updating website

it generates backlinks and indexs in a more reliable way

.direnv/bin/nix-direnv-reload

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+dir="$(realpath $(dirname ${BASH_SOURCE[0]})/../..)"
+_nix_direnv_force_reload=1 direnv exec "$dir" true
+direnv reload
+# direnv reload updates the mtime of .envrc. Also update the timestamp of the
+# profile_rc file to keep track that we actually are up to date.
+touch $dir/.direnv/{nix,flake}-profile-*.rc
+

.envrc

@@ -0,0 +1,2 @@
+export HE_PASSWORD=SuperDuper
+use flake

.gitignore

@@ -0,0 +1 @@
+.direnv/

dns/dnsconfig.js

@@ -4,6 +4,27 @@ var REG_NONE = NewRegistrar('none');    // No registrar.
 var DNS_BIND = NewDnsProvider('bind');  // ISC BIND.
 var DNS_HEDNS = NewDnsProvider('hedns');  
 
+D("lakhwara.com", REG_NONE,
+	DnsProvider(DNS_HEDNS),
+	DefaultTTL(300),
+	//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022041702, 86400, 7200, 3600000, 86400, TTL(172800)),
+	A('anish', '69.61.2.203'),
+	A('@', '69.61.2.203'),
+	//A('coaching', '103.16.130.98'),
+	TXT('anish', 'datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5'),
+	CNAME('fm1._domainkey', 'fm1.lakhwara.com.dkim.fmhosted.com.'),
+	CNAME('fm2._domainkey', 'fm2.lakhwara.com.dkim.fmhosted.com.'),
+	CNAME('fm3._domainkey', 'fm3.lakhwara.com.dkim.fmhosted.com.'),
+	MX('@', 10, 'in1-smtp.messagingengine.com.'),
+	MX('@', 20, 'in2-smtp.messagingengine.com.'),
+	//NAMESERVER('ns1.he.net.'),
+	//NAMESERVER('ns2.he.net.'),
+	//NAMESERVER('ns3.he.net.'),
+	//NAMESERVER('ns4.he.net.'),
+	//NAMESERVER('ns5.he.net.'),
+	TXT('@', 'v=spf1 include:spf.messagingengine.com ?all')
+)
+
 D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
 	DefaultTTL(86400),
 	//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)),
@@ -13,9 +34,12 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
 	//NAMESERVER('ns4.he.net.'),
 	//NAMESERVER('ns5.he.net.'),
 	// capsul: helix
-	A('bridge', '69.61.38.225', TTL(300)),
+	A('bridge', '69.61.2.203', TTL(300)),
-	A('rss', '69.61.38.225', TTL(300)),
+	A('rss', '69.61.2.203', TTL(300)),
-	A('git', '69.61.38.225', TTL(300)),
+	A('git', '69.61.2.203', TTL(300)),
+	A('bin', '69.61.2.203', TTL(300)),
+	A('ci', '69.61.2.203', TTL(300)),
+	A('write', '69.61.2.203', TTL(300)),
 	// vultr -> nulled: lituus
 	A('@', '45.77.48.108', TTL(300)),
 	A('jitsi', '45.77.48.108', TTL(300)),

dns/zones/lakhwara.com.zone

@@ -0,0 +1,22 @@
+; lakhwara.com Dumped Sun May 28 22:30:02 2023
+;
+lakhwara.com.	172800	IN	SOA	ns1.he.net. hostmaster.he.net. (
+					2022041702	;serial
+					86400		;refresh
+					7200		;retry
+					3600000		;expire
+					86400	)	;minimum
+anish.lakhwara.com.	86400	IN	A	103.16.130.98
+anish.lakhwara.com.	86400	IN	TXT	datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5
+fm1._domainkey.lakhwara.com.	86400	IN	CNAME	fm1.lakhwara.com.dkim.fmhosted.com.
+fm2._domainkey.lakhwara.com.	86400	IN	CNAME	fm2.lakhwara.com.dkim.fmhosted.com.
+fm3._domainkey.lakhwara.com.	86400	IN	CNAME	fm3.lakhwara.com.dkim.fmhosted.com.
+lakhwara.com.	86400	IN	A	103.16.130.98
+lakhwara.com.	86400	IN	MX	10 in1-smtp.messagingengine.com.
+lakhwara.com.	86400	IN	MX	20 in2-smtp.messagingengine.com.
+lakhwara.com.	86400	IN	NS	ns1.he.net.
+lakhwara.com.	86400	IN	NS	ns2.he.net.
+lakhwara.com.	86400	IN	NS	ns3.he.net.
+lakhwara.com.	86400	IN	NS	ns4.he.net.
+lakhwara.com.	86400	IN	NS	ns5.he.net.
+lakhwara.com.	86400	IN	TXT	"v=spf1 include:spf.messagingengine.com ?all"

flake.lock

@@ -2,16 +2,19 @@
   "nodes": {
     "agenix": {
       "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1665870395,
+        "lastModified": 1723293904,
-        "narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
+        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "a630400067c6d03c9b3e0455347dc8559db14288",
+        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
         "type": "github"
       },
       "original": {
@@ -31,11 +34,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1663665682,
+        "lastModified": 1682226636,
-        "narHash": "sha256-YB+vmQB3N9RyeshHAO4GjIFebA7NPY2jlkdvGGZtM64=",
+        "narHash": "sha256-fmETHfUtQ5zOVr/4MT5wE7eNALCSQCnEUYZYmV3UEwg=",
         "ref": "main",
-        "rev": "36bda6965ab2e1a206f8c2b7a74f3b022c873662",
+        "rev": "095d14ff2469c8f3de7cbf45d229c0f46a733aae",
-        "revCount": 65,
+        "revCount": 77,
         "type": "git",
         "url": "ssh://gitea@git.sealight.xyz/aynish/basant"
       },
@@ -45,6 +48,28 @@
         "url": "ssh://gitea@git.sealight.xyz/aynish/basant"
       }
     },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -54,11 +79,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1668797197,
+        "lastModified": 1718194053,
-        "narHash": "sha256-0w6iD3GSSQbIeSFVDzAAQZB+hDq670ZTms3d9XI+BtM=",
+        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "2a3c5f70eee04a465aa534d8bd4fcc9bb3c4a8ce",
+        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
         "type": "github"
       },
       "original": {
@@ -67,55 +92,65 @@
         "type": "github"
       }
     },
+    "devshell": {
+      "locked": {
+        "lastModified": 1642188268,
+        "narHash": "sha256-DNz4xScpXIn7rSDohdayBpPR9H9OWCMDOgTYegX081k=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "696acc29668b644df1740b69e1601119bf6da83b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
     "dirt-samples-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1588278411,
+        "lastModified": 1698439458,
-        "narHash": "sha256-h8vQxRym6QzNLOTZU7A43VCHuG0H77l+BFwXnC0L1CE=",
+        "narHash": "sha256-Mp8qBpsOvW9Zguv95Kv7EU6S3ICaF2aO02Wz6xGURtE=",
         "owner": "tidalcycles",
         "repo": "dirt-samples",
-        "rev": "66d432418c9a7d82cf049d9246adfa62f46df2a6",
+        "rev": "9a6dff8f9ec3cd55b287290cf04e01afa6b8f532",
         "type": "github"
       },
       "original": {
         "owner": "tidalcycles",
-        "ref": "master",
         "repo": "dirt-samples",
         "type": "github"
       }
     },
-    "eww": {
+    "disko": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "rust-overlay": [
-          "rust-overlay"
         ]
       },
       "locked": {
-        "lastModified": 1669643151,
+        "lastModified": 1724031427,
-        "narHash": "sha256-39/l57QusriyNr426kXNqtub0ciZna+t20VKPYUAgsM=",
+        "narHash": "sha256-o1HdAf+7IGv9M13R3c+zc/sJ0QgeEnhsvHBcodI4UpM=",
-        "owner": "elkowar",
+        "owner": "nix-community",
-        "repo": "eww",
+        "repo": "disko",
-        "rev": "ec4c2d1a4f12e9c3664e9f53ad99007b4a10a16a",
+        "rev": "4e719b38fa7c85f4f65d0308ca7084c91e7bdd6d",
         "type": "github"
       },
       "original": {
-        "owner": "elkowar",
+        "owner": "nix-community",
-        "repo": "eww",
+        "repo": "disko",
         "type": "github"
       }
     },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1648199409,
+        "lastModified": 1696426674,
-        "narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -127,11 +162,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1650374568,
+        "lastModified": 1641205782,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "narHash": "sha256-4jY7RCWUoZ9cKD8co0/4tFARpWB+57+r1bLLvXNJliY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "rev": "b7547d3eed6f32d06102ead8991ec52ab0a4f1a7",
         "type": "github"
       },
       "original": {
@@ -157,26 +192,11 @@
     },
     "flake-utils_2": {
       "locked": {
-        "lastModified": 1652372896,
+        "lastModified": 1667395993,
-        "narHash": "sha256-lURGussfF3mGrFPQT3zgW7+RC0pBhbHzco0C7I+ilow=",
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "0d347c56f6f41de822a4f4c7ff5072f3382db121",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_3": {
-      "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
         "type": "github"
       },
       "original": {
@@ -188,17 +208,16 @@
     "grasp": {
       "inputs": {
         "flake-utils": "flake-utils_2",
-        "grasp": "grasp_2",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1652615971,
+        "lastModified": 1682644301,
-        "narHash": "sha256-e8fvTQCR/At2jgenuY71WXN13XawYRiMpKiHSGgGSkY=",
+        "narHash": "sha256-gMBFZLf41s3+cnhxgZVRvj2JSAFYv4jn2xBKwEESthE=",
         "ref": "main",
-        "rev": "ef605857248ec1b60cece250f98d2964164d48db",
+        "rev": "a2d85675b930ffc26f6891b2e14491795907be4e",
-        "revCount": 19,
+        "revCount": 137,
         "type": "git",
         "url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
       },
@@ -208,29 +227,13 @@
         "url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
       }
     },
-    "grasp_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1586706168,
-        "narHash": "sha256-xLkxE24xtTghQpAfAqAsOvsGpz0coACXjNT8bHZhcxM=",
-        "owner": "karlicoss",
-        "repo": "grasp",
-        "rev": "4bc8f011227d1baa18b4e98543561534065490d8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "karlicoss",
-        "repo": "grasp",
-        "type": "github"
-      }
-    },
     "hardware": {
       "locked": {
-        "lastModified": 1670174919,
+        "lastModified": 1723310128,
-        "narHash": "sha256-XdQr3BUnrvVLRFunLWrZORhwYHDG0+9jUUe0Jv1pths=",
+        "narHash": "sha256-IiH8jG6PpR4h9TxSGMYh+2/gQiJW9MwehFvheSb5rPc=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "9d87bc030a0bf3f00e953dbf095a7d8e852dab6b",
+        "rev": "c54cf53e022b0b3c1d3b8207aa0f9b194c24f0cf",
         "type": "github"
       },
       "original": {
@@ -242,16 +245,16 @@
     "home-manager": {
       "inputs": {
         "nixpkgs": [
+          "agenix",
           "nixpkgs"
-        ],
+        ]
-        "utils": "utils_2"
       },
       "locked": {
-        "lastModified": 1670280307,
+        "lastModified": 1703113217,
-        "narHash": "sha256-3x+0whP1nCz5adQMIsBA3L9fI/ABOpRUJdbw0AmxBnU=",
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2af0d07678fc15612345e0dd55337550dcf6465f",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
         "type": "github"
       },
       "original": {
@@ -260,44 +263,118 @@
         "type": "github"
       }
     },
-    "nixpkgs": {
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1670193339,
+        "lastModified": 1720042825,
-        "narHash": "sha256-oHTAhX4p6+uxcabq0rKL4EyKWPbDLGKec88ocPIU/2Y=",
+        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
-        "owner": "nixos",
+        "owner": "nix-community",
-        "repo": "nixpkgs",
+        "repo": "home-manager",
-        "rev": "e169cf5b3b1e6cc4a25ff15087c2621605f83409",
+        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "nix-community",
-        "ref": "nixos-22.11",
+        "ref": "release-24.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nix-matrix-appservices": {
+      "inputs": {
+        "devshell": "devshell",
+        "flake-compat": "flake-compat_2",
+        "nixlib": "nixlib",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1683490239,
+        "narHash": "sha256-QKzpvl2XrqbobWq/I/smDa9hEniwctjJybXPVILHP0w=",
+        "owner": "coffeetables",
+        "repo": "nix-matrix-appservices",
+        "rev": "e795d2fbc61da45d49802bb3e8f8d0c70ddc1e68",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "coffeetables",
+        "repo": "nix-matrix-appservices",
+        "type": "gitlab"
+      }
+    },
+    "nixlib": {
+      "locked": {
+        "lastModified": 1643502816,
+        "narHash": "sha256-Wrbt6Gs+hjXD3HUICPBJHKnHEUqiyx8rzHCgvqC1Bok=",
+        "owner": "divnix",
+        "repo": "nixpkgs.lib",
+        "rev": "ebed7ec5bcb5d01e298535989c6c321df18b631a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1723310128,
+        "narHash": "sha256-IiH8jG6PpR4h9TxSGMYh+2/gQiJW9MwehFvheSb5rPc=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "c54cf53e022b0b3c1d3b8207aa0f9b194c24f0cf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1662099760,
+        "narHash": "sha256-MdZLCTJPeHi/9fg6R9fiunyDwP3XHJqDd51zWWz9px0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "67e45078141102f45eff1589a831aeaa3182b41e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-22.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1662446902,
+        "lastModified": 1723938990,
-        "narHash": "sha256-Dmsd3jSG2ldZUlhFaIwunqgMf14EEK7ylXpw+OPDLxE=",
+        "narHash": "sha256-9tUadhnZQbWIiYVXH8ncfGXGvkNq3Hag4RCBEMUk7MI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3bfaf06b12253ddaafe64a67f4ed39b547d41667",
+        "rev": "c42fcfbdfeae23e68fc520f9182dde9f38ad1890",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nur": {
       "locked": {
-        "lastModified": 1670315682,
+        "lastModified": 1724040334,
-        "narHash": "sha256-/v0RgZZIjvsFuJbJLUlzRbzSlYFXq3olgJTuJBNtcoY=",
+        "narHash": "sha256-Ia4gRRmhFn4oJ4SJKJPDNPomsRRFWU+bqCK7yuiLW4E=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "af814db16c89385c65e758608296440555f61ccc",
+        "rev": "24471a48600e18669d13d24c9640b9859357d2cf",
         "type": "github"
       },
       "original": {
@@ -308,15 +385,16 @@
     },
     "poonam": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": [
-        "vimwiki-cli": "vimwiki-cli"
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1671357603,
+        "lastModified": 1730098805,
-        "narHash": "sha256-LIathTJK9ElWdjlT+zI+CJFB5adORTM9kYeWqEbKwiU=",
+        "narHash": "sha256-LvLTqCX3BZ92srebbpMFMCOOBXJ1GZn/rbayiEcXScE=",
         "ref": "main",
-        "rev": "ea3d0f9a8146f1985dec0b0348a79e3a3038d9b7",
+        "rev": "ec87c69f50283d106d16338963baaa614580ce4a",
-        "revCount": 465,
+        "revCount": 1512,
         "type": "git",
         "url": "ssh://gitea@git.sealight.xyz/aynish/kitaab"
       },
@@ -331,31 +409,33 @@
         "agenix": "agenix",
         "basant": "basant",
         "deploy-rs": "deploy-rs",
-        "eww": "eww",
+        "disko": "disko",
         "grasp": "grasp",
         "hardware": "hardware",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs",
+        "nix-matrix-appservices": "nix-matrix-appservices",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs_2",
         "nur": "nur",
         "poonam": "poonam",
         "rust-overlay": "rust-overlay",
         "tidalcycles": "tidalcycles",
-        "unstable": "unstable"
+        "unstable": "unstable",
+        "vimwikicli": "vimwikicli"
       }
     },
     "rust-overlay": {
       "inputs": {
-        "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1670293639,
+        "lastModified": 1724034091,
-        "narHash": "sha256-RkPLwza77YkFgxKHGzfYAYVKiD9SeIvsOA7+ihiySwI=",
+        "narHash": "sha256-b1g7w0sw+MDAhUAeCoX1vlTghsqcDZkxr+k9OZmxPa8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "9767af967a0becaa3bb79eeda838dbf81295eb62",
+        "rev": "c7d36e0947826e0751a5214ffe82533fbc909bc0",
         "type": "github"
       },
       "original": {
@@ -367,33 +447,62 @@
     "superdirt-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1611740180,
+        "lastModified": 1697377840,
-        "narHash": "sha256-GtnqZeMFqFkVhgx2Exu0wY687cHa7mNnVCgjQd6fiIA=",
+        "narHash": "sha256-9qU9CHYAXbN1IE3xXDqGipuroifVaSVXj3c/cDfwM80=",
         "owner": "musikinformatik",
         "repo": "superdirt",
-        "rev": "7abb62e89649daa1232b9cbd6427241868abd30e",
+        "rev": "c7f32998572984705d340e7c1b9ed9ad998a39b6",
         "type": "github"
       },
       "original": {
         "owner": "musikinformatik",
-        "ref": "master",
         "repo": "superdirt",
         "type": "github"
       }
     },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tidal-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1654350756,
+        "lastModified": 1712519522,
-        "narHash": "sha256-tONM5SYYBca0orTLH1EUOilSC1FCluWrFt8AetUx+YQ=",
+        "narHash": "sha256-LbvxQmVxHElidCgvt+w0g1k+QQbNLebK46vtRCgsLeQ=",
         "owner": "tidalcycles",
         "repo": "tidal",
-        "rev": "fda9c1ecb3722698935245e5409ef8ccdfca16c8",
+        "rev": "88f09edf6bef2228d5f530dea872b08a9d803066",
         "type": "github"
       },
       "original": {
         "owner": "tidalcycles",
-        "ref": "main",
+        "ref": "v1.9.5",
         "repo": "tidal",
         "type": "github"
       }
@@ -406,16 +515,15 @@
         ],
         "superdirt-src": "superdirt-src",
         "tidal-src": "tidal-src",
-        "utils": "utils_3",
         "vim-tidal-src": "vim-tidal-src",
         "vowel-src": "vowel-src"
       },
       "locked": {
-        "lastModified": 1664760044,
+        "lastModified": 1723223284,
-        "narHash": "sha256-e5LGk/tDnphory1mYhADgPnVtShofY2w/3xY09jEE2A=",
+        "narHash": "sha256-NAT+g5nsaJZkpR0sCZjerd1xx233ZUdRH3ZWwZhzq/c=",
         "owner": "mitchmindtree",
         "repo": "tidalcycles.nix",
-        "rev": "3f3a820cd43709077d15a24fa6062de7d623a6bf",
+        "rev": "82f3e8e8d02eb9f0c9dfe9ab3773b825c6bc1982",
         "type": "github"
       },
       "original": {
@@ -426,11 +534,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1670152712,
+        "lastModified": 1723637854,
-        "narHash": "sha256-LJttwIvJqsZIj8u1LxVRv82vwUtkzVqQVi7Wb8gxPS4=",
+        "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "14ddeaebcbe9a25748221d1d7ecdf98e20e2325e",
+        "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
         "type": "github"
       },
       "original": {
@@ -441,42 +549,15 @@
       }
     },
     "utils": {
-      "locked": {
+      "inputs": {
-        "lastModified": 1648297722,
+        "systems": "systems_2"
-        "narHash": "sha256-W+qlPsiZd8F3XkzXOzAoR+mpFqzm3ekQkJNa+PIh1BQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "0f8662f1319ad6abf89b3380dd2722369fc51ade",
-        "type": "github"
       },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "utils_2": {
       "locked": {
-        "lastModified": 1667395993,
+        "lastModified": 1701680307,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "utils_3": {
-      "locked": {
-        "lastModified": 1653893745,
-        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
         "type": "github"
       },
       "original": {
@@ -488,24 +569,22 @@
     "vim-tidal-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1664252474,
+        "lastModified": 1685703852,
-        "narHash": "sha256-hleiK2Q7xYndpB+tIbyyXIM2sk4NunUh9DPgMqmf/Wc=",
+        "narHash": "sha256-8gyk17YLeKpLpz3LRtxiwbpsIbZka9bb63nK5/9IUoA=",
         "owner": "tidalcycles",
         "repo": "vim-tidal",
-        "rev": "b07f5c12986fb837e055d7fcf0acf3b7e248148f",
+        "rev": "e440fe5bdfe07f805e21e6872099685d38e8b761",
         "type": "github"
       },
       "original": {
         "owner": "tidalcycles",
-        "ref": "master",
         "repo": "vim-tidal",
         "type": "github"
       }
     },
-    "vimwiki-cli": {
+    "vimwikicli": {
       "inputs": {
         "nixpkgs": [
-          "poonam",
           "nixpkgs"
         ]
       },
@@ -536,7 +615,6 @@
       },
       "original": {
         "owner": "supercollider-quarks",
-        "ref": "master",
         "repo": "vowel",
         "type": "github"
       }

flake.nix

@@ -1,13 +1,17 @@
 {
-  description = "Your new nix config";
+  description = "Sealight NixOS Config";
 
   inputs = {
     # Nixpkgs
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-22.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
     unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+
+    # ngipkgs.url = "github:Chickensoupwithrice/ngipkgs?ref=aynish/atomic-server-module";
+    # ngipkgs-local.url = "path:/home/anish/usr/ngipkgs";
 
     # Home manager
-    home-manager.url = "github:nix-community/home-manager";
+    home-manager.url = "github:nix-community/home-manager/release-24.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
     hardware.url = "github:nixos/nixos-hardware";
 
@@ -16,25 +20,30 @@
     agenix.inputs.nixpkgs.follows = "nixpkgs";
     deploy-rs.url = "github:serokell/deploy-rs";
     deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    disko.url = "github:nix-community/disko";
+    disko.inputs.nixpkgs.follows = "nixpkgs";
 
