "marlonrichert";
+      #     repo = "zsh-autocomplete";
+      #     rev = "22.01.21";
+      #     sha256 = "+UziTYsjgpiumSulrLojuqHtDrgvuG91+XNiaMD7wIs=";
+      #   };
+      # }
       {
         name = "zsh-autopair";
         src = pkgs.fetchFromGitHub {
@@ -171,16 +137,16 @@
         };
         file = "zsh-autoquoter.zsh";
       }
-      # {
+      {
-      #   name = "zsh-nix-shell";
+        name = "zsh-nix-shell";
-      #   file = "nix-shell.plugin.zsh";
+        file = "nix-shell.plugin.zsh";
-      #   src = pkgs.fetchFromGitHub {
+        src = pkgs.fetchFromGitHub {
-      #     owner = "chisui";
+          owner = "chisui";
-      #     repo = "zsh-nix-shell";
+          repo = "zsh-nix-shell";
-      #     rev = "v0.5.0";
+          rev = "v0.5.0";
-      #     sha256 = "0za4aiwwrlawnia4f29msk822rj9bgcygw6a8a6iikiwzjjz0g91";
+          sha256 = "0za4aiwwrlawnia4f29msk822rj9bgcygw6a8a6iikiwzjjz0g91";
-      #   };
+        };
-      # }
+      }
     ];
   };
 
@@ -198,6 +164,7 @@
     enable = true;
     enableZshIntegration = true;
     nix-direnv.enable = true;
+    # nix-direnv.enableFlakes = true; always enabled
   };
 
   programs.zoxide = {
@@ -214,14 +181,13 @@
     "...." = "cd ../../..";
     "....." = "cd ../../../..";
 
-    icat = "kitty +kitten icat";
+    # kitaab recents
-    yt = "ytfzf -T kitty -t ";
+    kr = "cd /home/anish/kitaab/vimwiki; ls --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 {}'";
-    gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
 
     # modern cli tools 
-    ls = "eza --icons";
+    ls = "exa --icons";
-    l = "esa -l --icons";
+    l = "exa -l --icons";
-    la = "eza -la --icons";
+    la = "exa -la --icons";
     tree = "ls --tree --icons";
     cat = "bat";
     unzip = "aunpack";
@@ -232,25 +198,19 @@
     make-secret = "< /dev/urandom \\tr -dc _A-Za-z0-9 | head -c \${1:-32};echo;";
 
     # task warrior
-    t = "task -BLOCKED -idea -backlog"; 
+    # TODO: make blocked a context?
-    tw = "t rc.context:work";
+    t = "task -BLOCKED";
-    # TODO find a reasonable way to manage this from a non-nix managed file in ~/.task/context or something
+    tin = "task in";
-    # we can do something like task rc.context:$(cat ~/.task/context) to read context
+    tun = "task -BLOCKED -wait";
-    # and write a little script make-context = cat $@ > ~/.task/context or something
+    tb = "task list +backlog";
-    tt = "taskwarrior-tui -r list";
-    ti = "task +idea";
-    tb = "task +backlog list";
-    ttb = "taskwarrior-tui -r backlog";
     tr = "task newest limit:page";
-    twait = "task +wait";
+    tu = "task unblocked -wait";
+    tl = "task list";
     ta = "task add";
-    tai = "task add +idea";
+    tai = "task add +in";
     tn = "task-note";
+    tp = "task limit:page";
     ts = "task sync";
-    # taskwarrior task lists
-    twt = "task tags +PENDING | tail -n +4 | cut -d ' ' -f1 | fzf --preview 'task +{}'";
-    # task warrior projects list
-    tp = "task projects +PENDING | tail -n +4 | head -n -2 | cut -d ' ' -f1 | fzf --preview 'task pro:{}'";
 
     # keeping for posterity but now sxhkbd handles screenshot with <Super+O>
     # scrot = "flameshot screen -c -p ~/screenshots/";
@@ -275,12 +235,12 @@
     nf = "n flake";
     nfl = "nf lock";
     nepl = "n repl '<nixpkgs>'";
-    srch = "ns nixpkgs";
+    srch = "ns nixos";
     orch = "ns override";
-    nrb = "cd /tmp; sudo nixos-rebuild switch --flake '/home/anish/usr/helm#curve'; cd $OLDPWD";
+    nrb = "cd /tmp; sudo nixos-rebuild switch --flake '/etc/nixos/#curve'; cd $OLDPWD";
-    nrt = "cd /tmp; sudo nixos-rebuild test --flake '/home/anish/usr/helm#curve'; cd $OLDPWD";
+    nrt = "cd /tmp; sudo nixos-rebuild test --flake '/etc/nixos/#curve'; cd $OLDPWD";
-    ned = "cd /home/anish/usr/helm; vim; cd $OLDPWD";
+    ned = "cd /etc/nixos; vim; cd $OLDPWD";
-    ncd = "cd /home/anish/usr/helm";
+    ncd = "cd /etc/nixos";
     mn = ''
       manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | sk --preview="manix '{}'" | xargs manix
     '';
@@ -305,11 +265,10 @@
     jtl = "journalctl";
 
     # quick ssh
-    kssh = "kitty +kitten  ssh";
+    kssh = "kitten +kitty ssh";
     smm = "ssh 10.0.69.4"; # box over wireguard
     sm = "ssh mossnet.lan"; # box regular
-    sl = "ssh sealight.xyz"; # lituus
+    ss = "ssh sealight.xyz"; # helix
-    sh = "ssh git.sealight.xyz"; # helix
+    # sl = "ssh 69.61.38.225"; # lituus  has become helix
-    sb = "ssh cyberian@69.61.38.246"; # bonfire for allwell
   };
 }

home/profiles/desktop/bin/bspswallow

@@ -1,71 +0,0 @@
-#!/bin/sh
-
-# Get class of a wid
-get_class() {
-	id=$1
-  if [ -z "$id" ]; then
-    echo ""
-  else
-    xprop -id "$id" | sed -n \
-      -e '/WM_CLASS/s/\( "\)/\n/g; s/[^\n]*\n\([^"]*\)[^\n]*/\1\n/g' \
-      -e '/WM_COMMAND/s/[^"]*/\n\n/1; s/\n"//1; s/\n\([^"]*\)".*/\n\1/; /\n/p' | sed '/^$/d' | head -n1
-  fi
-}
-
-get_pid() {
-	xprop _NET_WM_PID -id "$1" | awk '/[0-9]+/ {print $3}'
-}
-
-get_ppid() {
-	ps -o ppid= -p $1
-}
-
-check_swallowing_process() {
-	pid=$(get_pid $1)
-	[ -z $pid ] && return 0
-	gppid=$(get_ppid $(get_ppid $pid))
-	grep -i "^$(ps -o cmd= -p $gppid | awk '{print $1}' | sed 's_^.*/__')$" ~/.config/bspwm/terminals && return 0
-	[ "$(get_ppid "$(get_ppid "$(get_pid "$1")")")" = "$(get_pid "$2")" ] && return 0 || return 1
-}
-
-swallow() {
-	addedtodesktop=$2
-	lasttermdesktop=$(bspc query -D -n last)
-
-	swallowerid=$1
-	swallowingid=$(bspc query -N -n last)
-	if [ "$addedtodesktop" = "$lasttermdesktop" ] && check_swallowing_process "$swallowerid" "$swallowingid"; then
-		grep -q "^$(get_class "$swallowerid")$" ~/.config/bspwm/{noswallow, terminals} && return
-		grep -i "^$(get_class "$swallowingid")$" ~/.config/bspwm/terminals || return
-		echo "$swallowerid $swallowingid" >> /tmp/swallowids
-		bspc node "$swallowingid" --flag hidden=on
-	fi
-}
-
-spit() {
-	spitterid=$1
-	spitterdesktop=$2
-	grep "^$spitterid" /tmp/swallowids || return
-	spittingid=$(grep "^$spitterid" /tmp/swallowids | head -n1 | awk '{print $2}')
-
-	bspc node "$spittingid" --flag hidden=off
-
-	termdesktop=$(bspc query -D -n "$spittingid")
-	[ "$termdesktop" = "$spitterdesktop" ] || bspc node "$spittingid" -d "$spitterdesktop"
-
-	bspc node "$spittingid" -f
-	sed -i "/^$spitterid/d" /tmp/swallowids
-}
-
-bspc subscribe node_add node_remove | while read -r event
-do
-	case $(echo "$event" | awk '{ print $1 }') in
-		node_add)
-            		swallow $(echo "$event" | awk '{print $5 " " $3}')
-			;;
-		node_remove)
-			spit $(echo "$event" | awk '{print $4 " " $3}')
-			;;
-	esac
-done
-

home/profiles/desktop/bin/ku

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-# get into a shell that has poonam
-cd ~/kitaab || exit; 
-nix develop; 
-# Use fzf to select a file and capture the output
-selected_file=$(${pkgs.poonam}/main report --titles=false | head -n -2 | fzf --preview 'bat --color=always --terminal-width -1 ./vimwiki/{}')
-echo $selected_file
-
-# Add additional details to the file path
-# file_path="./vimwiki/${selected_file}"
-# 
-# # Open the file in vim for editing
-# vim "${file_path}"
-# 

home/profiles/desktop/bin/paste

@@ -1 +0,0 @@
-curl -F "content=$(xclip -o)" -X POST https://bin.sealight.xyz/upload

home/profiles/desktop/bin/powermenu

@@ -5,9 +5,9 @@ rofi_command="rofi -theme theme/powermenu.rasi"
 ### Options ###
 power_off="\tShutdown"
 reboot="\tReboot"
-lock="\tLock"
+lock="\tLock"
-suspend="󰤄\tSleep"
+suspend="鈴\tSleep"
-log_out="󰍃\tLogout"
+log_out="\tLogout"
 # Variable passed to rofi
 options="$power_off\n$reboot\n$lock\n$suspend\n$log_out"
 
@@ -18,14 +18,14 @@ case "$(echo -e "$options" | $rofi_command -dmenu)" in
 		"	Reboot")
 				systemctl reboot
 				;;
-		"	Lock")
+		"	Lock")
 				dm-tool lock
 				;;
-		"󰤄	Sleep")
+		"鈴	Sleep")
 				dbus-send --print-reply --dest=org.mpris.MediaPlayer2.spotify /org/mpris/MediaPlayer2 org.mpris.MediaPlayer2.Player.Pause
 				systemctl suspend
 				;;
-		"󰍃	Logout")
+		"	Logout")
 				bspc quit
 				;;
 esac

home/profiles/desktop/bin/screenshot

@@ -3,12 +3,11 @@
 timer=5
 
 # Options
-select="󰩭 "
+select="麗"
-window=" "
+window="类"
-screen=" "
+screen=""
-record=" "
+delay=""
-delay="󱑃 "
+cancel=""
-cancel="󰜺 "
 
 # Variable passed to rofi
 options="$select\n$window\n$screen\n$delay\n$cancel"
@@ -51,6 +50,4 @@ case $chosen in
       | tee $filepath | xclip -selection c -t image/png
     notify
     ;;
-	$record)
-		kooha
 esac

home/profiles/desktop/bspwmrc

@@ -39,10 +39,7 @@ bspc rule -a Pinentry state=floating center=on
 bspc rule -a Firefox state=fullscreen
 bspc rule -a feh state=fullscreen
 
-# bspswallow
-pgrep bspswallow || bspswallow &
-
 # polybar
-for file in "$XDG_CONFIG_HOME"/bspwm/rc.d/*; do
+for file in $XDG_CONFIG_HOME/bspwm/rc.d/*; do
   source "$file"
 done

home/profiles/desktop/default.nix

@@ -29,104 +29,8 @@ in
     kitty
     libreoffice
     inotify-tools
-    offpunk
-    termpdfpy
-    libsForQt5.kontact
-    thunderbird
   ];
 
-  # GTK4 color scheme?
-  dconf.settings = {
-    "org/gnome/desktop/interface" = {
-      color-scheme = "prefer-dark";
-    };
-  };
-
-  # Move required config files around
-  xdg.enable = true; # This doesn't seem to do anything so we have below
-  xdg.configHome = "/home/anish/.config"; # TODO bad hardcode
-  xdg.configFile = {
-    "Kvantum/Dracula/Dracula.kvconfig".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.kvconfig";
-    "Kvantum/Dracula/Dracula.svg".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.svg";
-    "Kvantum/kvantum.kvconfig".text = "[General]\ntheme=Dracula";
-  };
-  xdg.mimeApps.defaultApplications = {
-
-  };
-  home.file = {
-    ".config/bspwm/rc.d/polybar".source = ./run.sh;
-    ".config/bspwm/bspwmrc".source = ./bspwmrc;
-    ".config/sxhkdrc".source = ./sxhkdrc;
-    ".config/rofi/theme" = {
-      source = ./rofi;
-      recursive = true;
-    };
-    ".config/polybar" = {
-      source = ./polybar;
-      recursive = true;
-    };
-    ".config/dunst/dunstrc".source = ./dunstrc;
-    ".config/kitty/kitty.conf".source = ./kitty.conf;
-    ".config/kitty/ayu.conf".source = ./ayu-kitty.conf;
-    ".config/zathura/zathurarc".source = ./zathurarc;
-    ".background-image".source = ./background.jpg;
-    #gtk4 theme
-    ".config/gtk-4.0/settings.ini".text = ''
-      [Settings]
-      gtk-application-prefer-dark-theme=1
-    '';
-    # gtk3 theme
-    ".config/gtk-3.0/settings.ini".text = ''
-      [Settings]
-      gtk-theme-name=Dracula
-      gtk-icon-theme-name=Paper
-      gtk-cursor-theme-name=Capitaine Cursors - White
-      gtk-fallback-icon-theme=gnome
-      gtk-application-prefer-dark-theme=1
-      gtk-xft-hinting=1
-      gtk-xft-hintstyle=hintfull
-      gtk-xft-rgba=none
-    '';
-    # GTK2 global theme (widget and icon theme)
-    ".config/gtk-2.0/gtkrc".text = ''
-      gtk-theme-name=Ayu-Mirage
-      gtk-icon-theme-name=Capitaine Cursors - White
-      gtk-font-name="Sans 10"
-    '';
-    ".local/bin/passmenu".source = ./bin/passmenu;
-    ".local/bin/paste".source = ./bin/paste;
-    ".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
-    ".local/bin/wifimenu".source = ./bin/wifimenu;
-    ".local/bin/powermenu".source = ./bin/powermenu;
-    ".local/bin/screenshot".source = ./bin/screenshot;
-    ".local/bin/mpv-ify".source = ./bin/mpv-ify;
-    ".local/bin/bspswallow".source = ./bin/bspswallow;
-    ".config/bspwm/terminals".text = "Kitty";
-    # ".local/bin/hotplug-monitor.sh".source = ./bin/hotplug-monitor.sh;
-  };
-
-  xdg.desktopEntries = {
-    ocr = {
-      name = "OCR image";
-      exec = "${pkgs.writeScript "ocr" ''
-        ${pkgs.xfce.xfce4-screenshooter}/bin/xfce4-screenshooter -r --save /tmp/ocr-tmp.png
-        ${pkgs.tesseract}/bin/tesseract /tmp/ocr-tmp.png | ${pkgs.xclip}/bin/xclip -sel clip
-        rm /tmp/ocr-tmp.png
-      ''}";
-    };
-    screenshot = {
-      name = "Screenshot";
-      exec = "screenshot";
-    };
-  };
-
-
-  qt = {
-    enable = true;
-    platformTheme.name = "gtk";
-    style = { name = "qt5ct-style"; };
-  };
-
   # set up env
   xsession.enable = true;
 
@@ -162,10 +66,67 @@ in
     "*.colorBD" = "#e6e1cf";
   };
 
-  programs.autorandr.enable = true;
+  # Move required config files around
-  services.udiskie.automount = true;
+  xdg.enable = true; # This doesn't seem to do anything so we have below
+  xdg.configHome = "/home/anish/.config"; # TODO bad hardcode
+  xdg.configFile = {
+    "Kvantum/Dracula/Dracula.kvconfig".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.kvconfig";
+    "Kvantum/Dracula/Dracula.svg".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.svg";
+    "Kvantum/kvantum.kvconfig".text = "[General]\ntheme=Dracula";
+  };
+  home.file = {
+    ".config/bspwm/rc.d/polybar".source = ./run.sh;
+    ".config/bspwm/bspwmrc".source = ./bspwmrc;
+    ".config/sxhkdrc".source = ./sxhkdrc;
+    ".config/rofi/theme" = {
+      source = ./rofi;
+      recursive = true;
+    };
+    ".config/polybar" = {
+      source = ./polybar;
+      recursive = true;
+    };
+    ".config/dunst/dunstrc".source = ./dunstrc;
+    ".config/kitty/kitty.conf".source = ./kitty.conf;
+    ".config/kitty/ayu.conf".source = ./ayu-kitty.conf;
+    ".config/zathura/zathurarc".source = ./zathurarc;
+    ".background-image".source = ./background.jpg;
+    # gtk3 theme
+    ".config/gtk-3.0/settings.ini".text = ''
+      [Settings]
+      gtk-theme-name=Dracula
+      gtk-icon-theme-name=Paper
+      gtk-cursor-theme-name=Capitaine Cursors - White
+      gtk-fallback-icon-theme=gnome
+      gtk-application-prefer-dark-theme=true
+      gtk-xft-hinting=1
+      gtk-xft-hintstyle=hintfull
+      gtk-xft-rgba=none
+    '';
+    # GTK2 global theme (widget and icon theme)
+    ".config/gtk-2.0/gtkrc".text = ''
+      gtk-theme-name=Ayu-Mirage
+      gtk-icon-theme-name=Capitaine Cursors - White
+      gtk-font-name="Sans 10"
+    '';
+    # TODO hardcoded
+    ".local/bin/passmenu".source = ./bin/passmenu;
+    ".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
+    ".local/bin/wifimenu".source = ./bin/wifimenu;
+    ".local/bin/powermenu".source = ./bin/powermenu;
+    ".local/bin/screenshot".source = ./bin/screenshot;
+    ".local/bin/mpv-ify".source = ./bin/mpv-ify;
+    ".config/eww/eww.yuck".source = ./eww/eww.yuck;
+    ".config/eww/eww.scss".source = ./eww/eww.scss;
+    ".config/eww/widgets.yuck".source = ./eww/widgets.yuck;
+    # ".local/bin/hotplug-monitor.sh".source = ./bin/hotplug-monitor.sh;
+  };
 
