ssh for laptop

This reverts commit c6a21aee85.

.sops.yaml

@@ -3,29 +3,7 @@ keys:
   - &laptop age1yqgyp2uxz4lzrc9f9ka0mfjl5fr6ahf8nf24nlmran2wulg6fpvq9hyp9q
   - &android age12pnf36uqesjmy3e0lythfnpwam3zg5mv8m936fc4jphy4ces2fdqwn0s74
 creation_rules:
-  - path_regex: homebox/secrets.yaml$
+  - path_regex: system/secrets.yaml$
-    key_groups:
-    - age:
-      - *homebox
-  - path_regex: laptop/secrets.yaml$
-    key_groups:
-    - age:
-      - *laptop
-  - path_regex: pi4/secrets.yaml$
-    key_groups:
-    - age:
-      - *laptop
-  - path_regex: live/secrets.yaml$
-    key_groups:
-    - age:
-      - *laptop
-  - path_regex: nathan/secrets.yaml$
-    key_groups:
-    - age:
-      - *laptop
-      - *homebox
-      - *android
-  - path_regex: system-config/secrets.yaml$
     key_groups:
     - age:
       - *laptop

flake.nix

@@ -2,21 +2,15 @@
     description = "Nixos config flake";
      
     inputs = {
-        nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+        nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
 
         nixpkgs-us.url = "github:nixos/nixpkgs/nixos-unstable";
 
         home-manager = {
-            url = "github:nix-community/home-manager/release-25.05";
+            url = "github:nix-community/home-manager/release-25.11";
             inputs.nixpkgs.follows = "nixpkgs";
         };
 
-        nix-on-droid = {
-            url = "github:nix-community/nix-on-droid";
-            inputs.nixpkgs.follows = "nixpkgs";
-            inputs.home-manager.follows = "home-manager";
-        };
-
         disko = {
             url = "github:nix-community/disko";
             inputs.nixpkgs.follows = "nixpkgs";
@@ -27,168 +21,25 @@
             inputs.nixpkgs.follows = "nixpkgs";
         };
 
+        flake-parts.url = "github:hercules-ci/flake-parts";
+
+        import-tree.url = "github:vic/import-tree";
 
         firefox-addons = {
             url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
             inputs.nixpkgs.follows = "nixpkgs";
         };
 
-        nix-minecraft.url = "github:Infinidoge/nix-minecraft";
-
-        #simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-24.05";
-
         hyprland.url = "git+https://github.com/hyprwm/Hyprland?submodules=1";
 
-        #nixvim.url = "git+https://gitea.blunkall.us/Blunkall-Technologies/Moirai";
+        nixvim.url = "git+https://gitea.esotericbytes.com/Blunkall-Technologies/Moirai";
-        nixvim.url = "git+ssh://gitea@gitea.blunkall.us/Blunkall-Technologies/Moirai";
+        #nixvim.url = "git+file:///home/nathan/Projects/Moirai";
 
+        aurora.url = "git+https://gitea.esotericbytes.com/Blunkall-Technologies/Aurora";
+        #aurora.url = "git+file:///home/nathan/Projects/Aurora";
     };
 
-    outputs = { self, nixpkgs, home-manager, ... } @ inputs: {
+    outputs = { ... } @ inputs: 
-
+    inputs.flake-parts.lib.mkFlake { inherit inputs; }
-
+    (inputs.import-tree [ ./modules ]);
-        nixosConfigurations = {
-        
-            homebox = nixpkgs.lib.nixosSystem {
-                specialArgs = { 
-                    inputs = inputs // { 
-                        nathan = import ./home-manager/users/nathan;
-                        home-manager-config = import ./home-manager;
-                        inherit self;
-                    }; 
-                };
-                modules = [
-                    ./system-config/configuration/homebox
-                    ./system-config
-                ];
-            };
-
-            laptop = nixpkgs.lib.nixosSystem {
-                specialArgs = { 
-                    inputs = inputs // { 
-                        nathan = import ./home-manager/users/nathan;
-                        home-manager-config = import ./home-manager;
-                        inherit self;
-                    }; 
-                };
-                modules = [
-                    ./system-config/configuration/laptop
-                    ./system-config
-                ];
-            };
-
-            jesstop = nixpkgs.lib.nixosSystem {
-                specialArgs = { 
-                    inputs = inputs // { 
-                    }; 
-                };
-                modules = [
-                    ./system-config/configuration/jesstop
-                    ./system-config
-                ];
-            };
-
-            pi4 = {
-                system = "aarch64-linux";
-                specialArgs = { 
-                    inputs = inputs // { 
-                        nathan = import ./home-manager/users/nathan;
-                        home-manager-config = import ./home-manager;
-                        inherit self;
-                    }; 
-                };
-                modules = [
-                    ./system-config/configuration/pi4
-                    ./system-config
-                ];
-            };
-
-            live = nixpkgs.lib.nixosSystem {
-                specialArgs = { 
-                    inputs = inputs // { 
-                        nathan = import ./home-manager/users/nathan;
-                        home-manager-config = import ./home-manager;
-                        inherit self;
-                    }; 
-                };
-                modules = [
-                    ./system-config/configuration/live
-                    ./system-config
-                ];
-            };
-
-            container = nixpkgs.lib.nixosSystem {
-                specialArgs = { 
-                    inputs = inputs // { 
-                        nathan = import ./home-manager/users/nathan;
-                        home-manager-config = import ./home-manager;
-                        inherit self;
-                    }; 
-                };
-                modules = [
-                    ./system-config/configuration/containers/nathan
-                    ./system-config
-                ];
-            };
-
-            iso = nixpkgs.lib.nixosSystem {
-                system = "x86_64-linux";
-                specialArgs = { 
-                    inputs = inputs // { 
-                        nathan = import ./home-manager/users/nathan;
-                        home-manager-config = import ./home-manager;
-                        inherit self;
-                    }; 
-                };
-                modules = [
-                    ./system-config/configuration/iso
-                    ./system-config
-                ];
-            };
-        };
-
-        nixOnDroidConfigurations.default = inputs.nix-on-droid.lib.nixOnDroidConfiguration {
-            pkgs = import nixpkgs { 
-                system = "aarch64-linux"; 
-                overlays = [ inputs.nix-on-droid.overlays.default ];
-            };
-
-            modules = [
-                ./system-config/configuration/android 
-            ];
-
-            extraSpecialArgs = {
-                inputs = inputs // {
-                    nathan = import ./home-manager/users/nathan;
-                    home-manager-config = import ./home-manager;
-                };
-            };
-        };
-
-
-        homeConfigurations = {
-            nathan = home-manager.lib.homeManagerConfiguration {
-                pkgs = import nixpkgs {
-                    system = builtins.currentSystem;
-                };
-
-                modules = [
-                    ./home-manager
-                    {
-                        homeconfig = {
-                            username = "nathan";
-                            graphical = false;
-                            minimal = false;
-                        };
-                    }
-                ];
-
-                extraSpecialArgs = {
-                    inherit inputs;
-                };
-            };
-        };
-        
-        iso = self.nixosConfigurations.iso.config.system.build.isoImage;
-    };
 }

home-manager/default.nix

@@ -1,38 +0,0 @@
-{ config, lib, ... }: {
-
-    imports = [
-        ./programs
-        ./services
-    ];
-
-    options.homeconfig = with lib; {
-        host = mkOption {
-            type = with types; nullOr str;
-            default = null;
-        };
-        
-        name = mkOption {
-            type = with types; nullOr str;
-            default = null;
-        };
-        
-        graphical = mkOption {
-            type = with types; bool;
-            default = true;
-        };
-
-        standalone.enable = mkOption {
-            type = with types; bool;
-            default = false;
-        };
-    };
-
-    config = {
-
-        home.username = lib.mkDefault config.homeconfig.name;
-
-        home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
-        
-        programs.home-manager.enable = config.homeconfig.standalone.enable;
-    };
-}

home-manager/programs/calcurse/default.nix

@@ -1,14 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options.homeconfig.calcurse.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.calcurse.enable {
-        home.packages = with pkgs; [
-            calcurse
-            libnotify
-        ];
-    };
-}

home-manager/programs/default.nix

@@ -1,24 +0,0 @@
-{ config, lib, pkgs, inputs, ... }: {
-
-    imports = [
-        ./git
-        ./nh
-        ./hyprland
-        ./hyprpanel
-	    ./terminal
-        ./rofi
-        ./pywal
-        ./hyprlock
-        ./calcurse
-        ./firefox
-    ];
-
-    config = lib.mkIf (config.homeconfig.host != "android") {
-
-        home.packages = lib.mkIf (!config.homeconfig.wal.enable) [
-            inputs.nixvim.packages.${pkgs.system}.default
-        ];
-
-        home.sessionVariables.EDITOR = "nvim";
-    };
-}

home-manager/programs/firefox/default.nix

@@ -1,60 +0,0 @@
-{ config, lib, pkgs, inputs, ... }: {
-
-    options.homeconfig.firefox.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.firefox.enable {
-
-        home.sessionVariables.BROWSER = "${config.programs.firefox.package}/bin/firefox";
-
-        home.packages = lib.mkIf config.homeconfig.wal.enable [ 
-            pkgs.pywalfox-native
-        ];
-
-        home.file.".mozilla/native-messaging-hosts/pywalfox.json".text = let
-            pywalfox-wrapper = pkgs.writeShellScriptBin "pywalfox-wrapper" ''
-                ${pkgs.pywalfox-native}/bin/pywalfox start
-            '';
-        in lib.replaceStrings [ "<path>" ] [
-            "${pywalfox-wrapper}/bin/pywalfox-wrapper"
-        ] (lib.readFile "${pkgs.pywalfox-native}/lib/python3.12/site-packages/pywalfox/assets/manifest.json");
-
-
-        programs.firefox = {
-
-            enable = true;
-            package = pkgs.firefox;
-
-            profiles.nathan = {
-                search = {
-                    default = "ddg";
-                    privateDefault = "ddg";
-                    force = true;
-                };
-                bookmarks = {
-                    force = true;
-                    settings = [
-                        {
-                            name = "toolbar";
-                            toolbar = true;
-                            bookmarks = [
-                                {
-                                    name = "NixOS Search - Packages";
-                                    url = "https://search.nixos.org/packages";
-                                }
-                            ];
-                        }
-                    ];
-                };
-
-                extensions.packages = with inputs.firefox-addons.packages.${pkgs.system}; [
-                    ublock-origin
-                    keepassxc-browser
-                    pywalfox
-                ];
-            };
-        };
-    };
-}

home-manager/programs/git/default.nix

@@ -1,44 +0,0 @@
-{ config, lib, ... }: {
-
-    options.homeconfig.git.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.git.enable {
-
-        sops = {
-            secrets = {
-                "git/username" = {};
-                "git/email" = {};
-            };
-
-            templates.gitconfig.content = ''
-                [user]
-                    name = "${config.sops.placeholder."git/username"}"
-                    email = "${config.sops.placeholder."git/email"}"
-            '';
-        };
-        
-        programs.git = {
-            enable = true;
-
-            includes = [
-                { path = "${config.sops.templates.gitconfig.path}"; }
-            ];
-            
-            extraConfig = {
-                init = {
-                    defaultBranch = "master";
-                };
-                url = {
-                    "ssh://gitea@gitea.blunkall.us/" = {
-                        insteadOf = [
-                            "blunkall:"
-                        ];
-                    };
-                };
-            };
-        };
-    };
-}

home-manager/programs/hyprland/default.nix

@@ -1,66 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options.homeconfig.hyprland.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.hyprland.enable {
-
-        home.sessionVariables.NIX_OZONE_WL = "1";
-
-        programs.kitty.enable = lib.mkDefault true;
-
-        home.packages = with pkgs; [
-            pyprland
-        ];
-
-        home.activation.extraHyprFile = lib.hm.dag.entryAfter ["writeBoundary"] ''
-            if [[ ! -f ${config.home.homeDirectory}/.config/hypr/otf.conf ]]; then
-                touch ${config.home.homeDirectory}/.config/hypr/otf.conf
-            fi
-
-            if [[ ! -f ${config.home.homeDirectory}/.config/background ]]; then
-                cp ${config.home.homeDirectory}/Pictures/Wallpaper/bluescape.jpg ${config.home.homeDirectory}/.config/background
-                chmod 600 ${config.home.homeDirectory}/.config/background
-            fi
-        '';
-
-
-        wayland.windowManager.hyprland = {
-
-            enable = true;
-
-            systemd = {
-                enable = true;
-                variables = [ "--all" ];
-            };
-
-            extraConfig = (if config.homeconfig.host == "laptop" then ''
-                    bind = CTRL SHIFT, XF86Launch2, exec, bash -c 'if [[ $(hyprctl monitors | grep 0x0 | sed -n -e "s/\t*1920x1080@//" -e "s/.[1234567890]* at 0x0//p") == 300 ]]; then pkexec --user root /nix/var/nix/profiles/system/bin/switch-to-configuration switch; else pkexec --user root /nix/var/nix/profiles/system/specialisation/docked/bin/switch-to-configuration switch; fi'
-                    bind = ALT, Escape, exec, if [[ $(hyprctl monitors | grep 0x0 | sed -n -e "s/\t*1920x1080@//" -e "s/.[1234567890]* at 0x0//p") == 300 ]]; then hyprctl keyword monitor eDP-1,1920x1080@60,0x0,1; else hyprctl keyword monitor eDP-1,1920x1080@300,0x0,1; fi
-                '' else if config.homeconfig.host == "homebox" then ''
-                    monitor=HDMI-A-2,1920x1080@60,0x0,1
-                    monitor=HEADLESS-2,1920x1080@60,0x0,1
-                    exec-once=hyprctl output create headless HEADLESS-2
-                    exec-once=hyprctl keyword monitor HDMI-A-2,disable
-                    exec-once=${pkgs.wayvnc}/bin/wayvnc 0.0.0.0 -o HEADLESS-2
-                '' else if config.homeconfig.host == "container" then ''
-                    monitor=HEADLESS-2,1920x1080@60,0x0,1
-                    exec-once=hyprctl output create headless HEADLESS-2
-                    exec-once=${pkgs.wayvnc}/bin/wayvnc 0.0.0.0 -o HEADLESS-2
-                '' else ''
-                    monitor= , prefered, auto, 1
-                '') + (if config.homeconfig.hyprpanel.enable then ''
-                    bind = , Print, exec, bash -c ${pkgs.hyprpanel}/share/scripts/screenshot.sh"
-                '' else ''
-                    bind = , Print, exec, grim -g "$(slurp)"
-                '') + ''
-                source = ${config.home.homeDirectory}/.config/hypr/main.conf
-
-                exec-shutdown = if [[ -f ${config.home.homeDirectory}/.local/share/calcurse/.calcurse.pid ]]; then rm ${config.home.homeDirectory}/.local/share/calcurse/.calcurse.pid; fi
-            '';
-
-        };
-    };
-}