-    # Packages
+    # My Packages
     poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
+    poonam.inputs.nixpkgs.follows = "nixpkgs";
     basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
+    vimwikicli.url =
+      "git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main";
     basant.inputs.nixpkgs.follows = "nixpkgs";
     basant.inputs.poonam.follows = "poonam";
+    vimwikicli.inputs.nixpkgs.follows = "nixpkgs";
     grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
     grasp.inputs.nixpkgs.follows = "nixpkgs";
+
+    # Matrix
+    nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
+
     # Others
     nur.url = "github:nix-community/NUR";
     rust-overlay = {
       url = "github:oxalica/rust-overlay";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    eww = {
-      url = "github:elkowar/eww";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.rust-overlay.follows = "rust-overlay";
-    };
     tidalcycles.url = "github:mitchmindtree/tidalcycles.nix";
     tidalcycles.inputs.nixpkgs.follows = "unstable";
     # TODO hundred rabbits software
@@ -46,21 +55,9 @@
     # muneem.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs =
+  outputs = { self, nixpkgs, unstable, nixos-hardware, home-manager, deploy-rs
-    { self
+    , agenix, disko, basant, grasp, nix-matrix-appservices, nur, tidalcycles
-    , nixpkgs
+    , rust-overlay, vimwikicli, ... }@inputs:
-    , unstable
-    , home-manager
-    , deploy-rs
-    , agenix
-    , basant
-    , grasp
-    , nur
-    , tidalcycles
-    , rust-overlay
-    , eww
-    , ...
-    }@inputs:
     let
       forAllSystems = nixpkgs.lib.genAttrs [
         "aarch64-linux"
@@ -74,52 +71,63 @@
         unstable = unstable.legacyPackages.${prev.system};
         deploy = deploy-rs.packages.${prev.system}.deploy-rs;
       };
+      vimwikiOverlay = final: prev: {
+        vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli;
+      };
 
-      nixpkgsFor = forAllSystems (system: import nixpkgs {
+      nixpkgsFor = forAllSystems (system:
-        inherit system;
+        import nixpkgs {
-        config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [
+          inherit system;
-          "ripcord"
+          config.allowUnfreePredicate = pkg:
-          "VCV-Rack"
+            builtins.elem (nixpkgs.lib.getName pkg) [
-          "SunVox"
+              "ripcord"
-          "renoise"
+              "vcv-rack"
-        ];
+              "SunVox"
-        # config.permittedInsecurePackages = [
+              "renoise"
-        #   "python3.10-django-3.1.14" # Needed for archivebox deployments on curve
+            ];
-        #   # Check when archive box updates it's dependeny
+          # config.permittedInsecurePackages = [
-        # ];
+          #   "python3.10-django-3.1.14" # Needed for archivebox deployments on curve
-        overlays = [
+          #   # Check when archive box updates it's dependeny
-          rust-overlay.overlays.default
+          # ];
-          tidalcycles.overlays.default
+          overlays = [
-          agenix.overlay
+            rust-overlay.overlays.default
-          nur.overlay
+            tidalcycles.overlays.default
-          unstableOverlay
+            agenix.overlays.default
-          self.overlays.additions
+            nur.overlay
-          self.overlays.modifications
+            nix-matrix-appservices.overlay
-        ];
+            unstableOverlay
-      });
+            vimwikiOverlay
+            self.overlays.additions
+            self.overlays.modifications
+          ];
+        });
 
       # for when space matters
-      litePkgsFor = forAllSystems (system: import nixpkgs {
+      litePkgsFor = forAllSystems (system:
-        inherit system;
+        import nixpkgs {
-        overlays = [
+          inherit system;
-          agenix.overlay
+          # config.permittedInsecurePackages = [
-          tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
+          #   "forgejo-1.19.4-0" # Needed for archivebox deployments on curve
-        ];
+          #   # Check when archive box updates it's dependeny
-      });
+          # ];
-    in
+          overlays = [
-    {
+            agenix.overlays.default
+            self.overlays.additions
+            self.overlays.modifications
+            tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
+          ];
+        });
+    in {
       # Your custom packages
       # Acessible through 'nix build', 'nix shell', etc
       packages = forAllSystems (system:
         let pkgs = nixpkgsFor.${system};
-        in import ./pkgs { pkgs = pkgs; }
+        in import ./pkgs { pkgs = pkgs; });
-      );
       # Devshell for bootstrapping
       # Acessible through 'nix develop' or 'nix-shell' (legacy)
       devShells = forAllSystems (system:
         let pkgs = nixpkgsFor.${system};
-        in import ./shell.nix { pkgs = pkgs; }
+        in import ./shell.nix { pkgs = pkgs; });
-      );
 
       # Your custom packages and modifications, exported as overlays
       overlays = import ./overlays;
@@ -141,8 +149,12 @@
             agenix.nixosModules.age
             self.nixosModules.backup
             self.nixosModules.wireguard
+            self.nixosModules.wallabag
+            nixos-hardware.nixosModules.lenovo-thinkpad-x270
             home-manager.nixosModules.home-manager
             {
+              nix.registry.nixpkgs.flake = nixpkgs;
+              nix.registry.unstable.flake = unstable;
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
               home-manager.users.anish = import ./home/gui;
@@ -153,17 +165,18 @@
         helix = nixpkgs.lib.nixosSystem rec {
           specialArgs = { inherit inputs self; };
           system = "x86_64-linux";
-          pkgs = nixpkgsFor.${system};
+          pkgs = litePkgsFor.${system};
           modules = [
             ./hosts/helix
             agenix.nixosModules.age
             self.nixosModules.backup
             self.nixosModules.wireguard
-            home-manager.nixosModules.home-manager
+            basant.nixosModule
+            # self.nixosModules.microbin
+            disko.nixosModules.disko
             {
-              home-manager.useGlobalPkgs = true;
+              nixpkgs.flake.setNixPath = false;
-              home-manager.useUserPackages = true;
+              nixpkgs.flake.setFlakeRegistry = false;
-              home-manager.users.anish = import ./home/core;
             }
           ];
         };
@@ -177,6 +190,7 @@
             agenix.nixosModules.age
             self.nixosModules.backup
             self.nixosModules.hesienbridge
+            nix-matrix-appservices.nixosModule
             home-manager.nixosModules.home-manager
             {
               home-manager.useGlobalPkgs = true;
@@ -186,19 +200,6 @@
           ];
         };
 
-        cube = nixpkgs.lib.nixosSystem rec {
-          specialArgs = { inherit inputs self; };
-          system = "x86_64-linux";
-          pkgs = litePkgsFor.${system};
-          modules = [
-            ./hosts/cube
-            agenix.nixosModules.age
-            self.nixosModules.backup
-            self.nixosModules.wireguard
-            basant.nixosModule
-          ];
-        };
-
         box = nixpkgs.lib.nixosSystem rec {
           specialArgs = { inherit inputs self; };
           system = "x86_64-linux";
@@ -208,14 +209,17 @@
             agenix.nixosModules.age
             self.nixosModules.backup
             self.nixosModules.wireguard
-            self.nixosModules.wallabag
             self.nixosModules.gonic
+            self.nixosModules.gpodder2go
+            self.nixosModules.wallabag
+            self.nixosModules.ulogger-server
             grasp.nixosModule
             home-manager.nixosModules.home-manager
             {
+              nix.registry.nixpkgs.flake = nixpkgs;
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
-              home-manager.users.anish = import ./home/core;
+              home-manager.users.anish = import ./home/dev;
             }
           ];
         };
@@ -225,46 +229,47 @@
       # Available through 'home-manager --flake .#your-username@your-hostname'
       homeConfigurations = {
         "anish@work" = home-manager.lib.homeManagerConfiguration {
-          pkgs = nixpkgsFor."x86_64-linux"; # Home-manager requires 'pkgs' instance
+          pkgs =
+            nixpkgsFor."x86_64-linux"; # Home-manager requires 'pkgs' instance
           extraSpecialArgs = { inherit inputs; };
-          modules = [
+          modules = [ ./home/core.nix ./home/profiles/firefox ];
-            ./home/core.nix
-            ./home/profiles/firefox
-          ];
         };
       };
 
       deploy.nodes = {
         box = {
           hostname = "mossnet.lan";
+          autoRollback = false;
+          magicRollback = false;
+          remoteBuild = true;
           profiles.system = {
             user = "root";
-            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;
+            path = deploy-rs.lib.x86_64-linux.activate.nixos
+              self.nixosConfigurations.box;
           };
         };
         lituus = {
           hostname = "sealight.xyz";
+          # autoRollback = false;
           profiles.system = {
             user = "root";
-            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus;
+            path = deploy-rs.lib.x86_64-linux.activate.nixos
+              self.nixosConfigurations.lituus;
           };
         };
         helix = {
           hostname = "git.sealight.xyz";
+          autoRollback = false;
+          magicRollback = false;
           profiles.system = {
             user = "root";
-            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;
+            path = deploy-rs.lib.x86_64-linux.activate.nixos
-          };
+              self.nixosConfigurations.helix;
-        };
-        cube = {
-          hostname = "lakhwara.com";
-          profiles.system = {
-            user = "root";
-            path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.cube;
           };
         };
       };
 
-      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+      checks = builtins.mapAttrs
+        (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
     };
 }

home/core/default.nix

@@ -1,11 +1,9 @@
 { self, pkgs, ... }:
 {
   imports = [
-    ../profiles/nvim
     ../profiles/cli
     ../profiles/direnv
     ../profiles/git
-    ../profiles/task
   ];
   home.stateVersion = "22.05";
 }

home/dev/default.nix

@@ -0,0 +1,5 @@
+{ self, pkgs, ... }: {
+  imports =
+    [ ../profiles/cli ../profiles/nvim ../profiles/direnv ../profiles/git ];
+  home.stateVersion = "22.05";
+}

home/gui/default.nix

@@ -2,9 +2,13 @@
 {
   imports = [
     ../core
+    ../profiles/nvim
     ../profiles/firefox
     ../profiles/desktop
     ../profiles/email
     ../profiles/cal
+    ../profiles/sync/kitaab
+    ../profiles/ssh
+    ../profiles/task
   ];
 }

home/profiles/cli/bin/clear-vim-trash.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+working_directory=$(pwd)
+vim_directory="${working_directory//\//%}.vim"
+trash "$HOME/.local/share/nvim/sessions/${vim_directory}"

home/profiles/cli/dasht-queries.txt

@@ -0,0 +1,19 @@
+`dasht-docsets-intstall`
+
+Bash
+Clojure
+Docker
+Elixir
+HTML
+JavaScript
+Jinja
+Lua_5.4
+Nginx
+OpenGL_4
+PostgreSQL
+Processing
+Python_3
+React
+Rust
+TypeScript
+Vim

home/profiles/cli/default.nix

@@ -7,6 +7,7 @@
     dasht
     dosfstools
     #git
+    git-machete
     bottom
     gptfdisk
     starship
@@ -26,10 +27,12 @@
     iftop
     wget
     curl
-    exa
+    eza 
     bat
     fd
     ncdu
+    du-dust 
+    # dia-cli
     duf
     trash-cli
     nix-index
@@ -51,16 +54,19 @@
     gdb
     xxd
     taskwarrior
-    yt-dlp
     gnupg
     syncthing
     dijo
     #ssb-patchwork
     fontconfig
     pandoc
+    taskwarrior-tui
+    python3Packages.howdoi
+    vimwiki-cli
+
     (pkgs.writeScriptBin "jq-repl" ''
       #!/usr/bin/env bash
-      if [[ -z $1 ]] || [[ $1 == "-" ]] then 
+      if [[ -z $1 ]] || [[ $1 == "-" ]]; then 
         input=$(mktemp)
         trap "rm -f $input" EXIT
         cat /dev/stdin > $input
@@ -70,27 +76,64 @@
 
       echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
     '')
+    (pkgs.writeScriptBin "clear-vim-trash" (builtins.readFile ./bin/clear-vim-trash.sh))
+    (pkgs.writeScriptBin "flakify" ''
+      #!/usr/bin/env zsh
+      if [ ! -e flake.nix ]; then
+        nix flake new -t github:nix-community/nix-direnv .
+      elif [ ! -e .envrc ]; then
+        echo "use flake" > .envrc
+        direnv allow
+      fi
+      vim flake.nix
+    '')
+    (pkgs.writeScriptBin "mx" ''
+      #!/usr/bin/env bash
+      manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview="manix '{}'" | xargs manix
+    '')
+    (pkgs.writeScriptBin "monitor" ''
+      # hotplug
+      connect() {
+          # Turn it on if it was off
+          xrandr --output HDMI-2 --auto
+          xrandr --output HDMI-2 --same-as eDP-1
+      }
+
+      disconnect() {
+          xrandr --output HDMI-2 --off
+      }
+
+      xrandr | grep "HDMI-2 connected" &>>/dev/null && connect || disconnect
+    '')
+    (pkgs.writeScriptBin "disconnect-keyboard" ''
+      # keyboard on curve is busted
+      get_keyboard_id() {
+        xinput list | grep 'AT Translated Set' | cut -f2 | cut -d'=' -f2 | xinput float 
+      }
+
+      disconnect_keyboard() {
+        id=$(get_keyboard_id)
+        xinput float $id
+        unset id
+      }
+
+      attach_keyboard() {
+        id=$(get_keyboard_id)
+        xinput reattach $id 3
+        unset id
+      }
+
+      disconnect_keyboard
+    '')
   ];
 
   programs.zsh = {
     enable = true;
     enableCompletion = true;
-    enableAutosuggestions = true;
+    autosuggestion.enable = false;
 
     initExtra = ''
       bindkey -v
-      flakify() {
-        if [ ! -e flake.nix ]; then
-          nix flake new -t github:nix-community/nix-direnv .
-        elif [ ! -e .envrc ]; then
-          echo "use flake" > .envrc
-          direnv allow
-        fi
-        vim flake.nix
-      }
-      mx() {
-        manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview="manix '{}'" | xargs manix
-      }
       autopair-init
     '';
     sessionVariables = {
@@ -98,15 +141,6 @@
       TERMINFO_DIRS = "${pkgs.kitty.terminfo.outPath}/share/terminfo"; # Needed to run home-manager switch on non-nixOS
     };
     plugins = [
-      # {
-      #   name = "zsh-autocomplete";
-      #   src = pkgs.fetchFromGitHub {
-      #     owner = "marlonrichert";
-      #     repo = "zsh-autocomplete";
-      #     rev = "22.01.21";
-      #     sha256 = "+UziTYsjgpiumSulrLojuqHtDrgvuG91+XNiaMD7wIs=";
-      #   };
-      # }
       {
         name = "zsh-autopair";
         src = pkgs.fetchFromGitHub {
@@ -137,16 +171,16 @@
         };
         file = "zsh-autoquoter.zsh";
       }
-      {
+      # {
-        name = "zsh-nix-shell";
+      #   name = "zsh-nix-shell";
-        file = "nix-shell.plugin.zsh";
+      #   file = "nix-shell.plugin.zsh";
-        src = pkgs.fetchFromGitHub {
+      #   src = pkgs.fetchFromGitHub {
-          owner = "chisui";
+      #     owner = "chisui";
-          repo = "zsh-nix-shell";
+      #     repo = "zsh-nix-shell";
-          rev = "v0.5.0";
+      #     rev = "v0.5.0";
-          sha256 = "0za4aiwwrlawnia4f29msk822rj9bgcygw6a8a6iikiwzjjz0g91";
+      #     sha256 = "0za4aiwwrlawnia4f29msk822rj9bgcygw6a8a6iikiwzjjz0g91";
-        };
+      #   };
-      }
+      # }
     ];
   };
 
@@ -164,7 +198,6 @@
     enable = true;
     enableZshIntegration = true;
     nix-direnv.enable = true;
-    # nix-direnv.enableFlakes = true; always enabled
   };
 
   programs.zoxide = {
@@ -181,13 +214,14 @@
     "...." = "cd ../../..";
     "....." = "cd ../../../..";
 
-    # kitaab recents
+    icat = "kitty +kitten icat";
-    kr = "cd /home/anish/kitaab/vimwiki; ls --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 {}'";
+    yt = "ytfzf -T kitty -t ";
+    gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
 
     # modern cli tools 
-    ls = "exa --icons";
+    ls = "eza --icons";
-    l = "exa -l --icons";
+    l = "esa -l --icons";
-    la = "exa -la --icons";
+    la = "eza -la --icons";
     tree = "ls --tree --icons";
     cat = "bat";
     unzip = "aunpack";
@@ -198,19 +232,25 @@
     make-secret = "< /dev/urandom \\tr -dc _A-Za-z0-9 | head -c \${1:-32};echo;";
 
     # task warrior
-    # TODO: make blocked a context?
+    t = "task -BLOCKED -idea -backlog"; 
-    t = "task -BLOCKED";
+    tw = "t rc.context:work";
-    tin = "task in";
+    # TODO find a reasonable way to manage this from a non-nix managed file in ~/.task/context or something
-    tun = "task -BLOCKED -wait";
+    # we can do something like task rc.context:$(cat ~/.task/context) to read context
-    tb = "task list +backlog";
+    # and write a little script make-context = cat $@ > ~/.task/context or something
+    tt = "taskwarrior-tui -r list";
+    ti = "task +idea";
+    tb = "task +backlog list";
+    ttb = "taskwarrior-tui -r backlog";
     tr = "task newest limit:page";
-    tu = "task unblocked -wait";
+    twait = "task +wait";
-    tl = "task list";
     ta = "task add";
-    tai = "task add +in";
+    tai = "task add +idea";
     tn = "task-note";
-    tp = "task limit:page";
     ts = "task sync";
+    # taskwarrior task lists
+    twt = "task tags +PENDING | tail -n +4 | cut -d ' ' -f1 | fzf --preview 'task +{}'";
+    # task warrior projects list
+    tp = "task projects +PENDING | tail -n +4 | head -n -2 | cut -d ' ' -f1 | fzf --preview 'task pro:{}'";
 
     # keeping for posterity but now sxhkbd handles screenshot with <Super+O>
     # scrot = "flameshot screen -c -p ~/screenshots/";
@@ -235,12 +275,12 @@
     nf = "n flake";
     nfl = "nf lock";
     nepl = "n repl '<nixpkgs>'";
-    srch = "ns nixos";
+    srch = "ns nixpkgs";
     orch = "ns override";
-    nrb = "cd /tmp; sudo nixos-rebuild switch --flake '/etc/nixos/#curve'; cd $OLDPWD";
+    nrb = "cd /tmp; sudo nixos-rebuild switch --flake '/home/anish/usr/helm#curve'; cd $OLDPWD";
-    nrt = "cd /tmp; sudo nixos-rebuild test --flake '/etc/nixos/#curve'; cd $OLDPWD";
+    nrt = "cd /tmp; sudo nixos-rebuild test --flake '/home/anish/usr/helm#curve'; cd $OLDPWD";
-    ned = "cd /etc/nixos; vim; cd $OLDPWD";
+    ned = "cd /home/anish/usr/helm; vim; cd $OLDPWD";
-    ncd = "cd /etc/nixos";
+    ncd = "cd /home/anish/usr/helm";
     mn = ''
       manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | sk --preview="manix '{}'" | xargs manix
     '';
@@ -265,10 +305,11 @@
     jtl = "journalctl";
 
     # quick ssh
-    kssh = "kitten +kitty ssh";
+    kssh = "kitty +kitten  ssh";
     smm = "ssh 10.0.69.4"; # box over wireguard
     sm = "ssh mossnet.lan"; # box regular
-    ss = "ssh sealight.xyz"; # helix
+    sl = "ssh sealight.xyz"; # lituus
-    # sl = "ssh 69.61.38.225"; # lituus  has become helix
+    sh = "ssh git.sealight.xyz"; # helix
+    sb = "ssh cyberian@69.61.38.246"; # bonfire for allwell
   };
 }

home/profiles/desktop/bin/bspswallow

@@ -0,0 +1,71 @@
+#!/bin/sh
+
+# Get class of a wid
+get_class() {
+	id=$1
+  if [ -z "$id" ]; then
+    echo ""
+  else
+    xprop -id "$id" | sed -n \
+      -e '/WM_CLASS/s/\( "\)/\n/g; s/[^\n]*\n\([^"]*\)[^\n]*/\1\n/g' \
+      -e '/WM_COMMAND/s/[^"]*/\n\n/1; s/\n"//1; s/\n\([^"]*\)".*/\n\1/; /\n/p' | sed '/^$/d' | head -n1
+  fi
+}
+
+get_pid() {
+	xprop _NET_WM_PID -id "$1" | awk '/[0-9]+/ {print $3}'
+}
+
+get_ppid() {
+	ps -o ppid= -p $1
+}
+
+check_swallowing_process() {
+	pid=$(get_pid $1)
+	[ -z $pid ] && return 0
+	gppid=$(get_ppid $(get_ppid $pid))
+	grep -i "^$(ps -o cmd= -p $gppid | awk '{print $1}' | sed 's_^.*/__')$" ~/.config/bspwm/terminals && return 0
+	[ "$(get_ppid "$(get_ppid "$(get_pid "$1")")")" = "$(get_pid "$2")" ] && return 0 || return 1
+}
+
+swallow() {
+	addedtodesktop=$2
+	lasttermdesktop=$(bspc query -D -n last)
+
+	swallowerid=$1
+	swallowingid=$(bspc query -N -n last)
+	if [ "$addedtodesktop" = "$lasttermdesktop" ] && check_swallowing_process "$swallowerid" "$swallowingid"; then
+		grep -q "^$(get_class "$swallowerid")$" ~/.config/bspwm/{noswallow, terminals} && return
+		grep -i "^$(get_class "$swallowingid")$" ~/.config/bspwm/terminals || return
+		echo "$swallowerid $swallowingid" >> /tmp/swallowids
+		bspc node "$swallowingid" --flag hidden=on
+	fi
+}
+
+spit() {
+	spitterid=$1
+	spitterdesktop=$2
+	grep "^$spitterid" /tmp/swallowids || return
+	spittingid=$(grep "^$spitterid" /tmp/swallowids | head -n1 | awk '{print $2}')
+
+	bspc node "$spittingid" --flag hidden=off
+
+	termdesktop=$(bspc query -D -n "$spittingid")
+	[ "$termdesktop" = "$spitterdesktop" ] || bspc node "$spittingid" -d "$spitterdesktop"
+
+	bspc node "$spittingid" -f
+	sed -i "/^$spitterid/d" /tmp/swallowids
+}
+
+bspc subscribe node_add node_remove | while read -r event
+do
+	case $(echo "$event" | awk '{ print $1 }') in
+		node_add)
+            		swallow $(echo "$event" | awk '{print $5 " " $3}')
+			;;
+		node_remove)
+			spit $(echo "$event" | awk '{print $4 " " $3}')
+			;;
+	esac
+done
+

home/profiles/desktop/bin/ku

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+# get into a shell that has poonam
+cd ~/kitaab || exit; 
+nix develop; 
+# Use fzf to select a file and capture the output
+selected_file=$(${pkgs.poonam}/main report --titles=false | head -n -2 | fzf --preview 'bat --color=always --terminal-width -1 ./vimwiki/{}')
+echo $selected_file
+
+# Add additional details to the file path
+# file_path="./vimwiki/${selected_file}"
+# 
+# # Open the file in vim for editing
+# vim "${file_path}"
+# 

home/profiles/desktop/bin/paste

@@ -0,0 +1 @@
+curl -F "content=$(xclip -o)" -X POST https://bin.sealight.xyz/upload

home/profiles/desktop/bin/powermenu

@@ -5,9 +5,9 @@ rofi_command="rofi -theme theme/powermenu.rasi"
 ### Options ###
 power_off="\tShutdown"
 reboot="\tReboot"
-lock="\tLock"
+lock="\tLock"
-suspend="鈴\tSleep"
+suspend="󰤄\tSleep"
-log_out="\tLogout"
+log_out="󰍃\tLogout"
 # Variable passed to rofi
 options="$power_off\n$reboot\n$lock\n$suspend\n$log_out"
 