-  services.mpris-proxy.enable = true; # bluetooth media control
+  qt = {
+    enable = true;
+    platformTheme = "gtk";
+    style = { name = "qt5ct-style"; };
+  };
 
   # Compositor
   # services.picom = {
@@ -188,4 +149,9 @@ in
   #        corner-radius = 3
   #      '';
   # };
+
+  programs.autorandr.enable = true;
+  services.udiskie.automount = true;
+
+  services.mpris-proxy.enable = true; # bluetooth media control
 }

home/profiles/desktop/dunstrc

@@ -35,7 +35,7 @@
     origin = top-right
 
     # Offset from the origin
-    offset = 12x36
+    offset = 18x36
 
     # Scale factor. It is auto-detected if value is 0.
     scale = 0

home/profiles/desktop/kitty.conf

@@ -1,13 +1,11 @@
 include ayu.conf
 font_family      Hermit
-font_size        13
 bold_font        auto
 italic_font      auto
 bold_italic_font auto
 open_url_with default
 mouse_map left click ungrabbed mouse_click_url_or_select
 confirm_os_window_close 0
-enable_audio_bell no
 -- Allows zen-mode.nvim to increase font size
--- allow_remote_control socket-only
+allow_remote_control socket-only
--- listen_on unix:/tmp/kitty
+listen_on unix:/tmp/kitty

home/profiles/desktop/polybar/config

@@ -34,6 +34,9 @@ fixed-center = true
 width = 100%
 height = 34
 
+offset-x = 
+offset-y =  
+
 ; Background ARGB color (e.g. #f00, #ff992a, #ddff1023)
 background = ${colors.bg}
 
@@ -46,7 +49,7 @@ line-color = #fff
 ; Number of spaces to add at the beginning/end of the bar
 ; Individual side values can be defined using:
 ;   padding-{left,right}
-padding-right = 1
+padding-right = 1 
 padding-left = 0
 
 ; Number of spaces to add before/after each module
@@ -55,15 +58,14 @@ padding-left = 0
 module-margin = 0
 margin-bottom = 34
 
-font-0 = "Iosevka Nerd Font,Iosevka NF:pixelsize=10;1" ; Icon Size
+font-0 = "Iosevka Term:pixelsize=13;4"
-font-1 = "Iosevka Nerd Font,Iosevka NF:pixelsize=12;4" ; Large Text font
+font-1 = "Iosevka Term:pixelsize=6;1"
-font-2 = "FiraCode Nerd Font:pixelsize=12;2"
+font-2 = "Fira Code:pixelsize=13;2"
-font-3 = "Siji:pixelsize=10;2"
+font-3 = "Siji:pixelsize=8;2"
-font-4 = "Iosevka Nerd Font,Iosevka NF:pixelsize=8;1" ; Small Icon Size
 
 ; Add module mpd for artist - title info
 modules-left = bspwm sps volume
-; modules-center = title
+modules-center = title
 modules-right = wireless-network sps battery sps memory sps cpu sps date
 
 ; The separator will be inserted between the output of each module
@@ -114,11 +116,11 @@ type = internal/bspwm
 pin-workspaces = true
 enable-click = true
 
-ws-icon-0 = 1;%{T2} %{T-} 
+ws-icon-0 = 1;%{T1}%{T-}
-ws-icon-1 = 2;%{T2} %{T-} 
+ws-icon-1 = 2;%{T1}%{T-}
-ws-icon-2 = 3;%{T2}󰺻 %{T-} 
+ws-icon-2 = 3;%{T1}%{T-}
-ws-icon-3 = 4;%{T2} %{T-} 
+ws-icon-3 = 4;%{T1}%{T-}
-ws-icon-4 = 5;%{T2} %{T-} 
+ws-icon-4 = 5;%{T1}%{T-}
 ws-icon-default = 
 ; fuzzy-match = true
 
@@ -155,14 +157,14 @@ interval = 1.0
 
 ; See "http://en.cppreference.com/w/cpp/io/manip/put_time" for details on how to format the date string
 ; NOTE: if you want to use syntax tags here you need to use %%{...}
-date = %{T2} %{T-}%{T1} %d/%a%{T-}
+date = %{T1}%{T-}%{T2} %d/%a%{T-}
 
 ; Optional time format
 time = %{T2} %H:%M%{T-}
 
 ; if `date-alt` or `time-alt` is defined, clicking
 ; the module will toggle between formats
-date-alt = %{T2} %{T-} %{T1} %a, %d %b %y%{T-}
+date-alt = %{T1}%{T-}%{T2} %a, %d %b %y%{T-}
 time-alt = %{T2} %H:%M:%S%{T-}
 
 label = %date%%time%
@@ -175,12 +177,11 @@ interface = wlp3s0
 
 label-connected = %essid%
 label-connected-font = 2
-format-connected = <ramp-signal> <label-connected>
+format-connected = <ramp-signal><label-connected>
 label-connected-foreground = #82b414
 
-
 format-disconnected = <label-disconnected>
-label-disconnected = "󰖪"
+label-disconnected = "睊"
 label-disconnected-foreground = #f92672
 
 ramp-signal-foreground = #82b414
@@ -198,7 +199,7 @@ type = internal/cpu
 ; Default: 1
 interval = 0.5
 
-label = %{T2} %{T-}%{T1} %percentage:2%%%{T-}
+label = %{T1}%{T-}%{T2} %percentage:2%%%{T-}
 
 label-foreground = ${colors.cyan}
 
@@ -228,7 +229,7 @@ format = <label>
 ;   %gb_swap_free%
 ;   %gb_swap_used%
 
-label = %{T2}󰍛 %{T-}%{T1} %gb_used%%{T-}
+label = %{T1}%{T-}%{T2} %gb_used%%{T-}
 
 label-foreground = ${colors.cyan}
 
@@ -276,6 +277,38 @@ type = custom/text
 content = " "
 content-padding = 0
 
+[module/network]
+type = internal/network
+interface = wlp3s0
+;enp0s29u1u2
+interval = 1.0
+label-connected = "%{T1}龍%{T-}%{T2} %downspeed% | %upspeed%%{T-}"
+label-disconnected = "%{T2}0/0%{T-}"
+label-connected-background = ${colors.bg}
+label-connected-foreground = ${colors.blue}
+label-disconnected-foreground = ${colors.red}
+
+[module/title]
+type = internal/xwindow
+; Available tags:
+;   <label> (default)
+format = <label>
+format-background = ${colors.bg}
+format-foreground = ${colors.green}
+format-padding = 4
+
+; Available tokens:
+;   %title%
+; Default: %title%
+label = "%{T1}类%{T-}%{T2} %title%%{T-}"
+label-maxlen = 65
+
+; Used instead of label when there is no window title
+; Available tokens:
+;   None
+label-empty =%{T2}Empty%{T-}
+label-empty-foreground = #707880
+
 [module/volume]
 type = internal/pulseaudio
 
@@ -283,7 +316,7 @@ use-ui-max = false
 
 interval = 5
 
-format-volume = <ramp-volume> <bar-volume>
+format-volume = <ramp-volume><bar-volume>
 
 format-muted = <label-muted>
 format-muted-prefix = "  "
@@ -299,13 +332,13 @@ label-muted-foreground = ${colors.mauve}
 bar-volume-width = 8
 bar-volume-gradient = false
 bar-volume-indicator = |
-bar-volume-indicator-font = 6
+bar-volume-indicator-font = 2
 bar-volume-indicator-foreground = ${colors.mauve}
 bar-volume-fill = ─
-bar-volume-fill-font = 6
+bar-volume-fill-font = 2
 bar-volume-fill-foreground = ${colors.mauve}
 bar-volume-empty = ─
-bar-volume-empty-font = 6
+bar-volume-empty-font = 2
 bar-volume-empty-foreground = ${colors.fg-alt}
 
 ramp-volume-0 = "  "
@@ -337,19 +370,19 @@ battery = BAT0
 poll-interval = 2
 time-format = %H:%M
 
-format-charging = <animation-charging> <label-charging>
+format-charging = <animation-charging><label-charging>
 format-charging-prefix = 
 
-format-discharging = <ramp-capacity> <label-discharging>
+format-discharging = <ramp-capacity><label-discharging>
 
 format-full = <label-full>
-format-full-prefix = "  "
+format-full-prefix = " "
-format-full-prefix-font = 2
+format-full-prefix-font = 1
 format-full-prefix-foreground = ${colors.sky}
 
 label-charging = "%percentage%% "
 label-discharging = "%percentage%% "
-label-full = "%percentage%%"
+label-full = "%percentage%% "
 
 label-charging-foreground = ${colors.sky}
 label-discharging-foreground = ${colors.sky}
@@ -376,4 +409,3 @@ animation-charging-foreground = ${colors.sky}
 animation-charging-framerate = 750
 
 ;; _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
-

home/profiles/desktop/rofi/appmenu.rasi

@@ -2,7 +2,7 @@
 @import "config.rasi"
 
 textbox-icon {
-  str: "󱎂 ";
+  str: "  ";
 }
 
 prompt {

home/profiles/desktop/sxhkdrc

@@ -27,9 +27,6 @@ super + Tab
 super + e
 	rofimoji --selector-args "-theme theme/emojimenu.rasi" --skin-tone moderate --action copy 
 
-super + a
-	paste
-
 super + p
 	passmenu
 

home/profiles/email/default.nix

@@ -20,7 +20,7 @@
   programs.msmtp.enable = true;
   programs.notmuch.enable = true;
   home.file.".mailcap".text = ''
-    text/html; firefox %s
+    text/html; browsh %s
     application/pdf; zathura %s
     image/png; feh %s
     image/jpeg; feh %s
@@ -175,7 +175,7 @@
       bind editor ^T complete
 
       # Press A to archive
-      macro index,pager A  "<clear-flag><save-message>=/Archive"  "mark message as Archived"
+      macro index,pager A  "<clear-flag>N<save-message>=/Archive"  "mark message as Archived"
       # Press C to add contact to Khard address book
       macro index,pager C \
       "<pipe-message>khard add-email<return>" \

home/profiles/firefox/default.nix

@@ -13,40 +13,37 @@
   #env.XDG_DEXSTOP_DIR = "$HOME/";
   programs.firefox = {
     enable = true;
+    extensions = with pkgs.nur.repos.rycee.firefox-addons; [
+      # Find extensions: https://github.com/nix-community/nur-combined/blob/master/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
+      ublock-origin
+      wallabagger
+      # tree-style-tab
+      tridactyl
+      promnesia
+      sidebery
+      (buildFirefoxXpiAddon {
+        pname = "shaarli";
+        version = "2.0.0";
+        addonId = "shaarli@imirhil.fr";
+        url = "https://addons.mozilla.org/firefox/downloads/file/815126/shaarli-2.0.0.xpi";
+        sha256 = "W/OpvOfMclibP6LeG573/DlMs0p8fF0efyd+i8Sudgg=";
+        meta = { };
+      })
+      (buildFirefoxXpiAddon {
+        pname = "grasp";
+        version = "0.6.6";
+        addonId = "{37e42980-a7c9-473c-96d5-13f18e0efc74}";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3502186/grasp-0.6.6.xpi";
+        sha256 = "L4JhT29MeA34nHIlB8FtCU7hrpbWljZZBusx12uxblE=";
+        meta = { };
+      })
+    ];
     profiles.anish = {
       id = 0;
       isDefault = true;
       name = "anish";
       userChrome = (builtins.readFile ./userChrome.css);
-      extensions = with pkgs.nur.repos.rycee.firefox-addons; [
-        # Find extensions: https://github.com/nix-community/nur-combined/blob/master/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
-        ublock-origin
-        # wallabagger
-        # tree-style-tab
-        tridactyl
-        promnesia
-        sidebery
-        (buildFirefoxXpiAddon {
-          pname = "shaarli";
-          version = "2.0.0";
-          addonId = "shaarli@imirhil.fr";
-          url = "https://addons.mozilla.org/firefox/downloads/file/815126/shaarli-2.0.0.xpi";
-          sha256 = "W/OpvOfMclibP6LeG573/DlMs0p8fF0efyd+i8Sudgg=";
-          meta = { };
-        })
-        (buildFirefoxXpiAddon {
-          pname = "grasp";
-          version = "0.6.6";
-          addonId = "{37e42980-a7c9-473c-96d5-13f18e0efc74}";
-          url = "https://addons.mozilla.org/firefox/downloads/file/3502186/grasp-0.6.6.xpi";
-          sha256 = "L4JhT29MeA34nHIlB8FtCU7hrpbWljZZBusx12uxblE=";
-          meta = { };
-        })
-      ];
-
       settings = {
-        "browser.zoom.siteSpecific" = false;
-        "zoom.minPercent" = "150"; # TODO doesn't seem to work anymore, you have to manually go into preferences and set the zoom level.
         "devtools.theme" = "dark";
         # Enable userContent.css and userChrome.css for our theme modules
         "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
@@ -54,7 +51,6 @@
         "browser.download.dir" = "/home/anish/downloads"; # TODO Don't hardcode this!
         # Don't use the built-in password manager; a nixos user is more likely
         # using an external one (you are using one, right?).
-        # I am, but it's far too convienent. I'm enabling 2FA anyway so w/e 
         #"signon.rememberSignons" = false;
         # Do not check if Firefox is the default browser
         "browser.shell.checkDefaultBrowser" = false;

home/profiles/git/default.nix

@@ -49,7 +49,6 @@
       ".tmp"
       ".direnv"
       "result"
-      "node_modules/"
     ];
 
     extraConfig = {

home/profiles/nvim/default.nix

@@ -19,16 +19,7 @@ let
         sha256 = "rs3NTZwWdsmBGXnrgUeVxUiNjbN/ULxJHifPYJD9mT4=";
       };
     };
-    my-lspsaga = pkgs.vimUtils.buildVimPlugin {
+    nvim-luapad = pkgs.vimUtils.buildVimPluginFrom2Nix {
-      name = "lspsaga.nvim";
-      src = pkgs.fetchFromGitHub {
-        owner = "glepnir";
-        repo = "lspsaga.nvim";
-        rev = "b7b4777369b441341b2dcd45c738ea4167c11c9e";
-        sha256 = "sciX/fMxzY1YOxXxjj1+ymrdMi451avcFFu+14R+/pk=";
-      };
-    };
-    nvim-luapad = pkgs.vimUtils.buildVimPlugin {
       name = "nvim-luapad";
       src = pkgs.fetchFromGitHub {
         owner = "rafcamlet";
@@ -37,7 +28,7 @@ let
         sha256 = "gMaS5YFi3+gmUIfkCMEt9vhm8XSgv54Cquv5+WCWeTo=";
       };
     };
-    leap = pkgs.vimUtils.buildVimPlugin {
+    leap = pkgs.vimUtils.buildVimPluginFrom2Nix {
       name = "leap";
       src = pkgs.fetchFromGitHub {
         owner = "ggandor";
@@ -55,7 +46,7 @@ let
         sha256 = "vX7ZVJxgatIicmijehtaRvyHxk1i4gFfXrbPM/+VoFc=";
       };
     };
-    my-which-key-nvim = pkgs.vimUtils.buildVimPlugin {
+    my-which-key-nvim = pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "which-key.nvim";
       version = "2022-05-04";
       src = pkgs.fetchFromGitHub {
@@ -66,7 +57,17 @@ let
       };
       meta.homepage = "https://github.com/folke/which-key.nvim/";
     };
-    scnvim = pkgs.vimUtils.buildVimPlugin {
+    my-conjure = pkgs.vimUtils.buildVimPluginFrom2Nix {
+      pname = "conjure";
+      version = "2022-05-04";
+      src = pkgs.fetchFromGitHub {
+        owner = "olical";
+        repo = "conjure";
+        rev = "2e7f449d06753f2996e186954e96afc60edd5862";
+        sha256 = "ZV0vPYiZI5/3Isw2l7rrLuiO+kA9G0vrA6OxHFkLTFw=";
+      };
+    };
+    scnvim = pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "scnvim";
       version = "2022-06-04";
       src = pkgs.fetchFromGitHub {
@@ -76,7 +77,7 @@ let
         sha256 = "kvSwS6FNUY2Ue84NhWLLcm0ldLMSp4WqQ7s6TUoX6Cc=";
       };
     };
-    yuck-vim = pkgs.vimUtils.buildVimPlugin {
+    yuck-vim = pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "yuck.vim";
       version = "2021-08-09";
       src = pkgs.fetchFromGitHub {
@@ -86,7 +87,7 @@ let
         sha256 = "lp7qJWkvelVfoLCyI0aAiajTC+0W1BzDhmtta7tnICE=";
       };
     };
-    nvim-parinfer = pkgs.vimUtils.buildVimPlugin {
+    nvim-parinfer = pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "nvim-parinfer";
       version = "v1.2.0";
       src = pkgs.fetchFromGitHub {
@@ -96,7 +97,7 @@ let
         sha256 = "Dlzfp3CZTzq8zQeHByWf3ER6/Em+KNGYNI4Z17ui8Lc=";
       };
     };
-    my-marks = pkgs.vimUtils.buildVimPlugin {
+    my-marks = pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "marks";
       version = "2022-08-31";
       src = pkgs.fetchFromGitHub {
@@ -106,7 +107,7 @@ let
         sha256 = "XdbgIWuAHNdTfyKDrKmQVq5oSbBoi56DpwtgOqhScAk=";
       };
     };
-    my-fterm = pkgs.vimUtils.buildVimPlugin {
+    my-fterm = pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "fterm";
       version = "2022-07-22";
       src = pkgs.fetchFromGitHub {
@@ -116,7 +117,7 @@ let
         sha256 = "rR6KDwj58aYfyaSsoUy75536SdBhk394yspCUl/hzfE=";
       };
     };
-    my-nvim-peekup = pkgs.vimUtils.buildVimPlugin {
+    my-nvim-peekup = pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "nvim-peekup";
       version = "0.1.0";
       src = pkgs.fetchFromGitHub {
@@ -145,21 +146,12 @@ in
   home.sessionVariables.EDITOR = "nvim";
   home.shellAliases = {
     k = "cd ~/kitaab/vimwiki; vim -c :VimwikiIndex; cd $OLDPWD";
-    # kitaab zettel
     kz = "cd ~/kitaab/vimwiki; vim -c :VimwikiIndex -c :ZettelNew; cd $OLDPWD";
-    # kitaab recents
-    kr = "cd /home/anish/kitaab/vimwiki; eza --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
-    # kitaab get by tagged
-    kt = "cd /home/anish/kitaab/vimwiki; eza *_index.wiki | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
-    # List files that have no links in them
-    ku = "cd /home/anish/kitaab/;vim  ./vimwiki/$(python3 poonam/main.py report --titles=false | tail -n +4 | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./vimwiki/{}');cd $OLDPWD";
   };
   # Add %update to the highlight clause for vimwiki files
   home.file.".config/nvim/after/syntax/vimwiki.vim".text = ''
     " match with %update
     syntax match VimwikiPlaceholder /^\s*%update\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
-    " match with %link
-    syntax match VimwikiPlaceholder /^\s*%link\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
   '';
 