home-manager/programs/hyprlock/default.nix

@@ -1,52 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options.homeconfig.hyprlock.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.hyprlock.enable {
-
-        programs.hyprlock = {
-            enable = true;
-        };
-
-        services.hypridle = {
-            enable = true;
-
-            settings = {
-
-                general = {
-                    lock_cmd = "pidof hyprlock || hyprlock";       # avoid starting multiple hyprlock instances.
-                    before_sleep_cmd = "loginctl lock-session";    # lock before suspend.
-                    after_sleep_cmd = "hyprctl --instance 0 dispatch dpms on";  # to avoid having to press a key twice to turn on the display.
-                };
-
-                listener = [
-
-                {
-                    timeout = 150;                                # 2.5min.
-                    on-timeout = "brightnessctl -s set 10";        # set monitor backlight to minimum, avoid 0 on OLED monitor.
-                    on-resume = "brightnessctl -r";                 # monitor backlight restore.
-                }
-
-                {
-                    timeout = 300;                                 # 5min
-                    on-timeout = "loginctl lock-session";            # lock screen when timeout has passed
-                }
-
-                {
-                    timeout = 330;                                                     # 5.5min
-                    on-timeout = "hyprctl --instance 0 dispatch dpms off";                            # screen off when timeout has passed
-                    on-resume = "hyprctl --instance 0 dispatch dpms on && brightnessctl -r";          # screen on when activity is detected after timeout has fired.
-                }
-
-                {
-                    timeout = 1800;                                # 30min
-                    on-timeout = "systemctl suspend";                # suspend pc
-                }
-                ];
-            };
-        };
-    };
-}

home-manager/programs/hyprpanel/default.nix

@@ -1,14 +0,0 @@
-{ config, lib, ... }: {
-
-    options.homeconfig.hyprpanel.enable = with lib; mkOption {
-        type = with types; bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.hyprpanel.enable {
-        
-        programs.hyprpanel = {
-            enable = true;
-        };
-    };
-}

home-manager/programs/nh/default.nix

@@ -1,21 +0,0 @@
-{ config, lib, ... }: {
-
-    options.homeconfig.nh.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.nh.enable {
-        
-        programs.nh = {
-            enable = true;
-            flake = "${config.home.homeDirectory}/Projects/Olympus";
-
-            clean = {
-                enable = true;
-                dates = "weekly";
-                extraArgs = "--keep 5 --keep-since 5d";
-            };
-        };
-    };
-}

home-manager/programs/pywal/default.nix

@@ -1,19 +0,0 @@
-{ config, lib, pkgs, inputs, ... }: {
-
-    options.homeconfig.wal.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.wal.enable {
-
-        home.packages = with pkgs; [
-            inputs.nixvim.packages.${pkgs.system}.pywal
-
-            pywal16
-		    imagemagick
-        ];
-
-        
-    };
-}

home-manager/programs/quickshell/default.nix

@@ -1,14 +0,0 @@
-{ config, lib, ... }: {
-
-    options.homeconfig.quickshell.enable = with lib; mkOption {
-        type = with types; bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.quickshell.enable {
-        
-        programs.quickshell = {
-            enable = true;
-        };
-    };
-}

home-manager/programs/rofi/default.nix

@@ -1,20 +0,0 @@
-{ config, lib, pkgs, ... }: {
-    
-    options.homeconfig.rofi.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.rofi.enable {
-        programs.rofi = {
-
-            enable = true;
-            package = pkgs.rofi-wayland;
-
-            cycle = true;
-
-            theme = "/home/nathan/.cache/wal/colors-rofi-dark.rasi";
-        };
-    };
-}
-

home-manager/programs/terminal/bash/default.nix

@@ -1,31 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    home.packages = with pkgs; [ oh-my-posh ];
-
-    programs.bash = {
-        enable = true;
-        enableCompletion = true;
-
-        shellAliases = {
-            ls = "eza";
-            ll = "ls -l";
-
-            ksh = "kitten ssh";
-
-            vi = "nvim";
-            vim = "nvim";
-
-        };
-
-        bashrcExtra = ''
-            source ${pkgs.blesh}/share/blesh/ble.sh
-        '';
-
-        initExtra = if config.homeconfig.wal.enable then (lib.mkBefore ''
-            cat ${config.home.homeDirectory}/.cache/wal/sequences
-            eval "$(oh-my-posh init bash --config ${config.home.homeDirectory}/.cache/wal/ohmyposh.toml)"
-        '') else (lib.mkBefore ''
-            eval "$(oh-my-posh init bash --config ${config.home.homeDirectory}/.config/ohmyposh/ohmyposh.toml)"
-        '');
-    };
-}

home-manager/programs/terminal/bat/default.nix

@@ -1,18 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.bat = {
-
-    enable = true;
-
-    extraPackages = with pkgs.bat-extras; [
-      batman
-      batpipe
-      batgrep
-      batdiff
-      batwatch
-      prettybat
-    ];
-
-
-  };
-}

home-manager/programs/terminal/default.nix

@@ -1,16 +0,0 @@
-{ ... }: {
-
-  imports = [
-    ./bat
-    ./bash
-    ./eza
-    ./fzf
-    ./lf
-    ./tmux
-    ./kitty
-    ./zoxide
-    ./zsh
-    ./ssh
-    ./ohmyposh
-  ];
-}

home-manager/programs/terminal/eza/default.nix

@@ -1,17 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.eza = {
-
-    enable = true;
-
-    enableZshIntegration = true;
-
-    extraOptions = [
-      "--color=auto"
-    ];
-
-    git = true;
-
-    icons = "auto";
-  };
-}

home-manager/programs/terminal/fzf/default.nix

@@ -1,15 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.fzf = {
-  
-    enable = true;
-
-    enableZshIntegration = true;
-
-    tmux = {
-      #enableShellIntegration = true;
-
-      #shellIntegrationOptions = [];
-    };
-  };
-}

home-manager/programs/terminal/kitty/default.nix

@@ -1,33 +0,0 @@
-{ config, lib, pkgs, ... }: {
-      
-  programs.kitty = {
-    
-    enable = true;
-
-    font = {
-      name = "FiraCode Nerd Font";
-      size = 12;
-    };
-
-    extraConfig = ''
-
-confirm_os_window_close 0
-
-include ${config.home.homeDirectory}/.cache/wal/colors-kitty.conf
-
-disable_ligatures never
-
-dynamic_background_opacity yes
-
-tab_bar_edge top
-
-map ctrl+shift+t new_tab
-map ctrl+shift+w close_tab
-
-map ctrl+tab next_tab
-map ctrl+shift+tab previous_tab
-
-    '';
-  };
-}
-

home-manager/programs/terminal/lf/default.nix

@@ -1,7 +0,0 @@
-{ ... }: {
-    config = {
-        programs.lf = {
-            enable = true;
-        };
-    };
-}

home-manager/programs/terminal/ohmyposh/default.nix

@@ -1,132 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  home.packages = with pkgs; [
-    oh-my-posh
-  ];
-  
-  programs.zsh = {
-    
-    initContent = if config.homeconfig.wal.enable then (lib.mkBefore ''
-      cat ${config.home.homeDirectory}/.cache/wal/sequences
-      eval "$(oh-my-posh init zsh --config ${config.home.homeDirectory}/.cache/wal/ohmyposh.toml)"
-    '') else (lib.mkBefore ''
-      eval "$(oh-my-posh init zsh --config ${config.home.homeDirectory}/.config/ohmyposh/ohmyposh.toml)"
-    '');
-
-  };
-
-  home.file.".config/wal/templates/ohmyposh.toml".text = ''
-#:schema https://raw.githubusercontent.com/JanDeDobbeleer/oh-my-posh/main/themes/schema.json
-
-version = 2
-final_space = true
-console_title_template = '{{{{ .Shell }}}} in {{{{ .Folder }}}}'
-
-[[blocks]]
-  type = 'prompt'
-  alignment = 'left'
-  newline = true
-
-  [[blocks.segments]]
-    type = 'os'
-    style = 'diamond'
-    trailing_diamond = ''
-    background = 'p:c1'
-    foreground = 'p:c12'
-    template = ' {{{{ .Icon }}}} '
-
-  [[blocks.segments]]
-    type = 'session'
-    style = 'diamond'
-    trailing_diamond = ''
-    background = 'p:c2'
-    foreground = 'p:c14'
-    template = '{{{{ .UserName }}}}@{{{{ .HostName }}}}'
-
-  [[blocks.segments]]
-    type = 'path'
-    style = 'diamond'
-    trailing_diamond = ''
-    background = 'p:c4'
-    foreground = 'p:c13'
-    template = '{{{{ .Path }}}}'
-
-    [blocks.segments.properties]
-      style = 'full'
-
-[[blocks]]
-  type = 'prompt'
-  overflow = 'hidden'
-  alignment = 'right'
-
-  [[blocks.segments]]
-    type = 'executiontime'
-    style = 'diamond'
-    leading_diamond = ''
-    background = 'p:c4'
-    foreground = 'p:c13'
-    template = '{{{{ .FormattedMs }}}}'
-
-  [[blocks.segments]]
-    type = 'time'
-    style = 'diamond'
-    leading_diamond = ''
-    background = 'p:c2'
-    foreground = 'p:c14'
-
-  [[blocks.segments]]
-    type = 'shell'
-    style = 'diamond'
-    leading_diamond = ''
-    background = 'p:c1'
-    foreground = 'p:c12'
-
-[[blocks]]
-  type = 'prompt'
-  alignment = 'left'
-  newline = true
-
-  [[blocks.segments]]
-    type = 'text'
-    style = 'plain'
-    background = 'transparent'
-    foreground_templates = [
-      "{{{{ if gt .Code 0 }}}}p:c13{{{{end}}}}",
-      "{{{{ if eq .Code 0 }}}}p:c14{{{{end}}}}",
-    ]
-    template = "{{{{ if gt .Code 0 }}}}!❭ {{{{else}}}}❭ {{{{end}}}}"
-
-[transient_prompt] 
-  foreground_templates = [
-    "{{{{ if gt .Code 0 }}}}p:c13{{{{end}}}}",
-    "{{{{ if eq .Code 0 }}}}p:c14{{{{end}}}}",
-  ]
-  background = 'transparent'
-  template = "{{{{ if gt .Code 0 }}}}!❭ {{{{else}}}}❭ {{{{end}}}}"
-
-[secondary_prompt]
-  background = 'transparent'
-  forground = 'p:c14'
-  template = "❭❭ "
-
-
-[palette]
-
-c0 = "{color0}"
-c1 = "{color1}"
-c2 = "{color2}"
-c3 = "{color3}"
-c4 = "{color4}"
-c5 = "{color5}"
-c6 = "{color6}"
-c7 = "{color7}"
-c8 = "{color8}"
-c9 = "{color9}"
-c10 = "{color10}"
-c11 = "{color11}"
-c12 = "{color12}"
-c13 = "{color13}"
-c14 = "{color14}"
-c15 = "{color15}"
-  '';
-}

home-manager/programs/terminal/ssh/default.nix

@@ -1,8 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.ssh = {
-
-    enable = true;
-
-  };
-}

home-manager/programs/terminal/tmux/default.nix

@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.tmux = {
-    
-    enable = true;
-    
-    clock24 = true;
-    
-    mouse = true;
-    
-    baseIndex = 1;
-    
-    keyMode = "vi";
-    
-    prefix = "C-b";
-    
-    shell = "${pkgs.zsh}/bin/zsh";
-  
-  };
-
-}
-
-

home-manager/programs/terminal/zoxide/default.nix

@@ -1,13 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.zoxide = {
-
-    enable = true;
-
-    enableZshIntegration = true;
-
-    options = [
-      "--cmd cd"
-    ];
-  };
-}

home-manager/programs/terminal/zsh/default.nix

@@ -1,33 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.zsh = {
-    
-    enable = true;
-    
-    enableCompletion = true;
-    
-    autosuggestion.enable = true;
-    
-    syntaxHighlighting.enable = true;
-    
-    shellAliases = {
-      ls = "eza";
-      ll = "ls -l";
-
-      ksh = "kitten ssh";
-
-      vi = "nvim";
-      vim = "nvim";
-
-      python = "python3.13";
-      python3 = "python3.13";
-    };
-
-    history = {
-      size = 5000;
-      ignoreAllDups = true;
-      ignoreSpace = true;
-      share = true;
-    };
-  };
-}

home-manager/services/custom/default.nix

@@ -1 +0,0 @@
-{}: {}

home-manager/services/default.nix

@@ -1,5 +0,0 @@
-{ ... }: {
-    imports = [
-        ./mpd
-    ];
-}

home-manager/services/mpd/default.nix

@@ -1,41 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options = {
-        homeconfig.mpd.enable = lib.options.mkOption {
-            type = lib.types.bool;
-            default = false;
-        };
-    };
-
-    config = lib.mkIf config.homeconfig.mpd.enable {
-        services.mpd = {
-            enable = true;
-            network.startWhenNeeded = true;
-            network.port = 6600;
-            network.listenAddress = "127.0.0.1";
-            musicDirectory = "/home/nathan/Music";
-            extraConfig = ''
-                audio_output {
-                    type "pipewire"
-                    name "Audio1"
-                }
-                audio_output {
-                    type "fifo"
-                    name "visualizer"
-                    path "/tmp/mpd.fifo"
-                    format "44100:16:1"
-                }
-            '';
-        };
-
-        services.mpdris2 = { 
-            enable = true;
-            mpd.host = "127.0.0.1";
-            mpd.port = 6600;
-            package = pkgs.mpdris2;
-            mpd.musicDirectory = "/home/nathan/Music";
-            notifications = true;
-        };
-    };
-
-}