@@ -18,14 +18,14 @@ case "$(echo -e "$options" | $rofi_command -dmenu)" in
 		"	Reboot")
 				systemctl reboot
 				;;
-		"	Lock")
+		"	Lock")
 				dm-tool lock
 				;;
-		"鈴	Sleep")
+		"󰤄	Sleep")
 				dbus-send --print-reply --dest=org.mpris.MediaPlayer2.spotify /org/mpris/MediaPlayer2 org.mpris.MediaPlayer2.Player.Pause
 				systemctl suspend
 				;;
-		"	Logout")
+		"󰍃	Logout")
 				bspc quit
 				;;
 esac

home/profiles/desktop/bin/screenshot

@@ -3,11 +3,12 @@
 timer=5
 
 # Options
-select="麗"
+select="󰩭 "
-window="类"
+window=" "
-screen=""
+screen=" "
-delay=""
+record=" "
-cancel=""
+delay="󱑃 "
+cancel="󰜺 "
 
 # Variable passed to rofi
 options="$select\n$window\n$screen\n$delay\n$cancel"
@@ -50,4 +51,6 @@ case $chosen in
       | tee $filepath | xclip -selection c -t image/png
     notify
     ;;
+	$record)
+		kooha
 esac

home/profiles/desktop/bspwmrc

@@ -39,7 +39,10 @@ bspc rule -a Pinentry state=floating center=on
 bspc rule -a Firefox state=fullscreen
 bspc rule -a feh state=fullscreen
 
+# bspswallow
+pgrep bspswallow || bspswallow &
+
 # polybar
-for file in $XDG_CONFIG_HOME/bspwm/rc.d/*; do
+for file in "$XDG_CONFIG_HOME"/bspwm/rc.d/*; do
   source "$file"
 done

home/profiles/desktop/default.nix

@@ -29,8 +29,104 @@ in
     kitty
     libreoffice
     inotify-tools
+    offpunk
+    termpdfpy
+    libsForQt5.kontact
+    thunderbird
   ];
 
+  # GTK4 color scheme?
+  dconf.settings = {
+    "org/gnome/desktop/interface" = {
+      color-scheme = "prefer-dark";
+    };
+  };
+
+  # Move required config files around
+  xdg.enable = true; # This doesn't seem to do anything so we have below
+  xdg.configHome = "/home/anish/.config"; # TODO bad hardcode
+  xdg.configFile = {
+    "Kvantum/Dracula/Dracula.kvconfig".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.kvconfig";
+    "Kvantum/Dracula/Dracula.svg".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.svg";
+    "Kvantum/kvantum.kvconfig".text = "[General]\ntheme=Dracula";
+  };
+  xdg.mimeApps.defaultApplications = {
+
+  };
+  home.file = {
+    ".config/bspwm/rc.d/polybar".source = ./run.sh;
+    ".config/bspwm/bspwmrc".source = ./bspwmrc;
+    ".config/sxhkdrc".source = ./sxhkdrc;
+    ".config/rofi/theme" = {
+      source = ./rofi;
+      recursive = true;
+    };
+    ".config/polybar" = {
+      source = ./polybar;
+      recursive = true;
+    };
+    ".config/dunst/dunstrc".source = ./dunstrc;
+    ".config/kitty/kitty.conf".source = ./kitty.conf;
+    ".config/kitty/ayu.conf".source = ./ayu-kitty.conf;
+    ".config/zathura/zathurarc".source = ./zathurarc;
+    ".background-image".source = ./background.jpg;
+    #gtk4 theme
+    ".config/gtk-4.0/settings.ini".text = ''
+      [Settings]
+      gtk-application-prefer-dark-theme=1
+    '';
+    # gtk3 theme
+    ".config/gtk-3.0/settings.ini".text = ''
+      [Settings]
+      gtk-theme-name=Dracula
+      gtk-icon-theme-name=Paper
+      gtk-cursor-theme-name=Capitaine Cursors - White
+      gtk-fallback-icon-theme=gnome
+      gtk-application-prefer-dark-theme=1
+      gtk-xft-hinting=1
+      gtk-xft-hintstyle=hintfull
+      gtk-xft-rgba=none
+    '';
+    # GTK2 global theme (widget and icon theme)
+    ".config/gtk-2.0/gtkrc".text = ''
+      gtk-theme-name=Ayu-Mirage
+      gtk-icon-theme-name=Capitaine Cursors - White
+      gtk-font-name="Sans 10"
+    '';
+    ".local/bin/passmenu".source = ./bin/passmenu;
+    ".local/bin/paste".source = ./bin/paste;
+    ".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
+    ".local/bin/wifimenu".source = ./bin/wifimenu;
+    ".local/bin/powermenu".source = ./bin/powermenu;
+    ".local/bin/screenshot".source = ./bin/screenshot;
+    ".local/bin/mpv-ify".source = ./bin/mpv-ify;
+    ".local/bin/bspswallow".source = ./bin/bspswallow;
+    ".config/bspwm/terminals".text = "Kitty";
+    # ".local/bin/hotplug-monitor.sh".source = ./bin/hotplug-monitor.sh;
+  };
+
+  xdg.desktopEntries = {
+    ocr = {
+      name = "OCR image";
+      exec = "${pkgs.writeScript "ocr" ''
+        ${pkgs.xfce.xfce4-screenshooter}/bin/xfce4-screenshooter -r --save /tmp/ocr-tmp.png
+        ${pkgs.tesseract}/bin/tesseract /tmp/ocr-tmp.png | ${pkgs.xclip}/bin/xclip -sel clip
+        rm /tmp/ocr-tmp.png
+      ''}";
+    };
+    screenshot = {
+      name = "Screenshot";
+      exec = "screenshot";
+    };
+  };
+
+
+  qt = {
+    enable = true;
+    platformTheme.name = "gtk";
+    style = { name = "qt5ct-style"; };
+  };
+
   # set up env
   xsession.enable = true;
 
@@ -66,67 +162,10 @@ in
     "*.colorBD" = "#e6e1cf";
   };
 
-  # Move required config files around
+  programs.autorandr.enable = true;
-  xdg.enable = true; # This doesn't seem to do anything so we have below
+  services.udiskie.automount = true;
-  xdg.configHome = "/home/anish/.config"; # TODO bad hardcode
-  xdg.configFile = {
-    "Kvantum/Dracula/Dracula.kvconfig".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.kvconfig";
-    "Kvantum/Dracula/Dracula.svg".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.svg";
-    "Kvantum/kvantum.kvconfig".text = "[General]\ntheme=Dracula";
-  };
-  home.file = {
-    ".config/bspwm/rc.d/polybar".source = ./run.sh;
-    ".config/bspwm/bspwmrc".source = ./bspwmrc;
-    ".config/sxhkdrc".source = ./sxhkdrc;
-    ".config/rofi/theme" = {
-      source = ./rofi;
-      recursive = true;
-    };
-    ".config/polybar" = {
-      source = ./polybar;
-      recursive = true;
-    };
-    ".config/dunst/dunstrc".source = ./dunstrc;
-    ".config/kitty/kitty.conf".source = ./kitty.conf;
-    ".config/kitty/ayu.conf".source = ./ayu-kitty.conf;
-    ".config/zathura/zathurarc".source = ./zathurarc;
-    ".background-image".source = ./background.jpg;
-    # gtk3 theme
-    ".config/gtk-3.0/settings.ini".text = ''
-      [Settings]
-      gtk-theme-name=Dracula
-      gtk-icon-theme-name=Paper
-      gtk-cursor-theme-name=Capitaine Cursors - White
-      gtk-fallback-icon-theme=gnome
-      gtk-application-prefer-dark-theme=true
-      gtk-xft-hinting=1
-      gtk-xft-hintstyle=hintfull
-      gtk-xft-rgba=none
-    '';
-    # GTK2 global theme (widget and icon theme)
-    ".config/gtk-2.0/gtkrc".text = ''
-      gtk-theme-name=Ayu-Mirage
-      gtk-icon-theme-name=Capitaine Cursors - White
-      gtk-font-name="Sans 10"
-    '';
-    # TODO hardcoded
-    ".local/bin/passmenu".source = ./bin/passmenu;
-    ".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
-    ".local/bin/wifimenu".source = ./bin/wifimenu;
-    ".local/bin/powermenu".source = ./bin/powermenu;
-    ".local/bin/screenshot".source = ./bin/screenshot;
-    ".local/bin/mpv-ify".source = ./bin/mpv-ify;
-    ".config/eww/eww.yuck".source = ./eww/eww.yuck;
-    ".config/eww/eww.scss".source = ./eww/eww.scss;
-    ".config/eww/widgets.yuck".source = ./eww/widgets.yuck;
-    # ".local/bin/hotplug-monitor.sh".source = ./bin/hotplug-monitor.sh;
-  };
 
-  qt = {
+  services.mpris-proxy.enable = true; # bluetooth media control
-    enable = true;
-    platformTheme = "gtk";
-    style = { name = "qt5ct-style"; };
-  };
 
   # Compositor
   # services.picom = {
@@ -149,9 +188,4 @@ in
   #        corner-radius = 3
   #      '';
   # };
-
-  programs.autorandr.enable = true;
-  services.udiskie.automount = true;
-
-  services.mpris-proxy.enable = true; # bluetooth media control
 }

home/profiles/desktop/dunstrc

@@ -35,7 +35,7 @@
     origin = top-right
 
     # Offset from the origin
-    offset = 18x36
+    offset = 12x36
 
     # Scale factor. It is auto-detected if value is 0.
     scale = 0

home/profiles/desktop/kitty.conf

@@ -1,11 +1,13 @@
 include ayu.conf
 font_family      Hermit
+font_size        13
 bold_font        auto
 italic_font      auto
 bold_italic_font auto
 open_url_with default
 mouse_map left click ungrabbed mouse_click_url_or_select
 confirm_os_window_close 0
+enable_audio_bell no
 -- Allows zen-mode.nvim to increase font size
-allow_remote_control socket-only
+-- allow_remote_control socket-only
-listen_on unix:/tmp/kitty
+-- listen_on unix:/tmp/kitty

home/profiles/desktop/polybar/config

@@ -34,9 +34,6 @@ fixed-center = true
 width = 100%
 height = 34
 
-offset-x = 
-offset-y =  
-
 ; Background ARGB color (e.g. #f00, #ff992a, #ddff1023)
 background = ${colors.bg}
 
@@ -49,7 +46,7 @@ line-color = #fff
 ; Number of spaces to add at the beginning/end of the bar
 ; Individual side values can be defined using:
 ;   padding-{left,right}
-padding-right = 1 
+padding-right = 1
 padding-left = 0
 
 ; Number of spaces to add before/after each module
@@ -58,14 +55,15 @@ padding-left = 0
 module-margin = 0
 margin-bottom = 34
 
-font-0 = "Iosevka Term:pixelsize=13;4"
+font-0 = "Iosevka Nerd Font,Iosevka NF:pixelsize=10;1" ; Icon Size
-font-1 = "Iosevka Term:pixelsize=6;1"
+font-1 = "Iosevka Nerd Font,Iosevka NF:pixelsize=12;4" ; Large Text font
-font-2 = "Fira Code:pixelsize=13;2"
+font-2 = "FiraCode Nerd Font:pixelsize=12;2"
-font-3 = "Siji:pixelsize=8;2"
+font-3 = "Siji:pixelsize=10;2"
+font-4 = "Iosevka Nerd Font,Iosevka NF:pixelsize=8;1" ; Small Icon Size
 
 ; Add module mpd for artist - title info
 modules-left = bspwm sps volume
-modules-center = title
+; modules-center = title
 modules-right = wireless-network sps battery sps memory sps cpu sps date
 
 ; The separator will be inserted between the output of each module
@@ -116,11 +114,11 @@ type = internal/bspwm
 pin-workspaces = true
 enable-click = true
 
-ws-icon-0 = 1;%{T1}%{T-}
+ws-icon-0 = 1;%{T2} %{T-} 
-ws-icon-1 = 2;%{T1}%{T-}
+ws-icon-1 = 2;%{T2} %{T-} 
-ws-icon-2 = 3;%{T1}%{T-}
+ws-icon-2 = 3;%{T2}󰺻 %{T-} 
-ws-icon-3 = 4;%{T1}%{T-}
+ws-icon-3 = 4;%{T2} %{T-} 
-ws-icon-4 = 5;%{T1}%{T-}
+ws-icon-4 = 5;%{T2} %{T-} 
 ws-icon-default = 
 ; fuzzy-match = true
 
@@ -157,14 +155,14 @@ interval = 1.0
 
 ; See "http://en.cppreference.com/w/cpp/io/manip/put_time" for details on how to format the date string
 ; NOTE: if you want to use syntax tags here you need to use %%{...}
-date = %{T1}%{T-}%{T2} %d/%a%{T-}
+date = %{T2} %{T-}%{T1} %d/%a%{T-}
 
 ; Optional time format
 time = %{T2} %H:%M%{T-}
 
 ; if `date-alt` or `time-alt` is defined, clicking
 ; the module will toggle between formats
-date-alt = %{T1}%{T-}%{T2} %a, %d %b %y%{T-}
+date-alt = %{T2} %{T-} %{T1} %a, %d %b %y%{T-}
 time-alt = %{T2} %H:%M:%S%{T-}
 
 label = %date%%time%
@@ -177,11 +175,12 @@ interface = wlp3s0
 
 label-connected = %essid%
 label-connected-font = 2
-format-connected = <ramp-signal><label-connected>
+format-connected = <ramp-signal> <label-connected>
 label-connected-foreground = #82b414
 
+
 format-disconnected = <label-disconnected>
-label-disconnected = "睊"
+label-disconnected = "󰖪"
 label-disconnected-foreground = #f92672
 
 ramp-signal-foreground = #82b414
@@ -199,7 +198,7 @@ type = internal/cpu
 ; Default: 1
 interval = 0.5
 
-label = %{T1}%{T-}%{T2} %percentage:2%%%{T-}
+label = %{T2} %{T-}%{T1} %percentage:2%%%{T-}
 
 label-foreground = ${colors.cyan}
 
@@ -229,7 +228,7 @@ format = <label>
 ;   %gb_swap_free%
 ;   %gb_swap_used%
 
-label = %{T1}%{T-}%{T2} %gb_used%%{T-}
+label = %{T2}󰍛 %{T-}%{T1} %gb_used%%{T-}
 
 label-foreground = ${colors.cyan}
 
@@ -277,38 +276,6 @@ type = custom/text
 content = " "
 content-padding = 0
 
-[module/network]
-type = internal/network
-interface = wlp3s0
-;enp0s29u1u2
-interval = 1.0
-label-connected = "%{T1}龍%{T-}%{T2} %downspeed% | %upspeed%%{T-}"
-label-disconnected = "%{T2}0/0%{T-}"
-label-connected-background = ${colors.bg}
-label-connected-foreground = ${colors.blue}
-label-disconnected-foreground = ${colors.red}
-
-[module/title]
-type = internal/xwindow
-; Available tags:
-;   <label> (default)
-format = <label>
-format-background = ${colors.bg}
-format-foreground = ${colors.green}
-format-padding = 4
-
-; Available tokens:
-;   %title%
-; Default: %title%
-label = "%{T1}类%{T-}%{T2} %title%%{T-}"
-label-maxlen = 65
-
-; Used instead of label when there is no window title
-; Available tokens:
-;   None
-label-empty =%{T2}Empty%{T-}
-label-empty-foreground = #707880
-
 [module/volume]
 type = internal/pulseaudio
 
@@ -316,7 +283,7 @@ use-ui-max = false
 
 interval = 5
 
-format-volume = <ramp-volume><bar-volume>
+format-volume = <ramp-volume> <bar-volume>
 
 format-muted = <label-muted>
 format-muted-prefix = "  "
@@ -332,13 +299,13 @@ label-muted-foreground = ${colors.mauve}
 bar-volume-width = 8
 bar-volume-gradient = false
 bar-volume-indicator = |
-bar-volume-indicator-font = 2
+bar-volume-indicator-font = 6
 bar-volume-indicator-foreground = ${colors.mauve}
 bar-volume-fill = ─
-bar-volume-fill-font = 2
+bar-volume-fill-font = 6
 bar-volume-fill-foreground = ${colors.mauve}
 bar-volume-empty = ─
-bar-volume-empty-font = 2
+bar-volume-empty-font = 6
 bar-volume-empty-foreground = ${colors.fg-alt}
 
 ramp-volume-0 = "  "
@@ -370,19 +337,19 @@ battery = BAT0
 poll-interval = 2
 time-format = %H:%M
 
-format-charging = <animation-charging><label-charging>
+format-charging = <animation-charging> <label-charging>
 format-charging-prefix = 
 
-format-discharging = <ramp-capacity><label-discharging>
+format-discharging = <ramp-capacity> <label-discharging>
 
 format-full = <label-full>
-format-full-prefix = " "
+format-full-prefix = "  "
-format-full-prefix-font = 1
+format-full-prefix-font = 2
 format-full-prefix-foreground = ${colors.sky}
 
 label-charging = "%percentage%% "
 label-discharging = "%percentage%% "
-label-full = "%percentage%% "
+label-full = "%percentage%%"
 
 label-charging-foreground = ${colors.sky}
 label-discharging-foreground = ${colors.sky}
@@ -409,3 +376,4 @@ animation-charging-foreground = ${colors.sky}
 animation-charging-framerate = 750
 
 ;; _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
+

home/profiles/desktop/rofi/appmenu.rasi

@@ -2,7 +2,7 @@
 @import "config.rasi"
 
 textbox-icon {
-  str: "  ";
+  str: "󱎂 ";
 }
 
 prompt {

home/profiles/desktop/sxhkdrc

@@ -27,6 +27,9 @@ super + Tab
 super + e
 	rofimoji --selector-args "-theme theme/emojimenu.rasi" --skin-tone moderate --action copy 
 
+super + a
+	paste
+
 super + p
 	passmenu
 

home/profiles/email/default.nix

@@ -20,7 +20,7 @@
   programs.msmtp.enable = true;
   programs.notmuch.enable = true;
   home.file.".mailcap".text = ''
-    text/html; browsh %s
+    text/html; firefox %s
     application/pdf; zathura %s
     image/png; feh %s
     image/jpeg; feh %s
@@ -175,7 +175,7 @@
       bind editor ^T complete
 