   #environment.systemPackages = with customPlugins; [ tidal ];
@@ -269,10 +261,6 @@ in
       " Sexp in Conjure (since it's fennel)
       let g:sexp_filetypes = "clojure,scheme,lisp,janet,fennel,yuck" 
       let g:conjure#filetype#fennel = "conjure.client.fennel.stdio"
-      " we only use fennel with love; no we don't...
-      let g:conjure#client#fennel#stdio#command = "fennel" 
-      " let g:conjure#extract#tree_sitter#enabled = true
-      map <localleader>lt :ConjureLogToggle<CR>
 
       let g:rainbow_active = 0
       autocmd BufReadPost,BufNewFile c,clj,cljs RainbowParenthesesToggleAll
@@ -350,25 +338,23 @@ in
       let g:fzf_layout = { 'window': { 'width': 0.8, 'height': 0.8 } }
 
       " lsp commands
-      nnoremap <leader>vgd :lua vim.lsp.buf.definition()<CR>
+      nnoremap <leader>vd :lua vim.lsp.buf.definition()<CR>
       nnoremap <leader>vi :lua require('telescope.builtin').lsp_implementation()<CR>
       nnoremap <leader>vsh :lua vim.lsp.buf.signature_help()<CR>
       nnoremap <leader>vrr :lua require('telescope.builtin').lsp_references()<CR>
-      " nnoremap <leader>vrn :lua vim.lsp.buf.rename()<CR>
+      nnoremap <leader>vrn :lua vim.lsp.buf.rename()<CR>
-      " nnoremap <leader>vh :lua vim.lsp.buf.hover()<CR>
+      nnoremap <leader>vh :lua vim.lsp.buf.hover()<CR>
-      " nnoremap <leader>vca :lua vim.lsp.buf.code_action()<CR>
+      nnoremap <leader>vca :lua vim.lsp.buf.code_action()<CR>
-      " nnoremap <leader>vsd :lua vim.lsp.util.show_line_diagnostics()<CR>
+      nnoremap <leader>vsd :lua vim.lsp.util.show_line_diagnostics()<CR>
-      " nnoremap <leader>vn :lua vim.lsp.diagnostic.goto_next()<CR>
+      nnoremap <leader>vn :lua vim.lsp.diagnostic.goto_next()<CR>
-      " nnoremap <leader>va :lua require('telescope.builtin').lsp_code_actions(require('telescope.themes').get_cursor())<cr>
+      nnoremap <leader>va :lua require('telescope.builtin').lsp_code_actions(require('telescope.themes').get_cursor())<cr>
       " lspsaga stuff doesn't work
-      nnoremap <leader>vd :Lspsaga peek_definition<CR>
+      " nnoremap <leader>vd :call Lspsaga peek_definition<CR>
-      nnoremap <leader>vrn :Lspsaga rename<CR><CR>
+      " nnoremap <leader>vrn :call Lspsaga rename<CR><CR>
-      nnoremap <leader>vh :Lspsaga hover_doc<CR>
+      " nnoremap <leader>vh :call Lspsaga hover_doc<CR>
-      nnoremap <leader>vca :Lspsaga code_action<CR>
+      " nnoremap <leader>vca :call Lspsaga code_action<CR>
-      nnoremap <leader>vsd :Lspsaga show_line_diagnostics<CR>
+      " nnoremap <leader>vsd :call Lspsaga show_line_diagnostics<CR>
-      nnoremap <leader>vs :Dasht<Space>
+      " nnoremap <leader>vn :call Lspsaga diagnostic_jump_prev<CR>
-      nnoremap <leader>vn :Lspsaga diagnostic_jump_prev<CR>
-      nnoremap <leader>vo :LSoutlineToggle<CR>
 
       " dashboard
       let g:dashboard_custom_header = [
@@ -478,14 +464,6 @@ in
         }
       )
 
-      local orig_util_open_floating_preview = vim.lsp.util.open_floating_preview
-      function vim.lsp.util.open_floating_preview(contents, syntax, opts, ...)
-        opts = opts or {}
-        opts.border = opts.border or 'rounded'
-        return orig_util_open_floating_preview(contents, syntax, opts, ...)
-      end
-
-
       vim.api.nvim_set_keymap('n', '<leader>vt', ':call v:lua.toggle_diagnostics()<CR>',  {noremap = true, silent = true})
 
       -- autopairs
@@ -516,6 +494,22 @@ in
               format = lspkind.cmp_format({
                 mode = 'symbol_text', 
                 maxwidth = 50, 
+              -- old format
+              -- format = function(entry, vim_item)
+              --     -- fancy icons and a name of kind
+              --     vim_item.kind = require("lspkind").presets.default[vim_item.kind] ..
+              --                         " " .. vim_item.kind
+              --     -- set a name for each source
+              --     vim_item.menu = ({
+              --         buffer = "[Buffer]",
+              --         nvim_lsp = "[LSP]",
+              --         look = "[Look]",
+              --         path = "[Path]",
+              --         spell = "[Spell]",
+              --         calc = "[Calc]",
+              --     })[entry.source.name]
+              --     return vim_item
+              -- end
             })
           },
           mapping = {
@@ -574,8 +568,6 @@ in
         sources = {
           null_ls.builtins.diagnostics.shellcheck,
           null_ls.builtins.diagnostics.proselint.with({ filetypes = { "vimwiki", "mail", }, }),
-          null_ls.builtins.diagnostics.commitlint,
-          null_ls.builtins.diagnostics.jsonlint,
       --     null_ls.builtins.code_actions.statix,
       --     null_ls.builtins.diagnostics.clj_kondo,
       --     null_ls.builtins.formatting.isort,
@@ -590,52 +582,24 @@ in
       local navic = require("nvim-navic")
 
       -- lspsaga, code_action lightbulb is annoying
-      local saga = require('lspsaga')
+      -- local saga = require('lspsaga')
-      saga.init_lsp_saga({
+      -- saga.init_lsp_saga({
-        border_style = "rounded",
+      --   code_action_lightbulb = {
-        code_action_icon = "",
+      --     enable = true,
-        code_action_num_shortcut = true,
+      --     enable_in_insert = true,
-        code_action_lightbulb = {
+      --     cache_code_action = true,
-            enable = false,
+      --     sign = true,
-            enable_in_insert = false,
+      --     update_time = 150,
-            cache_code_action = true,
+      --     sign_priority = 4,
-            sign = true,
+      --     virtual_text = false,
-            update_time = 150,
+      --   },
-            sign_priority = 20,
+      -- })
-            virtual_text = false,
-        },
-        code_action_keys = {
-            quit = 'q',
-            exec = '<CR>',
-        },
-        -- show outline
-        show_outline = {
-          win_position = 'right',
-          --set special filetype win that outline window split.like NvimTree neotree
-          -- defx, db_ui
-          auto_enter = true,
-          auto_preview = true,
-          virt_text = '┃',
-          jump_key = 'o',
-          -- auto refresh when change buffer
-          auto_refresh = true,
-        },
-      })
 
-      capabilities = require('cmp_nvim_lsp').default_capabilities()
+      local capabilities = vim.lsp.protocol.make_client_capabilities()
+      capabilities = require('cmp_nvim_lsp').default_capabilities(capabilities)
 
-      -- fennel-ls is bleeding edge
       local lspconfig = require('lspconfig')
-      require("lspconfig.configs")["fennel-ls"] = {
+      local servers = { 'clojure_lsp', 'terraform_lsp', 'zls', 'pyright', 'rust_analyzer', 'tsserver', 'sumneko_lua' }
-        default_config = {
-          cmd = {"fennel-ls"},
-          filetypes = {"fennel"},
-          root_dir = function(dir) return lspconfig.util.find_git_ancestor(dir) end,
-          settings = {}
-        }
-      }
-
-      local servers = { 'clojure_lsp', 'terraform_lsp', 'zls', 'pyright', 'rust_analyzer', 'tsserver', 'lua_ls', 'nil_ls', 'gopls'}
       for _, lsp in ipairs(servers) do
         lspconfig[lsp].setup {
           on_attach = function(client, bufnr)
@@ -645,15 +609,13 @@ in
           capabilities = capabilities,
         }
       end
-
+      -- rnix doesn't support gps
-      -- fennel-ls doesn't support gps
+      require('lspconfig').rnix.setup {
-      lspconfig['fennel-ls'].setup {
         on_attach = function(client, bufnr)
           format.on_attach(client)
         end,
         capabilities = capabilities,
       }
-
       -- deprecated pylsp
       -- require('lspconfig').pylsp.setup {
       --   on_attach = function(client, bufnr)
@@ -683,8 +645,8 @@ in
 
       -- treesitter
       require('nvim-treesitter.configs').setup { 
-        -- parser_install_dir = "~/.local/share/nvim/site/parser/",
+        parser_install_dir = "~/.local/share/nvim/site/parser/",
-        -- ensure_installed={'nix', 'clojure', 'python', 'fennel', 'lua', 'html', 'css', 'regex', 'supercollider', 'beancount', 'janet'},
+        ensure_installed={'nix', 'clojure', 'python', 'fennel', 'lua', 'html', 'css', 'regex', 'supercollider', 'beancount'},
         highlight = { enabled = true, additional_vim_regex_highting = true, },
         textobjects = { enabled = true },
       }
@@ -797,7 +759,6 @@ in
           ['<F2>'] = map_expr('s.meter'),
         }
       } 
-      -- You gotta run :SCNvimGenerateAssets for this first
       -- require("luasnip").add_snippets("supercollider", require("scnvim/utils").get_snippets())
 
       -- zen mode
@@ -845,26 +806,21 @@ in
       }
       require('twilight').setup{}
 
-      -- hologram
-      require('hologram').setup{
-          auto_display = false -- WIP automatic markdown image display, may be prone to breaking
-      }
-
       EOF
 
     '';
     extraPackages = with pkgs // customPlugins; [
       # used to compile tree-sitter grammar
+      tree-sitter
       python-with-my-packages
       nodejs
       clojure-lsp
       clojure
-      nil
+      rnix-lsp
       terraform-lsp
       rust-analyzer
       clj-kondo
       zls
-      gopls
       gcc
       nodePackages_latest.pyright
       shellcheck
@@ -872,8 +828,7 @@ in
       statix
       nodePackages.typescript
       nodePackages.typescript-language-server
-      luajitPackages.lua-lsp
+      sumneko-lua-language-server
-      fennel-ls
     ];
 
     plugins = with pkgs.vimPlugins // customPlugins; [
@@ -890,7 +845,7 @@ in
       telescope-nvim
       plenary-nvim
       nvim-navic
-      (nvim-treesitter.withPlugins (p: [ p.nix p.clojure p.python p.fennel p.lua p.html p.css p.regex p.supercollider p.beancount p.markdown p.glsl p.yaml p.toml p.dockerfile p.json ]))
+      nvim-treesitter
       nvim-treesitter-context
       my-fterm
       barbar-nvim
@@ -900,8 +855,7 @@ in
       nvim-peekup
       zen-mode-nvim
       twilight-nvim
-      my-lspsaga
+      lspsaga-nvim
-      vim-dasht
 
       # language
       vim-nix
@@ -916,7 +870,6 @@ in
       vimwiki
       taskwiki
       vim-zettel
-      hologram-nvim
 
       # lsp stuff
       # nvim-lint

home/profiles/nvim/package.json

@@ -1,9 +0,0 @@
-{
-  "console.log": {
-    "prefix": "clog",
-    "body": [
-      "console.log('$1')"
-    ],
-    "description": "Log output to console"
-  }
-}

home/profiles/ssh/default.nix

@@ -1,10 +0,0 @@
-{
-  home.file.".ssh/config".text = ''
-    Host mossnet.lan
-      ForwardAgent Yes
-    Host sealight.xyz
-      ForwardAgent Yes
-    Host git.sealight.xyz
-      ForwardAgent Yes
-  '';
-}

home/profiles/sync/kitaab/default.nix

@@ -1,39 +0,0 @@
-{ pkgs, ... }:
-
-let
-  name = "kitaab-sync";
-  # Note this will fail if index.wiki is open in vim while this runs
-  mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
-    # set -euo pipefail # Sometimes vimwiki is open and that causes `vimwiki tags rebuild` to fail, we still want to push to git in those cases
-    PATH=/run/current-system/sw/bin:/etc/profiles/per-user/anish/bin:$PATH
-    cd /home/anish/kitaab/vimwiki
-    vimwiki tags rebuild
-    cd ..
-    pushd kalpana/
-    ${pkgs.luaPackages.fennel}/bin/fennel main.fnl build
-    popd
-    pushd vimwiki/
-    git add -A .
-    popd
-    git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
-    git push
-    exit 0
-  '';
-in
-{
-  systemd.user.services.kitaab-sync = {
-    Service = {
-      ExecStart = "${mkStartScript name}";
-      Path = [ pkgs.luaPackages.fennel ];
-    };
-  };
-  systemd.user.timers.kitaab-sync = {
-    Install = {
-      WantedBy = [ "timers.target" ];
-      PartOf = [ "kitaab-sync.service" ];
-    };
-    Timer = {
-      OnCalendar = [ "hourly" ];
-    };
-  };
-}

home/profiles/task/bin/set-backlog.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify -idea +backlog

home/profiles/task/bin/set-focus.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify -idea -backlog

home/profiles/task/bin/set-idea.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify +idea -backlog

home/profiles/task/bin/task-note.py

@@ -34,16 +34,16 @@ def write_note(task_id: int):
     if not os.path.exists(notes_file):
         logging.info("Adding description to empty notes file")
         task_description = os.popen(f"task _get {task_id}.description").read()
-        task_project = os.popen(f"task _get {task_id}.project").read().strip("\n").replace(".", ":")
+        task_project = os.popen(f"task _get {task_id}.project").read().strip("\n")
         task_tags = os.popen(f"task _get {task_id}.tags").read().split(",")
         if len(task_tags):
             task_tags = ":".join(task_tags).strip("\n") + ":"
         time = datetime.datetime.now().strftime("%y-%m-%d %H:%M")
 
         with open(notes_file, "w") as f:
-            f.write(f"%title {task_description}")
+            f.write(f"%title: {task_description}")
             f.write(f":task:{task_project}:{task_tags if len(task_tags) else ''}\n")
-            f.write(f"%date {time}\n\n")
+            f.write(f"%date: {time}\n\n")
             f.flush()
 
     os.execlp(EDITOR, EDITOR, notes_file)

home/profiles/task/ca.cert

@@ -1,29 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIE/zCCAuegAwIBAgIUTLEuHYBh/sST/IrIhs+pWjDjW3UwDQYJKoZIhvcNAQEM
-BQAwFjEUMBIGA1UEAxMLMTkyLjE2OC4xLjYwIBcNMjEwMjEzMDUzODUxWhgPOTk5
-OTEyMzEyMzU5NTlaMBYxFDASBgNVBAMTCzE5Mi4xNjguMS42MIICIjANBgkqhkiG
-9w0BAQEFAAOCAg8AMIICCgKCAgEA8ZyNGBoudva5KAe1F281Fe3u91whLPB7SWv4
-zvN6n81NaMtl+rkfcO5GrYSbtemeQUz04N9dUIRABPyHGO+y0gQn/1p1KMdFzhH1
-wDR45h/Eo7+U+2Y/qjyvdjNU9aPe5yymuqSm0cTdFbRkXBoZDSDrwA0U078oYCBo
-yDxubKK7H7jWlSVyaBmsWDA72qdZhcOGKy6YoIEiT18V/57wTXBacBZvs3ORbOR6
-SMPjq0Pr32+kDriRbb9lQ9TAAGLE51hM8IBMnAZVvgS5GQ1y8elH4WJc7caom5B3
-l1MVQKEtgxU+QA4ZqGr9y7H4ey4Xf0V9pvrnsUTu1zCz+P4wd8jS6toxCnn8A8Tq
-c3ytA7t3o7BntLSWeQV5LKEiXqF3n3njqXk5Z0ZxDkI+FkhbnOytwGvUEpanTS1d
-z3EyZA8h1huoDdTmL1hVrg9pIaFJG5S9GuwcJiFPFo0QN6lcbhJmKrCOzPKb8Kwn
-zhymN7vtskSeqPZnQX+/tGupMzeITwcudoBg7zRUNKikIsTwFze+QV+puGFCjH+B
-BIe0NQ+rzpWOyI7FDYIMb5q+/PJKTkH2Bu5qYhgebzdCxKcJGBNoWsgzvl+tofQw
-XchzIqR35xbkmvLeuIIABd8BKaowrAUGrRxtp7IZqxcR3XxH1RIimkHzeRHTphU2
-oycB3eMCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA
-MB0GA1UdDgQWBBQBl2OoCoAweUqsfVQNmL9H3jtl2DANBgkqhkiG9w0BAQwFAAOC
-AgEAypV1zutIu7an9tansll20LH2WMAHqi5JrALPBCO9yTqnCS3xZg8VZott/qxm
-/SsdlhKtekpvljiQhKqB4wROTf26GjxB9iAzdfxAZEcpYWkyXQ6qzDpjIHLLB3X2
-31KHbMc63GOI4wmpGY532tt3qDb+VhgfK25GyvUvvw5qvFsYeGHdSD/HIEJHKlOK
-8esaF2/r+wuOWABbbmSBaCtR8H8T4Z/B5l6PoVft9uu8IQbtuhiDn08mZHat8tUq
-nxm3O1JsV4ZNtvqh5st1Qn32f7buM6AFMhMy9bcXwR33TJBuv994zRjJQYk+FKzE
-UzrWl9mlglWV34P0+xMxpDFEgQvkJAFmdhcVsZlDwILWzEa/ZrS2EQGsEuzHbfFo
-oVQuXjzQkX504kAypwQBwbqPfwwYEev7EPVOj32/ke1TzBLaqqJ5AMABShOUJD3L
-pNOWMD3B23lRDll2f/Tkhqq4qriqWmtn7urC5ga6AlnAUueiORHTTcA9XBuAz68q
-dVfU3cIwwnGhDAYUB27yeb0mhPGnTz2Xr4tn8TLrL7c0tXZPjDCttr6hUnB+X/Yx
-tBxT1fJMZR7lzRMvnLJJQKC5rVKE4AAy+FJb3JvhQw01CF4odCmgWT3y+MG4RxnN
-sqTWkKoE6bRT9rnRAG8EntRycibGKH0b1PhpY8ngOgMbfCw=
------END CERTIFICATE-----

home/profiles/task/default.nix

@@ -1,19 +1,9 @@
 { pkgs, config, lib, ... }:
 