home-manager/users/nathan/default.nix

@@ -1,74 +0,0 @@
-{ config, lib, pkgs, inputs, ... }: {
-
-    imports = [
-#        ./programs
-#        ./services
-        ./packages
-        ./dotfiles
-	];
-
-    config = {
-
-        homeconfig = {
-            mpd.enable = lib.mkDefault true;
-            calcurse.enable = lib.mkDefault true;
-            git.enable = lib.mkDefault true;
-            nh.enable = lib.mkDefault true;
-        };
-
-        home.stateVersion = "23.11";
-
-        home.pointerCursor = lib.mkIf config.homeconfig.graphical {
-            gtk.enable = true;
-            package = pkgs.bibata-cursors;
-            name = "Bibata-Modern-Classic";
-            size = 16;
-        };
-
-        gtk = lib.mkIf config.homeconfig.graphical {
-            enable = true;
-            theme.name = "Tokyonight-Dark";
-            theme.package = pkgs.tokyonight-gtk-theme;
-            iconTheme.package = pkgs.rose-pine-icon-theme;
-            iconTheme.name = "rose-pine-moon";
-        };
-
-        sops = {
-            age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
-            defaultSopsFile = ./secrets.yaml;
-            defaultSopsFormat = "yaml";
-        };
-
-        nix = lib.mkIf config.homeconfig.standalone.enable {
-            nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
-            settings = {
-                experimental-features = [ "nix-command" "flakes" ];
-                builders = "ssh://builder x86_64-linux,aarch64-linux /run/secrets/remoteBuildKey 1 1 nixos-test,benchmark,big-parallel,kvm - -";
-                builders-use-substituters = true;
-            };
-        };
-
-        services.mpris-proxy.enable = true;
-
-        programs.ssh = {
-            enable = true;
-
-            matchBlocks = {
-                "builder" = {
-                    hostname = "blunkall.us";
-                    user = "remote-builder";
-                    identityFile = "${config.home.homeDirectory}/.ssh/id_ed25519";
-                    port = 2222;
-                };
-                
-                "remote" = {
-                    hostname = "blunkall.us";
-                    user = "nathan";
-                    identityFile = "${config.home.homeDirectory}/.ssh/id_ed25519";
-                    port = 2222;
-                };
-            };
-        };
-
-    };
-}

home-manager/users/nathan/dotfiles/default.nix

@@ -1,11 +0,0 @@
-{ config, lib, ... }: {
-
-	home.file = {
-		".config/hypr" = lib.mkIf config.homeconfig.hyprland.enable { source = ./hypr; recursive = true; };
-		".config/hyprpanel" = lib.mkIf config.homeconfig.hyprpanel.enable { source = ./hyprpanel; recursive = true; };
-		".config/wal/templates" = lib.mkIf config.homeconfig.wal.enable { source = ./wal/templates; recursive = true; };
-		".config/ohmyposh" = { source = ./ohmyposh; recursive = true; };
-		"Pictures/Wallpaper" = lib.mkIf config.homeconfig.graphical { source = ./Wallpaper; recursive = true; };
-	};
-
-}

home-manager/users/nathan/dotfiles/hypr/hyprlock.conf

@@ -1,106 +0,0 @@
-# sample hyprlock.conf
-# for more configuration options, refer https://wiki.hyprland.org/Hypr-Ecosystem/hyprlock
-#
-# rendered text in all widgets supports pango markup (e.g. <b> or <i> tags)
-# ref. https://wiki.hyprland.org/Hypr-Ecosystem/hyprlock/#general-remarks
-#
-# shortcuts to clear password buffer: ESC, Ctrl+U, Ctrl+Backspace
-#
-# you can get started by copying this config to ~/.config/hypr/hyprlock.conf
-#
-
-$font = Monospace
-
-general {
-    hide_cursor = false
-}
-
-# uncomment to enable fingerprint authentication
-# auth {
-#     fingerprint {
-#         enabled = true
-#         ready_message = Scan fingerprint to unlock
-#         present_message = Scanning...
-#         retry_delay = 250 # in milliseconds
-#     }
-# }
-
-animations {
-    enabled = true
-    bezier = linear, 1, 1, 0, 0
-    animation = fadeIn, 1, 5, linear
-    animation = fadeOut, 1, 5, linear
-    animation = inputFieldDots, 1, 2, linear
-}
-
-background {
-    monitor =
-    path = screenshot
-    blur_passes = 3
-}
-
-input-field {
-    monitor =
-    size = 20%, 5%
-    outline_thickness = 3
-    inner_color = rgba(0, 0, 0, 0.0) # no fill
-
-    outer_color = rgba(33ccffee) rgba(00ff99ee) 45deg
-    check_color = rgba(00ff99ee) rgba(ff6633ee) 120deg
-    fail_color = rgba(ff6633ee) rgba(ff0066ee) 40deg
-
-    font_color = rgb(143, 143, 143)
-    fade_on_empty = false
-    rounding = 15
-
-    font_family = $font
-    placeholder_text = Input password...
-    fail_text = $PAMFAIL
-
-    # uncomment to use a letter instead of a dot to indicate the typed password
-    # dots_text_format = *
-    # dots_size = 0.4
-    dots_spacing = 0.3
-
-    # uncomment to use an input indicator that does not show the password length (similar to swaylock's input indicator)
-    # hide_input = true
-
-    position = 0, -20
-    halign = center
-    valign = center
-}
-
-# TIME
-label {
-    monitor =
-    text = $TIME # ref. https://wiki.hyprland.org/Hypr-Ecosystem/hyprlock/#variable-substitution
-    font_size = 90
-    font_family = $font
-
-    position = -30, 0
-    halign = right
-    valign = top
-}
-
-# DATE
-label {
-    monitor =
-    text = cmd[update:60000] date +"%A, %d %B %Y" # update every 60 seconds
-    font_size = 25
-    font_family = $font
-
-    position = -30, -150
-    halign = right
-    valign = top
-}
-
-label {
-    monitor =
-    text = $LAYOUT[en,ru]
-    font_size = 24
-    onclick = hyprctl switchxkblayout all next
-
-    position = 250, -20
-    halign = center
-    valign = center
-}

home-manager/users/nathan/dotfiles/hyprpanel/config.json

@@ -1,65 +0,0 @@
-{
-  "theme.font.name": "FiraCode Nerd Font Mono",
-  "theme.font.label": "FiraCode Nerd Font Mono Medium",
-  "theme.bar.floating": true,
-  "bar.layouts": {
-    "*": {
-      "left": [
-        "dashboard",
-        "workspaces",
-        "windowtitle",
-        "submap",
-        "kbinput"
-      ],
-      "middle": [
-        "volume",
-        "battery",
-        "hyprsunset",
-        "clock",
-        "hypridle",
-        "network",
-        "bluetooth"
-      ],
-      "right": [
-        "ram",
-        "storage",
-        "systray",
-        "cava",
-        "notifications",
-        "power"
-      ]
-    }
-  },
-  "theme.bar.opacity": 50,
-  "wallpaper.image": "/tmp/nathan/bg",
-  "wallpaper.enable": false,
-  "theme.matugen_settings.scheme_type": "content",
-  "theme.matugen_settings.variation": "standard_2",
-  "theme.matugen": true,
-  "bar.launcher.autoDetectIcon": true,
-  "bar.network.truncation_size": 10,
-  "bar.bluetooth.label": false,
-  "bar.clock.showIcon": false,
-  "bar.clock.format": "%A %H:%M:%S %m/%d/%C%y",
-  "bar.notifications.show_total": true,
-  "bar.notifications.hideCountWhenZero": true,
-  "menus.dashboard.shortcuts.left.shortcut2.command": "spotify",
-  "menus.dashboard.shortcuts.left.shortcut1.command": "$BROWSER",
-  "menus.dashboard.shortcuts.left.shortcut1.tooltip": "Browser",
-  "menus.dashboard.shortcuts.left.shortcut1.icon": "󰈹",
-  "menus.dashboard.directories.enabled": false,
-  "menus.dashboard.stats.enable_gpu": true,
-  "menus.power.lowBatteryNotification": true,
-  "bar.customModules.cava.leftClick": "menu:media",
-  "bar.customModules.cava.showIcon": false,
-  "bar.customModules.hypridle.label": false,
-  "bar.customModules.hyprsunset.label": false,
-  "bar.customModules.hyprsunset.temperature": "4000k",
-  "bar.customModules.netstat.dynamicIcon": true,
-  "bar.customModules.netstat.label": true,
-  "bar.workspaces.show_numbered": true,
-  "bar.workspaces.numbered_active_indicator": "highlight",
-  "bar.workspaces.ignored": "-\\d+",
-  "menus.clock.time.military": true,
-  "menus.clock.weather.enabled": false
-}

home-manager/users/nathan/dotfiles/hyprpanel/modules.json

@@ -1 +0,0 @@
-{}

home-manager/users/nathan/dotfiles/wal/templates/colors-hypr.conf

@@ -1,18 +0,0 @@
-$foregroundCol = 0xff{foreground.strip}
-$backgroundCol = 0xff{background.strip}
-$color0 = 0xff{color0.strip}
-$color1 = 0xff{color1.strip}
-$color2 = 0xff{color2.strip}
-$color3 = 0xff{color3.strip}
-$color4 = 0xff{color4.strip}
-$color5 = 0xff{color5.strip}
-$color6 = 0xff{color6.strip}
-$color7 = 0xff{color7.strip}
-$color8 = 0xff{color8.strip}
-$color9 = 0xff{color9.strip}
-$color10 = 0xff{color10.strip}
-$color11 = 0xff{color11.strip}
-$color12 = 0xff{color12.strip}
-$color13 = 0xff{color13.strip}
-$color14 = 0xff{color14.strip}
-$color15 = 0xff{color15.strip}

home-manager/users/nathan/packages/default.nix

@@ -1,104 +0,0 @@
-{ config, lib, pkgs, inputs, ... }: let 
-    system = "x86_64-linux";
-
-    pkgs-us = import inputs.nixpkgs-us {
-      inherit system;
-      config.allowUnfree = true;
-    };
-
-    in {
-
-    imports = [ 
-	  ./scripts
-	];
-
-    options.homeconfig.minimal = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = {
-
-        nixpkgs.config = lib.mkIf (!config.homeconfig.minimal) {
-            allowUnfree = true;
-        };
-
-        home.packages = with pkgs; ([
-
-            inputs.disko.packages.${pkgs.system}.disko-install 
-
-            kjv
-            openssh
-            sops
-            killall
-            btop
-            zip    
-            unzip
-            rsync
-            curl
-            wget
-            (python313.withPackages (ps: with ps; [
-                gpustat
-                numpy
-                matplotlib
-                scipy
-                pandas
-                pyaudio
-                pyusb
-                debugpy
-                requests
-            ]))
-        ] ++ (if config.homeconfig.graphical then [
-            grim
-            slurp
-            xfce.thunar
-            wl-clipboard
-            blueberry
-            lxqt.lxqt-policykit
-        ] else []) ++ (if !config.homeconfig.minimal then [
-            cava 
-            android-tools
-            neovim-remote
-            gcc
-            zulu
-            fastfetch
-            ncmpcpp
-            playerctl
-            mpc-cli
-            ffmpeg
-
-        ] else []) ++ (if !config.homeconfig.minimal && config.homeconfig.graphical then [
-            handbrake
-            quickemu
-            bottles
-            
-            brightnessctl
-            libdbusmenu-gtk3
-            lmms
-
-#unfree {
-            geogebra
-            spotify
-            pkgs-us.discord
-#}
-            pkgs-us.rustdesk-flutter
-            pkgs-us.mpv
-            vlc
-            pavucontrol
-            rpi-imager
-            tigervnc
-            keepassxc
-
-#3D modeling/printing
-            blender
-            freecad-wayland
-            cura-appimage
-
-#productivity
-            libreoffice
-
-#games
-            prismlauncher
-        ] else []));
-    };
-}

home-manager/users/nathan/packages/scripts/default.nix

@@ -1,119 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options = {
-        homeconfig.scripts.enable = lib.options.mkOption {
-            type = lib.types.bool;
-            default = true;
-        };
-    };
-
-    config = lib.mkIf config.homeconfig.scripts.enable {
-        home.packages = [
-
-            #scripts
-	        (pkgs.writeShellScriptBin "_systemRebuild" ''
-	            ${pkgs.nh}/bin/nh os switch --ask
-	            echo //////Enter to close//////
-	            read
-	        '')
-	        
-
-	        (pkgs.writeShellScriptBin "randWallpaper" ''
-                file=''$(ls ${config.home.homeDirectory}/Pictures/Wallpaper/ | shuf -n 1)
-                setWallpaper ${config.home.homeDirectory}/Pictures/Wallpaper/''$file
-	        '')
-
-	        (pkgs.writeShellScriptBin "setWallpaper" ''
-
-	            if [[ ! -d /tmp/nathan ]]; then
-                    mkdir /tmp/nathan
-                fi
-
-	            img=''$(realpath "''${1:-$(find ~/Pictures/Wallpaper/* | rofi -dmenu)}")
-                n=''$(basename "''$img")
-	            ext="''${n''\#''\#*.}"
-
-                if [[ ''$ext == "gif" || ''$ext == "mp4" ]]; then
-                    yes | ${pkgs.ffmpeg}/bin/ffmpeg -i "''$img" -vframes 1 /tmp/nathan/tmp.jpg
-                    cp /tmp/nathan/tmp.jpg /tmp/nathan/tmp2.jpg
-                    pidof mpvpaper && pkill mpvpaper
-                    ${pkgs.swww}/bin/swww img /tmp/nathan/tmp.jpg -t wipe
-                    ${pkgs.hyprpanel}/bin/hyprpanel sw /tmp/nathan/tmp2.jpg
-                    sleep 0.3
-                    hyprctl dispatch exec "${pkgs.mpvpaper}/bin/mpvpaper ALL ''$img -o loop"
-                    ${pkgs.hyprpanel}/bin/hyprpanel sw /tmp/nathan/tmp.jpg
-                    rm /tmp/nathan/tmp2.jpg
-                else
-                    pidof mpvpaper && pkill mpvpaper
-                    hyprctl dispatch exec "${pkgs.swww}/bin/swww img ''$img -t wipe"
-                    ${pkgs.hyprpanel}/bin/hyprpanel sw "''$img"
-                fi
-
-                changeColors "''$img" "''$2"
-	        '')
-
-	        (pkgs.writeShellScriptBin "changeColors" ''
-
-                img=''$(realpath "''$1")
-                alpha=''${2:-70}
-
-                if [[ ''$alpha -lt 0 ]]; then
-                alpha=0
-                elif [[ ''$alpha -gt 100 ]]; then
-                alpha=100
-                fi
-
-                if [[ -f ~/.config/wal/colorschemes/dark/''$(basename "''$img")-''$alpha.json ]]; then
-                    ${pkgs.pywal16}/bin/wal -n -f "''$(basename "''$img")-''$alpha"
-                else
-	                ${pkgs.pywal16}/bin/wal -n -i "''$img" -a "''$alpha" --cols16 -p "''$(basename "''$img")-''$alpha"
-                fi
-
-	            colorPrefix 
-	        '')
-
-            (pkgs.writeShellScriptBin "colorPrefix" ''
-                exec -a "$0" "$@" &
-	            sleep 0.4
-	            ${pkgs.pywalfox-native}/bin/pywalfox update &
-	            pkill -USR1 kitty
-	            pidof cava && pkill -USR1 cava
-                for i in ''$(ls /run/user/1000 | grep nvim); do 
-                    ${pkgs.neovim-remote}/bin/nvr -s --servername /run/user/1000/''$i --remote-send '<cmd>colorscheme pywal<CR>'; 
-                done
-	        '')
-            
-	        (pkgs.writeShellScriptBin "onSystemStart" ''
-
-                if [[ ! -d /tmp/nathan ]]; then
-                    mkdir /tmp/nathan
-                fi
-
-                if [[ -f ${config.home.homeDirectory}/.local/share/calcurse/.calcurse.pid ]]; then
-                    rm ${config.home.homeDirectory}/.local/share/calcurse/.calcurse.pid
-                fi
-
-                hyprctl --batch "\
-                dispatch exec ${pkgs.swww}/bin/swww-daemon ;\
-                dispatch exec setWallpaper ${config.home.homeDirectory}/Pictures/Wallpaper/bluescape.jpg ;\
-	            dispatch exec ${pkgs.pyprland}/bin/pypr ;\
-                dispatch exec ${pkgs.netbird-ui}/bin/netbird-ui ;\
-	            dispatch exec ${pkgs.hyprpolkitagent}/libexec/hyprpolkitagent ;\
-                setcursor Bibata-Modern-Classic 16"
-                sleep 3
-		        hyprctl reload
-                hyprctl dispatch exec ${pkgs.pyprland}/bin/pypr toggle calendar
-                #tmux new-session -s hyprland 
-	        '')
-
-        ] ++ (if config.homeconfig.standalone.enable then [
-
-            (pkgs.writeShellScriptBin "_homeRebuild" ''
-	            ${pkgs.nh}/bin/nh home switch --ask
-	            echo //////Enter to close//////
-	            read
-	        '')
-        ] else []);
-    };
-}
-