       # Press A to archive
-      macro index,pager A  "<clear-flag>N<save-message>=/Archive"  "mark message as Archived"
+      macro index,pager A  "<clear-flag><save-message>=/Archive"  "mark message as Archived"
       # Press C to add contact to Khard address book
       macro index,pager C \
       "<pipe-message>khard add-email<return>" \

home/profiles/firefox/default.nix

@@ -13,37 +13,40 @@
   #env.XDG_DEXSTOP_DIR = "$HOME/";
   programs.firefox = {
     enable = true;
-    extensions = with pkgs.nur.repos.rycee.firefox-addons; [
-      # Find extensions: https://github.com/nix-community/nur-combined/blob/master/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
-      ublock-origin
-      wallabagger
-      # tree-style-tab
-      tridactyl
-      promnesia
-      sidebery
-      (buildFirefoxXpiAddon {
-        pname = "shaarli";
-        version = "2.0.0";
-        addonId = "shaarli@imirhil.fr";
-        url = "https://addons.mozilla.org/firefox/downloads/file/815126/shaarli-2.0.0.xpi";
-        sha256 = "W/OpvOfMclibP6LeG573/DlMs0p8fF0efyd+i8Sudgg=";
-        meta = { };
-      })
-      (buildFirefoxXpiAddon {
-        pname = "grasp";
-        version = "0.6.6";
-        addonId = "{37e42980-a7c9-473c-96d5-13f18e0efc74}";
-        url = "https://addons.mozilla.org/firefox/downloads/file/3502186/grasp-0.6.6.xpi";
-        sha256 = "L4JhT29MeA34nHIlB8FtCU7hrpbWljZZBusx12uxblE=";
-        meta = { };
-      })
-    ];
     profiles.anish = {
       id = 0;
       isDefault = true;
       name = "anish";
       userChrome = (builtins.readFile ./userChrome.css);
+      extensions = with pkgs.nur.repos.rycee.firefox-addons; [
+        # Find extensions: https://github.com/nix-community/nur-combined/blob/master/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
+        ublock-origin
+        # wallabagger
+        # tree-style-tab
+        tridactyl
+        promnesia
+        sidebery
+        (buildFirefoxXpiAddon {
+          pname = "shaarli";
+          version = "2.0.0";
+          addonId = "shaarli@imirhil.fr";
+          url = "https://addons.mozilla.org/firefox/downloads/file/815126/shaarli-2.0.0.xpi";
+          sha256 = "W/OpvOfMclibP6LeG573/DlMs0p8fF0efyd+i8Sudgg=";
+          meta = { };
+        })
+        (buildFirefoxXpiAddon {
+          pname = "grasp";
+          version = "0.6.6";
+          addonId = "{37e42980-a7c9-473c-96d5-13f18e0efc74}";
+          url = "https://addons.mozilla.org/firefox/downloads/file/3502186/grasp-0.6.6.xpi";
+          sha256 = "L4JhT29MeA34nHIlB8FtCU7hrpbWljZZBusx12uxblE=";
+          meta = { };
+        })
+      ];
+
       settings = {
+        "browser.zoom.siteSpecific" = false;
+        "zoom.minPercent" = "150"; # TODO doesn't seem to work anymore, you have to manually go into preferences and set the zoom level.
         "devtools.theme" = "dark";
         # Enable userContent.css and userChrome.css for our theme modules
         "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
@@ -51,6 +54,7 @@
         "browser.download.dir" = "/home/anish/downloads"; # TODO Don't hardcode this!
         # Don't use the built-in password manager; a nixos user is more likely
         # using an external one (you are using one, right?).
+        # I am, but it's far too convienent. I'm enabling 2FA anyway so w/e 
         #"signon.rememberSignons" = false;
         # Do not check if Firefox is the default browser
         "browser.shell.checkDefaultBrowser" = false;

home/profiles/git/default.nix

@@ -49,6 +49,7 @@
       ".tmp"
       ".direnv"
       "result"
+      "node_modules/"
     ];
 
     extraConfig = {

home/profiles/nvim/default.nix

@@ -19,7 +19,16 @@ let
         sha256 = "rs3NTZwWdsmBGXnrgUeVxUiNjbN/ULxJHifPYJD9mT4=";
       };
     };
-    nvim-luapad = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    my-lspsaga = pkgs.vimUtils.buildVimPlugin {
+      name = "lspsaga.nvim";
+      src = pkgs.fetchFromGitHub {
+        owner = "glepnir";
+        repo = "lspsaga.nvim";
+        rev = "b7b4777369b441341b2dcd45c738ea4167c11c9e";
+        sha256 = "sciX/fMxzY1YOxXxjj1+ymrdMi451avcFFu+14R+/pk=";
+      };
+    };
+    nvim-luapad = pkgs.vimUtils.buildVimPlugin {
       name = "nvim-luapad";
       src = pkgs.fetchFromGitHub {
         owner = "rafcamlet";
@@ -28,7 +37,7 @@ let
         sha256 = "gMaS5YFi3+gmUIfkCMEt9vhm8XSgv54Cquv5+WCWeTo=";
       };
     };
-    leap = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    leap = pkgs.vimUtils.buildVimPlugin {
       name = "leap";
       src = pkgs.fetchFromGitHub {
         owner = "ggandor";
@@ -46,7 +55,7 @@ let
         sha256 = "vX7ZVJxgatIicmijehtaRvyHxk1i4gFfXrbPM/+VoFc=";
       };
     };
-    my-which-key-nvim = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    my-which-key-nvim = pkgs.vimUtils.buildVimPlugin {
       pname = "which-key.nvim";
       version = "2022-05-04";
       src = pkgs.fetchFromGitHub {
@@ -57,17 +66,7 @@ let
       };
       meta.homepage = "https://github.com/folke/which-key.nvim/";
     };
-    my-conjure = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    scnvim = pkgs.vimUtils.buildVimPlugin {
-      pname = "conjure";
-      version = "2022-05-04";
-      src = pkgs.fetchFromGitHub {
-        owner = "olical";
-        repo = "conjure";
-        rev = "2e7f449d06753f2996e186954e96afc60edd5862";
-        sha256 = "ZV0vPYiZI5/3Isw2l7rrLuiO+kA9G0vrA6OxHFkLTFw=";
-      };
-    };
-    scnvim = pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "scnvim";
       version = "2022-06-04";
       src = pkgs.fetchFromGitHub {
@@ -77,7 +76,7 @@ let
         sha256 = "kvSwS6FNUY2Ue84NhWLLcm0ldLMSp4WqQ7s6TUoX6Cc=";
       };
     };
-    yuck-vim = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    yuck-vim = pkgs.vimUtils.buildVimPlugin {
       pname = "yuck.vim";
       version = "2021-08-09";
       src = pkgs.fetchFromGitHub {
@@ -87,7 +86,7 @@ let
         sha256 = "lp7qJWkvelVfoLCyI0aAiajTC+0W1BzDhmtta7tnICE=";
       };
     };
-    nvim-parinfer = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    nvim-parinfer = pkgs.vimUtils.buildVimPlugin {
       pname = "nvim-parinfer";
       version = "v1.2.0";
       src = pkgs.fetchFromGitHub {
@@ -97,7 +96,7 @@ let
         sha256 = "Dlzfp3CZTzq8zQeHByWf3ER6/Em+KNGYNI4Z17ui8Lc=";
       };
     };
-    my-marks = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    my-marks = pkgs.vimUtils.buildVimPlugin {
       pname = "marks";
       version = "2022-08-31";
       src = pkgs.fetchFromGitHub {
@@ -107,7 +106,7 @@ let
         sha256 = "XdbgIWuAHNdTfyKDrKmQVq5oSbBoi56DpwtgOqhScAk=";
       };
     };
-    my-fterm = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    my-fterm = pkgs.vimUtils.buildVimPlugin {
       pname = "fterm";
       version = "2022-07-22";
       src = pkgs.fetchFromGitHub {
@@ -117,7 +116,7 @@ let
         sha256 = "rR6KDwj58aYfyaSsoUy75536SdBhk394yspCUl/hzfE=";
       };
     };
-    my-nvim-peekup = pkgs.vimUtils.buildVimPluginFrom2Nix {
+    my-nvim-peekup = pkgs.vimUtils.buildVimPlugin {
       pname = "nvim-peekup";
       version = "0.1.0";
       src = pkgs.fetchFromGitHub {
@@ -146,12 +145,21 @@ in
   home.sessionVariables.EDITOR = "nvim";
   home.shellAliases = {
     k = "cd ~/kitaab/vimwiki; vim -c :VimwikiIndex; cd $OLDPWD";
+    # kitaab zettel
     kz = "cd ~/kitaab/vimwiki; vim -c :VimwikiIndex -c :ZettelNew; cd $OLDPWD";
+    # kitaab recents
+    kr = "cd /home/anish/kitaab/vimwiki; eza --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
+    # kitaab get by tagged
+    kt = "cd /home/anish/kitaab/vimwiki; eza *_index.wiki | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
+    # List files that have no links in them
+    ku = "cd /home/anish/kitaab/;vim  ./vimwiki/$(python3 poonam/main.py report --titles=false | tail -n +4 | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./vimwiki/{}');cd $OLDPWD";
   };
   # Add %update to the highlight clause for vimwiki files
   home.file.".config/nvim/after/syntax/vimwiki.vim".text = ''
     " match with %update
     syntax match VimwikiPlaceholder /^\s*%update\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
+    " match with %link
+    syntax match VimwikiPlaceholder /^\s*%link\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
   '';
 
   #environment.systemPackages = with customPlugins; [ tidal ];
@@ -261,6 +269,10 @@ in
       " Sexp in Conjure (since it's fennel)
       let g:sexp_filetypes = "clojure,scheme,lisp,janet,fennel,yuck" 
       let g:conjure#filetype#fennel = "conjure.client.fennel.stdio"
+      " we only use fennel with love; no we don't...
+      let g:conjure#client#fennel#stdio#command = "fennel" 
+      " let g:conjure#extract#tree_sitter#enabled = true
+      map <localleader>lt :ConjureLogToggle<CR>
 
       let g:rainbow_active = 0
       autocmd BufReadPost,BufNewFile c,clj,cljs RainbowParenthesesToggleAll
@@ -338,23 +350,25 @@ in
       let g:fzf_layout = { 'window': { 'width': 0.8, 'height': 0.8 } }
 
       " lsp commands
-      nnoremap <leader>vd :lua vim.lsp.buf.definition()<CR>
+      nnoremap <leader>vgd :lua vim.lsp.buf.definition()<CR>
       nnoremap <leader>vi :lua require('telescope.builtin').lsp_implementation()<CR>
       nnoremap <leader>vsh :lua vim.lsp.buf.signature_help()<CR>
       nnoremap <leader>vrr :lua require('telescope.builtin').lsp_references()<CR>
-      nnoremap <leader>vrn :lua vim.lsp.buf.rename()<CR>
+      " nnoremap <leader>vrn :lua vim.lsp.buf.rename()<CR>
-      nnoremap <leader>vh :lua vim.lsp.buf.hover()<CR>
+      " nnoremap <leader>vh :lua vim.lsp.buf.hover()<CR>
-      nnoremap <leader>vca :lua vim.lsp.buf.code_action()<CR>
+      " nnoremap <leader>vca :lua vim.lsp.buf.code_action()<CR>
-      nnoremap <leader>vsd :lua vim.lsp.util.show_line_diagnostics()<CR>
+      " nnoremap <leader>vsd :lua vim.lsp.util.show_line_diagnostics()<CR>
-      nnoremap <leader>vn :lua vim.lsp.diagnostic.goto_next()<CR>
+      " nnoremap <leader>vn :lua vim.lsp.diagnostic.goto_next()<CR>
-      nnoremap <leader>va :lua require('telescope.builtin').lsp_code_actions(require('telescope.themes').get_cursor())<cr>
+      " nnoremap <leader>va :lua require('telescope.builtin').lsp_code_actions(require('telescope.themes').get_cursor())<cr>
       " lspsaga stuff doesn't work
-      " nnoremap <leader>vd :call Lspsaga peek_definition<CR>
+      nnoremap <leader>vd :Lspsaga peek_definition<CR>
-      " nnoremap <leader>vrn :call Lspsaga rename<CR><CR>
+      nnoremap <leader>vrn :Lspsaga rename<CR><CR>
-      " nnoremap <leader>vh :call Lspsaga hover_doc<CR>
+      nnoremap <leader>vh :Lspsaga hover_doc<CR>
-      " nnoremap <leader>vca :call Lspsaga code_action<CR>
+      nnoremap <leader>vca :Lspsaga code_action<CR>
-      " nnoremap <leader>vsd :call Lspsaga show_line_diagnostics<CR>
+      nnoremap <leader>vsd :Lspsaga show_line_diagnostics<CR>
-      " nnoremap <leader>vn :call Lspsaga diagnostic_jump_prev<CR>
+      nnoremap <leader>vs :Dasht<Space>
+      nnoremap <leader>vn :Lspsaga diagnostic_jump_prev<CR>
+      nnoremap <leader>vo :LSoutlineToggle<CR>
 
       " dashboard
       let g:dashboard_custom_header = [
@@ -464,6 +478,14 @@ in
         }
       )
 
+      local orig_util_open_floating_preview = vim.lsp.util.open_floating_preview
+      function vim.lsp.util.open_floating_preview(contents, syntax, opts, ...)
+        opts = opts or {}
+        opts.border = opts.border or 'rounded'
+        return orig_util_open_floating_preview(contents, syntax, opts, ...)
+      end
+
+
       vim.api.nvim_set_keymap('n', '<leader>vt', ':call v:lua.toggle_diagnostics()<CR>',  {noremap = true, silent = true})
 
       -- autopairs
@@ -494,22 +516,6 @@ in
               format = lspkind.cmp_format({
                 mode = 'symbol_text', 
                 maxwidth = 50, 
-              -- old format
-              -- format = function(entry, vim_item)
-              --     -- fancy icons and a name of kind
-              --     vim_item.kind = require("lspkind").presets.default[vim_item.kind] ..
-              --                         " " .. vim_item.kind
-              --     -- set a name for each source
-              --     vim_item.menu = ({
-              --         buffer = "[Buffer]",
-              --         nvim_lsp = "[LSP]",
-              --         look = "[Look]",
-              --         path = "[Path]",
-              --         spell = "[Spell]",
-              --         calc = "[Calc]",
-              --     })[entry.source.name]
-              --     return vim_item
-              -- end
             })
           },
           mapping = {
@@ -568,6 +574,8 @@ in
         sources = {
           null_ls.builtins.diagnostics.shellcheck,
           null_ls.builtins.diagnostics.proselint.with({ filetypes = { "vimwiki", "mail", }, }),
+          null_ls.builtins.diagnostics.commitlint,
+          null_ls.builtins.diagnostics.jsonlint,
       --     null_ls.builtins.code_actions.statix,
       --     null_ls.builtins.diagnostics.clj_kondo,
       --     null_ls.builtins.formatting.isort,
@@ -582,24 +590,52 @@ in
       local navic = require("nvim-navic")
 
       -- lspsaga, code_action lightbulb is annoying
-      -- local saga = require('lspsaga')
+      local saga = require('lspsaga')
-      -- saga.init_lsp_saga({
+      saga.init_lsp_saga({
-      --   code_action_lightbulb = {
+        border_style = "rounded",
-      --     enable = true,
+        code_action_icon = "",
-      --     enable_in_insert = true,
+        code_action_num_shortcut = true,
-      --     cache_code_action = true,
+        code_action_lightbulb = {
-      --     sign = true,
+            enable = false,
-      --     update_time = 150,
+            enable_in_insert = false,
-      --     sign_priority = 4,
+            cache_code_action = true,
-      --     virtual_text = false,
+            sign = true,
-      --   },
+            update_time = 150,
-      -- })
+            sign_priority = 20,
+            virtual_text = false,
+        },
+        code_action_keys = {
+            quit = 'q',
+            exec = '<CR>',
+        },
+        -- show outline
+        show_outline = {
+          win_position = 'right',
+          --set special filetype win that outline window split.like NvimTree neotree
+          -- defx, db_ui
+          auto_enter = true,
+          auto_preview = true,
+          virt_text = '┃',
+          jump_key = 'o',
+          -- auto refresh when change buffer
+          auto_refresh = true,
+        },
+      })
 
-      local capabilities = vim.lsp.protocol.make_client_capabilities()
+      capabilities = require('cmp_nvim_lsp').default_capabilities()
-      capabilities = require('cmp_nvim_lsp').default_capabilities(capabilities)
 
+      -- fennel-ls is bleeding edge
       local lspconfig = require('lspconfig')
-      local servers = { 'clojure_lsp', 'terraform_lsp', 'zls', 'pyright', 'rust_analyzer', 'tsserver', 'sumneko_lua' }
+      require("lspconfig.configs")["fennel-ls"] = {
+        default_config = {
+          cmd = {"fennel-ls"},
+          filetypes = {"fennel"},
+          root_dir = function(dir) return lspconfig.util.find_git_ancestor(dir) end,
+          settings = {}
+        }
+      }
+
+      local servers = { 'clojure_lsp', 'terraform_lsp', 'zls', 'pyright', 'rust_analyzer', 'tsserver', 'lua_ls', 'nil_ls', 'gopls'}
       for _, lsp in ipairs(servers) do
         lspconfig[lsp].setup {
           on_attach = function(client, bufnr)
@@ -609,13 +645,15 @@ in
           capabilities = capabilities,
         }
       end
-      -- rnix doesn't support gps
+
-      require('lspconfig').rnix.setup {
+      -- fennel-ls doesn't support gps
+      lspconfig['fennel-ls'].setup {
         on_attach = function(client, bufnr)
           format.on_attach(client)
         end,
         capabilities = capabilities,
       }
+
       -- deprecated pylsp
       -- require('lspconfig').pylsp.setup {
       --   on_attach = function(client, bufnr)
@@ -645,8 +683,8 @@ in
 
       -- treesitter
       require('nvim-treesitter.configs').setup { 
-        parser_install_dir = "~/.local/share/nvim/site/parser/",
+        -- parser_install_dir = "~/.local/share/nvim/site/parser/",
-        ensure_installed={'nix', 'clojure', 'python', 'fennel', 'lua', 'html', 'css', 'regex', 'supercollider', 'beancount'},
+        -- ensure_installed={'nix', 'clojure', 'python', 'fennel', 'lua', 'html', 'css', 'regex', 'supercollider', 'beancount', 'janet'},
         highlight = { enabled = true, additional_vim_regex_highting = true, },
         textobjects = { enabled = true },
       }
@@ -759,6 +797,7 @@ in
           ['<F2>'] = map_expr('s.meter'),
         }
       } 
+      -- You gotta run :SCNvimGenerateAssets for this first
       -- require("luasnip").add_snippets("supercollider", require("scnvim/utils").get_snippets())
 
       -- zen mode
@@ -806,21 +845,26 @@ in
       }
       require('twilight').setup{}
 
+      -- hologram
+      require('hologram').setup{
+          auto_display = false -- WIP automatic markdown image display, may be prone to breaking
+      }
+
       EOF
 
     '';
     extraPackages = with pkgs // customPlugins; [
       # used to compile tree-sitter grammar
-      tree-sitter
       python-with-my-packages
       nodejs
       clojure-lsp
       clojure
-      rnix-lsp
+      nil
       terraform-lsp
       rust-analyzer
       clj-kondo
       zls
+      gopls
       gcc
       nodePackages_latest.pyright
       shellcheck
@@ -828,7 +872,8 @@ in
       statix
       nodePackages.typescript
       nodePackages.typescript-language-server
-      sumneko-lua-language-server
+      luajitPackages.lua-lsp
+      fennel-ls
     ];
 
     plugins = with pkgs.vimPlugins // customPlugins; [
@@ -845,7 +890,7 @@ in
       telescope-nvim
       plenary-nvim
       nvim-navic
-      nvim-treesitter
+      (nvim-treesitter.withPlugins (p: [ p.nix p.clojure p.python p.fennel p.lua p.html p.css p.regex p.supercollider p.beancount p.markdown p.glsl p.yaml p.toml p.dockerfile p.json ]))
       nvim-treesitter-context
       my-fterm
       barbar-nvim
@@ -855,7 +900,8 @@ in
       nvim-peekup
       zen-mode-nvim
       twilight-nvim
-      lspsaga-nvim
+      my-lspsaga
+      vim-dasht
 
       # language
       vim-nix
@@ -870,6 +916,7 @@ in
       vimwiki
       taskwiki
       vim-zettel
+      hologram-nvim
 
       # lsp stuff
       # nvim-lint

home/profiles/nvim/package.json

@@ -0,0 +1,9 @@
+{
+  "console.log": {
+    "prefix": "clog",
+    "body": [
+      "console.log('$1')"
+    ],
+    "description": "Log output to console"
+  }
+}

home/profiles/ssh/default.nix

@@ -0,0 +1,10 @@
+{
+  home.file.".ssh/config".text = ''
+    Host mossnet.lan
+      ForwardAgent Yes
+    Host sealight.xyz
+      ForwardAgent Yes
+    Host git.sealight.xyz
+      ForwardAgent Yes
+  '';
+}

home/profiles/sync/kitaab/default.nix

@@ -0,0 +1,39 @@
+{ pkgs, ... }:
+
+let
+  name = "kitaab-sync";
+  # Note this will fail if index.wiki is open in vim while this runs
+  mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
+    # set -euo pipefail # Sometimes vimwiki is open and that causes `vimwiki tags rebuild` to fail, we still want to push to git in those cases
+    PATH=/run/current-system/sw/bin:/etc/profiles/per-user/anish/bin:$PATH
+    cd /home/anish/kitaab/vimwiki
+    vimwiki tags rebuild
+    cd ..
+    pushd kalpana/
+    ${pkgs.luaPackages.fennel}/bin/fennel main.fnl build
+    popd
+    pushd vimwiki/
+    git add -A .
+    popd
+    git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
+    git push
+    exit 0
+  '';
+in
+{
+  systemd.user.services.kitaab-sync = {
+    Service = {
+      ExecStart = "${mkStartScript name}";
+      Path = [ pkgs.luaPackages.fennel ];
+    };
+  };
+  systemd.user.timers.kitaab-sync = {
+    Install = {
+      WantedBy = [ "timers.target" ];
+      PartOf = [ "kitaab-sync.service" ];
+    };
+    Timer = {
+      OnCalendar = [ "hourly" ];
+    };
+  };
+}

home/profiles/task/bin/set-backlog.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify -idea +backlog

home/profiles/task/bin/set-focus.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify -idea -backlog

home/profiles/task/bin/set-idea.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify +idea -backlog

home/profiles/task/bin/task-note.py

@@ -34,16 +34,16 @@ def write_note(task_id: int):
     if not os.path.exists(notes_file):
         logging.info("Adding description to empty notes file")
         task_description = os.popen(f"task _get {task_id}.description").read()
-        task_project = os.popen(f"task _get {task_id}.project").read().strip("\n")
+        task_project = os.popen(f"task _get {task_id}.project").read().strip("\n").replace(".", ":")
         task_tags = os.popen(f"task _get {task_id}.tags").read().split(",")
         if len(task_tags):
             task_tags = ":".join(task_tags).strip("\n") + ":"
         time = datetime.datetime.now().strftime("%y-%m-%d %H:%M")
 
         with open(notes_file, "w") as f:
-            f.write(f"%title: {task_description}")
+            f.write(f"%title {task_description}")
             f.write(f":task:{task_project}:{task_tags if len(task_tags) else ''}\n")
-            f.write(f"%date: {time}\n\n")
+            f.write(f"%date {time}\n\n")
             f.flush()
 
     os.execlp(EDITOR, EDITOR, notes_file)