 {
+  # If you're setting up taskwarrior again, there's a task-setup.sh script in seafile
   home.file = {
-    # Because the below is inconsistent, I turn it off once I have a copy in place. 
-    ".taskrc".enable = true;
-    # WARN ugly hack
-    # taskwarrior needs write access to this file for centexts
-    # this way, we get a copy of the file, and we make sure it's writable
     ".taskrc".source = ./taskrc;
-    # ".taskrc".executable = true;
-    # ".taskrc".onChange = "cp ~/.taskrc ~/.taskrc2;rm ~/.taskrc;mv ~/.taskrc2 ~/.taskrc;chmod +w ~/.taskrc";
-    ".task/keys/ca.cert".source = ./ca.cert;
-    ".task/keys/public.cert".source = ./public.cert;
-
     ".local/bin/task-note".source = ./bin/task-note.py;
-    ".local/bin/set-idea".source = ./bin/set-idea.sh;
   };
 }

home/profiles/task/public.cert

@@ -1,31 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFRDCCAyygAwIBAgIUCsfV17Ag4utaNHY9sv6x7g/Z3bgwDQYJKoZIhvcNAQEM
-BQAwFjEUMBIGA1UEAxMLMTkyLjE2OC4xLjYwIBcNMjEwMjEzMDUzODU0WhgPOTk5
-OTEyMzEyMzU5NTlaMCgxFDASBgNVBAMTCzE5Mi4xNjguMS42MRAwDgYDVQQKEwdt
-b3NzbmV0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA23j6Xo+BlPpM
-APbncIztaYOfL02lvCOhbx5sxPk6TH5dIxzkBAc3T9X6uY+hTY36QT+SjN5z0EBi
-UghxwMM8r2G4ip3XLEFgyFDuDzVgRRuGBbSGtOEIqt49lvmBEWKaxDdYftdlDpKq
-qV8NlQJJnBJ9cNZlWzlheRALHMvCUsfnX60piWbQjYrq6j+lF9VjUKUClD92/jhS
-LaeaQ6vMlCabYNOf+vq8J3L2oRwHkLMPHBa/a5vNT3bL8Q/Sjuegi+zD68k/fobt
-Y7gYL/qyhrFfIvGyN0Jf92DTKdj+1ma3kIaG+REeAx5W8NtRdfnSlS+DA5O0mp0P
-oMZICs0Xbq474XYkhBoz7smWA4DLT86on7qcCo24CvII9YU0VDYHNtnDi8CaStea
-dvGFDiQS5X3Awwsgt5OWJSgBx+NL9piiZq9Eu5E3CGpoYNiTCANrRV21qmyf090h
-md01QUU/f1IMa+wBgryTW94OUhSMmknB9roFAmQaD9Xnj6ecGJkq2ZiytpJ37QiV
-8h2ZM9K1PUD4/QulCG/U4IG1II7ef1IUyEFpj6BB7CGCHq+qJ7QKT6Kc/quEewHB
-eUjG+FvSmCCgfVf/hqYvul7ybbiqMgCSTSziKF7tN8DuFfIZo9EGdckKXxBgQ7ua
-BRVnSZw2vh8nJ8jtGkrw/grKwHL/yA0CAwEAAaN2MHQwDAYDVR0TAQH/BAIwADAT
-BgNVHSUEDDAKBggrBgEFBQcDAjAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBQi
-MnF9Np64W1zshqQxe8Cgvm8hFDAfBgNVHSMEGDAWgBQBl2OoCoAweUqsfVQNmL9H
-3jtl2DANBgkqhkiG9w0BAQwFAAOCAgEAsNqR/SziOtCRS+n7FGxJ+3FpfACqV4Yl
-MDTbpRe0qUcbMDetWZALdPS5gNW/4rj2cpacd3eQI6qRLtUW/l8QGqZl8OjslA2X
-/N+9Alza8D+cv6Almx1TclcYJF/Z0NneJ4DgdFXJAPK3zf5eD73N/7EohNWy70Bj
-J/4cmYL3T1Pq/FhN/9DV9HoSaRxy9naRjZ3dZXC4CgFRExXw+sEHLDzOHrLDz2xN
-4qOjYUH3I1rGWXsSGRFztgNTnA02hPxG1VHzmTvwPjoBxn2/QGTMuXnk8xQGGtdy
-G8oav2RLBqvh0AD4fqd2fnMezJiRipXzYmWb1bySe48HRtHJrZ/aQQrUlPdNQwAe
-EeixS97JEdBqtag41VhRBFxF9nML8ozA6cgj+Jm2M6OGU+M3tVhioEiuKPm6jXgl
-3v8AA2CQrSJjhkTzinxE4FXa9O8INwziHSCE3GNIZaDCMYj7R8tTVcLaQWzUtdj/
-i+0fI61n3ZOabvhLXttsdrtqcfNbrxCBVezoweg2RrVFcJc2GojCwJWt6a0cO+69
-ggHZgpAwXsMmyMhhCbBXhnxBrsuGbN7f3YN2ty2veeFtp8uDvjCqmgJ5AG32w5E4
-Ck9Rup6lwgq3YTQ4pTxl2y26HinobPrMzsZiWkZhN7elnVZL00kSF2Qn6x6xuAap
-Z5oPkwZtYnM=
------END CERTIFICATE-----

home/profiles/task/taskrc

@@ -15,7 +15,7 @@ data.location=~/.task
 taskd.server=task.mossnet.lan:53589
 #taskd.server=10.0.69.4:53589
 taskd.ca=~/.task/keys/ca.cert
-taskd.key=/run/agenix/taskwarrior-private
+taskd.key=~/.task/keys/private.key
 taskd.certificate=~/.task/keys/public.cert
 taskd.trust=ignore hostname
 taskd.credentials=mossnet\/anish\/1647259c-e340-405c-a38b-11ac18e34688
@@ -29,7 +29,7 @@ taskd.credentials=mossnet\/anish\/1647259c-e340-405c-a38b-11ac18e34688
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-green-256.theme
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-blue-256.theme
 # TODO this needs to be not a hardlink but a nix link
-# include /nix/store/64nvv0ac2dr8rdz2414f53x97j3msiz0-taskwarrior-2.6.2/share/doc/task/rc/dark-violets-256.theme
+include /nix/store/64nvv0ac2dr8rdz2414f53x97j3msiz0-taskwarrior-2.6.2/share/doc/task/rc/dark-violets-256.theme
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-yellow-green.theme
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-gray-256.theme
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-gray-blue-256.theme
@@ -42,11 +42,12 @@ news.version=2.6.0
 
 ## Contexts
 context.poor.read=-purchase
-context.dev.read=+dev or +ops -work
+context.dev.read=+dev
-context.home.read=-work
+context.ops.read=+ops
-context.work.read=+work
+context.bucket.read=+in
-context.work.write=+work
+context.focused=(priority:H or priority:M) -idea -backlog -finances urgency > 5.0
-context.bucket.read=+idea
+# context.work=+Work -idea -personal
+# context.offwork=-Work
 
 ## Reports
 
@@ -58,35 +59,17 @@ report.list.labels=ID,P,Project,Tags,R,Sch,Due,Until,Description
 report.in.columns=id,project,tags,description 
 report.in.labels=ID,Proj,Tags,Description 
 report.in.description=Inbox
-report.in.filter=status:pending limit:page (+idea)
+report.in.filter=status:pending limit:page (+in)
-
-# Backlog
-report.backlog.columns=id,priority,project,tags,recur.indicator,scheduled.countdown,due,until.remaining,description.count
-report.backlog.labels=ID,P,Project,Tags,R,Sch,Due,Until,Description
-report.backlog.description=backlog
-report.backlog.filter=status:pending limit:page (+backlog)
-report.backlog.sort=start-,due+,project+/,urgency-
 
 # Unblocked
 report.unblocked.labels=ID,Deps,Proj,Tags,Due,Active,Description
 report.unblocked.columns=id,depends,project,tags,due,start.active,description
 
 # Next 
-# It's not a good idea to filter this view, since modify depends on the next view
+report.next.filter=(status:pending -in -backlog pro.not:ideas limit:0)
-report.next.filter=(status:pending limit:0) # pro.not:ideas -idea -backlog 
 report.next.labels=ID,Active,Deps,P,Project,Tag,Recur,S,Due,Until,Description
 report.next.columns=id,start.age,depends,priority,project,tags,recur,scheduled.countdown,due.relative,until.remaining,description
 
-# Everything, including inbox
-report.every.filter=(status:pending limit:0)
-report.every.labels=ID,Active,Deps,P,Project,Tag,Recur,S,Due,Until,Description
-report.every.columns=id,start.age,depends,priority,project,tags,recur,scheduled.countdown,due.relative,until.remaining,description
-
-report.poms.filter=(status:pending -idea -backlog -BLOCKED)
-report.poms.labels=UUID,ID,Project,Tag,Description
-report.poms.columns=uuid,id,project,tags,description
-report.poms.sort=start+,urgency+
-
 # Urgency
 urgency.user.project.wait.coefficient=-10.0
 urgency.user.project.craft.coefficient=1.9
@@ -95,11 +78,6 @@ urgency.user.tag.think.coefficient=-7.0
 urgency.user.tag.purchase.coefficient=-1.2
 urgency.user.project.curve.glam.coefficient=-1.3
 
-# UDAs
-uda.taskwarrior-tui.shortcuts.1=~/.local/bin/task/set-focus.sh
-uda.taskwarrior-tui.shortcuts.2=~/.local/bin/task/set-backlog.sh
-uda.taskwarrior-tui.shortcuts.3=~/.local/bin/task/set-idea.sh
-
 # Colors
 color.project.chores=blue
 color.tag.dev=cyan

hosts/box/configuration.nix

@@ -11,15 +11,13 @@
       ./hardware-configuration.nix
     ];
 
-  # No systemd emergency mode (can't reliably be accessed over SSH)
-  systemd.enableEmergencyMode = false;
-
   # Use the GRUB 2 boot loader.
   boot.loader.efi.canTouchEfiVariables = false;
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
   boot.loader.grub = {
     enable = true;
     device = "nodev";
+    version = 2;
     efiSupport = true;
     enableCryptodisk = true;
     efiInstallAsRemovable = true;
@@ -30,16 +28,6 @@
     "/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin;
   };
 
-  # Remote SSH unlock
-  boot.initrd.network.enable = true;
-  boot.initrd.network.ssh = {
-    enable = true;
-    port = 22;
-    authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve " ];
-    hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ]; # create this file with `ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key`
-  };
-  boot.initrd.availableKernelModules = [ "igc" "iwlwifi" ];
-
   boot.initrd.luks.devices = {
     "root" = {
       #name = "root";
@@ -85,13 +73,16 @@
   networking.useDHCP = false;
   networking.interfaces.wlp3s0.useDHCP = true;
 
+  # Set your time zone.
+  time.timeZone = "Australia/Brisbane";
+
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
   networking.firewall.allowedTCPPorts = [ 22 ];
   sound.enable = false;
 
   programs.gnupg.agent.enable = true;
-  programs.gnupg.agent.pinentryPackage = pkgs.pinentry-curses;
+  programs.gnupg.agent.pinentryFlavor = "curses";
   programs.gnupg.agent.enableSSHSupport = true;
 
   # This value determines the NixOS release with which your system is to be

hosts/box/default.nix

@@ -1,4 +1,5 @@
-{ self, pkgs, ... }: {
+{ self, pkgs, ... }:
+{
   imports = [
     ./configuration.nix
     ../profiles/core
@@ -6,33 +7,31 @@
     ../profiles/taskd
     ../profiles/shaarli
     ../profiles/dns
-    # ../profiles/monitoring
+    ../profiles/monitoring
     ../profiles/nfs
     ../profiles/gonic
-    # ../profiles/headphones # TODO broken on 23.11, see: https://github.com/rembo10/headphones/issues/3320
+    ../profiles/headphones
     ../profiles/radicale
-    # ../profiles/seafile # waiting for https://github.com/NixOS/nixpkgs/pull/249523 to be merged
+    ../profiles/seafile
     ../profiles/syncthing
     ../profiles/dhyan
     ../profiles/calibre
     ../profiles/wallabag
     ../profiles/finance
-    ../profiles/sync/website
-    ../profiles/grasp
     # ../profiles/archivebox
-    # ../profiles/woodpecker-agent
-    # ../profiles/jellyfin
-    ../profiles/ulogger-server
-    ../profiles/photoprism # Replace with immich
-    ../profiles/gpodder
-    #../profiles/postgres_upgrade_script
   ];
 
+  # For some reason this doesn't work in the profile, but does over here??
+  # Something weird in the way I'm importing nixpkgs in the profile or something
+  services.grasp.enable = true;
+  services.grasp.path = "/home/anish/kitaab/grasp/grasp.wiki";
+  services.grasp.user = "anish";
+
   # Backups
   age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
   services.postgresqlBackup = {
     enable = true;
-    databases = [ "wallabag" "photoprism" "ulogger" ];
+    databases = [ "wallabag" ];
     location = "/var/backup/postgresql";
   };
   mossnet.backup = {
@@ -47,45 +46,13 @@
       "/data/books" # calibre-web
       # "/home/anish/usr/nonfiction" # syncthing
       "/home/anish/usr/finance" # beancount
-      "/mnt/two/postgres" # sealight postgres backups TODO remove once moved to capsul
+      "/mnt/two/postgres" # sealight postgres backups TODO remove once moved to capsul 
     ];
     # seafile
   };
 
-  services.transmission = {
-    enable = true;
-    settings = {
-      rpc.bind-address = "0.0.0.0";
-      download-dir = "/mnt/two/new-music";
-    };
-  };
-  services.nginx.virtualHosts."transmission.mossnet.lan" = {
-    enableACME = false;
-    forceSSL = false;
-
-    locations."/" = {
-      extraConfig = ''
-        proxy_pass http://localhost:9091/;
-        proxy_set_header X-Forwarded-Host $host;
-      '';
-    };
-  };
-
-  services.nginx.virtualHosts."mast.mossnet.lan" = {
-    enableACME = false;
-    forceSSL = false;
-
-    locations."/" = {
-      extraConfig = ''
-        proxy_pass http://localhost:5731/;
-        proxy_set_header X-Forwarded-Host $host;
-      '';
-    };
-  };
-
   age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
   age.secrets.box-wg.owner = "anish";
-  age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
   mossnet.wg = {
     enable = true;
     ips = [ "10.0.69.4/24" ];

hosts/box/hardware-configuration.nix

@@ -30,33 +30,18 @@
     {
       device = "/dev/disk/by-uuid/0f857c6e-509d-436f-9e78-bc25f1b0d23b";
       fsType = "ext4";
-      options = [
-        "noatime"
-        "nodiratime"
-        "nofail"
-      ];
     };
 
   fileSystems."/mnt/two" =
     {
       device = "/dev/disk/by-uuid/5bc894bf-ed87-4c30-aab4-87e154e0cd08";
       fsType = "ext4";
-      options = [
-        "noatime"
-        "nodiratime"
-        "nofail"
-      ];
     };
 
   fileSystems."/mnt/three" =
     {
       device = "/dev/disk/by-uuid/0be3ded1-9c8b-40aa-94ca-dc2297d5988e";
       fsType = "ext4";
-      options = [
-        "noatime"
-        "nodiratime"
-        "nofail"
-      ];
     };
 
   swapDevices =

hosts/cube/configuration.nix

@@ -8,9 +8,11 @@
     ];
 
   boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
 
   networking.hostName = "cube"; # Define your hostname.
+  time.timeZone = "Australia/Brisbane";
 
   networking.useDHCP = false;
   networking.interfaces.ens3.useDHCP = true;

hosts/cube/default.nix

@@ -6,11 +6,4 @@
     ../profiles/server
     ../profiles/site
   ];
-
-  services.nginx.enable = true;
-  services.nginx.virtualHosts."coaching.lakhwara.com" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = { root = "/var/lib/coaching"; index = "/index.html"; };
-  };
 }

hosts/curve/configuration.nix

@@ -1,6 +1,7 @@
 {
   imports = [ ./hardware-configuration.nix ];
   boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
   # Define on which hard drive you want to install Grub.
   boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
 
@@ -27,6 +28,8 @@
   networking.hostName = "curve";
   #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
 
+  time.timeZone = "Australia/Brisbane";
+
   # Select internationalisation properties.
   i18n.defaultLocale = "en_US.UTF-8";
   # console = {
@@ -36,5 +39,5 @@
 
   sound.enable = true;
 