home-manager/users/nathan/programs/calcurse/default.nix

@@ -1,14 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options.homeconfig.calcurse.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.calcurse.enable {
-        home.packages = with pkgs; [
-            calcurse
-            libnotify
-        ];
-    };
-}

home-manager/users/nathan/programs/default.nix

@@ -1,24 +0,0 @@
-{ config, lib, pkgs, inputs, ... }: {
-
-    imports = [
-        ./git
-        ./nh
-        ./hyprland
-        ./hyprpanel
-	    ./terminal
-        ./rofi
-        ./pywal
-        ./hyprlock
-        ./calcurse
-        ./firefox
-    ];
-
-    config = lib.mkIf (config.homeconfig.host != "android") {
-
-        home.packages = lib.mkIf (!config.homeconfig.wal.enable) [
-            inputs.nixvim.packages.${pkgs.system}.default
-        ];
-
-        home.sessionVariables.EDITOR = "nvim";
-    };
-}

home-manager/users/nathan/programs/firefox/default.nix

@@ -1,60 +0,0 @@
-{ config, lib, pkgs, inputs, ... }: {
-
-    options.homeconfig.firefox.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.firefox.enable {
-
-        home.sessionVariables.BROWSER = "${config.programs.firefox.package}/bin/firefox";
-
-        home.packages = lib.mkIf config.homeconfig.wal.enable [ 
-            pkgs.pywalfox-native
-        ];
-
-        home.file.".mozilla/native-messaging-hosts/pywalfox.json".text = let
-            pywalfox-wrapper = pkgs.writeShellScriptBin "pywalfox-wrapper" ''
-                ${pkgs.pywalfox-native}/bin/pywalfox start
-            '';
-        in lib.replaceStrings [ "<path>" ] [
-            "${pywalfox-wrapper}/bin/pywalfox-wrapper"
-        ] (lib.readFile "${pkgs.pywalfox-native}/lib/python3.12/site-packages/pywalfox/assets/manifest.json");
-
-
-        programs.firefox = {
-
-            enable = true;
-            package = pkgs.firefox;
-
-            profiles.nathan = {
-                search = {
-                    default = "ddg";
-                    privateDefault = "ddg";
-                    force = true;
-                };
-                bookmarks = {
-                    force = true;
-                    settings = [
-                        {
-                            name = "toolbar";
-                            toolbar = true;
-                            bookmarks = [
-                                {
-                                    name = "NixOS Search - Packages";
-                                    url = "https://search.nixos.org/packages";
-                                }
-                            ];
-                        }
-                    ];
-                };
-
-                extensions.packages = with inputs.firefox-addons.packages.${pkgs.system}; [
-                    ublock-origin
-                    keepassxc-browser
-                    pywalfox
-                ];
-            };
-        };
-    };
-}

home-manager/users/nathan/programs/git/default.nix

@@ -1,44 +0,0 @@
-{ config, lib, ... }: {
-
-    options.homeconfig.git.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.git.enable {
-
-        sops = {
-            secrets = {
-                "git/username" = {};
-                "git/email" = {};
-            };
-
-            templates.gitconfig.content = ''
-                [user]
-                    name = "${config.sops.placeholder."git/username"}"
-                    email = "${config.sops.placeholder."git/email"}"
-            '';
-        };
-        
-        programs.git = {
-            enable = true;
-
-            includes = [
-                { path = "${config.sops.templates.gitconfig.path}"; }
-            ];
-            
-            extraConfig = {
-                init = {
-                    defaultBranch = "master";
-                };
-                url = {
-                    "ssh://gitea@gitea.blunkall.us/" = {
-                        insteadOf = [
-                            "blunkall:"
-                        ];
-                    };
-                };
-            };
-        };
-    };
-}

home-manager/users/nathan/programs/hyprland/default.nix

@@ -1,66 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options.homeconfig.hyprland.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.hyprland.enable {
-
-        home.sessionVariables.NIX_OZONE_WL = "1";
-
-        programs.kitty.enable = lib.mkDefault true;
-
-        home.packages = with pkgs; [
-            pyprland
-        ];
-
-        home.activation.extraHyprFile = lib.hm.dag.entryAfter ["writeBoundary"] ''
-            if [[ ! -f ${config.home.homeDirectory}/.config/hypr/otf.conf ]]; then
-                touch ${config.home.homeDirectory}/.config/hypr/otf.conf
-            fi
-
-            if [[ ! -f ${config.home.homeDirectory}/.config/background ]]; then
-                cp ${config.home.homeDirectory}/Pictures/Wallpaper/bluescape.jpg ${config.home.homeDirectory}/.config/background
-                chmod 600 ${config.home.homeDirectory}/.config/background
-            fi
-        '';
-
-
-        wayland.windowManager.hyprland = {
-
-            enable = true;
-
-            systemd = {
-                enable = true;
-                variables = [ "--all" ];
-            };
-
-            extraConfig = (if config.homeconfig.host == "laptop" then ''
-                    monitor=eDP-1,1920x1080@300,0x0,1
-                    bind = CTRL SHIFT, XF86Launch2, exec, if [[ $(hyprctl monitors | grep 0x0 | sed -n -e "s/\t*1920x1080@//" -e "s/.[1234567890]* at 0x0//p") == 300 ]]; then hyprctl keyword monitor eDP-1,1920x1080@60,0x0,1; else hyprctl keyword monitor eDP-1,1920x1080@300,0x0,1; fi
-                '' else if config.homeconfig.host == "homebox" then ''
-                    monitor=HDMI-A-2,1920x1080@60,0x0,1
-                    monitor=HEADLESS-2,1920x1080@60,0x0,1
-                    exec-once=hyprctl output create headless HEADLESS-2
-                    exec-once=hyprctl keyword monitor HDMI-A-2,disable
-                    exec-once=${pkgs.wayvnc}/bin/wayvnc 0.0.0.0 -o HEADLESS-2
-                '' else if config.homeconfig.host == "container" then ''
-                    monitor=HEADLESS-2,1920x1080@60,0x0,1
-                    exec-once=hyprctl output create headless HEADLESS-2
-                    exec-once=${pkgs.wayvnc}/bin/wayvnc 0.0.0.0 -o HEADLESS-2
-                '' else ''
-                    monitor= , prefered, auto, 1
-                '') + (if config.homeconfig.hyprpanel.enable then ''
-                    bind = , Print, exec, bash -c ${pkgs.hyprpanel}/share/scripts/screenshot.sh"
-                '' else ''
-                    bind = , Print, exec, grim -g "$(slurp)"
-                '') + ''
-                source = ${config.home.homeDirectory}/.config/hypr/main.conf
-
-                exec-shutdown = if [[ -f ${config.home.homeDirectory}/.local/share/calcurse/.calcurse.pid ]]; then rm ${config.home.homeDirectory}/.local/share/calcurse/.calcurse.pid; fi
-            '';
-
-        };
-    };
-}

home-manager/users/nathan/programs/hyprlock/default.nix

@@ -1,18 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options.homeconfig.hyprlock.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.hyprlock.enable {
-
-        programs.hyprlock = {
-            enable = true;
-        };
-
-        services.hypridle = {
-            enable = true;
-        };
-    };
-}

home-manager/users/nathan/programs/hyprpanel/default.nix

@@ -1,15 +0,0 @@
-{ config, lib, ... }: {
-
-    options.homeconfig.hyprpanel.enable = with lib; mkOption {
-        type = with types; bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.hyprpanel.enable {
-        
-        programs.hyprpanel = {
-            enable = true;
-            systemd.enable = false;
-        };
-    };
-}

home-manager/users/nathan/programs/nh/default.nix

@@ -1,21 +0,0 @@
-{ config, lib, ... }: {
-
-    options.homeconfig.nh.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.nh.enable {
-        
-        programs.nh = {
-            enable = true;
-            flake = "${config.home.homeDirectory}/Projects/Olympus";
-
-            clean = {
-                enable = true;
-                dates = "weekly";
-                extraArgs = "--keep 5 --keep-since 5d";
-            };
-        };
-    };
-}

home-manager/users/nathan/programs/pywal/default.nix

@@ -1,19 +0,0 @@
-{ config, lib, pkgs, inputs, ... }: {
-
-    options.homeconfig.wal.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.wal.enable {
-
-        home.packages = with pkgs; [
-            inputs.nixvim.packages.${pkgs.system}.pywal
-
-            pywal16
-		    imagemagick
-        ];
-
-        
-    };
-}

home-manager/users/nathan/programs/rofi/default.nix

@@ -1,20 +0,0 @@
-{ config, lib, pkgs, ... }: {
-    
-    options.homeconfig.rofi.enable = lib.options.mkOption {
-        type = lib.types.bool;
-        default = false;
-    };
-
-    config = lib.mkIf config.homeconfig.rofi.enable {
-        programs.rofi = {
-
-            enable = true;
-            package = pkgs.rofi-wayland;
-
-            cycle = true;
-
-            theme = "/home/nathan/.cache/wal/colors-rofi-dark.rasi";
-        };
-    };
-}
-

home-manager/users/nathan/programs/terminal/bash/default.nix

@@ -1,31 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    home.packages = with pkgs; [ oh-my-posh ];
-
-    programs.bash = {
-        enable = true;
-        enableCompletion = true;
-
-        shellAliases = {
-            ls = "eza";
-            ll = "ls -l";
-
-            ksh = "kitten ssh";
-
-            vi = "nvim";
-            vim = "nvim";
-
-        };
-
-        bashrcExtra = ''
-            source ${pkgs.blesh}/share/blesh/ble.sh
-        '';
-
-        initExtra = if config.homeconfig.wal.enable then (lib.mkBefore ''
-            cat ${config.home.homeDirectory}/.cache/wal/sequences
-            eval "$(oh-my-posh init bash --config ${config.home.homeDirectory}/.cache/wal/ohmyposh.toml)"
-        '') else (lib.mkBefore ''
-            eval "$(oh-my-posh init bash --config ${config.home.homeDirectory}/.config/ohmyposh/ohmyposh.toml)"
-        '');
-    };
-}

home-manager/users/nathan/programs/terminal/bat/default.nix

@@ -1,18 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.bat = {
-
-    enable = true;
-
-    extraPackages = with pkgs.bat-extras; [
-      batman
-      batpipe
-      batgrep
-      batdiff
-      batwatch
-      prettybat
-    ];
-
-
-  };
-}

home-manager/users/nathan/programs/terminal/default.nix

@@ -1,15 +0,0 @@
-{ ... }: {
-
-  imports = [
-    ./bat
-    ./bash
-    ./eza
-    ./fzf
-    ./tmux
-    ./kitty
-    ./zoxide
-    ./zsh
-    ./ssh
-    ./ohmyposh
-  ];
-}

home-manager/users/nathan/programs/terminal/eza/default.nix

@@ -1,17 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.eza = {
-
-    enable = true;
-
-    enableZshIntegration = true;
-
-    extraOptions = [
-      "--color=auto"
-    ];
-
-    git = true;
-
-    icons = "auto";
-  };
-}

home-manager/users/nathan/programs/terminal/fzf/default.nix

@@ -1,15 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.fzf = {
-  
-    enable = true;
-
-    enableZshIntegration = true;
-
-    tmux = {
-      #enableShellIntegration = true;
-
-      #shellIntegrationOptions = [];
-    };
-  };
-}

home-manager/users/nathan/programs/terminal/kitty/default.nix

@@ -1,33 +0,0 @@
-{ config, lib, pkgs, ... }: {
-      
-  programs.kitty = {
-    
-    enable = true;
-
-    font = {
-      name = "FiraCode Nerd Font";
-      size = 12;
-    };
-
-    extraConfig = ''
-
-confirm_os_window_close 0
-
-include ${config.home.homeDirectory}/.cache/wal/colors-kitty.conf
-
-disable_ligatures never
-
-dynamic_background_opacity yes
-
-tab_bar_edge top
-
-map ctrl+shift+t new_tab
-map ctrl+shift+w close_tab
-
-map ctrl+tab next_tab
-map ctrl+shift+tab previous_tab
-
-    '';
-  };
-}
-

home-manager/users/nathan/programs/terminal/ssh/default.nix

@@ -1,8 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.ssh = {
-
-    enable = true;
-
-  };
-}

home-manager/users/nathan/programs/terminal/tmux/default.nix

@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.tmux = {
-    
-    enable = true;
-    
-    clock24 = true;
-    
-    mouse = true;
-    
-    baseIndex = 1;
-    
-    keyMode = "vi";
-    
-    prefix = "C-b";
-    
-    shell = "${pkgs.zsh}/bin/zsh";
-  
-  };
-
-}
-
-

home-manager/users/nathan/programs/terminal/zoxide/default.nix

@@ -1,13 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.zoxide = {
-
-    enable = true;
-
-    enableZshIntegration = true;
-
-    options = [
-      "--cmd cd"
-    ];
-  };
-}