home/profiles/task/ca.cert

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE/zCCAuegAwIBAgIUTLEuHYBh/sST/IrIhs+pWjDjW3UwDQYJKoZIhvcNAQEM
+BQAwFjEUMBIGA1UEAxMLMTkyLjE2OC4xLjYwIBcNMjEwMjEzMDUzODUxWhgPOTk5
+OTEyMzEyMzU5NTlaMBYxFDASBgNVBAMTCzE5Mi4xNjguMS42MIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEA8ZyNGBoudva5KAe1F281Fe3u91whLPB7SWv4
+zvN6n81NaMtl+rkfcO5GrYSbtemeQUz04N9dUIRABPyHGO+y0gQn/1p1KMdFzhH1
+wDR45h/Eo7+U+2Y/qjyvdjNU9aPe5yymuqSm0cTdFbRkXBoZDSDrwA0U078oYCBo
+yDxubKK7H7jWlSVyaBmsWDA72qdZhcOGKy6YoIEiT18V/57wTXBacBZvs3ORbOR6
+SMPjq0Pr32+kDriRbb9lQ9TAAGLE51hM8IBMnAZVvgS5GQ1y8elH4WJc7caom5B3
+l1MVQKEtgxU+QA4ZqGr9y7H4ey4Xf0V9pvrnsUTu1zCz+P4wd8jS6toxCnn8A8Tq
+c3ytA7t3o7BntLSWeQV5LKEiXqF3n3njqXk5Z0ZxDkI+FkhbnOytwGvUEpanTS1d
+z3EyZA8h1huoDdTmL1hVrg9pIaFJG5S9GuwcJiFPFo0QN6lcbhJmKrCOzPKb8Kwn
+zhymN7vtskSeqPZnQX+/tGupMzeITwcudoBg7zRUNKikIsTwFze+QV+puGFCjH+B
+BIe0NQ+rzpWOyI7FDYIMb5q+/PJKTkH2Bu5qYhgebzdCxKcJGBNoWsgzvl+tofQw
+XchzIqR35xbkmvLeuIIABd8BKaowrAUGrRxtp7IZqxcR3XxH1RIimkHzeRHTphU2
+oycB3eMCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA
+MB0GA1UdDgQWBBQBl2OoCoAweUqsfVQNmL9H3jtl2DANBgkqhkiG9w0BAQwFAAOC
+AgEAypV1zutIu7an9tansll20LH2WMAHqi5JrALPBCO9yTqnCS3xZg8VZott/qxm
+/SsdlhKtekpvljiQhKqB4wROTf26GjxB9iAzdfxAZEcpYWkyXQ6qzDpjIHLLB3X2
+31KHbMc63GOI4wmpGY532tt3qDb+VhgfK25GyvUvvw5qvFsYeGHdSD/HIEJHKlOK
+8esaF2/r+wuOWABbbmSBaCtR8H8T4Z/B5l6PoVft9uu8IQbtuhiDn08mZHat8tUq
+nxm3O1JsV4ZNtvqh5st1Qn32f7buM6AFMhMy9bcXwR33TJBuv994zRjJQYk+FKzE
+UzrWl9mlglWV34P0+xMxpDFEgQvkJAFmdhcVsZlDwILWzEa/ZrS2EQGsEuzHbfFo
+oVQuXjzQkX504kAypwQBwbqPfwwYEev7EPVOj32/ke1TzBLaqqJ5AMABShOUJD3L
+pNOWMD3B23lRDll2f/Tkhqq4qriqWmtn7urC5ga6AlnAUueiORHTTcA9XBuAz68q
+dVfU3cIwwnGhDAYUB27yeb0mhPGnTz2Xr4tn8TLrL7c0tXZPjDCttr6hUnB+X/Yx
+tBxT1fJMZR7lzRMvnLJJQKC5rVKE4AAy+FJb3JvhQw01CF4odCmgWT3y+MG4RxnN
+sqTWkKoE6bRT9rnRAG8EntRycibGKH0b1PhpY8ngOgMbfCw=
+-----END CERTIFICATE-----

home/profiles/task/default.nix

@@ -1,9 +1,19 @@
 { pkgs, config, lib, ... }:
 
 {
-  # If you're setting up taskwarrior again, there's a task-setup.sh script in seafile
   home.file = {
+    # Because the below is inconsistent, I turn it off once I have a copy in place. 
+    ".taskrc".enable = true;
+    # WARN ugly hack
+    # taskwarrior needs write access to this file for centexts
+    # this way, we get a copy of the file, and we make sure it's writable
     ".taskrc".source = ./taskrc;
+    # ".taskrc".executable = true;
+    # ".taskrc".onChange = "cp ~/.taskrc ~/.taskrc2;rm ~/.taskrc;mv ~/.taskrc2 ~/.taskrc;chmod +w ~/.taskrc";
+    ".task/keys/ca.cert".source = ./ca.cert;
+    ".task/keys/public.cert".source = ./public.cert;
+
     ".local/bin/task-note".source = ./bin/task-note.py;
+    ".local/bin/set-idea".source = ./bin/set-idea.sh;
   };
 }

home/profiles/task/public.cert

@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFRDCCAyygAwIBAgIUCsfV17Ag4utaNHY9sv6x7g/Z3bgwDQYJKoZIhvcNAQEM
+BQAwFjEUMBIGA1UEAxMLMTkyLjE2OC4xLjYwIBcNMjEwMjEzMDUzODU0WhgPOTk5
+OTEyMzEyMzU5NTlaMCgxFDASBgNVBAMTCzE5Mi4xNjguMS42MRAwDgYDVQQKEwdt
+b3NzbmV0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA23j6Xo+BlPpM
+APbncIztaYOfL02lvCOhbx5sxPk6TH5dIxzkBAc3T9X6uY+hTY36QT+SjN5z0EBi
+UghxwMM8r2G4ip3XLEFgyFDuDzVgRRuGBbSGtOEIqt49lvmBEWKaxDdYftdlDpKq
+qV8NlQJJnBJ9cNZlWzlheRALHMvCUsfnX60piWbQjYrq6j+lF9VjUKUClD92/jhS
+LaeaQ6vMlCabYNOf+vq8J3L2oRwHkLMPHBa/a5vNT3bL8Q/Sjuegi+zD68k/fobt
+Y7gYL/qyhrFfIvGyN0Jf92DTKdj+1ma3kIaG+REeAx5W8NtRdfnSlS+DA5O0mp0P
+oMZICs0Xbq474XYkhBoz7smWA4DLT86on7qcCo24CvII9YU0VDYHNtnDi8CaStea
+dvGFDiQS5X3Awwsgt5OWJSgBx+NL9piiZq9Eu5E3CGpoYNiTCANrRV21qmyf090h
+md01QUU/f1IMa+wBgryTW94OUhSMmknB9roFAmQaD9Xnj6ecGJkq2ZiytpJ37QiV
+8h2ZM9K1PUD4/QulCG/U4IG1II7ef1IUyEFpj6BB7CGCHq+qJ7QKT6Kc/quEewHB
+eUjG+FvSmCCgfVf/hqYvul7ybbiqMgCSTSziKF7tN8DuFfIZo9EGdckKXxBgQ7ua
+BRVnSZw2vh8nJ8jtGkrw/grKwHL/yA0CAwEAAaN2MHQwDAYDVR0TAQH/BAIwADAT
+BgNVHSUEDDAKBggrBgEFBQcDAjAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBQi
+MnF9Np64W1zshqQxe8Cgvm8hFDAfBgNVHSMEGDAWgBQBl2OoCoAweUqsfVQNmL9H
+3jtl2DANBgkqhkiG9w0BAQwFAAOCAgEAsNqR/SziOtCRS+n7FGxJ+3FpfACqV4Yl
+MDTbpRe0qUcbMDetWZALdPS5gNW/4rj2cpacd3eQI6qRLtUW/l8QGqZl8OjslA2X
+/N+9Alza8D+cv6Almx1TclcYJF/Z0NneJ4DgdFXJAPK3zf5eD73N/7EohNWy70Bj
+J/4cmYL3T1Pq/FhN/9DV9HoSaRxy9naRjZ3dZXC4CgFRExXw+sEHLDzOHrLDz2xN
+4qOjYUH3I1rGWXsSGRFztgNTnA02hPxG1VHzmTvwPjoBxn2/QGTMuXnk8xQGGtdy
+G8oav2RLBqvh0AD4fqd2fnMezJiRipXzYmWb1bySe48HRtHJrZ/aQQrUlPdNQwAe
+EeixS97JEdBqtag41VhRBFxF9nML8ozA6cgj+Jm2M6OGU+M3tVhioEiuKPm6jXgl
+3v8AA2CQrSJjhkTzinxE4FXa9O8INwziHSCE3GNIZaDCMYj7R8tTVcLaQWzUtdj/
+i+0fI61n3ZOabvhLXttsdrtqcfNbrxCBVezoweg2RrVFcJc2GojCwJWt6a0cO+69
+ggHZgpAwXsMmyMhhCbBXhnxBrsuGbN7f3YN2ty2veeFtp8uDvjCqmgJ5AG32w5E4
+Ck9Rup6lwgq3YTQ4pTxl2y26HinobPrMzsZiWkZhN7elnVZL00kSF2Qn6x6xuAap
+Z5oPkwZtYnM=
+-----END CERTIFICATE-----

home/profiles/task/taskrc

@@ -15,7 +15,7 @@ data.location=~/.task
 taskd.server=task.mossnet.lan:53589
 #taskd.server=10.0.69.4:53589
 taskd.ca=~/.task/keys/ca.cert
-taskd.key=~/.task/keys/private.key
+taskd.key=/run/agenix/taskwarrior-private
 taskd.certificate=~/.task/keys/public.cert
 taskd.trust=ignore hostname
 taskd.credentials=mossnet\/anish\/1647259c-e340-405c-a38b-11ac18e34688
@@ -29,7 +29,7 @@ taskd.credentials=mossnet\/anish\/1647259c-e340-405c-a38b-11ac18e34688
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-green-256.theme
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-blue-256.theme
 # TODO this needs to be not a hardlink but a nix link
-include /nix/store/64nvv0ac2dr8rdz2414f53x97j3msiz0-taskwarrior-2.6.2/share/doc/task/rc/dark-violets-256.theme
+# include /nix/store/64nvv0ac2dr8rdz2414f53x97j3msiz0-taskwarrior-2.6.2/share/doc/task/rc/dark-violets-256.theme
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-yellow-green.theme
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-gray-256.theme
 #include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-gray-blue-256.theme
@@ -42,12 +42,11 @@ news.version=2.6.0
 
 ## Contexts
 context.poor.read=-purchase
-context.dev.read=+dev
+context.dev.read=+dev or +ops -work
-context.ops.read=+ops
+context.home.read=-work
-context.bucket.read=+in
+context.work.read=+work
-context.focused=(priority:H or priority:M) -idea -backlog -finances urgency > 5.0
+context.work.write=+work
-# context.work=+Work -idea -personal
+context.bucket.read=+idea
-# context.offwork=-Work
 
 ## Reports
 
@@ -59,17 +58,35 @@ report.list.labels=ID,P,Project,Tags,R,Sch,Due,Until,Description
 report.in.columns=id,project,tags,description 
 report.in.labels=ID,Proj,Tags,Description 
 report.in.description=Inbox
-report.in.filter=status:pending limit:page (+in)
+report.in.filter=status:pending limit:page (+idea)
+
+# Backlog
+report.backlog.columns=id,priority,project,tags,recur.indicator,scheduled.countdown,due,until.remaining,description.count
+report.backlog.labels=ID,P,Project,Tags,R,Sch,Due,Until,Description
+report.backlog.description=backlog
+report.backlog.filter=status:pending limit:page (+backlog)
+report.backlog.sort=start-,due+,project+/,urgency-
 
 # Unblocked
 report.unblocked.labels=ID,Deps,Proj,Tags,Due,Active,Description
 report.unblocked.columns=id,depends,project,tags,due,start.active,description
 
 # Next 
-report.next.filter=(status:pending -in -backlog pro.not:ideas limit:0)
+# It's not a good idea to filter this view, since modify depends on the next view
+report.next.filter=(status:pending limit:0) # pro.not:ideas -idea -backlog 
 report.next.labels=ID,Active,Deps,P,Project,Tag,Recur,S,Due,Until,Description
 report.next.columns=id,start.age,depends,priority,project,tags,recur,scheduled.countdown,due.relative,until.remaining,description
 
+# Everything, including inbox
+report.every.filter=(status:pending limit:0)
+report.every.labels=ID,Active,Deps,P,Project,Tag,Recur,S,Due,Until,Description
+report.every.columns=id,start.age,depends,priority,project,tags,recur,scheduled.countdown,due.relative,until.remaining,description
+
+report.poms.filter=(status:pending -idea -backlog -BLOCKED)
+report.poms.labels=UUID,ID,Project,Tag,Description
+report.poms.columns=uuid,id,project,tags,description
+report.poms.sort=start+,urgency+
+
 # Urgency
 urgency.user.project.wait.coefficient=-10.0
 urgency.user.project.craft.coefficient=1.9
@@ -78,6 +95,11 @@ urgency.user.tag.think.coefficient=-7.0
 urgency.user.tag.purchase.coefficient=-1.2
 urgency.user.project.curve.glam.coefficient=-1.3
 
+# UDAs
+uda.taskwarrior-tui.shortcuts.1=~/.local/bin/task/set-focus.sh
+uda.taskwarrior-tui.shortcuts.2=~/.local/bin/task/set-backlog.sh
+uda.taskwarrior-tui.shortcuts.3=~/.local/bin/task/set-idea.sh
+
 # Colors
 color.project.chores=blue
 color.tag.dev=cyan

hosts/box/configuration.nix

@@ -11,13 +11,15 @@
       ./hardware-configuration.nix
     ];
 
+  # No systemd emergency mode (can't reliably be accessed over SSH)
+  systemd.enableEmergencyMode = false;
+
   # Use the GRUB 2 boot loader.
   boot.loader.efi.canTouchEfiVariables = false;
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
   boot.loader.grub = {
     enable = true;
     device = "nodev";
-    version = 2;
     efiSupport = true;
     enableCryptodisk = true;
     efiInstallAsRemovable = true;
@@ -28,6 +30,16 @@
     "/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin;
   };
 
+  # Remote SSH unlock
+  boot.initrd.network.enable = true;
+  boot.initrd.network.ssh = {
+    enable = true;
+    port = 22;
+    authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve " ];
+    hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ]; # create this file with `ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key`
+  };
+  boot.initrd.availableKernelModules = [ "igc" "iwlwifi" ];
+
   boot.initrd.luks.devices = {
     "root" = {
       #name = "root";
@@ -73,16 +85,13 @@
   networking.useDHCP = false;
   networking.interfaces.wlp3s0.useDHCP = true;
 
-  # Set your time zone.
-  time.timeZone = "Australia/Brisbane";
-
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
   networking.firewall.allowedTCPPorts = [ 22 ];
   sound.enable = false;
 
   programs.gnupg.agent.enable = true;
-  programs.gnupg.agent.pinentryFlavor = "curses";
+  programs.gnupg.agent.pinentryPackage = pkgs.pinentry-curses;
   programs.gnupg.agent.enableSSHSupport = true;
 
   # This value determines the NixOS release with which your system is to be

hosts/box/default.nix

@@ -1,5 +1,4 @@
-{ self, pkgs, ... }:
+{ self, pkgs, ... }: {
-{
   imports = [
     ./configuration.nix
     ../profiles/core
@@ -7,31 +6,33 @@
     ../profiles/taskd
     ../profiles/shaarli
     ../profiles/dns
-    ../profiles/monitoring
+    # ../profiles/monitoring
     ../profiles/nfs
     ../profiles/gonic
-    ../profiles/headphones
+    # ../profiles/headphones # TODO broken on 23.11, see: https://github.com/rembo10/headphones/issues/3320
     ../profiles/radicale
-    ../profiles/seafile
+    # ../profiles/seafile # waiting for https://github.com/NixOS/nixpkgs/pull/249523 to be merged
     ../profiles/syncthing
     ../profiles/dhyan
     ../profiles/calibre
     ../profiles/wallabag
     ../profiles/finance
+    ../profiles/sync/website
+    ../profiles/grasp
     # ../profiles/archivebox
+    # ../profiles/woodpecker-agent
+    # ../profiles/jellyfin
+    ../profiles/ulogger-server
+    ../profiles/photoprism # Replace with immich
+    ../profiles/gpodder
+    #../profiles/postgres_upgrade_script
   ];
 
-  # For some reason this doesn't work in the profile, but does over here??
-  # Something weird in the way I'm importing nixpkgs in the profile or something
-  services.grasp.enable = true;
-  services.grasp.path = "/home/anish/kitaab/grasp/grasp.wiki";
-  services.grasp.user = "anish";
-
   # Backups
   age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
   services.postgresqlBackup = {
     enable = true;
-    databases = [ "wallabag" ];
+    databases = [ "wallabag" "photoprism" "ulogger" ];
     location = "/var/backup/postgresql";
   };
   mossnet.backup = {
@@ -46,13 +47,45 @@
       "/data/books" # calibre-web
       # "/home/anish/usr/nonfiction" # syncthing
       "/home/anish/usr/finance" # beancount
-      "/mnt/two/postgres" # sealight postgres backups TODO remove once moved to capsul 
+      "/mnt/two/postgres" # sealight postgres backups TODO remove once moved to capsul
     ];
     # seafile
   };
 
+  services.transmission = {
+    enable = true;
+    settings = {
+      rpc.bind-address = "0.0.0.0";
+      download-dir = "/mnt/two/new-music";
+    };
+  };
+  services.nginx.virtualHosts."transmission.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://localhost:9091/;
+        proxy_set_header X-Forwarded-Host $host;
+      '';
+    };
+  };
+
+  services.nginx.virtualHosts."mast.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://localhost:5731/;
+        proxy_set_header X-Forwarded-Host $host;
+      '';
+    };
+  };
+
   age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
   age.secrets.box-wg.owner = "anish";
+  age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
   mossnet.wg = {
     enable = true;
     ips = [ "10.0.69.4/24" ];

hosts/box/hardware-configuration.nix

@@ -30,18 +30,33 @@
     {
       device = "/dev/disk/by-uuid/0f857c6e-509d-436f-9e78-bc25f1b0d23b";
       fsType = "ext4";
+      options = [
+        "noatime"
+        "nodiratime"
+        "nofail"
+      ];
     };
 
   fileSystems."/mnt/two" =
     {
       device = "/dev/disk/by-uuid/5bc894bf-ed87-4c30-aab4-87e154e0cd08";
       fsType = "ext4";
+      options = [
+        "noatime"
+        "nodiratime"
+        "nofail"
+      ];
     };
 
   fileSystems."/mnt/three" =
     {
       device = "/dev/disk/by-uuid/0be3ded1-9c8b-40aa-94ca-dc2297d5988e";
       fsType = "ext4";
+      options = [
+        "noatime"
+        "nodiratime"
+        "nofail"
+      ];
     };
 
   swapDevices =

hosts/cube/configuration.nix

@@ -8,11 +8,9 @@
     ];
 
   boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
 
   networking.hostName = "cube"; # Define your hostname.
-  time.timeZone = "Australia/Brisbane";
 
   networking.useDHCP = false;
   networking.interfaces.ens3.useDHCP = true;

hosts/cube/default.nix

@@ -6,4 +6,11 @@
     ../profiles/server
     ../profiles/site
   ];
+
+  services.nginx.enable = true;
+  services.nginx.virtualHosts."coaching.lakhwara.com" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = { root = "/var/lib/coaching"; index = "/index.html"; };
+  };
 }

hosts/curve/configuration.nix

@@ -1,7 +1,6 @@
 {
   imports = [ ./hardware-configuration.nix ];
   boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
   # Define on which hard drive you want to install Grub.
   boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
 
@@ -28,8 +27,6 @@
   networking.hostName = "curve";
   #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
 
-  time.timeZone = "Australia/Brisbane";
-
   # Select internationalisation properties.
   i18n.defaultLocale = "en_US.UTF-8";
   # console = {
@@ -39,5 +36,5 @@
 
   sound.enable = true;
 
-  services.xserver.libinput.enable = true;
+  services.libinput.enable = true;
 }

hosts/curve/default.nix

@@ -1,31 +1,45 @@
-{ self, pkgs, ... }:
+{ self, pkgs, ... }: {
-{
   imports = [
     ./configuration.nix
     ../users/anish
     ../profiles/core
     ../profiles/bluetooth
     ../profiles/music
-    ../profiles/sync/kitaab
-    ../profiles/sync/website
     ../profiles/sync/cal
     ../profiles/wifi
     ../profiles/desktop
     ../profiles/mimetypes
     ../profiles/syncthing
     ../profiles/mossnet-hosts
+    # ../profiles/fly-wg
+    # ../profiles/kuberenetes
+    # ../profiles/mount-mossnet
   ];
 
-  # home-manager.users.anish = import ../../home/gui;
+  # temporarily allow ssh access for work, to be able to do deploy new services
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    settings.PermitRootLogin = "no";
+  };
+
+  # import profiling tools
+  programs.systemtap.enable = true;
+
+  virtualisation.docker.enable = true;
+  virtualisation.docker.storageDriver = "btrfs";
+  environment.systemPackages = with pkgs; [ docker-compose ];
 
   # Speed up boot by removing dependency on network 
   systemd = {
-    targets.network-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
+    targets.network-online.wantedBy =
-    services.NetworkManager-wait-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
+      pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
+    services.NetworkManager-wait-online.wantedBy =
+      pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
   };
 
   programs.gnupg.agent.enable = true;
-  programs.gnupg.agent.pinentryFlavor = "gnome3";
+  programs.gnupg.agent.pinentryPackage = pkgs.pinentry-gnome3;
 
   fileSystems."/mnt/ftp" = {
     device = "192.168.1.240:/home/ftp";
@@ -56,8 +70,15 @@
 
   # lazy enable of ports necessary for KDE connect which is installed via cli home profile (for some reason?)
   networking.firewall = {
-    allowedTCPPortRanges = [{ from = 1714; to = 1764; }];
+    allowedTCPPorts = [ 22 ]; # allow ssh
-    allowedUDPPortRanges = [{ from = 1714; to = 1764; }];
+    allowedTCPPortRanges = [{
+      from = 1714;
+      to = 1764;
+    }];
+    allowedUDPPortRanges = [{
+      from = 1714;
+      to = 1764;
+    }];
   };
 
   age.secrets.curve-wg.file = "${self}/secrets/curve-wg.age";
@@ -69,10 +90,11 @@
   };
 
   age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
+  age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
   mossnet.backup = {
     enable = true;
     name = "curve";
-    paths = [ "/home/anish/usr" ];
+    paths = [ "/home/anish/usr" "/home/anish/.ssh" ];
   };
 