-  services.libinput.enable = true;
+  services.xserver.libinput.enable = true;
 }

hosts/curve/default.nix

@@ -1,45 +1,31 @@
-{ self, pkgs, ... }: {
+{ self, pkgs, ... }:
+{
   imports = [
     ./configuration.nix
     ../users/anish
     ../profiles/core
     ../profiles/bluetooth
     ../profiles/music
+    ../profiles/sync/kitaab
+    ../profiles/sync/website
     ../profiles/sync/cal
     ../profiles/wifi
     ../profiles/desktop
     ../profiles/mimetypes
     ../profiles/syncthing
     ../profiles/mossnet-hosts
-    # ../profiles/fly-wg
-    # ../profiles/kuberenetes
-    # ../profiles/mount-mossnet
   ];
 
-  # temporarily allow ssh access for work, to be able to do deploy new services
+  # home-manager.users.anish = import ../../home/gui;
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-    settings.PermitRootLogin = "no";
-  };
-
-  # import profiling tools
-  programs.systemtap.enable = true;
-
-  virtualisation.docker.enable = true;
-  virtualisation.docker.storageDriver = "btrfs";
-  environment.systemPackages = with pkgs; [ docker-compose ];
 
   # Speed up boot by removing dependency on network 
   systemd = {
-    targets.network-online.wantedBy =
+    targets.network-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
-      pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
+    services.NetworkManager-wait-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
-    services.NetworkManager-wait-online.wantedBy =
-      pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
   };
 
   programs.gnupg.agent.enable = true;
-  programs.gnupg.agent.pinentryPackage = pkgs.pinentry-gnome3;
+  programs.gnupg.agent.pinentryFlavor = "gnome3";
 
   fileSystems."/mnt/ftp" = {
     device = "192.168.1.240:/home/ftp";
@@ -70,15 +56,8 @@
 
   # lazy enable of ports necessary for KDE connect which is installed via cli home profile (for some reason?)
   networking.firewall = {
-    allowedTCPPorts = [ 22 ]; # allow ssh
+    allowedTCPPortRanges = [{ from = 1714; to = 1764; }];
-    allowedTCPPortRanges = [{
+    allowedUDPPortRanges = [{ from = 1714; to = 1764; }];
-      from = 1714;
-      to = 1764;
-    }];
-    allowedUDPPortRanges = [{
-      from = 1714;
-      to = 1764;
-    }];
   };
 
   age.secrets.curve-wg.file = "${self}/secrets/curve-wg.age";
@@ -90,11 +69,10 @@
   };
 
   age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
-  age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
   mossnet.backup = {
     enable = true;
     name = "curve";
-    paths = [ "/home/anish/usr" "/home/anish/.ssh" ];
+    paths = [ "/home/anish/usr" ];
   };
 
   # enable adb 
@@ -103,8 +81,7 @@
   #virtualisation.docker.enable = true;
   boot.blacklistedKernelModules = [ "qcserial" ];
   # Used for packer Capsul
-  users.users.anish.extraGroups =
+  users.users.anish.extraGroups = [ "adbusers" "wheel" "plugdev" "libvertd" ];
-    [ "adbusers" "wheel" "plugdev" "libvertd" "docker" ];
   virtualisation.libvirtd.enable = true;
   hardware.keyboard.zsa.enable = true;
   services.udev.extraRules = ''

hosts/curve/hardware-configuration.nix

@@ -5,43 +5,47 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
+    {
+      device = "/dev/disk/by-uuid/74ba39ee-35cd-4b87-9ee9-651384fa55bd";
       fsType = "btrfs";
       options = [ "subvol=root" ];
     };
 
   fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
+    {
+      device = "/dev/disk/by-uuid/74ba39ee-35cd-4b87-9ee9-651384fa55bd";
       fsType = "btrfs";
       options = [ "subvol=home" ];
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/8244-A184";
+    {
+      device = "/dev/disk/by-uuid/87DA-98E7";
       fsType = "vfat";
     };
 
   swapDevices =
-    [ { device = "/dev/disk/by-uuid/e220fea6-cf3b-4687-bfe1-9cf6d3ba57f7"; }
+    [{ device = "/dev/disk/by-uuid/c36e3ba9-8eee-4fbf-837c-7e1cfda33f09"; }];
-    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
+  # networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
   # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
 
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  nixpkgs.hostPlatform = "x86_64-linux";
 }

hosts/development/mirlo/docker-compose.nix

@@ -1,337 +0,0 @@
-# Auto-generated using compose2nix v0.1.6.
-{ pkgs, lib, ... }:
-
-{
-  # Runtime
-  virtualisation.podman = {
-    enable = true;
-    autoPrune.enable = true;
-    dockerCompat = true;
-    defaultNetwork.settings = {
-      # Required for container networking to be able to use names.
-      dns_enabled = true;
-    };
-  };
-  virtualisation.oci-containers.backend = "podman";
-
-  # Containers
-  virtualisation.oci-containers.containers."blackbird-api" = {
-    image = "";
-    environment = {
-      API_DOMAIN = "http://localhost:3000";
-      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
-      JWT_SECRET = "test1234";
-      MEDIA_LOCATION = "./data/media/";
-      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
-      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
-      MINIO_HOST = "minio";
-      MINIO_PORT = "9000";
-      MINIO_ROOT_PASSWORD = "password";
-      MINIO_ROOT_USER = "blackbird";
-      NODE_ENV = "development";
-      PORT = "3000";
-      POSTGRES_LOCAL_MACHINE_PORT = "5434";
-      POSTGRES_PASSWORD = "nomads";
-      POSTGRES_USER = "nomads";
-      REACT_APP_API_DOMAIN = "http://localhost:3000";
-      REDIS_HOST = "redis";
-      REDIS_PASSWORD = "password";
-      REDIS_PORT = "6379";
-      REFRESH_TOKEN_SECRET = "test1234";
-      STATIC_MEDIA_HOST = "http://localhost:3000";
-      STRIPE_KEY = "";
-    };
-    volumes = [
-      "/home/anish/.ssh:/root/.ssh:rw"
-      "/home/anish/usr/mirlo:/var/www/api:rw"
-      "/home/anish/usr/mirlo/data/media/downloadCache:/data/media/downloadCache:rw"
-      "/home/anish/usr/mirlo/data/media/incoming:/data/media/incoming:rw"
-    ];
-    ports = [
-      "3000:3000/tcp"
-    ];
-    cmd = [ "/bin/sh" "-c" "yarn && yarn migrate:deploy && yarn dev:api" ];
-    dependsOn = [
-      "blackbird-minio"
-      "blackbird-pgsql"
-      "blackbird-redis"
-    ];
-    log-driver = "journald";
-    extraOptions = [
-      "--network-alias=api"
-      "--network=mirlo-api-network"
-      "--network=mirlo-redis-network"
-    ];
-  };
-  systemd.services."podman-blackbird-api" = {
-    serviceConfig = {
-      Restart = lib.mkOverride 500 "always";
-    };
-    after = [
-      "podman-network-mirlo-api-network.service"
-      "podman-network-mirlo-redis-network.service"
-    ];
-    requires = [
-      "podman-network-mirlo-api-network.service"
-      "podman-network-mirlo-redis-network.service"
-    ];
-    partOf = [
-      "podman-compose-mirlo-root.target"
-    ];
-    unitConfig.UpheldBy = [
-      "podman-blackbird-minio.service"
-      "podman-blackbird-pgsql.service"
-      "podman-blackbird-redis.service"
-    ];
-    wantedBy = [
-      "podman-compose-mirlo-root.target"
-    ];
-  };
-  virtualisation.oci-containers.containers."blackbird-background" = {
-    image = "";
-    environment = {
-      API_DOMAIN = "http://localhost:3000";
-      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
-      JWT_SECRET = "test1234";
-      MEDIA_LOCATION = "./data/media/";
-      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
-      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
-      MINIO_HOST = "minio";
-      MINIO_PORT = "9000";
-      MINIO_ROOT_PASSWORD = "password";
-      MINIO_ROOT_USER = "blackbird";
-      NODE_ENV = "development";
-      PORT = "3000";
-      POSTGRES_LOCAL_MACHINE_PORT = "5434";
-      POSTGRES_PASSWORD = "nomads";
-      POSTGRES_USER = "nomads";
-      REACT_APP_API_DOMAIN = "http://localhost:3000";
-      REDIS_HOST = "redis";
-      REDIS_PASSWORD = "password";
-      REDIS_PORT = "6379";
-      REFRESH_TOKEN_SECRET = "test1234";
-      STATIC_MEDIA_HOST = "http://localhost:3000";
-      STRIPE_KEY = "";
-    };
-    volumes = [
-      "/home/anish/.ssh:/root/.ssh:rw"
-      "/home/anish/usr/mirlo:/var/www/api:rw"
-      "/home/anish/usr/mirlo/data/media/processing:/data/media/processing:rw"
-    ];
-    dependsOn = [
-      "blackbird-api"
-      "blackbird-minio"
-      "blackbird-pgsql"
-      "blackbird-redis"
-    ];
-    log-driver = "journald";
-    extraOptions = [
-      "--network-alias=background"
-      "--network=mirlo-api-network"
-      "--network=mirlo-redis-network"
-    ];
-  };
-  systemd.services."podman-blackbird-background" = {
-    serviceConfig = {
-      Restart = lib.mkOverride 500 "always";
-    };
-    after = [
-      "podman-network-mirlo-api-network.service"
-      "podman-network-mirlo-redis-network.service"
-    ];
-    requires = [
-      "podman-network-mirlo-api-network.service"
-      "podman-network-mirlo-redis-network.service"
-    ];
-    partOf = [
-      "podman-compose-mirlo-root.target"
-    ];
-    unitConfig.UpheldBy = [
-      "podman-blackbird-api.service"
-      "podman-blackbird-minio.service"
-      "podman-blackbird-pgsql.service"
-      "podman-blackbird-redis.service"
-    ];
-    wantedBy = [
-      "podman-compose-mirlo-root.target"
-    ];
-  };
-  virtualisation.oci-containers.containers."blackbird-minio" = {
-    image = "minio/minio";
-    environment = {
-      API_DOMAIN = "http://localhost:3000";
-      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
-      JWT_SECRET = "test1234";
-      MEDIA_LOCATION = "./data/media/";
-      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
-      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
-      MINIO_HOST = "minio";
-      MINIO_PORT = "9000";
-      MINIO_ROOT_PASSWORD = "password";
-      MINIO_ROOT_USER = "blackbird";
-      PORT = "3000";
-      POSTGRES_LOCAL_MACHINE_PORT = "5434";
-      POSTGRES_PASSWORD = "nomads";
-      POSTGRES_USER = "nomads";
-      REACT_APP_API_DOMAIN = "http://localhost:3000";
-      REDIS_HOST = "redis";
-      REDIS_PASSWORD = "password";
-      REDIS_PORT = "6379";
-      REFRESH_TOKEN_SECRET = "test1234";
-      STATIC_MEDIA_HOST = "http://localhost:3000";
-      STRIPE_KEY = "";
-    };
-    volumes = [
-      "/home/anish/usr/mirlo/data/minio_storage:/data:rw"
-    ];
-    ports = [
-      "9000:9000/tcp"
-      "9001:9001/tcp"
-    ];
-    cmd = [ "server" "--console-address" ":9001" "/data" ];
-    log-driver = "journald";
-    extraOptions = [
-      "--network-alias=minio"
-      "--network=mirlo-api-network:alias=minio"
-    ];
-  };
-  systemd.services."podman-blackbird-minio" = {
-    serviceConfig = {
-      Restart = lib.mkOverride 500 "no";
-    };
-    after = [
-      "podman-network-mirlo-api-network.service"
-    ];
-    requires = [
-      "podman-network-mirlo-api-network.service"
-    ];
-    partOf = [
-      "podman-compose-mirlo-root.target"
-    ];
-    wantedBy = [
-      "podman-compose-mirlo-root.target"
-    ];
-  };
-  virtualisation.oci-containers.containers."blackbird-pgsql" = {
-    image = "postgres:14-alpine";
-    environment = {
-      API_DOMAIN = "http://localhost:3000";
-      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
-      JWT_SECRET = "test1234";
-      MEDIA_LOCATION = "./data/media/";
-      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
-      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
-      MINIO_HOST = "minio";
-      MINIO_PORT = "9000";
-      MINIO_ROOT_PASSWORD = "password";
-      MINIO_ROOT_USER = "blackbird";
-      PORT = "3000";
-      POSTGRES_LOCAL_MACHINE_PORT = "5434";
-      POSTGRES_PASSWORD = "nomads";
-      POSTGRES_USER = "nomads";
-      REACT_APP_API_DOMAIN = "http://localhost:3000";
-      REDIS_HOST = "redis";
-      REDIS_PASSWORD = "password";
-      REDIS_PORT = "6379";
-      REFRESH_TOKEN_SECRET = "test1234";
-      STATIC_MEDIA_HOST = "http://localhost:3000";
-      STRIPE_KEY = "";
-    };
-    volumes = [
-      "/home/anish/usr/mirlo/data/pgsql:/var/lib/postgresql/data:rw"
-      "/home/anish/usr/mirlo/data/pgsql_backups:/backups:rw"
-    ];
-    ports = [
-      "5432:5432/tcp"
-    ];
-    log-driver = "journald";
-    extraOptions = [
-      "--network-alias=pgsql"
-      "--network=mirlo-api-network:alias=pgsql"
-    ];
-  };
-  systemd.services."podman-blackbird-pgsql" = {
-    serviceConfig = {
-      Restart = lib.mkOverride 500 "no";
-    };
-    after = [
-      "podman-network-mirlo-api-network.service"
-    ];
-    requires = [
-      "podman-network-mirlo-api-network.service"
-    ];
-    partOf = [
-      "podman-compose-mirlo-root.target"
-    ];
-    wantedBy = [
-      "podman-compose-mirlo-root.target"
-    ];
-  };
-  virtualisation.oci-containers.containers."blackbird-redis" = {
-    image = "redis";
-    ports = [
-      "6379:6379/tcp"
-    ];
-    cmd = [ "redis-server" "--appendonly" "yes" "--requirepass " ];
-    log-driver = "journald";
-    extraOptions = [
-      "--network-alias=redis"
-      "--network=mirlo-redis-network"
-    ];
-  };
-  systemd.services."podman-blackbird-redis" = {
-    serviceConfig = {
-      Restart = lib.mkOverride 500 "always";
-    };
-    after = [
-      "podman-network-mirlo-redis-network.service"
-    ];
-    requires = [
-      "podman-network-mirlo-redis-network.service"
-    ];
-    partOf = [
-      "podman-compose-mirlo-root.target"
-    ];
-    wantedBy = [
-      "podman-compose-mirlo-root.target"
-    ];
-  };
-
-  # Networks
-  systemd.services."podman-network-mirlo-api-network" = {
-    path = [ pkgs.podman ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-api-network";
-    };
-    script = ''
-      podman network inspect mirlo-api-network || podman network create mirlo-api-network --opt isolate=true
-    '';
-    partOf = [ "podman-compose-mirlo-root.target" ];
-    wantedBy = [ "podman-compose-mirlo-root.target" ];
-  };
-  systemd.services."podman-network-mirlo-redis-network" = {
-    path = [ pkgs.podman ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-redis-network";
-    };
-    script = ''
-      podman network inspect mirlo-redis-network || podman network create mirlo-redis-network --opt isolate=true
-    '';
-    partOf = [ "podman-compose-mirlo-root.target" ];
-    wantedBy = [ "podman-compose-mirlo-root.target" ];
-  };
-
-  # Root service
-  # When started, this will automatically create all resources and start
-  # the containers. When stopped, this will teardown all resources.
-  systemd.targets."podman-compose-mirlo-root" = {
-    unitConfig = {
-      Description = "Root target generated by compose2nix.";
-    };
-    wantedBy = [ "multi-user.target" ];
-  };
-}

hosts/helix/configuration.nix

@@ -8,6 +8,7 @@
 
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
 
   networking.hostName = "helix"; # Define your hostname.
@@ -21,6 +22,8 @@
 
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
+  services.openssh.passwordAuthentication = false;
+  services.openssh.permitRootLogin = "no";
   sound.enable = false;
 
   # Define a user account. Don't forget to set a password with ‘passwd’.

hosts/helix/default.nix

@@ -1,19 +1,14 @@
-{ self, profiles, suites, pkgs, ... }:
+{ self, profiles, suites, ... }:
 {
   imports = [
     ./configuration.nix
     ../profiles/core
     ../profiles/server
-    # ../profiles/metrics
+    ../profiles/metrics
     ../profiles/gitea
-    # ../profiles/woodpecker-server
     ../profiles/rss-bridge
-    # ../profiles/mount-mossnet
+    ../profiles/mount-mossnet
     ../profiles/freshrss
-    ../profiles/microbin
-    ../profiles/site
-    
-    # ../profiles/postgres_upgrade_script
   ];
 
   # Capsul specific
@@ -22,31 +17,10 @@
     extraGroups = [ "wheel" ];
   };
 
-  age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
-  age.secrets.helix-wg.owner = "anish";
   mossnet.wg = {
     enable = true;
     ips = [ "10.0.69.5/24" ];
-    privateKeyFile = "/run/agenix/helix-wg";
+    privateKeyFile = "/home/anish/wg/wg-priv";
   };
 