home-manager/users/nathan/programs/terminal/zsh/default.nix

@@ -1,33 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-  programs.zsh = {
-    
-    enable = true;
-    
-    enableCompletion = true;
-    
-    autosuggestion.enable = true;
-    
-    syntaxHighlighting.enable = true;
-    
-    shellAliases = {
-      ls = "eza";
-      ll = "ls -l";
-
-      ksh = "kitten ssh";
-
-      vi = "nvim";
-      vim = "nvim";
-
-      python = "python3.13";
-      python3 = "python3.13";
-    };
-
-    history = {
-      size = 5000;
-      ignoreAllDups = true;
-      ignoreSpace = true;
-      share = true;
-    };
-  };
-}

home-manager/users/nathan/services/custom/default.nix

@@ -1 +0,0 @@
-{}: {}

home-manager/users/nathan/services/default.nix

@@ -1,5 +0,0 @@
-{ ... }: {
-    imports = [
-        ./mpd
-    ];
-}

home-manager/users/nathan/services/mpd/default.nix

@@ -1,41 +0,0 @@
-{ config, lib, pkgs, ... }: {
-
-    options = {
-        homeconfig.mpd.enable = lib.options.mkOption {
-            type = lib.types.bool;
-            default = false;
-        };
-    };
-
-    config = lib.mkIf config.homeconfig.mpd.enable {
-        services.mpd = {
-            enable = true;
-            network.startWhenNeeded = true;
-            network.port = 6600;
-            network.listenAddress = "127.0.0.1";
-            musicDirectory = "/home/nathan/Music";
-            extraConfig = ''
-                audio_output {
-                    type "pipewire"
-                    name "Audio1"
-                }
-                audio_output {
-                    type "fifo"
-                    name "visualizer"
-                    path "/tmp/mpd.fifo"
-                    format "44100:16:1"
-                }
-            '';
-        };
-
-        services.mpdris2 = { 
-            enable = true;
-            mpd.host = "127.0.0.1";
-            mpd.port = 6600;
-            package = pkgs.mpdris2;
-            mpd.musicDirectory = "/home/nathan/Music";
-            notifications = true;
-        };
-    };
-
-}

modules/features/aurora-greeter.nix

@@ -0,0 +1,16 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.aurora-greeter = { config, lib, pkgs, ... }: {
+
+        imports = [
+            inputs.aurora.nixosModules.default
+        ];
+
+        config = {
+
+            services.aurora-greeter = {
+                enable = true;
+            };
+        };
+    };
+}

modules/features/authentik.nix

@@ -0,0 +1,236 @@
+{ ... }: {
+
+    flake.nixosModules.authentik = { config, lib, pkgs, ... }: let
+
+    hostPort = 9005;
+
+    subdomain = "auth";
+
+    name = "authentik";
+
+    in {
+
+        config = {
+
+            networking.firewall.interfaces = {
+                "ve-traefik" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+            };
+
+            sops.secrets = {
+                "authentik/pass" = {};
+                "authentik/secret_key" = {};
+            };
+
+            sops.templates."authentik.env" = {
+                content = ''
+                    PG_PASS=${config.sops.placeholder."authentik/pass"}
+                SECRET_KEY=${config.sops.placeholder."authentik/secret_key"}
+                '';
+            };
+
+            virtualisation.oci-containers.containers."authentik-postgresql" = {
+                image = "docker.io/library/postgres:16-alpine";
+                environment = {
+                    "POSTGRES_DB" = "authentik";
+                    "POSTGRES_PASSWORD" = "\${PG_PASS}";
+                    "POSTGRES_USER" = "authentik";
+                };
+                environmentFiles = [ config.sops.templates."authentik.env".path ];
+                volumes = [
+                    "authentik_database:/var/lib/postgresql/data:rw"
+                ];
+                log-driver = "journald";
+                extraOptions = [
+                    "--health-cmd=pg_isready -d \${POSTGRES_DB} -U \${POSTGRES_USER}"
+                        "--health-interval=30s"
+                        "--health-retries=5"
+                        "--health-start-period=20s"
+                        "--health-timeout=5s"
+                        "--network-alias=postgresql"
+                        "--network=authentik_default"
+                ];
+            };
+            systemd.services."docker-authentik-postgresql" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-authentik_default.service"
+                        "docker-volume-authentik_database.service" 
+                ];
+                requires = [
+                    "docker-network-authentik_default.service"
+                        "docker-volume-authentik_database.service" 
+                ];
+                partOf = [
+                    "docker-compose-authentik-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-authentik-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."authentik-server" = {
+                image = "ghcr.io/goauthentik/server:2025.12.2";
+                environment = {
+                    "AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
+                    "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
+                    "AUTHENTIK_POSTGRESQL__PASSWORD" = "\${PG_PASS}";
+                    "AUTHENTIK_POSTGRESQL__USER" = "authentik";
+                    "AUTHENTIK_SECRET_KEY" = "\${SECRET_KEY}";
+                };
+                environmentFiles = [ config.sops.templates."authentik.env".path ];
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "websecure,localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.101.1:${builtins.toString hostPort}";
+
+
+                    "traefik.http.middlewares.authentik.forwardauth.address" = "https://auth.esotericbytes.com/outpost.goauthentik.io/auth/traefik";
+                    "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader" = "true";
+                    "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders" = "X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version";
+
+                };
+                volumes = [
+                    "/etc/Authentik/custom-templates:/templates:rw"
+                        "/etc/Authentik/data:/data:rw"
+                ];
+                ports = [
+                    "${builtins.toString hostPort}:9000/tcp"
+#"9443:9443/tcp"
+                ];
+                cmd = [ "server" ];
+                dependsOn = [
+                    "authentik-postgresql"
+                ];
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=server"
+                        "--network-alias=authentik-server"
+                        "--network-alias=${name}"
+                        "--ip=192.168.101.6"
+                ];
+                networks = [
+                    "docker-main"
+                        "authentik_default"
+                ];
+            };
+            systemd.services."docker-authentik-server" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-authentik_default.service"
+                        "docker-network-setup.service" 
+                ];
+                requires = [
+                    "docker-network-authentik_default.service"
+                        "docker-network-setup.service" 
+                ];
+                partOf = [
+                    "docker-compose-authentik-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-authentik-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."authentik-worker" = {
+                image = "ghcr.io/goauthentik/server:2025.12.2";
+                environment = {
+                    "AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
+                    "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
+                    "AUTHENTIK_POSTGRESQL__PASSWORD" = "\${PG_PASS}";
+                    "AUTHENTIK_POSTGRESQL__USER" = "authentik";
+                    "AUTHENTIK_SECRET_KEY" = "\${SECRET_KEY}";
+                };
+                environmentFiles = [ config.sops.templates."authentik.env".path ];
+                volumes = [
+                    "/etc/Authentik/certs:/certs:rw"
+                        "/etc/Authentik/custom-templates:/templates:rw"
+                        "/etc/Authentik/data:/data:rw"
+                        "/var/run/docker.sock:/var/run/docker.sock:rw"
+                ];
+                cmd = [ "worker" ];
+                dependsOn = [
+                    "authentik-postgresql"
+                ];
+                user = "root";
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=worker"
+                        "--network=authentik_default"
+                ];
+            };
+            systemd.services."docker-authentik-worker" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-authentik_default.service"
+                ];
+                requires = [
+                    "docker-network-authentik_default.service"
+                ];
+                partOf = [
+                    "docker-compose-authentik-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-authentik-root.target"
+                ];
+            };
+
+# Networks
+            systemd.services."docker-network-authentik_default" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                    ExecStop = "docker network rm -f authentik_default";
+                };
+                script = ''
+                    docker network inspect authentik_default || docker network create authentik_default
+                    '';
+                partOf = [ "docker-compose-authentik-root.target" ];
+                wantedBy = [ "docker-compose-authentik-root.target" ];
+            };
+
+# Volumes
+            systemd.services."docker-volume-authentik_database" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect authentik_database || docker volume create authentik_database --driver=local
+                    '';
+                partOf = [ "docker-compose-authentik-root.target" ];
+                wantedBy = [ "docker-compose-authentik-root.target" ];
+            };
+
+# Root service
+# When started, this will automatically create all resources and start
+# the containers. When stopped, this will teardown all resources.
+            systemd.targets."docker-compose-authentik-root" = {
+                unitConfig = {
+                    Description = "Root target generated by compose2nix.";
+                };
+                wantedBy = [ "multi-user.target" ];
+            };
+        };
+    };
+}

modules/features/avahi.nix

@@ -0,0 +1,20 @@
+{ ... }: {
+
+    flake.nixosModules.avahi = { config, lib, ... }: {
+
+        config = {
+
+            services.avahi = {
+
+                enable = true;
+                ipv4 = true;
+                ipv6 = true;
+                openFirewall = true;
+                nssmdns4 = true;
+                wideArea = true;
+
+            };   
+        };
+    };
+}
+

modules/features/code-server.nix

@@ -0,0 +1,39 @@
+{ ... }: {
+
+    flake.nixosModules.code-server = { config, lib, ... }: {
+
+        config = {
+
+            containers.code-server = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.31";
+
+                config = {
+
+                    services.code-server = {
+                        enable = true;
+
+                        hashedPassword = "1$WFYzcW1TNmpYM1ZKU3lielNCaXAyRkF2K3FjPQ$bSeeV4bvL2uiDYKiQjBLJPAO13/gNjYVgw8YKFtTQDI";
+
+                        disableUpdateCheck = true;
+
+                        disableTelemetry = true;
+
+                        disableGettingStartedOverride = true;
+
+                        auth = "none";
+
+                        host = "0.0.0.0";
+                    };
+
+                    networking.firewall.allowedTCPPorts = [ 4444 ];
+
+                    system.stateVersion = "25.05";
+                };
+            };
+        };
+    };
+}

modules/features/default.nix

@@ -0,0 +1,96 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        imports = [
+            inputs.sops-nix.nixosModules.sops
+        ];
+
+        config = {
+
+            nix = {
+                nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
+                channel.enable = false;
+                settings = {
+                    experimental-features = [ "nix-command" "flakes" ];
+                    builders-use-substitutes = (config.sops.secrets ? "remoteBuildKey");
+
+                    substituters = lib.mkIf config.programs.hyprland.enable ["https://hyprland.cachix.org"];
+                    trusted-substituters = lib.mkIf config.programs.hyprland.enable ["https://hyprland.cachix.org"];
+                    trusted-public-keys = lib.mkIf config.programs.hyprland.enable ["hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="];
+                };
+
+                distributedBuilds = lib.mkDefault (config.sops.secrets ? "remoteBuildKey");
+                buildMachines = lib.mkIf (config.sops.secrets ? "remoteBuildKey") [
+                {
+                    hostName = "esotericbytes.com";
+                    sshUser = "remote-builder";
+                    sshKey = config.sops.secrets."remoteBuildKey".path;
+                    supportedFeatures = [
+                        "nixos-test"
+                            "benchmark"
+                            "big-parallel"
+                            "kvm"
+                    ];
+                    systems = [ "x86_64-linux" "aarch64-linux" ];
+                }
+                ];
+            };
+
+            users.users."remote-builder" = lib.mkIf (builtins.any
+                (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
+                (builtins.attrNames config.sops.secrets)
+            ) {
+                isNormalUser = true;
+                createHome = false;
+            };
+
+            sops.templates."remote-builder" = lib.mkIf (builtins.any
+                (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
+                (builtins.attrNames config.sops.secrets)
+            )  {
+                content = builtins.concatStringsSep ''''\n'' (builtins.map 
+                        (y: config.sops.placeholder.${y}) 
+                        (builtins.filter 
+                         (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
+                         (builtins.attrNames config.sops.secrets)
+                        )
+                        );
+                path = "/etc/ssh/authorized_keys.d/remote-builder";
+                owner = "remote-builder";
+            };
+
+            sops = {
+                age.keyFile = "/var/lib/sops/age/keys.txt";
+                defaultSopsFormat = "yaml";
+            };
+
+            programs.fuse.userAllowOther = true;
+
+            home-manager = {
+                backupFileExtension = "backup";
+                useUserPackages = true;
+                sharedModules = [];
+            };
+
+            time.timeZone = lib.mkDefault "America/Chicago";
+
+            i18n = lib.mkDefault {
+                defaultLocale = "en_US.UTF-8";
+
+                extraLocaleSettings = {
+                    LC_ADDRESS = "en_US.UTF-8";
+                    LC_IDENTIFICATION = "en_US.UTF-8";
+                    LC_MEASUREMENT = "en_US.UTF-8";
+                    LC_MONETARY = "en_US.UTF-8";
+                    LC_NAME = "en_US.UTF-8";
+                    LC_NUMERIC = "en_US.UTF-8";
+                    LC_PAPER = "en_US.UTF-8";
+                    LC_TELEPHONE = "en_US.UTF-8";
+                    LC_TIME = "en_US.UTF-8";
+                };
+            };
+        };
+    };
+}
+

modules/features/docker-mailserver.nix

@@ -0,0 +1 @@
+{}

modules/features/docker.nix

@@ -0,0 +1,49 @@
+{ ... }: {
+
+    flake.nixosModules.docker = { config, lib, pkgs, ... }: {
+
+        config = {
+
+            networking.nat.internalInterfaces = [ "docker0" "docker-main" ];
+
+            virtualisation = {
+                docker = {
+                    enable = true;
+                    storageDriver = "btrfs";
+                };
+
+                oci-containers = {
+                    backend = "docker";
+                };
+            };
+
+            hardware.nvidia-container-toolkit.enable = lib.mkDefault (builtins.any 
+                (x: x == "nvidia") 
+                config.services.xserver.videoDrivers
+            );
+
+            systemd.services."docker-network-setup" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                    ExecStop = "docker network rm -f docker-main";
+                };
+                script = ''
+                    docker network inspect docker-main ||
+                    docker network create -d bridge docker-main \
+                    --attachable --subnet 192.168.101.0/24 --ip-range 192.168.101.0/24 \
+                    --gateway 192.168.101.1 \
+                    -o "com.docker.network.bridge.name"="docker-main" \
+                    -o "com.docker.network.bridge.trusted_host_interfaces"="wt0:ve-netbird:ve-traefik"
+                    '';
+                wantedBy = [ "docker-net.target" ];
+            };
+
+            systemd.targets."docker-net" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+        };
+    };
+}
+

modules/features/dynamicDNS.nix

@@ -0,0 +1,38 @@
+{ ... }: {
+
+    flake.nixosModules.dynamicDNS = { config, lib, pkgs, ... }: {
+
+        config = {
+
+            systemd.timers.dynamicDNS = {
+
+                wantedBy = [ "timers.target" ];
+
+                timerConfig = {
+
+                    OnBootSec = "5m";
+
+                    OnUnitActiveSec = "1h";
+
+                    Unit = "dynamicDNS.service";
+                };
+            };
+
+            systemd.services.dynamicDNS = {
+
+                name = "dynamicDNS.service";
+
+                serviceConfig = {
+
+                    Type = "oneshot";
+
+                    LoadCredential = [ "cloudflare-api-key" ];
+
+                };
+
+                script = '''';
+            };
+        };
+    };
+}
+