   # enable adb 
@@ -81,7 +103,8 @@
   #virtualisation.docker.enable = true;
   boot.blacklistedKernelModules = [ "qcserial" ];
   # Used for packer Capsul
-  users.users.anish.extraGroups = [ "adbusers" "wheel" "plugdev" "libvertd" ];
+  users.users.anish.extraGroups =
+    [ "adbusers" "wheel" "plugdev" "libvertd" "docker" ];
   virtualisation.libvirtd.enable = true;
   hardware.keyboard.zsa.enable = true;
   services.udev.extraRules = ''

hosts/curve/hardware-configuration.nix

@@ -5,47 +5,43 @@
 
 {
   imports =
-    [
+    [ (modulesPath + "/installer/scan/not-detected.nix")
-      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    {
+    { device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
-      device = "/dev/disk/by-uuid/74ba39ee-35cd-4b87-9ee9-651384fa55bd";
       fsType = "btrfs";
       options = [ "subvol=root" ];
     };
 
   fileSystems."/home" =
-    {
+    { device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
-      device = "/dev/disk/by-uuid/74ba39ee-35cd-4b87-9ee9-651384fa55bd";
       fsType = "btrfs";
       options = [ "subvol=home" ];
     };
 
   fileSystems."/boot" =
-    {
+    { device = "/dev/disk/by-uuid/8244-A184";
-      device = "/dev/disk/by-uuid/87DA-98E7";
       fsType = "vfat";
     };
 
   swapDevices =
-    [{ device = "/dev/disk/by-uuid/c36e3ba9-8eee-4fbf-837c-7e1cfda33f09"; }];
+    [ { device = "/dev/disk/by-uuid/e220fea6-cf3b-4687-bfe1-9cf6d3ba57f7"; }
+    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  # networking.useDHCP = lib.mkDefault true;
+  networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
   # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
 
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  nixpkgs.hostPlatform = "x86_64-linux";
 }

hosts/development/mirlo/docker-compose.nix

@@ -0,0 +1,337 @@
+# Auto-generated using compose2nix v0.1.6.
+{ pkgs, lib, ... }:
+
+{
+  # Runtime
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings = {
+      # Required for container networking to be able to use names.
+      dns_enabled = true;
+    };
+  };
+  virtualisation.oci-containers.backend = "podman";
+
+  # Containers
+  virtualisation.oci-containers.containers."blackbird-api" = {
+    image = "";
+    environment = {
+      API_DOMAIN = "http://localhost:3000";
+      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
+      JWT_SECRET = "test1234";
+      MEDIA_LOCATION = "./data/media/";
+      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
+      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
+      MINIO_HOST = "minio";
+      MINIO_PORT = "9000";
+      MINIO_ROOT_PASSWORD = "password";
+      MINIO_ROOT_USER = "blackbird";
+      NODE_ENV = "development";
+      PORT = "3000";
+      POSTGRES_LOCAL_MACHINE_PORT = "5434";
+      POSTGRES_PASSWORD = "nomads";
+      POSTGRES_USER = "nomads";
+      REACT_APP_API_DOMAIN = "http://localhost:3000";
+      REDIS_HOST = "redis";
+      REDIS_PASSWORD = "password";
+      REDIS_PORT = "6379";
+      REFRESH_TOKEN_SECRET = "test1234";
+      STATIC_MEDIA_HOST = "http://localhost:3000";
+      STRIPE_KEY = "";
+    };
+    volumes = [
+      "/home/anish/.ssh:/root/.ssh:rw"
+      "/home/anish/usr/mirlo:/var/www/api:rw"
+      "/home/anish/usr/mirlo/data/media/downloadCache:/data/media/downloadCache:rw"
+      "/home/anish/usr/mirlo/data/media/incoming:/data/media/incoming:rw"
+    ];
+    ports = [
+      "3000:3000/tcp"
+    ];
+    cmd = [ "/bin/sh" "-c" "yarn && yarn migrate:deploy && yarn dev:api" ];
+    dependsOn = [
+      "blackbird-minio"
+      "blackbird-pgsql"
+      "blackbird-redis"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=api"
+      "--network=mirlo-api-network"
+      "--network=mirlo-redis-network"
+    ];
+  };
+  systemd.services."podman-blackbird-api" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+    };
+    after = [
+      "podman-network-mirlo-api-network.service"
+      "podman-network-mirlo-redis-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-api-network.service"
+      "podman-network-mirlo-redis-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    unitConfig.UpheldBy = [
+      "podman-blackbird-minio.service"
+      "podman-blackbird-pgsql.service"
+      "podman-blackbird-redis.service"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."blackbird-background" = {
+    image = "";
+    environment = {
+      API_DOMAIN = "http://localhost:3000";
+      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
+      JWT_SECRET = "test1234";
+      MEDIA_LOCATION = "./data/media/";
+      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
+      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
+      MINIO_HOST = "minio";
+      MINIO_PORT = "9000";
+      MINIO_ROOT_PASSWORD = "password";
+      MINIO_ROOT_USER = "blackbird";
+      NODE_ENV = "development";
+      PORT = "3000";
+      POSTGRES_LOCAL_MACHINE_PORT = "5434";
+      POSTGRES_PASSWORD = "nomads";
+      POSTGRES_USER = "nomads";
+      REACT_APP_API_DOMAIN = "http://localhost:3000";
+      REDIS_HOST = "redis";
+      REDIS_PASSWORD = "password";
+      REDIS_PORT = "6379";
+      REFRESH_TOKEN_SECRET = "test1234";
+      STATIC_MEDIA_HOST = "http://localhost:3000";
+      STRIPE_KEY = "";
+    };
+    volumes = [
+      "/home/anish/.ssh:/root/.ssh:rw"
+      "/home/anish/usr/mirlo:/var/www/api:rw"
+      "/home/anish/usr/mirlo/data/media/processing:/data/media/processing:rw"
+    ];
+    dependsOn = [
+      "blackbird-api"
+      "blackbird-minio"
+      "blackbird-pgsql"
+      "blackbird-redis"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=background"
+      "--network=mirlo-api-network"
+      "--network=mirlo-redis-network"
+    ];
+  };
+  systemd.services."podman-blackbird-background" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+    };
+    after = [
+      "podman-network-mirlo-api-network.service"
+      "podman-network-mirlo-redis-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-api-network.service"
+      "podman-network-mirlo-redis-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    unitConfig.UpheldBy = [
+      "podman-blackbird-api.service"
+      "podman-blackbird-minio.service"
+      "podman-blackbird-pgsql.service"
+      "podman-blackbird-redis.service"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."blackbird-minio" = {
+    image = "minio/minio";
+    environment = {
+      API_DOMAIN = "http://localhost:3000";
+      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
+      JWT_SECRET = "test1234";
+      MEDIA_LOCATION = "./data/media/";
+      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
+      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
+      MINIO_HOST = "minio";
+      MINIO_PORT = "9000";
+      MINIO_ROOT_PASSWORD = "password";
+      MINIO_ROOT_USER = "blackbird";
+      PORT = "3000";
+      POSTGRES_LOCAL_MACHINE_PORT = "5434";
+      POSTGRES_PASSWORD = "nomads";
+      POSTGRES_USER = "nomads";
+      REACT_APP_API_DOMAIN = "http://localhost:3000";
+      REDIS_HOST = "redis";
+      REDIS_PASSWORD = "password";
+      REDIS_PORT = "6379";
+      REFRESH_TOKEN_SECRET = "test1234";
+      STATIC_MEDIA_HOST = "http://localhost:3000";
+      STRIPE_KEY = "";
+    };
+    volumes = [
+      "/home/anish/usr/mirlo/data/minio_storage:/data:rw"
+    ];
+    ports = [
+      "9000:9000/tcp"
+      "9001:9001/tcp"
+    ];
+    cmd = [ "server" "--console-address" ":9001" "/data" ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=minio"
+      "--network=mirlo-api-network:alias=minio"
+    ];
+  };
+  systemd.services."podman-blackbird-minio" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "no";
+    };
+    after = [
+      "podman-network-mirlo-api-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-api-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."blackbird-pgsql" = {
+    image = "postgres:14-alpine";
+    environment = {
+      API_DOMAIN = "http://localhost:3000";
+      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
+      JWT_SECRET = "test1234";
+      MEDIA_LOCATION = "./data/media/";
+      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
+      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
+      MINIO_HOST = "minio";
+      MINIO_PORT = "9000";
+      MINIO_ROOT_PASSWORD = "password";
+      MINIO_ROOT_USER = "blackbird";
+      PORT = "3000";
+      POSTGRES_LOCAL_MACHINE_PORT = "5434";
+      POSTGRES_PASSWORD = "nomads";
+      POSTGRES_USER = "nomads";
+      REACT_APP_API_DOMAIN = "http://localhost:3000";
+      REDIS_HOST = "redis";
+      REDIS_PASSWORD = "password";
+      REDIS_PORT = "6379";
+      REFRESH_TOKEN_SECRET = "test1234";
+      STATIC_MEDIA_HOST = "http://localhost:3000";
+      STRIPE_KEY = "";
+    };
+    volumes = [
+      "/home/anish/usr/mirlo/data/pgsql:/var/lib/postgresql/data:rw"
+      "/home/anish/usr/mirlo/data/pgsql_backups:/backups:rw"
+    ];
+    ports = [
+      "5432:5432/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=pgsql"
+      "--network=mirlo-api-network:alias=pgsql"
+    ];
+  };
+  systemd.services."podman-blackbird-pgsql" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "no";
+    };
+    after = [
+      "podman-network-mirlo-api-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-api-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."blackbird-redis" = {
+    image = "redis";
+    ports = [
+      "6379:6379/tcp"
+    ];
+    cmd = [ "redis-server" "--appendonly" "yes" "--requirepass " ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=redis"
+      "--network=mirlo-redis-network"
+    ];
+  };
+  systemd.services."podman-blackbird-redis" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+    };
+    after = [
+      "podman-network-mirlo-redis-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-redis-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."podman-network-mirlo-api-network" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-api-network";
+    };
+    script = ''
+      podman network inspect mirlo-api-network || podman network create mirlo-api-network --opt isolate=true
+    '';
+    partOf = [ "podman-compose-mirlo-root.target" ];
+    wantedBy = [ "podman-compose-mirlo-root.target" ];
+  };
+  systemd.services."podman-network-mirlo-redis-network" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-redis-network";
+    };
+    script = ''
+      podman network inspect mirlo-redis-network || podman network create mirlo-redis-network --opt isolate=true
+    '';
+    partOf = [ "podman-compose-mirlo-root.target" ];
+    wantedBy = [ "podman-compose-mirlo-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-mirlo-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

hosts/helix/configuration.nix

@@ -8,7 +8,6 @@
 
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
 
   networking.hostName = "helix"; # Define your hostname.
@@ -22,8 +21,6 @@
 
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
-  services.openssh.passwordAuthentication = false;
-  services.openssh.permitRootLogin = "no";
   sound.enable = false;
 
   # Define a user account. Don't forget to set a password with ‘passwd’.

hosts/helix/default.nix

@@ -1,14 +1,19 @@
-{ self, profiles, suites, ... }:
+{ self, profiles, suites, pkgs, ... }:
 {
   imports = [
     ./configuration.nix
     ../profiles/core
     ../profiles/server
-    ../profiles/metrics
+    # ../profiles/metrics
     ../profiles/gitea
+    # ../profiles/woodpecker-server
     ../profiles/rss-bridge
-    ../profiles/mount-mossnet
+    # ../profiles/mount-mossnet
     ../profiles/freshrss
+    ../profiles/microbin
+    ../profiles/site
+    
+    # ../profiles/postgres_upgrade_script
   ];
 
   # Capsul specific
@@ -17,10 +22,31 @@
     extraGroups = [ "wheel" ];
   };
 
+  age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
+  age.secrets.helix-wg.owner = "anish";
   mossnet.wg = {
     enable = true;
     ips = [ "10.0.69.5/24" ];
-    privateKeyFile = "/home/anish/wg/wg-priv";
+    privateKeyFile = "/run/agenix/helix-wg";
   };
 
+  services.postgresql.package = pkgs.postgresql_15;
+  services.postgresqlBackup = {
+    # TODO needs working wireguard to box
+    enable = false;
+    databases = [ "gitea" "freshrss"  ]; # "woodpecker"
+    location = "/mnt/two/postgres";
+  };
+
+  mossnet.backup = {
+    enable = true;
+    name = "helix";
+    paths = [
+      "/var/lib/gitea"
+      "/var/lib/freshrss"
+      # "/var/lib/woodpecker"
+      "/var/lib/microbin"
+    ];
+
+  };
 }

hosts/helix/disko.nix

@@ -0,0 +1,51 @@
+{ disks ? [ "/dev/vdb" ], ... }: {
+  disko.devices = {
+    disk = {
+      vdb = {
+        type = "disk";
+        device = builtins.elemAt disks 0;
+        content = {
+          type = "table";
+          format = "gpt";
+          partitions = [
+            {
+              name = "ESP";
+              start = "1MiB";
+              end = "128MiB";
+              fs-type = "fat32";
+              bootable = true;
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            }
+            {
+              name = "root";
+              start = "128MiB";
+              end = "100%";
+              content = {
+                type = "btrfs";
+                extraArgs = [ "-f" ]; # Override existing partition
+                subvolumes = {
+                  # Subvolume name is different from mountpoint
+                  "/rootfs" = {
+                    mountpoint = "/";
+                  };
+                  # Mountpoints inferred from subvolume name
+                  "/home" = {
+                    mountOptions = [ "compress=zstd" ];
+                  };
+                  "/nix" = {
+                    mountOptions = [ "compress=zstd" "noatime" ];
+                  };
+                };
+              };
+            }
+          ];
+        };
+      };
+    };
+  };
+}
+

hosts/helix/hardware-configuration.nix

@@ -5,23 +5,27 @@
 
 {
   imports =
-    [
+    [ (modulesPath + "/profiles/qemu-guest.nix")
-      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    {
+    { device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
-      device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
+      fsType = "ext4";
-      fsType = "btrfs";
     };
 
   swapDevices = [ ];
 
-  nix.settings.max-jobs = lib.mkDefault 1;
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  nixpkgs.hostPlatform = "x86_64-linux";
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/lituus/configuration.nix

@@ -8,7 +8,6 @@
 
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
 
   networking.hostName = "lituus"; # Define your hostname.

hosts/lituus/hardware-configuration.nix

@@ -16,8 +16,8 @@
 
   fileSystems."/" =
     {
-      device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
+      device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
-      fsType = "ext4";
+      fsType = "btrfs";
     };
 
   swapDevices = [ ];

hosts/profiles/calibre/default.nix

@@ -36,6 +36,7 @@
       extraConfig = ''
         proxy_pass http://localhost:8083/;
         proxy_set_header X-Forwarded-Host $host;
+        client_max_body_size 50M;
       '';
     };
   };

hosts/profiles/core/default.nix

@@ -4,9 +4,8 @@ in
 {
   imports = [ ../../users/anish ];
 
-
   fonts = {
-    fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
+    packages = with pkgs; [ powerline-fonts dejavu_fonts ];
     fontconfig.defaultFonts = {
       monospace = [ "DejaVu Sans Mono for Powerline" ];
       sansSerif = [ "DejaVu Sans" ];
@@ -33,7 +32,7 @@ in
   };
 
   environment.systemPackages = with pkgs; [
-    pinentry_gnome
+    pinentry-gnome3
     cached-nix-shell
   ];
 
@@ -43,6 +42,8 @@ in
     openFirewall = lib.mkDefault false;
   };
 
+  time.timeZone = "Canada/Pacific";
+
   # programs.gnupg.agent.enable = true;
   # programs.gnupg.agent.pinentryFlavor = "curses";
 

hosts/profiles/desktop/default.nix

@@ -28,6 +28,10 @@ in
   age.secrets.mossnet.file = "${self}/secrets/mossnet.age";
   age.secrets.mossnet.owner = "anish";
 
+  # Taskwarrior private key
+  age.secrets.taskwarrior-private.file = "${self}/secrets/taskwarrior-private.age";
+  age.secrets.taskwarrior-private.owner = "anish";
+
   # We don't plug USBs into servers
   services.devmon.enable = true;
 
@@ -40,6 +44,7 @@ in
       packages = [ pkgs.dconf ];
     };
   };
+  programs.dconf.enable = true;
 
   security.pam.services.Default.enableGnomeKeyring = true;
   security.pam.services.Login.enableGnomeKeyring = true;
@@ -57,23 +62,23 @@ in
   };
 
   environment.systemPackages = with pkgs; [
-    unstable.signal-desktop # bridge to sealight?
+    #unstable.sublime-music
-    unstable.sublime-music
     unstable.nheko
-    unstable.tootle
+    unstable.signal-desktop
-    newsflash
+    unstable.tuba
-    liferea
+    unstable.newsflash
+    unstable.liferea
+    unstable.gh
+    unstable.flyctl
 
-    scrot
+    kooha
-    ripcord
+    light
     xfce.orage
     feh
     sxiv
     xkblayout-state
-    vcv-rack
     zathura
     calibre
-    fractal
     mpv
     zeal
     xclip
@@ -81,7 +86,6 @@ in
     rofi
     rofimoji
     rofi-calc
-    eww
     obs-studio
     lightdm
     dunst
@@ -93,10 +97,18 @@ in
     papirus-icon-theme
     calendar-cli
     wyrd
-    tex
+    # tic-80
-    tic-80
+    ytfzf
+    yt-dlp
   ];
 
+  xdg.portal = {
+    # Breaks link clicking in nheko
+    # Portal doesn't seem to find Firefox as an acceptable app to open links?
+    enable = false;
+    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+    xdgOpenUsePortal = false;
+  };
 
   location.provider = "geoclue2";
   services = {
@@ -107,12 +119,15 @@ in
         night = 3700;
       };
     };
+    displayManager.defaultSession = "none+bspwm";
     xserver = {
       enable = true;
-      layout = "us,dvorak";
+      # TODO should be xkb.layout
+      xkb.layout = "us";
+      # xkb.variant = "dvorak";
       desktopManager.wallpaper.mode = "fill";
       displayManager = {
-        defaultSession = "none+bspwm";
+        # startx.enable = true;
         sessionCommands = ''
           ${pkgs.xorg.xrdb}/bin/xrdb -merge <<EOF
           #define blk  #1F2430
@@ -163,10 +178,11 @@ in
           *.color239: #565761
           *.color240: #6272a4
           *.color241: #b6b6b2
-          EOF
 
           # hotplug
           connect() {
+              # Turn it on if it was off
+              xrandr --output HDMI-2 --auto
               xrandr --output HDMI-2 --same-as eDP-1
           }
 
@@ -175,24 +191,7 @@ in
           }
 
           xrandr | grep "HDMI-2 connected" &>>/dev/null && connect || disconnect
-
+          EOF
-          # keyboard on curve is busted
-          get_keyboard_id() {
-            xinput list | grep 'AT Translated Set' | cut -f2 | cut -d'=' -f2 | xinput float 
-          }
-
-          disconnect_keyboard() {
-            id=$(get_keyboard_id)
-            xinput float $id
-            unset id
-          }
-
-          attach_keyboard() {
-            id=$(get_keyboard_id)
-            xinput reattach $id 3
-          }
-
-          disconnect_keyboard
         '';
         lightdm = {
           enable = true;
@@ -215,7 +214,7 @@ in
     };
   };
 