-  services.postgresql.package = pkgs.postgresql_15;
-  services.postgresqlBackup = {
-    # TODO needs working wireguard to box
-    enable = false;
-    databases = [ "gitea" "freshrss"  ]; # "woodpecker"
-    location = "/mnt/two/postgres";
-  };
-
-  mossnet.backup = {
-    enable = true;
-    name = "helix";
-    paths = [
-      "/var/lib/gitea"
-      "/var/lib/freshrss"
-      # "/var/lib/woodpecker"
-      "/var/lib/microbin"
-    ];
-
-  };
 }

hosts/helix/disko.nix

@@ -1,51 +0,0 @@
-{ disks ? [ "/dev/vdb" ], ... }: {
-  disko.devices = {
-    disk = {
-      vdb = {
-        type = "disk";
-        device = builtins.elemAt disks 0;
-        content = {
-          type = "table";
-          format = "gpt";
-          partitions = [
-            {
-              name = "ESP";
-              start = "1MiB";
-              end = "128MiB";
-              fs-type = "fat32";
-              bootable = true;
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-              };
-            }
-            {
-              name = "root";
-              start = "128MiB";
-              end = "100%";
-              content = {
-                type = "btrfs";
-                extraArgs = [ "-f" ]; # Override existing partition
-                subvolumes = {
-                  # Subvolume name is different from mountpoint
-                  "/rootfs" = {
-                    mountpoint = "/";
-                  };
-                  # Mountpoints inferred from subvolume name
-                  "/home" = {
-                    mountOptions = [ "compress=zstd" ];
-                  };
-                  "/nix" = {
-                    mountOptions = [ "compress=zstd" "noatime" ];
-                  };
-                };
-              };
-            }
-          ];
-        };
-      };
-    };
-  };
-}
-

hosts/helix/hardware-configuration.nix

@@ -5,27 +5,23 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
+    {
-      fsType = "ext4";
+      device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
+      fsType = "btrfs";
     };
 
   swapDevices = [ ];
 
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  nix.settings.max-jobs = lib.mkDefault 1;
-  # (the default) this is the recommended approach. When using systemd-networkd it's
+  nixpkgs.hostPlatform = "x86_64-linux";
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/lituus/configuration.nix

@@ -8,6 +8,7 @@
 
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
 
   networking.hostName = "lituus"; # Define your hostname.

hosts/lituus/hardware-configuration.nix

@@ -16,8 +16,8 @@
 
   fileSystems."/" =
     {
-      device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
+      device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
-      fsType = "btrfs";
+      fsType = "ext4";
     };
 
   swapDevices = [ ];

hosts/profiles/calibre/default.nix

@@ -36,7 +36,6 @@
       extraConfig = ''
         proxy_pass http://localhost:8083/;
         proxy_set_header X-Forwarded-Host $host;
-        client_max_body_size 50M;
       '';
     };
   };

hosts/profiles/core/default.nix

@@ -4,8 +4,9 @@ in
 {
   imports = [ ../../users/anish ];
 
+
   fonts = {
-    packages = with pkgs; [ powerline-fonts dejavu_fonts ];
+    fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
     fontconfig.defaultFonts = {
       monospace = [ "DejaVu Sans Mono for Powerline" ];
       sansSerif = [ "DejaVu Sans" ];
@@ -32,7 +33,7 @@ in
   };
 
   environment.systemPackages = with pkgs; [
-    pinentry-gnome3
+    pinentry_gnome
     cached-nix-shell
   ];
 
@@ -42,8 +43,6 @@ in
     openFirewall = lib.mkDefault false;
   };
 
-  time.timeZone = "Canada/Pacific";
-
   # programs.gnupg.agent.enable = true;
   # programs.gnupg.agent.pinentryFlavor = "curses";
 

hosts/profiles/desktop/default.nix

@@ -28,10 +28,6 @@ in
   age.secrets.mossnet.file = "${self}/secrets/mossnet.age";
   age.secrets.mossnet.owner = "anish";
 
-  # Taskwarrior private key
-  age.secrets.taskwarrior-private.file = "${self}/secrets/taskwarrior-private.age";
-  age.secrets.taskwarrior-private.owner = "anish";
-
   # We don't plug USBs into servers
   services.devmon.enable = true;
 
@@ -44,7 +40,6 @@ in
       packages = [ pkgs.dconf ];
     };
   };
-  programs.dconf.enable = true;
 
   security.pam.services.Default.enableGnomeKeyring = true;
   security.pam.services.Login.enableGnomeKeyring = true;
@@ -62,23 +57,23 @@ in
   };
 
   environment.systemPackages = with pkgs; [
-    #unstable.sublime-music
+    unstable.signal-desktop # bridge to sealight?
+    unstable.sublime-music
     unstable.nheko
-    unstable.signal-desktop
+    unstable.tootle
-    unstable.tuba
+    newsflash
-    unstable.newsflash
+    liferea
-    unstable.liferea
-    unstable.gh
-    unstable.flyctl
 
-    kooha
+    scrot
-    light
+    ripcord
     xfce.orage
     feh
     sxiv
     xkblayout-state
+    vcv-rack
     zathura
     calibre
+    fractal
     mpv
     zeal
     xclip
@@ -86,6 +81,7 @@ in
     rofi
     rofimoji
     rofi-calc
+    eww
     obs-studio
     lightdm
     dunst
@@ -97,18 +93,10 @@ in
     papirus-icon-theme
     calendar-cli
     wyrd
-    # tic-80
+    tex
-    ytfzf
+    tic-80
-    yt-dlp
   ];
 
-  xdg.portal = {
-    # Breaks link clicking in nheko
-    # Portal doesn't seem to find Firefox as an acceptable app to open links?
-    enable = false;
-    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
-    xdgOpenUsePortal = false;
-  };
 
   location.provider = "geoclue2";
   services = {
@@ -119,15 +107,12 @@ in
         night = 3700;
       };
     };
-    displayManager.defaultSession = "none+bspwm";
     xserver = {
       enable = true;
-      # TODO should be xkb.layout
+      layout = "us,dvorak";
-      xkb.layout = "us";
-      # xkb.variant = "dvorak";
       desktopManager.wallpaper.mode = "fill";
       displayManager = {
-        # startx.enable = true;
+        defaultSession = "none+bspwm";
         sessionCommands = ''
           ${pkgs.xorg.xrdb}/bin/xrdb -merge <<EOF
           #define blk  #1F2430
@@ -178,11 +163,10 @@ in
           *.color239: #565761
           *.color240: #6272a4
           *.color241: #b6b6b2
+          EOF
 
           # hotplug
           connect() {
-              # Turn it on if it was off
-              xrandr --output HDMI-2 --auto
               xrandr --output HDMI-2 --same-as eDP-1
           }
 
@@ -191,7 +175,24 @@ in
           }
 
           xrandr | grep "HDMI-2 connected" &>>/dev/null && connect || disconnect
-          EOF
+
+          # keyboard on curve is busted
+          get_keyboard_id() {
+            xinput list | grep 'AT Translated Set' | cut -f2 | cut -d'=' -f2 | xinput float 
+          }
+
+          disconnect_keyboard() {
+            id=$(get_keyboard_id)
+            xinput float $id
+            unset id
+          }
+
+          attach_keyboard() {
+            id=$(get_keyboard_id)
+            xinput reattach $id 3
+          }
+
+          disconnect_keyboard
         '';
         lightdm = {
           enable = true;
@@ -214,7 +215,7 @@ in
     };
   };
 
-  fonts.packages = with pkgs; [
+  fonts.fonts = with pkgs; [
     fira-code
     fira-code-symbols
     hermit

hosts/profiles/dns/default.nix

@@ -1,89 +1,36 @@
 { config, pkgs, lib, ... }:
-let
+{
-  adblockLocalZones = pkgs.stdenv.mkDerivation {
+  services.dnsmasq.enable = true;
-    name = "unbound-zones-adblock";
+  services.dnsmasq.extraConfig = ''
-
+    domain-needed
-    src = (pkgs.fetchFromGitHub {
+    no-resolv
-      owner = "StevenBlack";
+    local=/lan/
-      repo = "hosts";
+    local=/moss/
-      rev = "3.12.21";
+    cache-size=5000
-      sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
+    addn-hosts=/etc/adblock.hosts 
-    } + "/hosts");
+  ''; # TODO find a way to make adblock hosts reproducible and updateable
-
+  services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
-    phases = [ "installPhase" ];
+  # TODO use this list in mossnet-hosts
-
+  networking.hosts = {
-    installPhase = ''
+    "192.168.1.240" = [
-      ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u >  $out
+      "mossnet.lan"
-    '';
+      "links.mossnet.lan"
+      "read.mossnet.lan"
+      "stats.mossnet.lan"
+      "music.mossnet.lan"
+      "rss.mossnet.lan"
+      "tasks.mossnet.lan"
+      "file.mossnet.lan"
+      "books.mossnet.lan"
+      "fin.mossnet.lan"
+      "paper.mossnet.lan"
+      "cal.mossnet.lan"
+      "archive.mossnet.lan"
+    ];
+    "192.168.1.226" = [
+      "df-web.lan"
+    ];
   };
-
-  mossnet = "192.168.1.240"; # The local lan-ip for box
-  wg-mossnet = "10.0.69.4"; # The wireguard ip for box
-  mossnet-hosts = [
-    "mossnet.lan"
-    "headphones.mossnet.lan"
-    "links.mossnet.lan"
-    "read.mossnet.lan"
-    "stats.mossnet.lan"
-    "music.mossnet.lan"
-    "tasks.mossnet.lan"
-    "file.mossnet.lan"
-    "books.mossnet.lan"
-    "fin.mossnet.lan"
-    "paper.mossnet.lan"
-    "cal.mossnet.lan"
-    "archive.mossnet.lan"
-    "headphones.mossnet.lan"
-    "transmission.mossnet.lan"
-    "tracks.mossnet.lan"
-    "grasp.mossnet.lan"
-    "photos.mossnet.lan"
-    "pod.mossnet.lan"
-    "mast.mossnet.lan"
-  ];
-
-in {
-  services.unbound = {
-    enable = true;
-    settings = {
-      server = {
-        include = "${adblockLocalZones}";
-        prefetch = "yes";
-        # private-address = "10.0.69.0/8";
-        # private-address = "192.168.1.0/24";
-        cache-min-ttl = 0;
-        serve-expired = "yes";
-        interface = [ "0.0.0.0" ];
-        access-control =
-          [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
-        access-control-view = "10.0.69.0/24 wireguard";
-        # so-reuseport = "yes";
-        tls-upstream = "yes";
-        domain-insecure = "mossnet.lan";
-        local-zone = ''"mossnet.lan." redirect'';
-        local-data = ''"mossnet.lan. IN A ${mossnet}"'';
-      };
-      forward-zone = [{
-        name = ".";
-        forward-addr = [
-          "45.90.28.0#6939b9.dns.nextdns.io"
-          "1.1.1.1@853#cloudflare-dns.com"
-        ];
-        # non-tls
-        # forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"] 
-      }];
-      view = {
-        name = "wireguard";
-        local-zone = ''"mossnet.lan." redirect'';
-        local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
-      };
-    };
-  };
-
-  # With unbound we're doing wildcard redirects, so we don't need that anymore
-  # networking.hosts = {
-  #   mossnet = mossnet-hosts;
-  # };
   networking.firewall.allowedTCPPorts = [ 53 ];
   networking.firewall.allowedUDPPorts = [ 53 ];
 }

hosts/profiles/finance/default.nix

@@ -2,9 +2,9 @@
 
 {
   services.paperless = {
-    enable = false;
+    enable = true;
     consumptionDirIsPublic = true;
-    settings.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
+    extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
   };
 
   environment.systemPackages = [
@@ -18,7 +18,6 @@
     path = [
       pkgs.fava
     ];
-    wantedBy = [ "multi-user.target" ];
     before = [ "nginx.service" ];
     serviceConfig = {
       User = "anish";

hosts/profiles/fly-wg/default.nix

@@ -1,6 +0,0 @@
-{ pkgs, config, lib, ... }:
-
-{
-  networking.wireguard.interfaces.fly-wg = "/home/anish/usr/fly-io-test/fly-wg.conf";
-  # ssh.startAgent = true;
-}

hosts/profiles/freshrss/default.nix

@@ -17,21 +17,17 @@
 
   services.postgresql = {
     enable = true; # Ensure postgresql is enabled
-    # authentication = ''
+    package = pkgs.postgresql_11;
-    #   local freshrss all ident map=freshrss-users
+    authentication = ''
-    # '';
+      local freshrss all ident map=freshrss-users
-    # identMap = # Map the freshrss user to postgresql
+    '';
-    #   ''
+    identMap = # Map the freshrss user to postgresql
-    #     freshrss-users freshrss freshrss
+      ''
-    #     freshrss-users postgres freshrss
+        freshrss-users freshrss freshrss
-    #   '';
+      '';
     ensureDatabases = [ "freshrss" ];
-    ensureUsers = [{ 
-      name = "freshrss"; 
-      ensureDBOwnership = true;
-    }];
     # TODO
-    # initialScript # set password for freshrss user
+    # initialScript # set password for gitea user
   };
 
   services.nginx.virtualHosts."rss.sealight.xyz" = {

hosts/profiles/gitea/default.nix

@@ -4,78 +4,56 @@
   age.secrets.gitea-dbpass.file = "${self}/secrets/gitea-dbpass.age";
   age.secrets.gitea-dbpass.owner = "gitea";
 
-  services.forgejo = {
+  services.gitea = {
     enable = true;
-    user = "gitea";
+    appName = "Sealight Git Forge";
-    group = "gitea";
+    domain = "git.sealight.xyz";
-    stateDir = "/var/lib/gitea";
+    rootUrl = "https://git.sealight.xyz";
+    httpPort = 3001;
     database = {
       type = "postgres";
-      user = "gitea";
-      name = "gitea";
       passwordFile = "/run/agenix/gitea-dbpass";
     };
     settings = {
-      DEFAULT.APP_NAME = "Sealight Git Forge";
-      server = {
-        DOMAIN = "git.sealight.xyz";
-        ROOT_URL = "https://git.sealight.xyz";
-        HTTP_PORT = 3001;
-      };
       metrics = {
         ENABLED = true;
       };
       repository = {
         DEFAULT_BRANCH = "main";
       };
-      service.DISABLE_REGISTRATION = true;
+      # TODO
       "markup.restructuredtext" = {
         ENABLED = true;
         FILE_EXTENSIONS = ".rst";
-        RENDER_COMMAND = "timeout 30s pandoc +RTS -RTS -f rst";
+        RENDER_COMMAND = "pandoc +RTS -M512M -RTS -f rst";
         IS_INPUT_FILE = false;
       };
+      # TODO 
       mailer = {
-        ENABLED = true;
+        ENABLED = false;
         MAILER_TYPE = "smtp";
         FROM = "ops@sealight.xyz";
-        SMTP_ADDR = "smtp.nullhex.com";
+        SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
-        SMTP_PORT = "465";
-        USER = "ops@sealight.xyz";
-        PASSWD = "breed deputy fossil glory"; # TODO how do we pass this from agenix?
-        IS_TLS_ENABLED = "true";
       };
     };
   };
 
-  users.users.gitea = {
-    home = "/var/lib/gitea";
-    useDefaultShell = true;
-    group = "gitea";
-    isSystemUser = true;
-  };
-
-  users.groups.gitea = {};
-
   environment.systemPackages = [ pkgs.pandoc ];
   services.postgresql = {
     enable = true; # Ensure postgresql is enabled
-    # authentication = ''
+    authentication = ''
-    #   local gitea all ident map=gitea-users
+      local gitea all ident map=gitea-users
-    # '';
+    '';
-    # identMap = # Map the gitea user to postgresql
+    identMap = # Map the gitea user to postgresql
-    #   ''
+      ''
-    #     gitea-users gitea gitea
+        gitea-users gitea gitea
-    #     gitea-users postgres gitea
+      '';
-    #   '';
+    # ensureDatabases = [ "gitea" ];
-    ensureDatabases = [ "gitea" ];
+    ensureUsers = [
-    ensureUsers = [{ 
+      { name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
-      name = "gitea"; 
+    ];
-      ensureDBOwnership = true; 
-    }];
     # TODO
-    # initialScript 
+    # initialScript # set password for gitea user
-    # set password for gitea user
   };
 
   services.nginx = {
@@ -92,4 +70,6 @@
     };
   };
   networking.firewall.allowedTCPPorts = [ 80 443 22 ];
+  security.acme.defaults.email = "anish+acme@lakhwara.com";
+  security.acme.acceptTerms = true;
 }

hosts/profiles/gonic/default.nix

@@ -1,21 +1,12 @@
 { config, lib, pkgs, ... }:
 {
-  mossnet.gonic.enable = true;
+  services.gonic.enable = true;
-  mossnet.gonic.settings = ''
+  services.gonic.settings = ''
     music-path /mnt/two/music/
     podcast-path /data/podcasts
     cache-path /data/cache
-    playlists-path /data/playlists
   '';
-  mossnet.gonic.user = "gonic";
+  services.gonic.group = "audio";
-  mossnet.gonic.group = "audio";
+  services.gonic.user = "headphones";
   networking.firewall.allowedTCPPorts = [ 4747 ];
-
-  users.users.gonic = {
-    # uid = config.ids.uids.headphones;
-    # isSystemUser = true;
-    group = "audio";
-    # home = "/var/lib/headphones";
-    createHome = true;
-  };
 }

hosts/profiles/gonic/module-gonic.nix

@@ -68,10 +68,14 @@ in
         Group = cfg.group;
         DevicePolicy = "closed";
         NoNewPrivileges = " yes";
+        PrivateTmp = "yes";
+        PrivateUsers = "yes";
         ProtectControlGroups = "yes";
         ProtectKernelModules = "yes";
         ProtectKernelTunables = "yes";
         RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+        RestrictNamespaces = "yes";
+        RestrictRealtime = "yes";
         SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
         ReadWritePaths = dataFolder;
         StateDirectory = baseNameOf dataFolder;

hosts/profiles/gpodder/default.nix

@@ -1,16 +0,0 @@
-{
-  services.gpodder.enable = true;
-  networking.firewall.allowedTCPPorts = [ 3005 ];
-  services.nginx.virtualHosts."pod.mossnet.lan" = {
-    extraConfig = "client_max_body_size 20M;";
-
-    locations."/" = {
-      extraConfig = ''
-        proxy_pass http://localhost:3005/;
-        proxy_set_header    X-Forwarded-Proto $scheme;
-        proxy_set_header    X-Real-IP $remote_addr;
-        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
-      '';
-    };
-  };
-}