modules/features/gitea.nix

@@ -0,0 +1,258 @@
+{ ... }: {
+
+    flake.nixosModules.gitea = { config, lib, ... }: {
+
+        config = {
+
+            networking = {
+                nat.internalInterfaces = [ "ve-gitea" ];
+            };
+
+            sops.secrets = {
+                "gitea/dbpass" = {};
+            };
+
+            containers.gitea = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.20";
+
+                bindMounts = {
+                    "/etc/gitea/data" = {
+                        hostPath = "/ssd1/Gitea/data";
+                        isReadOnly = false;
+                    };
+                };
+
+                extraFlags = [
+                    "--load-credential=dbpass:${config.sops.secrets."gitea/dbpass".path}"
+                ];
+                
+                config = {
+
+                    systemd.services.secrets_setup = {
+                        wantedBy = [ "gitea.service" ];
+
+                        serviceConfig = {
+                            LoadCredential = [
+                                "dbpass"
+                            ];
+                        };
+
+                        script = ''
+                            cat ''${CREDENTIALS_DIRECTORY}/dbpass > /etc/gitea/dbpass
+                            chown gitea:gitea /etc/gitea/*
+                        '';
+                    };
+
+                    services.gitea = {
+                        enable = true;
+
+                        stateDir = "/etc/gitea/data";
+
+                        dump.enable = false;
+
+                        appName = "Gitea";
+
+                        settings = {
+                            server = {
+                                DOMAIN = "gitea.esotericbytes.com";
+                                HTTP_PORT = 3000;
+                                ROOT_URL = "https://gitea.esotericbytes.com/";
+                            };
+                            service = {
+                                DISABLE_REGISTRATION = false;
+                                ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+                                REQUIRE_SIGNIN_VIEW = false;
+                            };
+                            oauth2_client = {
+                                ENABLE_AUTO_REGISTRATION = true;
+                            };
+                            session.COOKIE_SECURE = true;
+
+                            cron = {
+                                ENABLED = true;
+                                RUN_AT_START = true;
+                            };
+
+                            repository = {
+                                DEFAULT_BRANCH = "master";
+                            };
+                        };
+
+                        database = {
+                            passwordFile = "/etc/gitea/dbpass";
+                            type = "postgres";
+                        };
+
+                    };
+
+                    services.openssh = {
+                        enable = true;
+                        openFirewall = true;
+                        settings = {
+                            PermitRootLogin = lib.mkForce "no";
+                            PasswordAuthentication = false;
+                            KbdInteractiveAuthentication = false;
+                        };
+                        ports = [ 2222 ];
+                    };
+
+                    networking.firewall.allowedTCPPorts = [ 3000 ];
+
+                    system.stateVersion = "24.11";
+                };
+            };
+        };
+    };
+
+    flake.nixosModules.gitea-docker = { config, lib, pkgs, ... }: let
+
+    subdomain = "gitea";
+
+    name = "gitea";
+
+    in {
+
+        config = {
+
+
+            virtualisation.oci-containers.containers."${name}" = {
+                image = "docker.gitea.com/gitea:1.25.4";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "3000";
+
+
+                    "traefik.tcp.routers.${name}-ssh.entrypoints" = "gitea-ssh";
+                    "traefik.tcp.routers.${name}-ssh.rule" = "HostSNI(`*`)";
+                    "traefik.tcp.routers.${name}-ssh.service" = "${name}-ssh";
+
+                    "traefik.tcp.services.${name}-ssh.loadbalancer.server.port" = "22";
+                };
+
+                ports = [
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.20"
+                ];
+
+                volumes = [
+                    "vol_gitea:/data"
+                ];
+
+                environment = {
+                };
+            };
+
+            virtualisation.oci-containers.containers."${name}-db" = {
+                image = "docker.io/library/postgres:14";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${name}-db";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                };
+
+                ports = [
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.21"
+                ];
+
+                volumes = [
+                    "/etc/gitea/db:/var/lib/postgresql/data"
+                ];
+
+                environment = {
+                };
+            };
+
+            systemd.services."docker-gitea" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-gitea.service" 
+                        "docker-gitea-db.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-gitea.service" 
+                        "docker-gitea-db.service" 
+                ];
+                partOf = [
+                    "docker-compose-gitea-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-gitea-root.target"
+                ];
+            };
+
+            systemd.services."docker-gitea-db" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                ];
+                partOf = [
+                    "docker-compose-gitea-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-gitea-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-gitea" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_gitea || docker volume create vol_gitea --driver=local
+                    '';
+                partOf = [ "docker-compose-gitea-root.target" ];
+                wantedBy = [ "docker-compose-gitea-root.target" ];
+            };
+
+        };
+    };
+
+}

modules/features/home-assistant/configuration.yaml

@@ -0,0 +1,16 @@
+
+# Loads default set of integrations. Do not remove.
+default_config:
+
+# Load frontend themes from the themes folder
+frontend:
+  themes: !include_dir_merge_named themes
+
+automation: !include automations.yaml
+script: !include scripts.yaml
+scene: !include scenes.yaml
+
+http:
+  use_x_forwarded_for: true
+  trusted_proxies:
+    - 192.168.101.11

modules/features/home-assistant/home-assistant.nix

@@ -0,0 +1,63 @@
+{ ... }: {
+
+    flake.nixosModules.home-assistant = { config, lib, ... }: let
+
+    subdomain = "hass";
+
+    name = "home-assistant";
+
+    in {
+
+        config = {
+
+            environment.etc."home-assistant/configuration.yaml".source = ./configuration.yaml;
+
+            virtualisation.oci-containers.containers.home-assistant = {
+                image = "ghcr.io/home-assistant/home-assistant:stable";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "8123";
+                };
+
+                environment = {
+                    TZ = "America/Chicago";
+                };
+
+                extraOptions = [
+                    "--ip=192.168.101.13"
+                ];
+
+                ports = [
+                ];
+
+                volumes = [
+                    "vol_home-assistant:/config/"
+                        "/etc/home-assistant/configuration.yaml:/config/configuration.yaml"
+                ];
+            };
+        };
+    };
+
+    flake.nixosModules.home-assistant-vm = { config, lib, ... }: {
+
+        config = {
+
+        };
+    };
+}

modules/features/hyprland.nix

@@ -0,0 +1,28 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.hyprland = { config, lib, pkgs, ... }: {
+
+        config = {
+
+            environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+            programs.hyprland = let
+                system = pkgs.stdenv.hostPlatform.system;
+                #pkgs-us = import inputs.nixpkgs-us { inherit system; };
+            in {
+                enable = true;
+
+                withUWSM = false;
+
+                xwayland.enable = true;
+
+                systemd.setPath.enable = true;
+
+                package = inputs.hyprland.packages.${system}.hyprland;
+
+                portalPackage = inputs.hyprland.packages.${system}.xdg-desktop-portal-hyprland;
+            };
+        };
+    };
+}
+

modules/features/jellyfin.nix

@@ -0,0 +1,117 @@
+{ ... }: {
+
+    flake.nixosModules.jellyfin = { config, lib, pkgs, ... }: let
+
+    subdomain = "watch";
+
+    name = "jellyfin";
+
+    in {
+
+        config = {
+
+            networking.firewall.allowedUDPPorts = [ 7359 ];
+
+            virtualisation.oci-containers.containers.jellyfin = {
+                image = "jellyfin/jellyfin:10.11.6";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                ports = [
+                    "7359:7359/udp"
+                ];
+
+                volumes = [
+                    "vol_jellyfin-config:/config"
+                        "vol_jellyfin-cache:/cache"
+
+                        "/etc/jellyfin/media:/media"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "websecure,localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "8096";
+                };
+
+                extraOptions = lib.mkMerge [
+                    (lib.mkIf config.hardware.nvidia-container-toolkit.enable [
+                        "--device=nvidia.com/gpu=all"
+                    ])
+                    [ "--ip=192.168.101.21" ]
+                ];
+
+                environment = {
+                    JELLYFIN_PublishedServerUrl = "https://${subdomain}.esotericbytes.com";
+                };
+            };
+
+            systemd.services."docker-jellyfin" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-jellyfin-config.service" 
+                        "docker-volume-jellyfin-cache.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-jellyfin-config.service" 
+                        "docker-volume-jellyfin-cache.service" 
+                ];
+                partOf = [
+                    "docker-compose-jellyfin-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-jellyfin-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-jellyfin-config" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_jellyfin-config || docker volume create vol_jellyfin-config --driver=local
+                    '';
+                partOf = [ "docker-compose-jellyfin-root.target" ];
+                wantedBy = [ "docker-compose-jellyfin-root.target" ];
+            };
+
+            systemd.services."docker-volume-jellyfin-cache" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_jellyfin-cache || docker volume create vol_jellyfin-cache --driver=local
+                    '';
+                partOf = [ "docker-compose-jellyfin-root.target" ];
+                wantedBy = [ "docker-compose-jellyfin-root.target" ];
+            };
+
+            systemd.targets."docker-compose-jellyfin-root" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+
+        };
+    };
+}

modules/features/kdePlasma6.nix

@@ -0,0 +1,28 @@
+{ ... }: {
+
+    flake.nixosModules.kdePlasma6 = { config, lib, pkgs, ... }: {
+
+        config = {
+
+            services.desktopManager.plasma6.enable = true;
+
+            environment.systemPackages = with pkgs; [
+                kdePackages.discover # Optional: Install if you use Flatpak or fwupd firmware update sevice
+                    kdePackages.kcalc # Calculator
+                    kdePackages.kcharselect # Tool to select and copy special characters from all installed fonts
+                    kdePackages.kcolorchooser # A small utility to select a color
+                    kdePackages.kolourpaint # Easy-to-use paint program
+                    kdePackages.ksystemlog # KDE SystemLog Application
+                    kdePackages.sddm-kcm # Configuration module for SDDM
+                    kdiff3 # Compares and merges 2 or 3 files or directories
+                    kdePackages.isoimagewriter # Optional: Program to write hybrid ISO files onto USB disks
+                    kdePackages.partitionmanager # Optional Manage the disk devices, partitions and file systems on your computer
+                    hardinfo2 # System information and benchmarks for Linux systems
+                    haruna # Open source video player built with Qt/QML and libmpv
+                    wayland-utils # Wayland utilities
+                    wl-clipboard # Command-line copy/paste utilities for Wayland
+            ];
+        };
+    };
+}
+

modules/features/kiwix.nix

@@ -0,0 +1 @@
+{}

modules/features/minecraft.nix

@@ -0,0 +1 @@
+{}

modules/features/n8n.nix

@@ -0,0 +1,100 @@
+{ ... }: {
+
+    flake.nixosModules.n8n = { config, lib, pkgs, ... }: let
+
+    subdomain = "n8n";
+
+    name = "n8n";
+
+    in {
+
+        config = {
+
+
+            virtualisation.oci-containers.containers."${name}" = {
+                image = "docker.n8n.io/n8nio/n8n";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "5678";
+                };
+
+                ports = [
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.2"
+                ];
+
+                volumes = [
+                    "vol_n8n:/etc/n8n"
+                ];
+
+                environment = {
+                    GENERIC_TIMEZONE = "America/Chicago";
+                    TZ = "America/Chicago";
+                    N8N_DIAGNOSTICS_ENABLED = "false";
+                    N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
+                    N8N_TEMPLATES_ENABLED = "false";
+
+                    EXTERNAL_FRONTEND_HOOKS_URLS = "";
+                    N8N_DIAGNOSTICS_CONFIG_FRONTEND = "";
+                    N8N_DIAGNOSTICS_CONFIG_BACKEND = "";
+
+                    N8N_SECURE_COOKIE = "false";
+                };
+            };
+
+            systemd.services."docker-n8n" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-n8n.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-n8n.service" 
+                ];
+                partOf = [
+                    "docker-compose-n8n-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-n8n-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-n8n" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_n8n || docker volume create vol_n8n --driver=local
+                    '';
+                partOf = [ "docker-compose-n8n-root.target" ];
+                wantedBy = [ "docker-compose-n8n-root.target" ];
+            };
+
+        };
+    };
+}

modules/features/netbird/config/management.json

@@ -0,0 +1,27 @@
+{
+    "Stuns": [
+        {
+            "Proto": "udp",
+            "URI": "stun:vpn.esotericbytes.com:3478"
+        }
+    ],
+    "Relay": {
+        "Addresses": ["rels://vpn.esotericbytes.com:443"],
+        "CredentialsTTL": "24h",
+        "Secret": "0qSIu/S2sXHJbo0SyBNm4SFxAItRoPLKR4wjnW/Zsgc"
+    },
+    "Signal": {
+        "Proto": "https",
+        "URI": "vpn.esotericbytes.com:443"
+    },
+    "Datadir": "/var/lib/netbird",
+    "DataStoreEncryptionKey": "FZnQt+JqAC8GEXUSJwhrgo0vn4PoDetoAhjUx9nSJR0=",
+    "EmbeddedIdP": {
+        "Enabled": true,
+        "Issuer": "https://vpn.esotericbytes.com/oauth2",
+        "DashboardRedirectURIs": [
+            "https://vpn.esotericbytes.com/nb-auth",
+            "https://vpn.esotericbytes.com/nb-silent-auth"
+        ]
+    }
+}