-  fonts.fonts = with pkgs; [
+  fonts.packages = with pkgs; [
     fira-code
     fira-code-symbols
     hermit

hosts/profiles/dns/default.nix

@@ -1,36 +1,89 @@
 { config, pkgs, lib, ... }:
-{
+let
-  services.dnsmasq.enable = true;
+  adblockLocalZones = pkgs.stdenv.mkDerivation {
-  services.dnsmasq.extraConfig = ''
+    name = "unbound-zones-adblock";
-    domain-needed
+
-    no-resolv
+    src = (pkgs.fetchFromGitHub {
-    local=/lan/
+      owner = "StevenBlack";
-    local=/moss/
+      repo = "hosts";
-    cache-size=5000
+      rev = "3.12.21";
-    addn-hosts=/etc/adblock.hosts 
+      sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
-  ''; # TODO find a way to make adblock hosts reproducible and updateable
+    } + "/hosts");
-  services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
+
-  # TODO use this list in mossnet-hosts
+    phases = [ "installPhase" ];
-  networking.hosts = {
+
-    "192.168.1.240" = [
+    installPhase = ''
-      "mossnet.lan"
+      ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u >  $out
-      "links.mossnet.lan"
+    '';
-      "read.mossnet.lan"
-      "stats.mossnet.lan"
-      "music.mossnet.lan"
-      "rss.mossnet.lan"
-      "tasks.mossnet.lan"
-      "file.mossnet.lan"
-      "books.mossnet.lan"
-      "fin.mossnet.lan"
-      "paper.mossnet.lan"
-      "cal.mossnet.lan"
-      "archive.mossnet.lan"
-    ];
-    "192.168.1.226" = [
-      "df-web.lan"
-    ];
   };
+
+  mossnet = "192.168.1.240"; # The local lan-ip for box
+  wg-mossnet = "10.0.69.4"; # The wireguard ip for box
+  mossnet-hosts = [
+    "mossnet.lan"
+    "headphones.mossnet.lan"
+    "links.mossnet.lan"
+    "read.mossnet.lan"
+    "stats.mossnet.lan"
+    "music.mossnet.lan"
+    "tasks.mossnet.lan"
+    "file.mossnet.lan"
+    "books.mossnet.lan"
+    "fin.mossnet.lan"
+    "paper.mossnet.lan"
+    "cal.mossnet.lan"
+    "archive.mossnet.lan"
+    "headphones.mossnet.lan"
+    "transmission.mossnet.lan"
+    "tracks.mossnet.lan"
+    "grasp.mossnet.lan"
+    "photos.mossnet.lan"
+    "pod.mossnet.lan"
+    "mast.mossnet.lan"
+  ];
+
+in {
+  services.unbound = {
+    enable = true;
+    settings = {
+      server = {
+        include = "${adblockLocalZones}";
+        prefetch = "yes";
+        # private-address = "10.0.69.0/8";
+        # private-address = "192.168.1.0/24";
+        cache-min-ttl = 0;
+        serve-expired = "yes";
+        interface = [ "0.0.0.0" ];
+        access-control =
+          [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
+        access-control-view = "10.0.69.0/24 wireguard";
+        # so-reuseport = "yes";
+        tls-upstream = "yes";
+        domain-insecure = "mossnet.lan";
+        local-zone = ''"mossnet.lan." redirect'';
+        local-data = ''"mossnet.lan. IN A ${mossnet}"'';
+      };
+      forward-zone = [{
+        name = ".";
+        forward-addr = [
+          "45.90.28.0#6939b9.dns.nextdns.io"
+          "1.1.1.1@853#cloudflare-dns.com"
+        ];
+        # non-tls
+        # forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"] 
+      }];
+      view = {
+        name = "wireguard";
+        local-zone = ''"mossnet.lan." redirect'';
+        local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
+      };
+    };
+  };
+
+  # With unbound we're doing wildcard redirects, so we don't need that anymore
+  # networking.hosts = {
+  #   mossnet = mossnet-hosts;
+  # };
   networking.firewall.allowedTCPPorts = [ 53 ];
   networking.firewall.allowedUDPPorts = [ 53 ];
 }

hosts/profiles/finance/default.nix

@@ -2,9 +2,9 @@
 
 {
   services.paperless = {
-    enable = true;
+    enable = false;
     consumptionDirIsPublic = true;
-    extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
+    settings.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
   };
 
   environment.systemPackages = [
@@ -18,6 +18,7 @@
     path = [
       pkgs.fava
     ];
+    wantedBy = [ "multi-user.target" ];
     before = [ "nginx.service" ];
     serviceConfig = {
       User = "anish";

hosts/profiles/fly-wg/default.nix

@@ -0,0 +1,6 @@
+{ pkgs, config, lib, ... }:
+
+{
+  networking.wireguard.interfaces.fly-wg = "/home/anish/usr/fly-io-test/fly-wg.conf";
+  # ssh.startAgent = true;
+}

hosts/profiles/freshrss/default.nix

@@ -17,17 +17,21 @@
 
   services.postgresql = {
     enable = true; # Ensure postgresql is enabled
-    package = pkgs.postgresql_11;
+    # authentication = ''
-    authentication = ''
+    #   local freshrss all ident map=freshrss-users
-      local freshrss all ident map=freshrss-users
+    # '';
-    '';
+    # identMap = # Map the freshrss user to postgresql
-    identMap = # Map the freshrss user to postgresql
+    #   ''
-      ''
+    #     freshrss-users freshrss freshrss
-        freshrss-users freshrss freshrss
+    #     freshrss-users postgres freshrss
-      '';
+    #   '';
     ensureDatabases = [ "freshrss" ];
+    ensureUsers = [{ 
+      name = "freshrss"; 
+      ensureDBOwnership = true;
+    }];
     # TODO
-    # initialScript # set password for gitea user
+    # initialScript # set password for freshrss user
   };
 
   services.nginx.virtualHosts."rss.sealight.xyz" = {

hosts/profiles/gitea/default.nix

@@ -4,56 +4,78 @@
   age.secrets.gitea-dbpass.file = "${self}/secrets/gitea-dbpass.age";
   age.secrets.gitea-dbpass.owner = "gitea";
 
-  services.gitea = {
+  services.forgejo = {
     enable = true;
-    appName = "Sealight Git Forge";
+    user = "gitea";
-    domain = "git.sealight.xyz";
+    group = "gitea";
-    rootUrl = "https://git.sealight.xyz";
+    stateDir = "/var/lib/gitea";
-    httpPort = 3001;
     database = {
       type = "postgres";
+      user = "gitea";
+      name = "gitea";
       passwordFile = "/run/agenix/gitea-dbpass";
     };
     settings = {
+      DEFAULT.APP_NAME = "Sealight Git Forge";
+      server = {
+        DOMAIN = "git.sealight.xyz";
+        ROOT_URL = "https://git.sealight.xyz";
+        HTTP_PORT = 3001;
+      };
       metrics = {
         ENABLED = true;
       };
       repository = {
         DEFAULT_BRANCH = "main";
       };
-      # TODO
+      service.DISABLE_REGISTRATION = true;
       "markup.restructuredtext" = {
         ENABLED = true;
         FILE_EXTENSIONS = ".rst";
-        RENDER_COMMAND = "pandoc +RTS -M512M -RTS -f rst";
+        RENDER_COMMAND = "timeout 30s pandoc +RTS -RTS -f rst";
         IS_INPUT_FILE = false;
       };
-      # TODO 
       mailer = {
-        ENABLED = false;
+        ENABLED = true;
         MAILER_TYPE = "smtp";
         FROM = "ops@sealight.xyz";
-        SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
+        SMTP_ADDR = "smtp.nullhex.com";
+        SMTP_PORT = "465";
+        USER = "ops@sealight.xyz";
+        PASSWD = "breed deputy fossil glory"; # TODO how do we pass this from agenix?
+        IS_TLS_ENABLED = "true";
       };
     };
   };
 
+  users.users.gitea = {
+    home = "/var/lib/gitea";
+    useDefaultShell = true;
+    group = "gitea";
+    isSystemUser = true;
+  };
+
+  users.groups.gitea = {};
+
   environment.systemPackages = [ pkgs.pandoc ];
   services.postgresql = {
     enable = true; # Ensure postgresql is enabled
-    authentication = ''
+    # authentication = ''
-      local gitea all ident map=gitea-users
+    #   local gitea all ident map=gitea-users
-    '';
+    # '';
-    identMap = # Map the gitea user to postgresql
+    # identMap = # Map the gitea user to postgresql
-      ''
+    #   ''
-        gitea-users gitea gitea
+    #     gitea-users gitea gitea
-      '';
+    #     gitea-users postgres gitea
-    # ensureDatabases = [ "gitea" ];
+    #   '';
-    ensureUsers = [
+    ensureDatabases = [ "gitea" ];
-      { name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
+    ensureUsers = [{ 
-    ];
+      name = "gitea"; 
+      ensureDBOwnership = true; 
+    }];
     # TODO
-    # initialScript # set password for gitea user
+    # initialScript 
+    # set password for gitea user
   };
 
   services.nginx = {
@@ -70,6 +92,4 @@
     };
   };
   networking.firewall.allowedTCPPorts = [ 80 443 22 ];
-  security.acme.defaults.email = "anish+acme@lakhwara.com";
-  security.acme.acceptTerms = true;
 }

hosts/profiles/gonic/default.nix

@@ -1,12 +1,21 @@
 { config, lib, pkgs, ... }:
 {
-  services.gonic.enable = true;
+  mossnet.gonic.enable = true;
-  services.gonic.settings = ''
+  mossnet.gonic.settings = ''
     music-path /mnt/two/music/
     podcast-path /data/podcasts
     cache-path /data/cache
+    playlists-path /data/playlists
   '';
-  services.gonic.group = "audio";
+  mossnet.gonic.user = "gonic";
-  services.gonic.user = "headphones";
+  mossnet.gonic.group = "audio";
   networking.firewall.allowedTCPPorts = [ 4747 ];
+
+  users.users.gonic = {
+    # uid = config.ids.uids.headphones;
+    # isSystemUser = true;
+    group = "audio";
+    # home = "/var/lib/headphones";
+    createHome = true;
+  };
 }

hosts/profiles/gonic/module-gonic.nix

@@ -68,14 +68,10 @@ in
         Group = cfg.group;
         DevicePolicy = "closed";
         NoNewPrivileges = " yes";
-        PrivateTmp = "yes";
-        PrivateUsers = "yes";
         ProtectControlGroups = "yes";
         ProtectKernelModules = "yes";
         ProtectKernelTunables = "yes";
         RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
-        RestrictNamespaces = "yes";
-        RestrictRealtime = "yes";
         SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
         ReadWritePaths = dataFolder;
         StateDirectory = baseNameOf dataFolder;

hosts/profiles/gpodder/default.nix

@@ -0,0 +1,16 @@
+{
+  services.gpodder.enable = true;
+  networking.firewall.allowedTCPPorts = [ 3005 ];
+  services.nginx.virtualHosts."pod.mossnet.lan" = {
+    extraConfig = "client_max_body_size 20M;";
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://localhost:3005/;
+        proxy_set_header    X-Forwarded-Proto $scheme;
+        proxy_set_header    X-Real-IP $remote_addr;
+        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
+      '';
+    };
+  };
+}

hosts/profiles/grasp/default.nix

@@ -1,6 +1,12 @@
 { ... }:
 {
-  services."grasp".enable = true;
+  services.grasp = {
-  services."grasp".path = "/home/anish/kitaab/grasp";
+    enable = true;
-  services."grasp".user = "anish";
+    path = "/home/anish/kitaab/grasp/notes.wiki";
+    user = "anish";
+  };
+
+  services.nginx.virtualHosts."grasp.mossnet.lan" = {
+    locations."/".proxyPass = "http://localhost:12212";
+  };
 }

hosts/profiles/headphones/default.nix

@@ -2,11 +2,21 @@
 {
   services.headphones = {
     enable = true;
-    host = "192.168.1.240";
+    host = "0.0.0.0";
     port = 8181;
+    package = "${pkgs.unstable.headphones}";
     user = "headphones";
     group = "audio";
     dataDir = "/data/music";
   };
-  networking.firewall.allowedTCPPorts = [ 8181 ];
+  services.nginx.virtualHosts."headphones.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://127.0.0.1:8181/;
+      '';
+    };
+  };
 }

hosts/profiles/jellyfin/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+{
+  # Enable Hardware Acceleration for transcoding
+  nixpkgs.config.packageOverrides = pkgs: {
+    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+  };
+  hardware.opengl = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      vaapiIntel
+      vaapiVdpau
+      libvdpau-va-gl
+      intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
+    ];
+  };
+  services.jellyfin = {
+    enable = true;
+    user = "jellyfin";
+    group = "video";
+    openFirewall = true; # only for defaults
+  };
+  networking.firewall.allowedTCPPorts = [ 8181 ];
+  users.users.jellyfin = {
+    extraGroups = [ "video" "audio" ];
+  };
+}

hosts/profiles/kuberenetes/default.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+
+{
+  # k3s
+  networking.firewall.allowedTCPPorts = [ 6443 ];
+  services.k3s.enable = true;
+  services.k3s.role = "server";
+  services.k3s.clusterInit = false;
+  # services.k3s.extraFlags = toString [
+  #   "--kubelet-arg=v=4" # Optionally add additional args to k3s
+  # ];
+  environment.systemPackages = [ pkgs.k3s pkgs.kubernetes-helm pkgs.kubectl ];
+
+  # minikube on docker
+  virtualisation.docker.enable = true;
+  virtualisation.docker.storageDriver = "btrfs";
+  # or use kvm
+  # virtualisation.libvirtd.enable = true;
+  users.users.anish.extraGroups = [ "docker" "libvert" ]; # 
+}

hosts/profiles/matrix/default.nix

@@ -3,6 +3,7 @@
 {
   imports = [
     ./mautrix-telegram.nix
+    ./mautrix-services.nix
     # ./mautrix-discord.nix
     # ./mautrix-whatsapp.nix
     # ./mautrix-slack.nix
@@ -19,6 +20,7 @@
   services.matrix-synapse = {
     enable = true;
     settings = {
+      max_upload_size = "100M";
       server_name = "sealight.xyz";
       listeners = [
         {
@@ -40,11 +42,15 @@
           tls = false;
         }
       ];
+
       app_service_config_files = [
         #   The registration file is automatically generated after starting the appservice for the first time.
         #   cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
         #   chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
         "/var/lib/matrix-synapse/telegram-registration.yaml"
+        "/var/lib/matrix-synapse/signal-registration.yaml"
+        "/var/lib/matrix-as-whatsapp/whatsapp-registration.yaml"
+        "/var/lib/matrix-as-discord/discord-registration.yaml"
         # "/var/lib/matrix-synapse/slack-registration.yaml"
         # "/var/lib/matrix-synapse/discord-registration.yaml"
         # "/var/lib/matrix-synapse/whatsapp-registration.yaml"

hosts/profiles/matrix/mautrix-services.nix

@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Mautrix-signal settings
+  services.signald.enable = true;
+  systemd.services.matrix-as-signal = {
+    requires = [ "signald.service" ];
+    after = [ "signald.service" ];
+    unitConfig = {
+      JoinsNamespaceOf = "signald.service";
+    };
+    path = [
+      pkgs.ffmpeg # voice messages need `ffmpeg`
+    ];
+  };
+
+  services.matrix-appservices = {
+    addRegistrationFiles = false;
+    homeserverURL = "https://sealight.xyz/";
+    homeserverDomain = "sealight.xyz";
+    services = {
+      whatsapp = {
+        port = 29183;
+        format = "mautrix-go";
+        package = pkgs.mautrix-whatsapp;
+      };
+
+      discord = {
+        port = 29188;
+        format = "mautrix-go";
+        package = pkgs.my-mautrix-discord;
+      };
+
+      signal = {
+        port = 29184;
+        format = "mautrix-python";
+        package = pkgs.unstable.mautrix-signal;
+        serviceConfig = {
+          StateDirectory = [ "matrix-as-signal" "signald" ];
+          SupplementaryGroups = [ "signald" ];
+          TimeoutStopSec = 1; # work around the service ignoring SIGTERM, see https://gitlab.com/coffeetables/nix-matrix-appservices/-/issues/12
+          User = lib.mkForce config.services.signald.user;
+          Group = lib.mkForce config.services.signald.group;
+        };
+        settings.signal = {
+          socket_path = config.services.signald.socketPath;
+          outgoing_attachment_dir = "/var/lib/signald/tmp";
+        };
+      };
+    };
+  };
+}

hosts/profiles/matrix/mjolnir.nix

@@ -1,9 +1,9 @@
 { self, pkgs, lib, config, ... }:
 {
-  age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age";
+  # age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age";
-  age.secrets.sealight-mod-password.owner = "mjolnir";
+  # age.secrets.sealight-mod-password.owner = "mjolnir";
   services.mjolnir = {
-    enable = true;
+    enable = false;
     protectedRooms = [
       "https://matrix.to/#/#public:sealight.xyz"
       "https://matrix.to/#/#theFeed:sealight.xyz"

hosts/profiles/microbin/default.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+{
+  services.microbin.enable = true;
+  services.microbin.settings.PUBLIC_PATH = "bin.sealight.xyz"; 
+  services.microbin.settings.MICROBIN_PORT = 4949;
+  networking.firewall.allowedTCPPorts = [ 4949 ];
+  services.nginx.virtualHosts."bin.sealight.xyz" = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = "client_max_body_size 20M;";
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://localhost:4949/;
+        proxy_set_header    X-Forwarded-Proto $scheme;
+        proxy_set_header    X-Real-IP $remote_addr;
+        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
+      '';
+    };
+  };
+}

hosts/profiles/mimetypes/default.nix

@@ -2,7 +2,7 @@
 
 {
   xdg.mime.defaultApplications = {
-    "application/pdf" = "firefox.desktop";
+    "application/pdf" = "zathura.desktop";
     "image/png" = [
       "sxiv.desktop"
       "feh.desktop"

hosts/profiles/monitoring/default.nix

@@ -1,25 +1,54 @@
 { self, config, pkgs, ... }: {
+  age.secrets.nullhex-smtp.file = "${self}/secrets/nullhex-smtp.age";
+  age.secrets.nullhex-smtp.owner = "grafana";
+
   # grafana configuration
   services.grafana = {
     enable = true;
-    settings.server = {
+    settings = {
-      domain = "stats.mossnet.lan";
+      smtp = {
-      http_port = 2342;
+        enabled = true;
-      http_addr = "127.0.0.1";
+        password = "$__file{/run/agenix/nullhex-smtp}";
+        host = "smtp.nullhex.com";
+        user = "ops@sealight.xyz";
+        from_address = "ops@sealight.xyz";
+      };
+      server = {
+        domain = "stats.mossnet.lan";
+        http_addr = "127.0.0.1";
+        http_port = 2342;
+        root_url = "http://stats.mossnet.lan/";
+      };
     };
     # TODO enable
     # provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml";
   };
 
   # nginx reverse proxy
-  services.nginx.recommendedProxySettings = true; # Needed for new grafana versions 
+  # services.nginx.recommendedProxySettings = true; # Needed for new grafana versions 
-  services.nginx.virtualHosts.${config.services.grafana.domain} = {
+  services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
     locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
+      proxyPass = "http://127.0.0.1:2342";
       proxyWebsockets = true;
     };
   };
 
+    services.postgresql = {
+      ensureUsers = [{
+        name = "grafana";
+        # TODO this is deprecated 
+        # Need to translate this to 
+        # systemd.services.postgresql.postStart
+        # or initialScript 
+        ensurePermissions = {
+          "ALL TABLES IN SCHEMA public" = "SELECT";
+          "DATABASE wallabag" = "CONNECT";
+          "DATABASE ulogger" = "CONNECT";
+          "DATABASE photoprism" = "CONNECT";
+        };
+      }];
+    };
+
   services.prometheus = {
     enable = true;
     port = 9001;

hosts/profiles/mossnet-hosts/default.nix

@@ -4,6 +4,8 @@
     192.168.1.240 mossnet.lan
     192.168.1.240 links.mossnet.lan
     192.168.1.240 read.mossnet.lan
+    192.168.1.240 headphones.mossnet.lan
+    192.168.1.240 transmission.mossnet.lan
     192.168.1.240 music.mossnet.lan
     192.168.1.240 stats.mossnet.lan
     192.168.1.240 file.mossnet.lan
@@ -11,10 +13,16 @@
     192.168.1.240 fin.mossnet.lan
     192.168.1.240 paper.mossnet.lan
     192.168.1.240 books.mossnet.lan
-    192.f.1.240 archive.mossnet.lan
+    192.168.1.240 archive.mossnet.lan
+    192.168.1.240 music.mossnet.lan
+    192.168.1.240 tracks.mossnet.lan
+    192.168.1.240 grasp.mossnet.lan
+    192.168.1.240 photos.mossnet.lan
+    192.168.1.240 pod.mossnet.lan
   '';
   # 10.0.69.4 mossnet.lan
   #  10.0.69.4 links.mossnet.lan
   #  10.0.69.4 read.mossnet.lan
   #  10.0.69.4 stats.mossnet.lan
 }
+

hosts/profiles/music/default.nix

@@ -16,7 +16,7 @@
     orca-c
     supercollider
     dirt
-    sunvox
+    # sunvox
     vcv-rack
     lmms
     bespokesynth
@@ -31,21 +31,22 @@
   ];
 
   hardware.pulseaudio.enable = lib.mkForce false;
-  security.rtkit.enable = true;
+  security.rtkit.enable = false;
 
   services.pipewire = {
     enable = true;
     alsa.enable = true;
-    alsa.support32Bit = true;
+    alsa.support32Bit = false;
     pulse.enable = true;
     jack.enable = true;
-    config = {
+    # Deprecated as of 23.05
-      pipewire."context.properties"."default.clock.rate" = "48000";
+    # config = {
-      pipewire-pulse."stream.properties"."resample.quality" = 15;
+    #   pipewire."context.properties"."default.clock.rate" = "48000";
-      client."stream.properties"."resample.quality" = 15;
+    #   pipewire-pulse."stream.properties"."resample.quality" = 15;
-      client-rt."stream.properties"."resample.quality" = 15;
+    #   client."stream.properties"."resample.quality" = 15;
-      #jack."context.modules" = [];
+    #   client-rt."stream.properties"."resample.quality" = 15;
-    };
+    #   #jack."context.modules" = [];
+    # };
     #media-session.config.bluez-monitor.properties = {
     #  "bluez5.headset-roles" = [ "hsp_hs" "hsp_ag" ];
     #  "bluez5.codecs" = [ "aac" "ldac" "aptx_hd" ];
@@ -57,6 +58,6 @@
   #  "${config.hardware.bluetooth.package}/libexec/bluetooth/bluetoothd --noplugin=sap"
   #];
   boot.kernelModules = [ "snd-seq" "snd-rawmidi" ]; # midi sequence kernel mods
-  hardware.pulseaudio.package = pkgs.pulseaudio.override { jackaudioSupport = true; };
+  # hardware.pulseaudio.package = pkgs.pulseaudio.override { jackaudioSupport = true; };
 
 }

hosts/profiles/photoprism/default.nix

@@ -0,0 +1,46 @@
+{ self, pkgs, config, lib, ... }:
+
+{
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ "photoprism" ];
+    ensureUsers = [{
+      name = "photoprism";
+      ensureDBOwnership = true;
+    }];
+  };
+
+  services.photoprism = {
+    enable = true;
+    package = pkgs.unstable.photoprism;
+    port = 5152;
+    originalsPath = "/var/lib/private/photoprism/originals";
+    address = "0.0.0.0";
+    settings = {
+      PHOTOPRISM_ADMIN_USER = "admin";
+      PHOTOPRISM_ADMIN_PASSWORD = "photoprism"; # initial password, do change it!
+      PHOTOPRISM_DEFAULT_LOCALE = "en";
+      PHOTOPRISM_DATABASE_DRIVER = "postgres";
+      PHOTOPRISM_DATABASE_NAME = "photoprism";
+      PHOTOPRISM_DATABASE_SERVER = "/run/postgresql/";
+      PHOTOPRISM_DATABASE_USER = "photoprism";
+      PHOTOPRISM_SITE_URL = "http://photos.mossnet.lan/";
+      PHOTOPRISM_SITE_TITLE = "mossnet photos";
+    };
+  };
+
+  services.nginx.clientMaxBodySize = "500m";
+  services.nginx.recommendedProxySettings = true;
+  services.nginx.virtualHosts."photos.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://localhost:5152/;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_buffering off;
+        proxy_http_version 1.1;
+      '';
+    };
+  };
+}

hosts/profiles/postgres_upgrade_script/default.nix

@@ -6,13 +6,12 @@
       # TODO it's perhaps advisable to stop all services that depend on postgresql
       systemctl stop postgresql
 