hosts/profiles/grasp/default.nix

@@ -1,12 +1,6 @@
 { ... }:
 {
-  services.grasp = {
+  services."grasp".enable = true;
-    enable = true;
+  services."grasp".path = "/home/anish/kitaab/grasp";
-    path = "/home/anish/kitaab/grasp/notes.wiki";
+  services."grasp".user = "anish";
-    user = "anish";
-  };
-
-  services.nginx.virtualHosts."grasp.mossnet.lan" = {
-    locations."/".proxyPass = "http://localhost:12212";
-  };
 }

hosts/profiles/headphones/default.nix

@@ -2,21 +2,11 @@
 {
   services.headphones = {
     enable = true;
-    host = "0.0.0.0";
+    host = "192.168.1.240";
     port = 8181;
-    package = "${pkgs.unstable.headphones}";
     user = "headphones";
     group = "audio";
     dataDir = "/data/music";
   };
-  services.nginx.virtualHosts."headphones.mossnet.lan" = {
+  networking.firewall.allowedTCPPorts = [ 8181 ];
-    enableACME = false;
-    forceSSL = false;
-
-    locations."/" = {
-      extraConfig = ''
-        proxy_pass http://127.0.0.1:8181/;
-      '';
-    };
-  };
 }

hosts/profiles/jellyfin/default.nix

@@ -1,27 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  # Enable Hardware Acceleration for transcoding
-  nixpkgs.config.packageOverrides = pkgs: {
-    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
-  };
-  hardware.opengl = {
-    enable = true;
-    extraPackages = with pkgs; [
-      intel-media-driver
-      vaapiIntel
-      vaapiVdpau
-      libvdpau-va-gl
-      intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
-    ];
-  };
-  services.jellyfin = {
-    enable = true;
-    user = "jellyfin";
-    group = "video";
-    openFirewall = true; # only for defaults
-  };
-  networking.firewall.allowedTCPPorts = [ 8181 ];
-  users.users.jellyfin = {
-    extraGroups = [ "video" "audio" ];
-  };
-}

hosts/profiles/kuberenetes/default.nix

@@ -1,20 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # k3s
-  networking.firewall.allowedTCPPorts = [ 6443 ];
-  services.k3s.enable = true;
-  services.k3s.role = "server";
-  services.k3s.clusterInit = false;
-  # services.k3s.extraFlags = toString [
-  #   "--kubelet-arg=v=4" # Optionally add additional args to k3s
-  # ];
-  environment.systemPackages = [ pkgs.k3s pkgs.kubernetes-helm pkgs.kubectl ];
-
-  # minikube on docker
-  virtualisation.docker.enable = true;
-  virtualisation.docker.storageDriver = "btrfs";
-  # or use kvm
-  # virtualisation.libvirtd.enable = true;
-  users.users.anish.extraGroups = [ "docker" "libvert" ]; # 
-}

hosts/profiles/matrix/default.nix

@@ -3,7 +3,6 @@
 {
   imports = [
     ./mautrix-telegram.nix
-    ./mautrix-services.nix
     # ./mautrix-discord.nix
     # ./mautrix-whatsapp.nix
     # ./mautrix-slack.nix
@@ -20,7 +19,6 @@
   services.matrix-synapse = {
     enable = true;
     settings = {
-      max_upload_size = "100M";
       server_name = "sealight.xyz";
       listeners = [
         {
@@ -42,15 +40,11 @@
           tls = false;
         }
       ];
-
       app_service_config_files = [
         #   The registration file is automatically generated after starting the appservice for the first time.
         #   cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
         #   chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
         "/var/lib/matrix-synapse/telegram-registration.yaml"
-        "/var/lib/matrix-synapse/signal-registration.yaml"
-        "/var/lib/matrix-as-whatsapp/whatsapp-registration.yaml"
-        "/var/lib/matrix-as-discord/discord-registration.yaml"
         # "/var/lib/matrix-synapse/slack-registration.yaml"
         # "/var/lib/matrix-synapse/discord-registration.yaml"
         # "/var/lib/matrix-synapse/whatsapp-registration.yaml"

hosts/profiles/matrix/mautrix-services.nix

@@ -1,52 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  # Mautrix-signal settings
-  services.signald.enable = true;
-  systemd.services.matrix-as-signal = {
-    requires = [ "signald.service" ];
-    after = [ "signald.service" ];
-    unitConfig = {
-      JoinsNamespaceOf = "signald.service";
-    };
-    path = [
-      pkgs.ffmpeg # voice messages need `ffmpeg`
-    ];
-  };
-
-  services.matrix-appservices = {
-    addRegistrationFiles = false;
-    homeserverURL = "https://sealight.xyz/";
-    homeserverDomain = "sealight.xyz";
-    services = {
-      whatsapp = {
-        port = 29183;
-        format = "mautrix-go";
-        package = pkgs.mautrix-whatsapp;
-      };
-
-      discord = {
-        port = 29188;
-        format = "mautrix-go";
-        package = pkgs.my-mautrix-discord;
-      };
-
-      signal = {
-        port = 29184;
-        format = "mautrix-python";
-        package = pkgs.unstable.mautrix-signal;
-        serviceConfig = {
-          StateDirectory = [ "matrix-as-signal" "signald" ];
-          SupplementaryGroups = [ "signald" ];
-          TimeoutStopSec = 1; # work around the service ignoring SIGTERM, see https://gitlab.com/coffeetables/nix-matrix-appservices/-/issues/12
-          User = lib.mkForce config.services.signald.user;
-          Group = lib.mkForce config.services.signald.group;
-        };
-        settings.signal = {
-          socket_path = config.services.signald.socketPath;
-          outgoing_attachment_dir = "/var/lib/signald/tmp";
-        };
-      };
-    };
-  };
-}

hosts/profiles/matrix/mjolnir.nix

@@ -1,9 +1,9 @@
 { self, pkgs, lib, config, ... }:
 {
-  # age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age";
+  age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age";
-  # age.secrets.sealight-mod-password.owner = "mjolnir";
+  age.secrets.sealight-mod-password.owner = "mjolnir";
   services.mjolnir = {
-    enable = false;
+    enable = true;
     protectedRooms = [
       "https://matrix.to/#/#public:sealight.xyz"
       "https://matrix.to/#/#theFeed:sealight.xyz"

hosts/profiles/microbin/default.nix

@@ -1,21 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  services.microbin.enable = true;
-  services.microbin.settings.PUBLIC_PATH = "bin.sealight.xyz"; 
-  services.microbin.settings.MICROBIN_PORT = 4949;
-  networking.firewall.allowedTCPPorts = [ 4949 ];
-  services.nginx.virtualHosts."bin.sealight.xyz" = {
-    enableACME = true;
-    forceSSL = true;
-    extraConfig = "client_max_body_size 20M;";
-
-    locations."/" = {
-      extraConfig = ''
-        proxy_pass http://localhost:4949/;
-        proxy_set_header    X-Forwarded-Proto $scheme;
-        proxy_set_header    X-Real-IP $remote_addr;
-        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
-      '';
-    };
-  };
-}

hosts/profiles/mimetypes/default.nix

@@ -2,7 +2,7 @@
 
 {
   xdg.mime.defaultApplications = {
-    "application/pdf" = "zathura.desktop";
+    "application/pdf" = "firefox.desktop";
     "image/png" = [
       "sxiv.desktop"
       "feh.desktop"

hosts/profiles/monitoring/default.nix

@@ -1,54 +1,25 @@
 { self, config, pkgs, ... }: {
-  age.secrets.nullhex-smtp.file = "${self}/secrets/nullhex-smtp.age";
-  age.secrets.nullhex-smtp.owner = "grafana";
-
   # grafana configuration
   services.grafana = {
     enable = true;
-    settings = {
+    settings.server = {
-      smtp = {
+      domain = "stats.mossnet.lan";
-        enabled = true;
+      http_port = 2342;
-        password = "$__file{/run/agenix/nullhex-smtp}";
+      http_addr = "127.0.0.1";
-        host = "smtp.nullhex.com";
-        user = "ops@sealight.xyz";
-        from_address = "ops@sealight.xyz";
-      };
-      server = {
-        domain = "stats.mossnet.lan";
-        http_addr = "127.0.0.1";
-        http_port = 2342;
-        root_url = "http://stats.mossnet.lan/";
-      };
     };
     # TODO enable
     # provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml";
   };
 
   # nginx reverse proxy
-  # services.nginx.recommendedProxySettings = true; # Needed for new grafana versions 
+  services.nginx.recommendedProxySettings = true; # Needed for new grafana versions 
-  services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
+  services.nginx.virtualHosts.${config.services.grafana.domain} = {
     locations."/" = {
-      proxyPass = "http://127.0.0.1:2342";
+      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
       proxyWebsockets = true;
     };
   };
 
-    services.postgresql = {
-      ensureUsers = [{
-        name = "grafana";
-        # TODO this is deprecated 
-        # Need to translate this to 
-        # systemd.services.postgresql.postStart
-        # or initialScript 
-        ensurePermissions = {
-          "ALL TABLES IN SCHEMA public" = "SELECT";
-          "DATABASE wallabag" = "CONNECT";
-          "DATABASE ulogger" = "CONNECT";
-          "DATABASE photoprism" = "CONNECT";
-        };
-      }];
-    };
-
   services.prometheus = {
     enable = true;
     port = 9001;

hosts/profiles/mossnet-hosts/default.nix

@@ -4,8 +4,6 @@
     192.168.1.240 mossnet.lan
     192.168.1.240 links.mossnet.lan
     192.168.1.240 read.mossnet.lan
-    192.168.1.240 headphones.mossnet.lan
-    192.168.1.240 transmission.mossnet.lan
     192.168.1.240 music.mossnet.lan
     192.168.1.240 stats.mossnet.lan
     192.168.1.240 file.mossnet.lan
@@ -13,16 +11,10 @@
     192.168.1.240 fin.mossnet.lan
     192.168.1.240 paper.mossnet.lan
     192.168.1.240 books.mossnet.lan
-    192.168.1.240 archive.mossnet.lan
+    192.f.1.240 archive.mossnet.lan
-    192.168.1.240 music.mossnet.lan
-    192.168.1.240 tracks.mossnet.lan
-    192.168.1.240 grasp.mossnet.lan
-    192.168.1.240 photos.mossnet.lan
-    192.168.1.240 pod.mossnet.lan
   '';
   # 10.0.69.4 mossnet.lan
   #  10.0.69.4 links.mossnet.lan
   #  10.0.69.4 read.mossnet.lan
   #  10.0.69.4 stats.mossnet.lan
 }
-

hosts/profiles/music/default.nix

@@ -16,7 +16,7 @@
     orca-c
     supercollider
     dirt
-    # sunvox
+    sunvox
     vcv-rack
     lmms
     bespokesynth
@@ -31,22 +31,21 @@
   ];
 
   hardware.pulseaudio.enable = lib.mkForce false;
-  security.rtkit.enable = false;
+  security.rtkit.enable = true;
 
   services.pipewire = {
     enable = true;
     alsa.enable = true;
-    alsa.support32Bit = false;
+    alsa.support32Bit = true;
     pulse.enable = true;
     jack.enable = true;
-    # Deprecated as of 23.05
+    config = {
-    # config = {
+      pipewire."context.properties"."default.clock.rate" = "48000";
-    #   pipewire."context.properties"."default.clock.rate" = "48000";
+      pipewire-pulse."stream.properties"."resample.quality" = 15;
-    #   pipewire-pulse."stream.properties"."resample.quality" = 15;
+      client."stream.properties"."resample.quality" = 15;
-    #   client."stream.properties"."resample.quality" = 15;
+      client-rt."stream.properties"."resample.quality" = 15;
-    #   client-rt."stream.properties"."resample.quality" = 15;
+      #jack."context.modules" = [];
-    #   #jack."context.modules" = [];
+    };
-    # };
     #media-session.config.bluez-monitor.properties = {
     #  "bluez5.headset-roles" = [ "hsp_hs" "hsp_ag" ];
     #  "bluez5.codecs" = [ "aac" "ldac" "aptx_hd" ];
@@ -58,6 +57,6 @@
   #  "${config.hardware.bluetooth.package}/libexec/bluetooth/bluetoothd --noplugin=sap"
   #];
   boot.kernelModules = [ "snd-seq" "snd-rawmidi" ]; # midi sequence kernel mods
-  # hardware.pulseaudio.package = pkgs.pulseaudio.override { jackaudioSupport = true; };
+  hardware.pulseaudio.package = pkgs.pulseaudio.override { jackaudioSupport = true; };
 
 }

hosts/profiles/photoprism/default.nix

@@ -1,46 +0,0 @@
-{ self, pkgs, config, lib, ... }:
-
-{
-  services.postgresql = {
-    enable = true;
-    ensureDatabases = [ "photoprism" ];
-    ensureUsers = [{
-      name = "photoprism";
-      ensureDBOwnership = true;
-    }];
-  };
-
-  services.photoprism = {
-    enable = true;
-    package = pkgs.unstable.photoprism;
-    port = 5152;
-    originalsPath = "/var/lib/private/photoprism/originals";
-    address = "0.0.0.0";
-    settings = {
-      PHOTOPRISM_ADMIN_USER = "admin";
-      PHOTOPRISM_ADMIN_PASSWORD = "photoprism"; # initial password, do change it!
-      PHOTOPRISM_DEFAULT_LOCALE = "en";
-      PHOTOPRISM_DATABASE_DRIVER = "postgres";
-      PHOTOPRISM_DATABASE_NAME = "photoprism";
-      PHOTOPRISM_DATABASE_SERVER = "/run/postgresql/";
-      PHOTOPRISM_DATABASE_USER = "photoprism";
-      PHOTOPRISM_SITE_URL = "http://photos.mossnet.lan/";
-      PHOTOPRISM_SITE_TITLE = "mossnet photos";
-    };
-  };
-
-  services.nginx.clientMaxBodySize = "500m";
-  services.nginx.recommendedProxySettings = true;
-  services.nginx.virtualHosts."photos.mossnet.lan" = {
-    enableACME = false;
-    forceSSL = false;
-    locations."/" = {
-      extraConfig = ''
-        proxy_pass http://localhost:5152/;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_buffering off;
-        proxy_http_version 1.1;
-      '';
-    };
-  };
-}

hosts/profiles/postgres_upgrade_script/default.nix

@@ -6,12 +6,13 @@
       # TODO it's perhaps advisable to stop all services that depend on postgresql
       systemctl stop postgresql
 
+      # TODO replace `<new version>` with the psqlSchema here
       # The schema can be found by running:
-      # nix eval --raw nixpkgs#postgresql_15.psqlSchema
+      # nix-instantiate '<nixpkgs>' --eval -A postgresql_14.psqlSchema
-      export NEWDATA="/var/lib/postgresql/15"
+      export NEWDATA="/var/lib/postgresql/<new version>"
 
       # TODO specify the postgresql package you'd like to upgrade to
-      export NEWBIN="${pkgs.postgresql_15}/bin"
+      export NEWBIN="${pkgs.postgresql_14}/bin"
 
       export OLDDATA="${config.services.postgresql.dataDir}"
       export OLDBIN="${config.services.postgresql.package}/bin"

hosts/profiles/rss-bridge/default.nix

@@ -3,7 +3,7 @@
   services.rss-bridge = {
     enable = true;
     virtualHost = "bridge.sealight.xyz";
-    config.system.enabled_bridges = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
+    whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
   };
 
   services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;

hosts/profiles/server/default.nix

@@ -2,8 +2,8 @@
 {
   services.openssh = {
     enable = true;
-    settings.PasswordAuthentication = false;
+    passwordAuthentication = false;
-    settings.PermitRootLogin = "no";
+    permitRootLogin = "no";
   };
   networking.firewall.allowedTCPPorts = [ 80 443 22 ]; # ssh and website
   security.sudo.wheelNeedsPassword = false; # needed for deploy-rs

hosts/profiles/sync/kitaab/default.nix

@@ -0,0 +1,27 @@
+{ pkgs, ... }:
+
+{
+  systemd.services.kitaab-sync = {
+    serviceConfig.Type = "oneshot";
+    path = [
+      pkgs.git
+      pkgs.openssh
+      pkgs.coreutils
+    ];
+    script = ''
+      cd /home/anish/kitaab
+      git add -A
+      git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
+      git push
+      exit 0
+    '';
+    serviceConfig = {
+      User = "anish";
+    };
+  };
+  systemd.timers.kitaab-sync = {
+    wantedBy = [ "timers.target" ];
+    partOf = [ "kitaab-sync.service" ];
+    timerConfig.OnCalendar = [ "hourly" ];
+  };
+}

hosts/profiles/sync/website/default.nix

@@ -6,19 +6,19 @@
     path = [
       pkgs.git
       pkgs.coreutils
-      pkgs.nixVersions.latest
+      pkgs.nixUnstable
       pkgs.openssh
       pkgs.deploy
     ];
     script = ''
-      cd /home/anish/usr/helm/
+      cd /etc/nixos/ # TODO make variable
-      git pull
       nix flake lock --update-input poonam
       nix flake lock --update-input basant
-      git add flake.lock
+      # TODO 
-      git diff-index --quiet HEAD || git commit -m 'updating website' # if nothing, don't exit 1
+      # git add flake.lock
-      git push
+      # git commit -m "update website"
-      deploy .#helix
+      # git push
+      deploy .#cube
       exit 0
     '';
     serviceConfig = {

hosts/profiles/ulogger-server/default.nix

@@ -1,61 +0,0 @@
-{ self, pkgs, config, lib, ... }:
-
-{
-  services.postgresql = {
-    enable = true;
-    ensureDatabases = [ "ulogger" ];
-    ensureUsers = [{
-      name = "ulogger";
-      ensureDBOwnership = true;
-    }];
-  };
-
-  services.ulogger = {
-    enable = true;
-    hostName = "tracks.mossnet.lan";
-    user = "ulogger";
-    conf = ''
-      <?php
-      /* μlogger
-       *
-       * Copyright(C) 2017 Bartek Fabiszewski (www.fabiszewski.net)
-       *
-       * This is free software; you can redistribute it and/or modify it under
-       * the terms of the GNU General Public License as published by
-       * the Free Software Foundation; either version 3 of the License, or
-       * (at your option) any later version.
-       *
-       * This program is distributed in the hope that it will be useful, but
-       * WITHOUT ANY WARRANTY; without even the implied warranty of
-       * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-       * General Public License for more details.
-       *
-       * You should have received a copy of the GNU General Public License
-       * along with this program; if not, see <http://www.gnu.org/licenses/>.
-       */
-
-      // This is default configuration file.
-      // Copy it to config.php and customize
-
-      // Database config
-
-      // PDO data source name, eg.:
-      // mysql:host=localhost;port=3307;dbname=ulogger;charset=utf8
-      // mysql:unix_socket=/path/to/mysql.sock;dbname=ulogger;charset=utf8
-      // pgsql:host=localhost;port=5432;dbname=ulogger
-      // sqlite:/path/to/ulogger.db
-      $dbdsn = "pgsql:host=/run/postgresql/;port=5432;dbname=ulogger";
-
-      // Database user name
-      $dbuser = "ulogger";
-
-      // Database user password
-      $dbpass = "";
-
-      // Optional table names prefix, eg. "ulogger_"
-      $dbprefix = "";
-
-      ?>
-    '';
-  };
-}

hosts/profiles/wallabag/default.nix

@@ -1,37 +1,94 @@
 { self, pkgs, config, lib, ... }:
 