modules/features/netbird/netbird.nix

@@ -0,0 +1,258 @@
+{ inputs, ... }: {
+
+
+    flake.nixosModules.netbird = { config, lib, pkgs, ... }: {
+
+        config = let 
+            pkgs-us = import inputs.nixpkgs-us {
+                system = "x86_64-linux";
+            };
+        in {
+
+            services.netbird = {
+                enable = lib.mkDefault true;
+
+                clients.default = {
+                    port = 51820;
+                    name = "netbird";
+                    interface = "wt0";
+                    hardened = false;
+                    
+                    ui = {
+                        enable = lib.mkDefault config.hardware.graphics.enable;
+                        #package = pkgs-us.netbird-ui;
+                        #package = pkgs.netbird-ui;
+                    };
+                };
+
+                package = pkgs-us.netbird;
+                #package =   pkgs.netbird;
+            };
+        };
+    };
+
+    flake.nixosModules.netbird-docker = { config, lib, pkgs, ... }: {
+
+        config = {
+
+            networking.firewall.allowedUDPPorts = [ 3478 ];
+
+            sops.secrets."netbird/secret_key" = {};
+
+            sops.templates."netbird-relay.env" = {
+                content = ''
+                    NB_AUTH_SECRET=${config.sops.placeholder."netbird/secret_key"}
+                NB_LOG_LEVEL=info
+                    NB_LISTEN_ADDRESS=:80
+                    NB_EXPOSED_ADDRESS=rels://vpn.esotericbytes.com:443
+                    NB_ENABLE_STUN=true
+                    NB_STUN_LOG_LEVEL=info
+                    NB_STUN_PORTS=3478
+                    '';
+            };
+
+            environment.etc."netbird/management.json".source = ./config/management.json;
+
+# Containers
+            virtualisation.oci-containers.containers."netbird-dashboard" = {
+                image = "netbirdio/dashboard:v2.30.1";
+                environment = {
+                    "AUTH_AUDIENCE" = "netbird-dashboard";
+                    "AUTH_AUTHORITY" = "https://vpn.esotericbytes.com/oauth2";
+                    "AUTH_CLIENT_ID" = "netbird-dashboard";
+                    "AUTH_CLIENT_SECRET" = "";
+                    "AUTH_REDIRECT_URI" = "/nb-auth";
+                    "AUTH_SILENT_REDIRECT_URI" = "/nb-silent-auth";
+                    "AUTH_SUPPORTED_SCOPES" = "openid profile email groups";
+                    "LETSENCRYPT_DOMAIN" = "none";
+                    "NETBIRD_MGMT_API_ENDPOINT" = "https://vpn.esotericbytes.com";
+                    "NETBIRD_MGMT_GRPC_API_ENDPOINT" = "https://vpn.esotericbytes.com";
+                    "NGINX_SSL_PORT" = "443";
+                    "USE_AUTH0" = "false";
+                };
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.netbird-dashboard.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-dashboard.priority" = "1";
+                    "traefik.http.routers.netbird-dashboard.rule" = "Host(`vpn.esotericbytes.com`)";
+                    "traefik.http.routers.netbird-dashboard.tls" = "true";
+                    "traefik.http.services.netbird-dashboard.loadbalancer.server.port" = "80";
+                };
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=dashboard"
+                        "--network=docker-main"
+                        "--ip=192.168.101.5"
+                ];
+            };
+            systemd.services."docker-netbird-dashboard" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                partOf = [
+                    "docker-compose-netbird-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-netbird-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."netbird-management" = {
+                image = "netbirdio/management:0.64.4";
+                volumes = [
+                    "/etc/netbird/management.json:/etc/netbird/management.json:rw"
+                        "netbird_netbird_management:/var/lib/netbird:rw"
+                ];
+                cmd = [ "--port" "80" "--log-file" "console" "--log-level" "info" "--disable-anonymous-metrics=false" "--single-account-mode-domain=netbird.selfhosted" "--dns-domain=netbird.selfhosted" "--idp-sign-key-refresh-enabled" ];
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.netbird-api.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-api.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/api`)";
+                    "traefik.http.routers.netbird-api.service" = "netbird-api";
+                    "traefik.http.routers.netbird-api.tls" = "true";
+                    "traefik.http.routers.netbird-mgmt-grpc.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-mgmt-grpc.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/management.ManagementService/`)";
+                    "traefik.http.routers.netbird-mgmt-grpc.service" = "netbird-mgmt-grpc";
+                    "traefik.http.routers.netbird-mgmt-grpc.tls" = "true";
+                    "traefik.http.routers.netbird-mgmt-ws.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-mgmt-ws.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/ws-proxy/management`)";
+                    "traefik.http.routers.netbird-mgmt-ws.service" = "netbird-mgmt-ws";
+                    "traefik.http.routers.netbird-mgmt-ws.tls" = "true";
+                    "traefik.http.routers.netbird-oauth2.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-oauth2.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/oauth2`)";
+                    "traefik.http.routers.netbird-oauth2.service" = "netbird-oauth2";
+                    "traefik.http.routers.netbird-oauth2.tls" = "true";
+                    "traefik.http.services.netbird-api.loadbalancer.server.port" = "80";
+                    "traefik.http.services.netbird-mgmt-grpc.loadbalancer.server.port" = "80";
+                    "traefik.http.services.netbird-mgmt-grpc.loadbalancer.server.scheme" = "h2c";
+                    "traefik.http.services.netbird-mgmt-ws.loadbalancer.server.port" = "80";
+                    "traefik.http.services.netbird-oauth2.loadbalancer.server.port" = "80";
+                };
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=management"
+                        "--network=docker-main"
+                        "--ip=192.168.101.4"
+                ];
+            };
+            systemd.services."docker-netbird-management" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-volume-netbird_netbird_management.service"
+                ];
+                requires = [
+                    "docker-volume-netbird_netbird_management.service"
+                ];
+                partOf = [
+                    "docker-compose-netbird-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-netbird-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."netbird-relay" = {
+                image = "netbirdio/relay:0.64.4";
+
+                environmentFiles = [ config.sops.templates."netbird-relay.env".path ];
+
+                ports = [
+                    "3478:3478/udp"
+                ];
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.netbird-relay.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-relay.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/relay`)";
+                    "traefik.http.routers.netbird-relay.tls" = "true";
+                    "traefik.http.services.netbird-relay.loadbalancer.server.port" = "80";
+                };
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=relay"
+                        "--network=docker-main"
+                        "--ip=192.168.101.3"
+                ];
+            };
+            systemd.services."docker-netbird-relay" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                partOf = [
+                    "docker-compose-netbird-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-netbird-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."netbird-signal" = {
+                image = "netbirdio/signal:0.64.4";
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.netbird-signal-grpc.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-signal-grpc.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/signalexchange.SignalExchange/`)";
+                    "traefik.http.routers.netbird-signal-grpc.service" = "netbird-signal-grpc";
+                    "traefik.http.routers.netbird-signal-grpc.tls" = "true";
+                    "traefik.http.routers.netbird-signal-ws.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-signal-ws.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/ws-proxy/signal`)";
+                    "traefik.http.routers.netbird-signal-ws.service" = "netbird-signal-ws";
+                    "traefik.http.routers.netbird-signal-ws.tls" = "true";
+                    "traefik.http.services.netbird-signal-grpc.loadbalancer.server.port" = "10000";
+                    "traefik.http.services.netbird-signal-grpc.loadbalancer.server.scheme" = "h2c";
+                    "traefik.http.services.netbird-signal-ws.loadbalancer.server.port" = "80";
+                };
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=signal"
+                        "--network=docker-main"
+                ];
+            };
+            systemd.services."docker-netbird-signal" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                partOf = [
+                    "docker-compose-netbird-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-netbird-root.target"
+                ];
+            };
+
+# Volumes
+            systemd.services."docker-volume-netbird_netbird_management" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect netbird_netbird_management || docker volume create netbird_netbird_management
+                    '';
+                partOf = [ "docker-compose-netbird-root.target" ];
+                wantedBy = [ "docker-compose-netbird-root.target" ];
+            };
+
+# Root service
+# When started, this will automatically create all resources and start
+# the containers. When stopped, this will teardown all resources.
+            systemd.targets."docker-compose-netbird-root" = {
+                unitConfig = {
+                    Description = "Root target generated by compose2nix.";
+                };
+                wantedBy = [ "multi-user.target" ];
+            };
+        };
+    };
+}

modules/features/nextcloud.nix

@@ -0,0 +1,113 @@
+{ ... }: {
+
+    flake.nixosModules.nextcloud = { config, lib, pkgs, ... }: let
+
+    subdomain = "cloud";
+
+    name = "nextcloud";
+
+    in {
+
+        config = {
+
+            virtualisation.oci-containers.containers."nextcloud-aio-mastercontainer" = {
+                image = "ghcr.io/nextcloud-releases/all-in-one:20260122_105751";
+
+                serviceName = "docker-nextcloud";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                ports = [
+                ];
+
+                volumes = [
+                    "nextcloud_aio_mastercontainer:/mnt/docker-aio-config"
+                        "/run/docker.sock:/var/run/docker.sock:ro"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "websecure,localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.routers.${name}.middlewares" = "nextcloud-chain";
+
+                    "traefik.http.middlewares.https-redirect.redirectScheme.scheme" = "https";
+
+                    "traefik.http.middlewares.nextcloud-secure-headers.headers.hostsProxyHeaders" = "X-Forwarded-Host";
+                    "traefik.http.middlewares.nextcloud-secure-headers.headers.referrerPolicy" = "same-origin";
+
+                    "traefik.http.middlewares.nextcloud-chain.chain.middlewares" = "https-redirect,nextcloud-secure-headers";
+
+
+#"traefik.http.services.${name}.loadbalancer.server.port" = "11000";
+                    "traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.101.1:11000";
+                };
+
+                extraOptions = [
+                    "--ip=192.168.101.17"
+                ];
+
+                environment = {
+                    APACHE_PORT = "11000";
+                    APACHE_IP = "0.0.0.0";
+                    APACHE_ADDITIONAL_NETWORK = "docker-main";
+
+                    SKIP_DOMAIN_VALIDATION = "true";
+
+                    TALK_PORT = "3479";
+                };
+            };
+
+            systemd.services."docker-nextcloud" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-nextcloud.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-nextcloud.service" 
+                ];
+                partOf = [
+                    "docker-compose-nextcloud-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-nextcloud-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-nextcloud" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect nextcloud_aio_mastercontainer || docker volume create nextcloud_aio_mastercontainer --driver=local
+                    '';
+                partOf = [ "docker-compose-nextcloud-root.target" ];
+                wantedBy = [ "docker-compose-nextcloud-root.target" ];
+            };
+
+            systemd.targets."docker-compose-nextcloud-root" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+
+        };
+    };
+}

modules/features/nginx.nix

@@ -0,0 +1,41 @@
+{ ... }: {
+
+    flake.nixosModules.nginx = { config, lib, ... }: {
+
+        config = {
+
+            containers.esotericbytes-com = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.13";
+
+                bindMounts = {
+                    "/var/www/data" = {
+                        hostPath = "/ssd1/esotericbytes-com/data";
+                        isReadOnly = false;
+                    };
+                };
+
+                config = {
+
+                    services.nginx = {
+                        enable = true;
+                        virtualHosts = {
+                            "esotericbytes.com" = {
+                                enableACME = false;
+                                forceSSL = false;
+                                root = "/var/www/data";
+                            };
+                        };
+                    };
+
+                    networking.firewall.allowedTCPPorts = [ 80 ];
+
+                    system.stateVersion = "24.05";
+                };
+            };
+        };
+    };
+}

modules/features/novnc.nix

@@ -0,0 +1,78 @@
+{ ... }: {
+
+    flake.nixosModules.novnc = { config, lib, pkgs, ... }: {
+
+        config = {
+            systemd.services.novnc = {
+                enable = true;
+
+                path = with pkgs; [
+                    novnc
+                        ps
+                ];
+
+                script = ''
+                    novnc --listen 80 --vnc 127.0.0.1:5900
+                    '';
+
+                serviceConfig = {
+                    Type = "exec";
+                };
+
+                wantedBy = [ "multi-user.target" ];
+            };
+
+            networking.firewall.allowedTCPPorts = [ 80 ];
+        };
+    };
+
+    flake.nixosModules.novnc-container = { config, lib, pkgs, ... }: {
+
+        config = {
+
+            networking = {
+                firewall.interfaces."ve-novnc" = {
+                    allowedTCPPorts = [ 5900 ];
+                    allowedUDPPorts = [ 5900 ];
+                };
+            };
+
+            containers.novnc = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.30";
+
+                config = {
+
+                    systemd.services.novnc = {
+                        enable = true;
+
+                        path = with pkgs; [
+                            novnc
+                                ps
+                        ];
+
+                        script = ''
+                            novnc --listen 80 --vnc 192.168.100.10:5900
+                            '';
+
+                        serviceConfig = {
+                            Type = "exec";
+                        };
+
+                        wantedBy = [ "multi-user.target" ];
+                    };
+
+
+                    networking.firewall.allowedTCPPorts = [ 80 ];
+
+                    system.stateVersion = "25.05";
+                };
+            };
+        };
+    };
+
+}
+

modules/features/ntfy.nix

@@ -0,0 +1,41 @@
+{ ... }: {
+
+    flake.nixosModules.ntfy = { config, lib, ... }: {
+
+        config = {
+
+            containers.ntfy = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.19";
+
+                config = {
+
+                    services.ntfy-sh = {
+
+                        enable = true;
+
+                        settings = {
+
+                            base-url = "https://ntfy.esotericbytes.com";
+
+                            listen-http = ":80";
+
+                            behind-proxy = true;
+
+                            upstream-base-url = "https://ntfy.sh";
+
+                            auth-default-access = "deny-all";
+                        };
+                    };
+
+                    networking.firewall.allowedTCPPorts = [ 80 ];
+
+                    system.stateVersion = "24.05";
+                };
+            };
+        };
+    };
+}

modules/features/ollama.nix

@@ -0,0 +1,91 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.ollama = { config, lib, ... }: {
+
+        config = {
+            services.ollama = {
+                enable = true;
+                acceleration = "cuda";
+                environmentVariables = {
+                    OLLAMA_CONTEXT_LENGTH = lib.mkDefault "16000";
+                };
+                package = let 
+                    pkgs-us = import inputs.nixpkgs-us { 
+                        system = "x86_64-linux";
+                        config.allowUnfree = true;
+                    }; 
+                in pkgs-us.ollama-cuda;
+            };
+        };
+    };
+
+    flake.nixosModules.ollama-docker = { config, lib, pkgs, ... }: let
+
+    hostPort = 11434;
+
+    subdomain = "ollama";
+
+    name = "ollama";
+
+    in {
+
+        config = {
+
+            environment.systemPackages = with pkgs; [
+                ollama
+            ];
+
+            networking.firewall.interfaces = {
+                "ve-traefik" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+
+                "ve-openwebui" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+            };
+
+            virtualisation.oci-containers.containers.ollama = {
+                image = "ollama/ollama:latest";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                ports = [
+                    "${builtins.toString hostPort}:11434"
+                ];
+
+                volumes = [
+                    "vol_ollama:/root/.ollama"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.ollama.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "11434";
+                };
+
+                extraOptions = lib.mkIf config.hardware.nvidia-container-toolkit.enable [
+                    "--device=nvidia.com/gpu=all"
+                        "--ip=192.168.101.22"
+                ];
+
+                environment = {
+                    OLLAMA_CONTEXT_LENGTH = lib.mkDefault "32000";
+                };
+            };
+        };
+    };
+}
+

modules/features/openssh.nix

@@ -0,0 +1,19 @@
+{ ... }: {
+
+    flake.nixosModules.openssh = { config, lib, ... }: {
+
+        config = {
+
+            services.openssh = {
+                enable = true;
+                openFirewall = lib.mkDefault true;
+                settings = {
+                    PermitRootLogin = lib.mkForce "no";
+                    PasswordAuthentication = false;
+                    KbdInteractiveAuthentication = false;
+                };
+            };
+        };
+    };
+}
+