-      # TODO replace `<new version>` with the psqlSchema here
       # The schema can be found by running:
-      # nix-instantiate '<nixpkgs>' --eval -A postgresql_14.psqlSchema
+      # nix eval --raw nixpkgs#postgresql_15.psqlSchema
-      export NEWDATA="/var/lib/postgresql/<new version>"
+      export NEWDATA="/var/lib/postgresql/15"
 
       # TODO specify the postgresql package you'd like to upgrade to
-      export NEWBIN="${pkgs.postgresql_14}/bin"
+      export NEWBIN="${pkgs.postgresql_15}/bin"
 
       export OLDDATA="${config.services.postgresql.dataDir}"
       export OLDBIN="${config.services.postgresql.package}/bin"

hosts/profiles/rss-bridge/default.nix

@@ -3,7 +3,7 @@
   services.rss-bridge = {
     enable = true;
     virtualHost = "bridge.sealight.xyz";
-    whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
+    config.system.enabled_bridges = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
   };
 
   services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;

hosts/profiles/server/default.nix

@@ -2,8 +2,8 @@
 {
   services.openssh = {
     enable = true;
-    passwordAuthentication = false;
+    settings.PasswordAuthentication = false;
-    permitRootLogin = "no";
+    settings.PermitRootLogin = "no";
   };
   networking.firewall.allowedTCPPorts = [ 80 443 22 ]; # ssh and website
   security.sudo.wheelNeedsPassword = false; # needed for deploy-rs

hosts/profiles/sync/kitaab/default.nix

@@ -1,27 +0,0 @@
-{ pkgs, ... }:
-
-{
-  systemd.services.kitaab-sync = {
-    serviceConfig.Type = "oneshot";
-    path = [
-      pkgs.git
-      pkgs.openssh
-      pkgs.coreutils
-    ];
-    script = ''
-      cd /home/anish/kitaab
-      git add -A
-      git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
-      git push
-      exit 0
-    '';
-    serviceConfig = {
-      User = "anish";
-    };
-  };
-  systemd.timers.kitaab-sync = {
-    wantedBy = [ "timers.target" ];
-    partOf = [ "kitaab-sync.service" ];
-    timerConfig.OnCalendar = [ "hourly" ];
-  };
-}

hosts/profiles/sync/website/default.nix

@@ -6,19 +6,19 @@
     path = [
       pkgs.git
       pkgs.coreutils
-      pkgs.nixUnstable
+      pkgs.nixVersions.latest
       pkgs.openssh
       pkgs.deploy
     ];
     script = ''
-      cd /etc/nixos/ # TODO make variable
+      cd /home/anish/usr/helm/
+      git pull
       nix flake lock --update-input poonam
       nix flake lock --update-input basant
-      # TODO 
+      git add flake.lock
-      # git add flake.lock
+      git diff-index --quiet HEAD || git commit -m 'updating website' # if nothing, don't exit 1
-      # git commit -m "update website"
+      git push
-      # git push
+      deploy .#helix
-      deploy .#cube
       exit 0
     '';
     serviceConfig = {

hosts/profiles/ulogger-server/default.nix

@@ -0,0 +1,61 @@
+{ self, pkgs, config, lib, ... }:
+
+{
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ "ulogger" ];
+    ensureUsers = [{
+      name = "ulogger";
+      ensureDBOwnership = true;
+    }];
+  };
+
+  services.ulogger = {
+    enable = true;
+    hostName = "tracks.mossnet.lan";
+    user = "ulogger";
+    conf = ''
+      <?php
+      /* μlogger
+       *
+       * Copyright(C) 2017 Bartek Fabiszewski (www.fabiszewski.net)
+       *
+       * This is free software; you can redistribute it and/or modify it under
+       * the terms of the GNU General Public License as published by
+       * the Free Software Foundation; either version 3 of the License, or
+       * (at your option) any later version.
+       *
+       * This program is distributed in the hope that it will be useful, but
+       * WITHOUT ANY WARRANTY; without even the implied warranty of
+       * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+       * General Public License for more details.
+       *
+       * You should have received a copy of the GNU General Public License
+       * along with this program; if not, see <http://www.gnu.org/licenses/>.
+       */
+
+      // This is default configuration file.
+      // Copy it to config.php and customize
+
+      // Database config
+
+      // PDO data source name, eg.:
+      // mysql:host=localhost;port=3307;dbname=ulogger;charset=utf8
+      // mysql:unix_socket=/path/to/mysql.sock;dbname=ulogger;charset=utf8
+      // pgsql:host=localhost;port=5432;dbname=ulogger
+      // sqlite:/path/to/ulogger.db
+      $dbdsn = "pgsql:host=/run/postgresql/;port=5432;dbname=ulogger";
+
+      // Database user name
+      $dbuser = "ulogger";
+
+      // Database user password
+      $dbpass = "";
+
+      // Optional table names prefix, eg. "ulogger_"
+      $dbprefix = "";
+
+      ?>
+    '';
+  };
+}

hosts/profiles/wallabag/default.nix

@@ -1,94 +1,37 @@
 { self, pkgs, config, lib, ... }:
 
 {
-  # age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
+  age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
-  # age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
+  age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
-  # age.secrets.wallabag-password.owner = "wallabag";
+  age.secrets.wallabag-password.owner = "wallabag";
-  # age.secrets.wallabag-secret.owner = "wallabag";
+  age.secrets.wallabag-secret.owner = "wallabag";
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_11;
+    package = pkgs.postgresql_15;
 
     # Ensure the database, user, and permissions always exist
     ensureDatabases = [ "wallabag" ];
     ensureUsers = [
       {
         name = "wallabag";
-        ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
+        # ensureDBOwnership = true;
       }
     ];
+    authentication = ''
+      local wallabag all peer
+    '';
   };
 
   services.wallabag = {
     enable = true;
-    hostName = "read.mossnet.lan";
+    domain = "read.mossnet.lan";
-    package = pkgs.wallabag;
+    virtualHost.enable = true;
-    conf = ''
+    package = pkgs.my-wallabag;
-      # This file is a "template" of what your parameters.yml file should look like
+    # Systemd now defaults to /var/lib?
-      parameters:
+    # dataDir = "/var/lib/wallabag";
-          database_driver: pdo_pgsql
+    parameters = {
-          database_host: localhost
+      "env(SECRET_FILE)" = config.age.secrets.wallabag-secret.path;
-          database_port: ~
+      secret = "%env(file:resolve:SECRET_FILE)%";
-          database_name: wallabag
+    };
-          database_user: wallabag
-          database_password: wallabag 
-          # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
-          database_path: ~
-          database_table_prefix: wallabag_
-          database_socket: null
-          # with PostgreSQL and SQLite, you must set "utf8"
-          database_charset: utf8
-
-          domain_name: http://read.mossnet.lan
-          server_name: "mossnet wallabag instance"
-
-          mailer_transport:  smtp
-          mailer_user:       ~
-          mailer_password:   ~
-          mailer_host:       127.0.0.1
-          mailer_port:       false
-          mailer_encryption: ~
-          mailer_auth_mode:  ~
-
-          locale: en
-
-          # A secret key that's used to generate certain security-related tokens
-          secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
-
-          # two factor stuff
-          twofactor_auth: true
-          twofactor_sender: no-reply@wallabag.org
-
-          # fosuser stuff
-          fosuser_registration: true
-          fosuser_confirmation: true
-
-          # how long the access token should live in seconds for the API
-          fos_oauth_server_access_token_lifetime: 3600
-          # how long the refresh token should life in seconds for the API
-          fos_oauth_server_refresh_token_lifetime: 1209600
-
-          from_email: ops@sealight.xyz
-
-          rss_limit: 50
-
-          # RabbitMQ processing
-          rabbitmq_host: localhost
-          rabbitmq_port: 5672
-          rabbitmq_user: guest
-          rabbitmq_password: guest
-          rabbitmq_prefetch_count: 10
-
-          # Redis processing
-          redis_scheme: tcp
-          redis_host: localhost
-          redis_port: 6379
-          redis_path: null
-          redis_password: null
-
-          # sentry logging
-          sentry_dsn: ~
-    '';
   };
-  # networking.firewall.allowedTCPPorts = [ 8080 ];
 } 

hosts/profiles/wireguard-server/default.nix

@@ -18,7 +18,7 @@
     peers = [
       {
         # box
-        publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
+        publicKey = "OnvVM1UaX0nmdohzSDyl90VKwd4VUpJZ+4oBpkkytwU=";
         allowedIPs = [ "10.0.69.4/32" ];
       }
       {
@@ -28,7 +28,7 @@
       }
       {
         # curve
-        publicKey = "kzw+51vVYkitGmSMJPAj1jdhzmxhvmSrrIQ4Ar8wzlI=";
+        publicKey = "zkC7IzXX16i2ixqnRrPlUq2fD2/4noe84FlZBFaDBEE=";
         allowedIPs = [ "10.0.69.2/32" ];
       }
       {
@@ -36,6 +36,16 @@
         publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
         allowedIPs = [ "10.0.69.5/32" ];
       }
+      {
+        # hyperplane
+        publicKey = "v+EUuM60yZLvBmdCG9GxfFAtSjS1VvbUWcyNb8emjDg=";
+        allowedIPs = [ "10.0.69.6/32" ];
+      }
+      {
+        # work
+        publicKey = "/gv66s8DfppCCjaEN/jlc8z95IhEWPgDumykqKEl0QU=";
+        allowedIPs = [ "10.0.69.7/32" ];
+      }
     ];
   };
 }

hosts/profiles/wireguard/default.nix

@@ -1,30 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  # services.tailscale.enable = true;
-  networking.firewall.allowedUDPPorts = [ 60990 ];
-  age.secrets.curve-wg.file = "/etc/nixos/secrets/curve-wg.age";
-  age.secrets.curve-wg.owner = "anish";
-
-  networking.wireguard.interfaces = {
-    # TODO need some kind of module here to configure curve & box from hosts or something 
-    wg0 = {
-      ips = [ "10.0.69.2/24" ];
-      listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
-
-      privateKeyFile = "/run/agenix/curve-wg";
-      peers = [
-        # For a client configuration, one peer entry for the server will suffice.
-        {
-          publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
-          allowedIPs = [ "10.0.69.0/24" ];
-          # Set this to the server IP and port.
-          endpoint = "69.61.38.225:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
-
-          # Send keepalives every 25 seconds. Important to keep NAT tables alive.
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
-}

hosts/profiles/woodpecker-agent/default.nix

@@ -1,61 +1,60 @@
+{ pkgs, config, self, ... }:
 {
-
   users.users.woodpecker-runner = {
     isSystemUser = true;
     group = "woodpecker-runner";
+    home = "/var/lib/woodpecker";
+    createHome = true;
+    extraGroups = [ "docker" ];
   };
   users.groups.woodpecker-runner = { };
   # Allow the exec runner to write to build with nix
-  nix.allowedUsers = [ "woodpecker-runner" ];
+  nix.settings.allowed-users = [ "woodpecker-runner" ];
+  virtualisation.docker.enable = true;
 
-  systemd.services.woodpecker-runner-exec = {
+  age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner";
+  age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";
+
+  systemd.services.woodpecker-agent = {
     enable = true;
-    wantedBy = [ "multi-user.target" ];
     ### MANUALLY RESTART SERVICE IF CHANGED
     restartIfChanged = true;
-    confinement.enable = true;
+    # confinement.enable = true;
-    confinement.packages = [
+    # confinement.packages = [
-      pkgs.git
+    #   pkgs.git
-      pkgs.gnutar
+    #   pkgs.gnutar
-      pkgs.bash
+    #   pkgs.bash
-      pkgs.nixFlakes
+    #   pkgs.nixFlakes
-      pkgs.gzip
+    #   pkgs.gzip
-    ];
+    # ];
-    path = [
+    # path = [
-      pkgs.git
+    #   pkgs.git
-      pkgs.gnutar
+    #   pkgs.gnutar
-      pkgs.bash
+    #   pkgs.bash
-      pkgs.nixFlakes
+    #   pkgs.nixFlakes
-      pkgs.gzip
+    #   pkgs.gzip
-    ];
+    # ];
     serviceConfig = {
+      Type = "simple";
       Environment = [
-        "WOODPECKER_RUNNER_CAPACITY=2"
+        "WOODPECKER_RUNNER_CAPACITY=6"
         "WOODPECKER_RUNNER_NAME=woodpecker-agent"
+        "WOODPECKER_SERVER=ci.sealight.xyz:9000"
+        "WOODPECKER_HOSTNAME=mossnet"
+        "WOODPECKER_BACKEND=docker"
         "NIX_REMOTE=daemon"
         "PAGER=cat"
+        # "WOODPECKER_PROTO=https"
+        # "WOODPECKER_LOG_LEVEL=debug"
       ];
-      BindPaths = [
+      WorkingDirectory = "/var/lib/woodpecker";
-        "/nix/var/nix/daemon-socket/socket"
+      # Runtime directory and mode
-        "/run/nscd/socket"
+      RuntimeDirectory = "woodpecker";
-        # "/var/lib/woodpecker"
+      RuntimeDirectoryMode = "0755";
-      ];
+      # Access write directories
-      BindReadOnlyPaths = [
+      ReadWritePaths = [ "/var/lib/woodpecker" ];
-        "/etc/passwd:/etc/passwd"
-        "/etc/group:/etc/group"
-        "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
-        "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
-        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
-        "${builtins.toFile "ssh_config" ''
-          Host git.sealight.xyz
-          ForwardAgent yes
-        ''}:/etc/ssh/ssh_config"
-        "/etc/machine-id"
-        "/etc/resolv.conf"
-        "/nix/"
-      ];
       EnvironmentFile = [
-        # /run/agenix/woodpecker-agent-secret
+        /run/agenix/woodpecker-agent-secret
       ];
       ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
       User = "woodpecker-runner";

hosts/profiles/woodpecker-server/default.nix

@@ -1,9 +1,16 @@
+{ self, pkgs, config, ... }:
 {
+  age.secrets.woodpecker-server-secrets.owner = "woodpecker";
+  age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age";
+
+  age.secrets.woodpecker-agent-secret.owner = "woodpecker";
+  age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";
   users.users.woodpecker = {
-    group = woodpecker;
+    group = "woodpecker";
     description = "woodpecker user";
     home = "/var/lib/woodpecker";
     createHome = true;
+    isNormalUser = true;
   };
 
   users.groups.woodpecker = { };
@@ -11,41 +18,43 @@
   services.nginx.virtualHosts."ci.sealight.xyz" = {
     enableACME = true;
     forceSSL = true;
-    locations."/".proxyPass = "http://localhost:3030/";
+    locations."/".proxyPass = "http://localhost:38125";
   };
 
+  networking.firewall.allowedTCPPorts = [ 80 443 22 ];
+
   services.postgresql = {
     ensureDatabases = [ "woodpecker" ];
     ensureUsers = [{
       name = "woodpecker";
-      ensurePermissions = {
+      ensureDBOwnership = true;
-        "DATABASE woodpecker" = "ALL PRIVILEGES";
-      };
     }];
   };
 
   systemd.services.woodpecker-server = {
+    after = [ "postgresql.service" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
+      WorkingDirectory = "/var/lib/woodpecker";
       EnvironmentFile = [
-        # GITEA_CLIENT_SECRET etc
+        /run/agenix/woodpecker-server-secrets
-        # /run/agenix/woodpecker
+        /run/agenix/woodpecker-agent-secret
       ];
       Environment = [
-        "WOODPECKER_OPEN=true"
+        "WOODPECKER_OPEN=false"
-        "WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}"
+        "WOODPECKER_HOST=https://ci.sealight.xyz"
+        "WOODPECKER_SERVER_ADDR=:38125"
 
         "WOODPECKER_GITEA=true"
         "WOODPECKER_GITEA_URL=https://git.sealight.xyz"
 
         "WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
         "WOODPECKER_DATABASE_DRIVER=postgres"
-        "WOODPECKER_SERVER_PORT=:3030"
+        "WOODPECKER_ADMIN=aynish"
-        "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username
       ];
       ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
-      User = woodpecker;
+      User = "woodpecker";
-      Group = woodpecker;
+      Group = "woodpecker";
     };
   };
 

hosts/users/anish/default.nix

@@ -1,17 +1,23 @@
 { pkgs, ... }:
 
 {
+  programs.zsh.enable = true;
   users.users.anish = {
     description = "Personal user for Anish";
-    hashedPassword = "$y$j9T$y3DPt/dWaPE.gRazQqw1w0$1RMH5sl/Nu8kW3ZMywYCPRniHD/jF5qRh0VKrdJ.bV2";
+    hashedPassword =
+      "$y$j9T$y3DPt/dWaPE.gRazQqw1w0$1RMH5sl/Nu8kW3ZMywYCPRniHD/jF5qRh0VKrdJ.bV2";
     shell = pkgs.zsh;
     isNormalUser = true;
-    extraGroups = [ "wheel" "audio" "networkmanager" ];
+    extraGroups = [ "wheel" "audio" "networkmanager" "video" ];
     openssh.authorizedKeys.keys = [
       # Curve
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve"
-      # Line
+      # Box
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDtU2GMYjXj6RGO1+mwM4TDGOo0qrKLTL4Di8+QgDX0p5vUEsnE1PS9wnuqCmSu75U8g0XIAMtvtdYyGk1N+Bx01erAZpT8DLYtIXFCyaiN28PVu5T1D0T+TQ7xgIH1qenXZR2DOQdf6kpvKEfm7+7bWhCo0N/KFMpmReubyzHDQcq/1qQasxTL+YALQFOjwKqsOTBXbHwZ103AEAcQX4ftBFEOfVli4/1aKIK4dNSZYB7J9Htq707YnsEqo9RLAMh0aOTTYgTx9AoSUDeqGuh/AGkcB7NcS7EEtI6d5YUGylwZh/gF6hqE0jl8kn2m5jMKXL3CRohZvjifue8x/GIjpu5WRabUuhBEbrfTQQaC7taHnt5rvYCGzKZx09TexUzhuz2CL480DRoxSG+P+lCNm1dIg/EZrnGEzXCSr36PlOqS5t5gm8tPkzCmZf2wU15A3ZIYUPmnYLqsn4WmIV7rKmdqt2ctWELUXow3PPiZXBucP9P3xpsYEfF1SB2SGNc= u0_a139@localhost"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box"
+      # Nix-on-droid line
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOiXBPVvZAp1fY0a0Tupxj0Ml6MoA51lvqt/jAQq249 nix-on-droid@localhost"
+      # Work
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/vvh0i6+uAN0GWlK6ZfyTlc/AW54xe2CroUDsDSoGnFKeIUiSsWexobODlVakNhqwCKfsvUh6g+RdA8ZVcamATcYqxysP4X5fRksmAzRm5281O7ZBDHMB2BdcfHSTgiz7JvMRIQYWDlU8Ck6IL4wlN0b2GMUj9t/GeG37us8280rxpRNoIY7M27AJEZ7XNQhctBIVujxctVBgIMYmZiTwziU7ywJv4rNT5OAWvjRXSo1rkxdvx3VESv4y/mp8m7dEupZpIjIFsLs52+UG5LtadulUqtTWg05sCw8LEcmRhflgZSAvjw60RrKFCuWxc8+/Pmaw+zExeBMenqi0NzuTc3S3k2wCKVIZDh/0tlXzIwZ6WRqxDevUtEKfvbEFMXd8akhTfYs0dyszcFRevBxOBPbcKku+FK/HkdPLmEANvxYty3cv+Eipkz3c8JPJPvXNTXrjepXMm0LUKodO3c15hGogCOxUO38kykkyYnn+MxxHparoMfEr2+oHNpQoS5wA1G43ppqjVoRDgnhleu6ixwRkLZzphY3cnOd5jL9Ie5xIGbFWH1qSlQRdHBkHjuf85z7+QK8nFYAhmG1K3Vt3GNtF8LN1tYQkfwBJ/vsroMNzGPoq4PjVbqb80Eq+96cP89XKfU2/xw1g+p2lJDm/zC1WCjXVzf8NRwC7gqPavQ== anishlakhwara@anishs-mbp.lan"
     ];
   };
 }

install-yubikey.sh

@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 rbtohex() {
     ( od -An -vtx1 | tr -d ' \n' )
 }
@@ -17,7 +19,7 @@ cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(n
 
 # Yubikey Setup
 SLOT=2
-ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
+# ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
 SALT_LENGTH=16
 salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
 k_user=PASSWORDCHANGEMEPLAEASES 
@@ -64,7 +66,7 @@ mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT"
 #touch /mnt-root/nix-store.squashfs
 
 mount "/dev/partitions/$FSROOT" /mnt
-cd /mnt
+cd /mnt || exit
 btrfs subvolume create root
 btrfs subvolume create home
 cd
@@ -145,7 +147,7 @@ cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
   sound.enable = true;
   hardware.pulseaudio.enable = true;
 
-  services.xserver.libinput.enable = true;
+  services.libinput.enable = true;
 
   # Hmmm maybe somewhere else? 
   users.users.anish = {
@@ -167,6 +169,6 @@ cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
 
 endmsg
 
-cd /mnt
+cd /mnt || exit
 nixos-install --root /mnt
 passwd

modules/nixos/backup.nix

@@ -43,7 +43,7 @@ in
           mode = "repokey-blake2";
           passCommand = "cat /run/agenix/borg-password";
         };
-        environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY
+        environment = { BORG_RSH = "ssh -i /run/agenix/borg-key"; };
         compression = "auto,lzma";
         startAt = "daily";
         extraArgs = "--remote-path=borg1";

modules/nixos/default.nix

@@ -8,4 +8,7 @@
   hesienbridge = import ./heisenbridge.nix;
   wireguard = import ./wireguard.nix;
   backup = import ./backup.nix;
+  ulogger-server = import ./ulogger.nix;
+  gpodder2go = import ./gpodder2go.nix;
+  # microbin = import ./microbin.nix; # includide in 23.11
 }