 {
-  age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
+  # age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
-  age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
+  # age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
-  age.secrets.wallabag-password.owner = "wallabag";
+  # age.secrets.wallabag-password.owner = "wallabag";
-  age.secrets.wallabag-secret.owner = "wallabag";
+  # age.secrets.wallabag-secret.owner = "wallabag";
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_15;
+    package = pkgs.postgresql_11;
 
     # Ensure the database, user, and permissions always exist
     ensureDatabases = [ "wallabag" ];
     ensureUsers = [
       {
         name = "wallabag";
-        # ensureDBOwnership = true;
+        ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
       }
     ];
-    authentication = ''
-      local wallabag all peer
-    '';
   };
 
   services.wallabag = {
     enable = true;
-    domain = "read.mossnet.lan";
+    hostName = "read.mossnet.lan";
-    virtualHost.enable = true;
+    package = pkgs.wallabag;
-    package = pkgs.my-wallabag;
+    conf = ''
-    # Systemd now defaults to /var/lib?
+      # This file is a "template" of what your parameters.yml file should look like
-    # dataDir = "/var/lib/wallabag";
+      parameters:
-    parameters = {
+          database_driver: pdo_pgsql
-      "env(SECRET_FILE)" = config.age.secrets.wallabag-secret.path;
+          database_host: localhost
-      secret = "%env(file:resolve:SECRET_FILE)%";
+          database_port: ~
-    };
+          database_name: wallabag
+          database_user: wallabag
+          database_password: wallabag 
+          # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
+          database_path: ~
+          database_table_prefix: wallabag_
+          database_socket: null
+          # with PostgreSQL and SQLite, you must set "utf8"
+          database_charset: utf8
+
+          domain_name: http://read.mossnet.lan
+          server_name: "mossnet wallabag instance"
+
+          mailer_transport:  smtp
+          mailer_user:       ~
+          mailer_password:   ~
+          mailer_host:       127.0.0.1
+          mailer_port:       false
+          mailer_encryption: ~
+          mailer_auth_mode:  ~
+
+          locale: en
+
+          # A secret key that's used to generate certain security-related tokens
+          secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
+
+          # two factor stuff
+          twofactor_auth: true
+          twofactor_sender: no-reply@wallabag.org
+
+          # fosuser stuff
+          fosuser_registration: true
+          fosuser_confirmation: true
+
+          # how long the access token should live in seconds for the API
+          fos_oauth_server_access_token_lifetime: 3600
+          # how long the refresh token should life in seconds for the API
+          fos_oauth_server_refresh_token_lifetime: 1209600
+
+          from_email: ops@sealight.xyz
+
+          rss_limit: 50
+
+          # RabbitMQ processing
+          rabbitmq_host: localhost
+          rabbitmq_port: 5672
+          rabbitmq_user: guest
+          rabbitmq_password: guest
+          rabbitmq_prefetch_count: 10
+
+          # Redis processing
+          redis_scheme: tcp
+          redis_host: localhost
+          redis_port: 6379
+          redis_path: null
+          redis_password: null
+
+          # sentry logging
+          sentry_dsn: ~
+    '';
   };
+  # networking.firewall.allowedTCPPorts = [ 8080 ];
 } 

hosts/profiles/wireguard-server/default.nix

@@ -18,7 +18,7 @@
     peers = [
       {
         # box
-        publicKey = "OnvVM1UaX0nmdohzSDyl90VKwd4VUpJZ+4oBpkkytwU=";
+        publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
         allowedIPs = [ "10.0.69.4/32" ];
       }
       {
@@ -28,7 +28,7 @@
       }
       {
         # curve
-        publicKey = "zkC7IzXX16i2ixqnRrPlUq2fD2/4noe84FlZBFaDBEE=";
+        publicKey = "kzw+51vVYkitGmSMJPAj1jdhzmxhvmSrrIQ4Ar8wzlI=";
         allowedIPs = [ "10.0.69.2/32" ];
       }
       {
@@ -36,16 +36,6 @@
         publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
         allowedIPs = [ "10.0.69.5/32" ];
       }
-      {
-        # hyperplane
-        publicKey = "v+EUuM60yZLvBmdCG9GxfFAtSjS1VvbUWcyNb8emjDg=";
-        allowedIPs = [ "10.0.69.6/32" ];
-      }
-      {
-        # work
-        publicKey = "/gv66s8DfppCCjaEN/jlc8z95IhEWPgDumykqKEl0QU=";
-        allowedIPs = [ "10.0.69.7/32" ];
-      }
     ];
   };
 }

hosts/profiles/wireguard/default.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, lib, ... }:
+
+{
+  # services.tailscale.enable = true;
+  networking.firewall.allowedUDPPorts = [ 60990 ];
+  age.secrets.curve-wg.file = "/etc/nixos/secrets/curve-wg.age";
+  age.secrets.curve-wg.owner = "anish";
+
+  networking.wireguard.interfaces = {
+    # TODO need some kind of module here to configure curve & box from hosts or something 
+    wg0 = {
+      ips = [ "10.0.69.2/24" ];
+      listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+
+      privateKeyFile = "/run/agenix/curve-wg";
+      peers = [
+        # For a client configuration, one peer entry for the server will suffice.
+        {
+          publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
+          allowedIPs = [ "10.0.69.0/24" ];
+          # Set this to the server IP and port.
+          endpoint = "69.61.38.225:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+
+          # Send keepalives every 25 seconds. Important to keep NAT tables alive.
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}

hosts/profiles/woodpecker-agent/default.nix

@@ -1,60 +1,61 @@
-{ pkgs, config, self, ... }:
 {
+
   users.users.woodpecker-runner = {
     isSystemUser = true;
     group = "woodpecker-runner";
-    home = "/var/lib/woodpecker";
-    createHome = true;
-    extraGroups = [ "docker" ];
   };
   users.groups.woodpecker-runner = { };
   # Allow the exec runner to write to build with nix
-  nix.settings.allowed-users = [ "woodpecker-runner" ];
+  nix.allowedUsers = [ "woodpecker-runner" ];
-  virtualisation.docker.enable = true;
 
-  age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner";
+  systemd.services.woodpecker-runner-exec = {
-  age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";
-
-  systemd.services.woodpecker-agent = {
     enable = true;
+    wantedBy = [ "multi-user.target" ];
     ### MANUALLY RESTART SERVICE IF CHANGED
     restartIfChanged = true;
-    # confinement.enable = true;
+    confinement.enable = true;
-    # confinement.packages = [
+    confinement.packages = [
-    #   pkgs.git
+      pkgs.git
-    #   pkgs.gnutar
+      pkgs.gnutar
-    #   pkgs.bash
+      pkgs.bash
-    #   pkgs.nixFlakes
+      pkgs.nixFlakes
-    #   pkgs.gzip
+      pkgs.gzip
-    # ];
+    ];
-    # path = [
+    path = [
-    #   pkgs.git
+      pkgs.git
-    #   pkgs.gnutar
+      pkgs.gnutar
-    #   pkgs.bash
+      pkgs.bash
-    #   pkgs.nixFlakes
+      pkgs.nixFlakes
-    #   pkgs.gzip
+      pkgs.gzip
-    # ];
+    ];
     serviceConfig = {
-      Type = "simple";
       Environment = [
-        "WOODPECKER_RUNNER_CAPACITY=6"
+        "WOODPECKER_RUNNER_CAPACITY=2"
         "WOODPECKER_RUNNER_NAME=woodpecker-agent"
-        "WOODPECKER_SERVER=ci.sealight.xyz:9000"
-        "WOODPECKER_HOSTNAME=mossnet"
-        "WOODPECKER_BACKEND=docker"
         "NIX_REMOTE=daemon"
         "PAGER=cat"
-        # "WOODPECKER_PROTO=https"
-        # "WOODPECKER_LOG_LEVEL=debug"
       ];
-      WorkingDirectory = "/var/lib/woodpecker";
+      BindPaths = [
-      # Runtime directory and mode
+        "/nix/var/nix/daemon-socket/socket"
-      RuntimeDirectory = "woodpecker";
+        "/run/nscd/socket"
-      RuntimeDirectoryMode = "0755";
+        # "/var/lib/woodpecker"
-      # Access write directories
+      ];
-      ReadWritePaths = [ "/var/lib/woodpecker" ];
+      BindReadOnlyPaths = [
+        "/etc/passwd:/etc/passwd"
+        "/etc/group:/etc/group"
+        "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
+        "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
+        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
+        "${builtins.toFile "ssh_config" ''
+          Host git.sealight.xyz
+          ForwardAgent yes
+        ''}:/etc/ssh/ssh_config"
+        "/etc/machine-id"
+        "/etc/resolv.conf"
+        "/nix/"
+      ];
       EnvironmentFile = [
-        /run/agenix/woodpecker-agent-secret
+        # /run/agenix/woodpecker-agent-secret
       ];
       ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
       User = "woodpecker-runner";

hosts/profiles/woodpecker-server/default.nix

@@ -1,16 +1,9 @@
-{ self, pkgs, config, ... }:
 {
-  age.secrets.woodpecker-server-secrets.owner = "woodpecker";
-  age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age";
-
-  age.secrets.woodpecker-agent-secret.owner = "woodpecker";
-  age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";
   users.users.woodpecker = {
-    group = "woodpecker";
+    group = woodpecker;
     description = "woodpecker user";
     home = "/var/lib/woodpecker";
     createHome = true;
-    isNormalUser = true;
   };
 
   users.groups.woodpecker = { };
@@ -18,43 +11,41 @@
   services.nginx.virtualHosts."ci.sealight.xyz" = {
     enableACME = true;
     forceSSL = true;
-    locations."/".proxyPass = "http://localhost:38125";
+    locations."/".proxyPass = "http://localhost:3030/";
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 443 22 ];
-
   services.postgresql = {
     ensureDatabases = [ "woodpecker" ];
     ensureUsers = [{
       name = "woodpecker";
-      ensureDBOwnership = true;
+      ensurePermissions = {
+        "DATABASE woodpecker" = "ALL PRIVILEGES";
+      };
     }];
   };
 
   systemd.services.woodpecker-server = {
-    after = [ "postgresql.service" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
-      WorkingDirectory = "/var/lib/woodpecker";
       EnvironmentFile = [
-        /run/agenix/woodpecker-server-secrets
+        # GITEA_CLIENT_SECRET etc
-        /run/agenix/woodpecker-agent-secret
+        # /run/agenix/woodpecker
       ];
       Environment = [
-        "WOODPECKER_OPEN=false"
+        "WOODPECKER_OPEN=true"
-        "WOODPECKER_HOST=https://ci.sealight.xyz"
+        "WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}"
-        "WOODPECKER_SERVER_ADDR=:38125"
 
         "WOODPECKER_GITEA=true"
         "WOODPECKER_GITEA_URL=https://git.sealight.xyz"
 
         "WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
         "WOODPECKER_DATABASE_DRIVER=postgres"
-        "WOODPECKER_ADMIN=aynish"
+        "WOODPECKER_SERVER_PORT=:3030"
+        "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username
       ];
       ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
-      User = "woodpecker";
+      User = woodpecker;
-      Group = "woodpecker";
+      Group = woodpecker;
     };
   };
 

hosts/users/anish/default.nix

@@ -1,23 +1,17 @@
 { pkgs, ... }:
 
 {
-  programs.zsh.enable = true;
   users.users.anish = {
     description = "Personal user for Anish";
-    hashedPassword =
+    hashedPassword = "$y$j9T$y3DPt/dWaPE.gRazQqw1w0$1RMH5sl/Nu8kW3ZMywYCPRniHD/jF5qRh0VKrdJ.bV2";
-      "$y$j9T$y3DPt/dWaPE.gRazQqw1w0$1RMH5sl/Nu8kW3ZMywYCPRniHD/jF5qRh0VKrdJ.bV2";
     shell = pkgs.zsh;
     isNormalUser = true;
-    extraGroups = [ "wheel" "audio" "networkmanager" "video" ];
+    extraGroups = [ "wheel" "audio" "networkmanager" ];
     openssh.authorizedKeys.keys = [
       # Curve
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve"
-      # Box
+      # Line
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDtU2GMYjXj6RGO1+mwM4TDGOo0qrKLTL4Di8+QgDX0p5vUEsnE1PS9wnuqCmSu75U8g0XIAMtvtdYyGk1N+Bx01erAZpT8DLYtIXFCyaiN28PVu5T1D0T+TQ7xgIH1qenXZR2DOQdf6kpvKEfm7+7bWhCo0N/KFMpmReubyzHDQcq/1qQasxTL+YALQFOjwKqsOTBXbHwZ103AEAcQX4ftBFEOfVli4/1aKIK4dNSZYB7J9Htq707YnsEqo9RLAMh0aOTTYgTx9AoSUDeqGuh/AGkcB7NcS7EEtI6d5YUGylwZh/gF6hqE0jl8kn2m5jMKXL3CRohZvjifue8x/GIjpu5WRabUuhBEbrfTQQaC7taHnt5rvYCGzKZx09TexUzhuz2CL480DRoxSG+P+lCNm1dIg/EZrnGEzXCSr36PlOqS5t5gm8tPkzCmZf2wU15A3ZIYUPmnYLqsn4WmIV7rKmdqt2ctWELUXow3PPiZXBucP9P3xpsYEfF1SB2SGNc= u0_a139@localhost"
-      # Nix-on-droid line
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOiXBPVvZAp1fY0a0Tupxj0Ml6MoA51lvqt/jAQq249 nix-on-droid@localhost"
-      # Work
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/vvh0i6+uAN0GWlK6ZfyTlc/AW54xe2CroUDsDSoGnFKeIUiSsWexobODlVakNhqwCKfsvUh6g+RdA8ZVcamATcYqxysP4X5fRksmAzRm5281O7ZBDHMB2BdcfHSTgiz7JvMRIQYWDlU8Ck6IL4wlN0b2GMUj9t/GeG37us8280rxpRNoIY7M27AJEZ7XNQhctBIVujxctVBgIMYmZiTwziU7ywJv4rNT5OAWvjRXSo1rkxdvx3VESv4y/mp8m7dEupZpIjIFsLs52+UG5LtadulUqtTWg05sCw8LEcmRhflgZSAvjw60RrKFCuWxc8+/Pmaw+zExeBMenqi0NzuTc3S3k2wCKVIZDh/0tlXzIwZ6WRqxDevUtEKfvbEFMXd8akhTfYs0dyszcFRevBxOBPbcKku+FK/HkdPLmEANvxYty3cv+Eipkz3c8JPJPvXNTXrjepXMm0LUKodO3c15hGogCOxUO38kykkyYnn+MxxHparoMfEr2+oHNpQoS5wA1G43ppqjVoRDgnhleu6ixwRkLZzphY3cnOd5jL9Ie5xIGbFWH1qSlQRdHBkHjuf85z7+QK8nFYAhmG1K3Vt3GNtF8LN1tYQkfwBJ/vsroMNzGPoq4PjVbqb80Eq+96cP89XKfU2/xw1g+p2lJDm/zC1WCjXVzf8NRwC7gqPavQ== anishlakhwara@anishs-mbp.lan"
     ];
   };
 }

install-yubikey.sh

@@ -1,5 +1,3 @@
-#!/usr/bin/env bash
-
 rbtohex() {
     ( od -An -vtx1 | tr -d ' \n' )
 }
@@ -19,7 +17,7 @@ cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(n
 
 # Yubikey Setup
 SLOT=2
-# ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
+ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
 SALT_LENGTH=16
 salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
 k_user=PASSWORDCHANGEMEPLAEASES 
@@ -66,7 +64,7 @@ mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT"
 #touch /mnt-root/nix-store.squashfs
 
 mount "/dev/partitions/$FSROOT" /mnt
-cd /mnt || exit
+cd /mnt
 btrfs subvolume create root
 btrfs subvolume create home
 cd
@@ -147,7 +145,7 @@ cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
   sound.enable = true;
   hardware.pulseaudio.enable = true;
 
-  services.libinput.enable = true;
+  services.xserver.libinput.enable = true;
 
   # Hmmm maybe somewhere else? 
   users.users.anish = {
@@ -169,6 +167,6 @@ cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
 
 endmsg
 
-cd /mnt || exit
+cd /mnt
 nixos-install --root /mnt
 passwd

modules/nixos/backup.nix

@@ -43,7 +43,7 @@ in
           mode = "repokey-blake2";
           passCommand = "cat /run/agenix/borg-password";
         };
-        environment = { BORG_RSH = "ssh -i /run/agenix/borg-key"; };
+        environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY
         compression = "auto,lzma";
         startAt = "daily";
         extraArgs = "--remote-path=borg1";

modules/nixos/default.nix

@@ -8,7 +8,4 @@
   hesienbridge = import ./heisenbridge.nix;
   wireguard = import ./wireguard.nix;
   backup = import ./backup.nix;
-  ulogger-server = import ./ulogger.nix;
-  gpodder2go = import ./gpodder2go.nix;
-  # microbin = import ./microbin.nix; # includide in 23.11
 }