modules/features/openwebui.nix

@@ -0,0 +1,94 @@
+{ ... }: {
+
+    flake.nixosModules.openwebui = { config, lib, pkgs, ... }: let
+
+    subdomain = "ai";
+
+    name = "openwebui";
+
+    in {
+
+        config = {
+
+            virtualisation.oci-containers.containers.openwebui = {
+                image = "ghcr.io/open-webui/open-webui:v0.7.2";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                /*ports = [
+                  "${builtins.toString hostPort}:8080"
+                  ];*/
+
+                volumes = [
+                    "vol_openwebui:/app/backend/data"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "8080";
+                };
+
+                extraOptions = lib.mkIf config.hardware.nvidia-container-toolkit.enable [
+                    "--device=nvidia.com/gpu=all"
+                        "--ip=192.168.101.8"
+                ];
+
+                environment = {
+                };
+            };
+
+            systemd.services."docker-openwebui" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-openwebui.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-openwebui.service" 
+                ];
+                partOf = [
+                    "docker-compose-openwebui-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-openwebui-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-openwebui" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_openwebui || docker volume create vol_openwebui --driver=local
+                    '';
+                partOf = [ "docker-compose-openwebui-root.target" ];
+                wantedBy = [ "docker-compose-openwebui-root.target" ];
+            };
+
+            systemd.targets."docker-compose-openwebui-root" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+
+        };
+    };
+}

modules/features/packages.nix

@@ -0,0 +1,12 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.default = { pkgs, ... }: {
+
+        environment.systemPackages = with pkgs; [
+            age
+            sops
+            inputs.disko.packages.${pkgs.stdenv.hostPlatform.system}.disko-install 
+        ];
+    };
+}
+

modules/features/passbolt/docker-compose.nix-txt

@@ -0,0 +1,167 @@
+# Auto-generated by compose2nix.
+
+{ pkgs, lib, ... }:
+
+{
+  # Runtime
+  virtualisation.docker = {
+    enable = true;
+    autoPrune.enable = true;
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  # Containers
+  virtualisation.oci-containers.containers."passbolt-db" = {
+    image = "mariadb:10.11";
+    environment = {
+      "MYSQL_DATABASE" = "passbolt";
+      "MYSQL_PASSWORD" = "P4ssb0lt";
+      "MYSQL_RANDOM_ROOT_PASSWORD" = "true";
+      "MYSQL_USER" = "passbolt";
+    };
+    volumes = [
+      "passbolt_database_volume:/var/lib/mysql:rw"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=db"
+      "--network=passbolt_default"
+    ];
+  };
+  systemd.services."docker-passbolt-db" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    after = [
+      "docker-network-passbolt_default.service"
+      "docker-volume-passbolt_database_volume.service"
+    ];
+    requires = [
+      "docker-network-passbolt_default.service"
+      "docker-volume-passbolt_database_volume.service"
+    ];
+    partOf = [
+      "docker-compose-passbolt-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-passbolt-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."passbolt-passbolt" = {
+    image = "passbolt/passbolt:latest-ce";
+    environment = {
+      "APP_FULL_BASE_URL" = "https://passbolt.local";
+      "DATASOURCES_DEFAULT_DATABASE" = "passbolt";
+      "DATASOURCES_DEFAULT_HOST" = "db";
+      "DATASOURCES_DEFAULT_PASSWORD" = "P4ssb0lt";
+      "DATASOURCES_DEFAULT_USERNAME" = "passbolt";
+    };
+    volumes = [
+      "passbolt_gpg_volume:/etc/passbolt/gpg:rw"
+      "passbolt_jwt_volume:/etc/passbolt/jwt:rw"
+    ];
+    ports = [
+      "80:80/tcp"
+      "443:443/tcp"
+    ];
+    cmd = [ "/usr/bin/wait-for.sh" "-t" "0" "db:3306" "--" "/docker-entrypoint.sh" ];
+    dependsOn = [
+      "passbolt-db"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=passbolt"
+      "--network=passbolt_default"
+    ];
+  };
+  systemd.services."docker-passbolt-passbolt" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    after = [
+      "docker-network-passbolt_default.service"
+      "docker-volume-passbolt_gpg_volume.service"
+      "docker-volume-passbolt_jwt_volume.service"
+    ];
+    requires = [
+      "docker-network-passbolt_default.service"
+      "docker-volume-passbolt_gpg_volume.service"
+      "docker-volume-passbolt_jwt_volume.service"
+    ];
+    partOf = [
+      "docker-compose-passbolt-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-passbolt-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."docker-network-passbolt_default" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "docker network rm -f passbolt_default";
+    };
+    script = ''
+      docker network inspect passbolt_default || docker network create passbolt_default
+    '';
+    partOf = [ "docker-compose-passbolt-root.target" ];
+    wantedBy = [ "docker-compose-passbolt-root.target" ];
+  };
+
+  # Volumes
+  systemd.services."docker-volume-passbolt_database_volume" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      docker volume inspect passbolt_database_volume || docker volume create passbolt_database_volume
+    '';
+    partOf = [ "docker-compose-passbolt-root.target" ];
+    wantedBy = [ "docker-compose-passbolt-root.target" ];
+  };
+  systemd.services."docker-volume-passbolt_gpg_volume" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      docker volume inspect passbolt_gpg_volume || docker volume create passbolt_gpg_volume
+    '';
+    partOf = [ "docker-compose-passbolt-root.target" ];
+    wantedBy = [ "docker-compose-passbolt-root.target" ];
+  };
+  systemd.services."docker-volume-passbolt_jwt_volume" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      docker volume inspect passbolt_jwt_volume || docker volume create passbolt_jwt_volume
+    '';
+    partOf = [ "docker-compose-passbolt-root.target" ];
+    wantedBy = [ "docker-compose-passbolt-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."docker-compose-passbolt-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

modules/features/passbolt/passbolt.nix

@@ -0,0 +1 @@
+{}

modules/features/pihole.nix

@@ -0,0 +1,80 @@
+{ ... }: {
+
+    flake.nixosModules.pihole = { config, lib, ... }: let
+
+    hostPort = 9001;
+
+    subdomain = "pihole";
+
+    name = "pihole";
+
+    in {
+
+        config = {
+
+            virtualisation.docker.daemon.settings.dns = [ "192.168.101.12" ];
+
+            environment.etc."resolv.conf" = {
+                enable = true;
+                text = ''
+                    nameserver 127.0.0.1
+                    nameserver 1.1.1.1
+                    nameserver 1.0.0.1
+                    options edns0
+                    '';
+
+                user = "root";
+                mode = "0664";
+            };
+
+            networking.firewall.interfaces = {
+                "ve-traefik" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+            };
+
+            virtualisation.oci-containers.containers.pihole = {
+                image = "pihole/pihole:latest";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "80";
+                };
+
+                extraOptions = [
+                    "--ip=192.168.101.12"
+                ];
+
+                ports = [
+                    "${builtins.toString hostPort}:80"
+                        "127.0.0.1:53:53/tcp"
+                        "127.0.0.1:53:53/udp"
+                ];
+
+                volumes = [
+                    "vol_pihole:/etc/pihole"
+                ];
+
+                environment = {
+                    FTLCONF_webserver_api_password = "7567";
+                    FTLCONF_dns_listeningMode = "ALL";
+                };
+            };
+        };
+    };
+}

modules/features/pipewire.nix

@@ -0,0 +1,47 @@
+{ ... }: {
+
+    flake.nixosModules.pipewire = { config, lib, pkgs, ... }: {
+
+        config = {
+
+# Enable sound with pipewire.
+#sound.enable = true;
+
+            security.rtkit.enable = true;
+            services.pipewire = {
+                enable = true;
+                package = pkgs.pipewire;
+                alsa.enable = true;
+                alsa.support32Bit = true;
+                pulse.enable = true;
+                extraConfig.pipewire-pulse."92-low-latency" = {
+                    context.modules = [
+                    {
+                        name = "libpipewire-module-protocol-pulse";
+                        args = {
+                            pulse.min.req = "32/48000";
+                            pulse.default.req = "32/48000";
+                            pulse.max.req = "32/48000";
+                            pulse.min.quantum = "32/48000";
+                            pulse.max.quantum = "32/48000";
+                        };
+                    }
+                    ];
+                    stream.properties = {
+                        node.latency = "32/48000";
+                        resample.quality = 1;
+                    };
+                };
+# If you want to use JACK applications, uncomment this
+#jack.enable = true;
+
+# use the example session manager (no others are packaged yet so this is enabled by default,
+# no need to redefine it in your config for now)
+                wireplumber.enable = true;
+
+            };
+        };
+
+
+    };
+}

modules/features/portainer.nix

@@ -0,0 +1,60 @@
+{ ... }: {
+
+    flake.nixosModules.portainer = { config, lib, ... }: let
+
+    hostPort = 9000;
+
+    subdomain = "portainer";
+
+    name = "portainer";
+
+    in {
+
+        config = {
+
+            networking.firewall.interfaces = {
+                "ve-traefik" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+            };
+
+            virtualisation.oci-containers.containers.portainer = {
+                image = "portainer/portainer-ce:latest";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "9000";
+                };
+
+                ports = [
+                    "127.0.0.1:8000:8000"
+                        "${builtins.toString hostPort}:9000"
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.10"
+                ];
+
+                volumes = [
+                    "vol_portainer:/data"
+                        "/run/docker.sock:/var/run/docker.sock"
+                ];
+            };
+        };
+    };
+}

modules/features/rustdesk/default.nix

@@ -0,0 +1 @@
+{}

modules/features/rustdesk/docker-compose.nix-txt

@@ -0,0 +1,77 @@
+# Auto-generated by compose2nix.
+
+{ pkgs, lib, ... }:
+
+{
+  # Runtime
+  virtualisation.docker = {
+    enable = true;
+    autoPrune.enable = true;
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  # Containers
+  virtualisation.oci-containers.containers."hbbr" = {
+    image = "rustdesk/rustdesk-server:latest";
+    volumes = [
+      "/home/nathan/Projects/Olympus/system/virtualization/docker/rustdesk/data:/root:rw"
+    ];
+    cmd = [ "hbbr" ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network=host"
+    ];
+  };
+  systemd.services."docker-hbbr" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    partOf = [
+      "docker-compose-rustdesk-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-rustdesk-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."hbbs" = {
+    image = "rustdesk/rustdesk-server:latest";
+    volumes = [
+      "/home/nathan/Projects/Olympus/system/virtualization/docker/rustdesk/data:/root:rw"
+    ];
+    cmd = [ "hbbs" ];
+    dependsOn = [
+      "hbbr"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network=host"
+    ];
+  };
+  systemd.services."docker-hbbs" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    partOf = [
+      "docker-compose-rustdesk-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-rustdesk-root.target"
+    ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."docker-compose-rustdesk-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

modules/features/sandbox.nix

@@ -0,0 +1,77 @@
+{ ... }: {
+
+    flake.nixosModules.sandbox = { config, lib, self, ... }: {
+
+        config = {
+
+            networking = {
+
+                nat.internalInterfaces = [ "ve-sandbox" ];
+            };
+            containers.sandbox = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.32";
+
+                ephemeral = true;
+
+                timeoutStartSec = "3min";
+
+                flake = "${self}";
+
+                /*bindMounts = {
+                  "/dev/nvidia0" = {
+                  hostPath = "/dev/nvidia0";
+                  isReadOnly = false;
+                  };
+                  "/dev/nvidiactl" = {
+                  hostPath = "/dev/nvidiactl";
+                  isReadOnly = false;
+                  };
+                  "/dev/nvidia-uvm" = {
+                  hostPath = "/dev/nvidia-uvm";
+                  isReadOnly = false;
+                  };
+                  "/dev/nvidia-modeset" = {
+                  hostPath = "/dev/nvidia-modeset";
+                  isReadOnly = false;
+                  };
+                  "/dev/nvidia-uvm-tools" = {
+                  hostPath = "/dev/nvidia-uvm-tools";
+                  isReadOnly = false;
+                  };
+                  };
+
+                  allowedDevices = [
+                  {
+                  node = "/dev/nvidia0";
+                  modifier = "rw";
+                  }
+                  {
+                  node = "/dev/nvidiactl";
+                  modifier = "rw";
+                  }
+                  {
+                  node = "/dev/nvidia-uvm";
+                  modifier = "rw";
+                  }
+                  {
+                  node = "/dev/nvidia-modeset";
+                  modifier = "rw";
+                  }
+                  {
+                  node = "/dev/nvidia-uvm-tools";
+                  modifier = "rw";
+                  }
+                  ];*/
+
+                config = {
+                };
+
+
+            };
+        };
+    };
+}

modules/features/sddm.nix

@@ -0,0 +1,32 @@
+{ ... }: {
+
+    flake.nixosModules.sddm = { config, lib, pkgs, ... }: {
+
+        config = {
+
+            qt.enable = true;
+
+            environment.systemPackages = with pkgs; [ (sddm-astronaut.override { embeddedTheme = "pixel_sakura"; }) ];
+
+            services.displayManager.sddm = {
+                enable = true;
+                wayland.enable = true;
+                autoNumlock = true;
+                theme = "sddm-astronaut-theme"; #"${inputs.tokyo-night-sddm-theme { inherit pkgs; }}";
+                enableHidpi = true;
+                /*extraPackages = with pkgs; [
+                  libsForQt5.qtsvg
+                  libsForQt5.qtquickcontrols2
+                  libsForQt5.qtgraphicaleffects
+                  ];*/
+
+                package = lib.mkDefault pkgs.kdePackages.sddm;
+                extraPackages = with pkgs; [
+                    kdePackages.qtsvg
+                        kdePackages.qtvirtualkeyboard
+                        kdePackages.qtmultimedia
+                ];
+            };
+        };
+    };
+}

modules/features/searxng/searxng.nix

@@ -0,0 +1,57 @@
+{ ... }: {
+
+    flake.nixosModules.searxng = { config, lib, ... }: let
+
+    subdomain = "searxng";
+
+    name = "searxng";
+
+    in {
+
+        config = {
+
+            environment.etc."searxng/settings.yml".source = ./settings.yml;
+
+            virtualisation.oci-containers.containers.searxng = {
+                image = "searxng/searxng:latest";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "8080";
+                };
+
+                ports = [
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.9"
+                ];
+
+                volumes = [
+                    "vol_searxng_settings:/etc/searxng/"
+                        "vol_searxng_data:/var/cache/searxng/"
+                        "/etc/searxng/settings.yml:/etc/searxng/settings.yml"
+                ];
+
+                environment = {
+                    SEARXNG_SECRET = "2e8b4fcf4c0f46b097496f2d5715dbb061bd5cac78c64d0f5a0bee27f013f3c0";
+                };
+            };
+        };
+    };
+}