gpg: add encrypt-to option to always encrypt to yourself

Flake lock file updates:

• Updated input 'authentik-nix':
    'github:nix-community/authentik-nix/04db807ac00ba6d62808ffab18b3b6d500b6f7cb?narHash=sha256-2Zbde5orbGsYdzroe51P1AW8pFMCNyqHgLjmHYJvOmE%3D' (2025-09-12)
  → 'github:nix-community/authentik-nix/69fac057b2e553ee17c9a09b822d735823d65a6c?narHash=sha256-yiv/g/tiJI3PI95F7vhTnaf1TDsIkFLrmmFTjWfb6pQ%3D' (2025-10-01)
• Updated input 'authentik-nix/authentik-src':
    'github:goauthentik/authentik/dd7c6b29d950664deadbcf5390272619a8bf9a5e?narHash=sha256-5l1g55b0xozGg0NaZFimiO5JbHGcudaNSEn1/XsweaU%3D' (2025-08-22)
  → 'github:goauthentik/authentik/8d3a289d12c7de2f244c76493af7880f70d08af2?narHash=sha256-pIzDaoDWc58cY/XhsyweCwc4dfRvkaT/zqsV1gDSnCI%3D' (2025-09-30)
• Updated input 'authentik-nix/flake-parts':
    'github:hercules-ci/flake-parts/af66ad14b28a127c5c0f3bbb298218fc63528a18?narHash=sha256-pHYj8gUBapuUzKV/kN/tR3Zvqc7o6gdFB9XKXIp1SQ8%3D' (2025-08-06)
  → 'github:hercules-ci/flake-parts/4524271976b625a4a605beefd893f270620fd751?narHash=sha256-%2BuWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw%3D' (2025-09-01)
• Updated input 'authentik-nix/flake-parts/nixpkgs-lib':
    'github:nix-community/nixpkgs.lib/0f36c44e01a6129be94e3ade315a5883f0228a6e?narHash=sha256-zvaMGVn14/Zz8hnp4VWT9xVnhc8vuL3TStRqwk22biA%3D' (2025-07-27)
  → 'github:nix-community/nixpkgs.lib/a73b9c743612e4244d865a2fdee11865283c04e6?narHash=sha256-x2rJ%2BOvzq0sCMpgfgGaaqgBSwY%2BLST%2BWbZ6TytnT9Rk%3D' (2025-08-10)
• Updated input 'authentik-nix/pyproject-build-systems':
    'github:pyproject-nix/build-system-pkgs/6edb3ae27395cd88be3d64b732d1539957dad59c?narHash=sha256-4jc3JDQt75fYXFrglgqyzF6C6zLU0QGLymzian4aP%2BU%3D' (2025-08-25)
  → 'github:pyproject-nix/build-system-pkgs/5b8e37fe0077db5c1df3a5ee90a651345f085d38?narHash=sha256-6nzSZl28IwH2Vx8YSmd3t6TREHpDbKlDPK%2Bdq1LKIZQ%3D' (2025-09-08)
• Updated input 'authentik-nix/pyproject-nix':
    'github:pyproject-nix/pyproject.nix/030dffc235dcf240d918c651c78dc5f158067b51?narHash=sha256-5aJM14MpoLk2cdZAetu60OkLQrtFLWTICAyn1EP7ZpM%3D' (2025-08-28)
  → 'github:pyproject-nix/pyproject.nix/8d77f342d66ad1601cdb9d97e9388b69f64d4c8e?narHash=sha256-6pNlGhwOIMfhe/RLjHdpXveKS4FyLHvlGe%2BKtjDild4%3D' (2025-09-07)
• Updated input 'authentik-nix/uv2nix':
    'github:pyproject-nix/uv2nix/0529e6d8227517205afcd1b37eee3088db745730?narHash=sha256-ALXRHIMXQ4qVNfCbcWykC23MjMwUoHn9BreoBfqmq0Y%3D' (2025-08-29)
  → 'github:pyproject-nix/uv2nix/780494c40895bb7419a73d942bee326291e80b3b?narHash=sha256-7Hwz0vfHuFqCo5v7Q07GQgLBWuPvZCuf/5/pk4NoADg%3D' (2025-09-15)
• Updated input 'home-manager':
    'github:nix-community/home-manager/f21d9167782c086a33ad53e2311854a8f13c281e?narHash=sha256-K6PEI5PYY94TVMH0mX3MbZNYFme7oNRKml/85BpRRAo%3D' (2025-09-14)
  → 'github:nix-community/home-manager/3b955f5f0a942f9f60cdc9cacb7844335d0f21c3?narHash=sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA%3D' (2025-09-21)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/9a094440e02a699be5c57453a092a8baf569bdad?narHash=sha256-Vp9K5ol6h0J90jG7Rm4RWZsCB3x7v5VPx588TQ1dkfs%3D' (2025-09-14)
  → 'github:nixos/nixpkgs/3bcc93c5f7a4b30335d31f21e2f1281cba68c318?narHash=sha256-YWo57PL7mGZU7D4WeKFMiW4ex/O6ZolUS6UNBHTZfkI%3D' (2025-10-04)
• Updated input 'nur':
    'github:nix-community/NUR/087c74cd9cc63e44dd20f1dcc5cdb4e5fddc9e14?narHash=sha256-EHZWQe3a04DvOlUR2j7LwGCaGqYTStYExpstYezfq3c%3D' (2025-09-14)
  → 'github:nix-community/NUR/ba4952df76bc6179d0bb3b9e7b4ff8517cfec870?narHash=sha256-bPh7JZnT7WydN4E1kVLq1l87NlzuD2pz1GYwvYSWo1U%3D' (2025-10-05)
• Updated input 'nur/nixpkgs':
    'github:nixos/nixpkgs/c23193b943c6c689d70ee98ce3128239ed9e32d1?narHash=sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820%3D' (2025-09-13)
  → 'github:nixos/nixpkgs/7df7ff7d8e00218376575f0acdcc5d66741351ee?narHash=sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs%3D' (2025-10-02)
• Updated input 'trivionomicon':
    'path:./trivionomicon'
  → 'path:./trivionomicon'
• Updated input 'unstable':
    'github:nixos/nixpkgs/c23193b943c6c689d70ee98ce3128239ed9e32d1?narHash=sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820%3D' (2025-09-13)
  → 'github:nixos/nixpkgs/7df7ff7d8e00218376575f0acdcc5d66741351ee?narHash=sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs%3D' (2025-10-02)
• Updated input 'vpsadminos':
    'github:vpsfreecz/vpsadminos/20f55b1d9bee4fdab62494d4471854d6586d3637?narHash=sha256-%2BYzznL/mHiSjDFC8vJsSgQ%2BpvjhqWMsLRjegEKSNv/4%3D' (2025-08-23)
  → 'github:vpsfreecz/vpsadminos/087b340cc897083a31defafd6a6f1c66e5bf48eb?narHash=sha256-H0FC6QbxgEE79pXwlPVvWUNenQOTMldzlWSij5pPyMk%3D' (2025-10-03)

README.md

@@ -0,0 +1,41 @@
+# Nix configuration
+
+## Updating
+
+Update flake
+
+    nix flake update --commit-lock-file
+
+Switch current machine
+
+    sudo nixos-rebuild switch --flake . --show-trace
+
+Switch current home manager
+
+    home-manager switch --flake . --show-trace
+
+Switch server
+
+    nixos-rebuild switch --target-host root@posixlycorrect.com --use-substitutes --show-trace --flake .\#vps
+
+Update homepage
+
+    nix flake update --commit-lock-file homepage
+
+
+## Cleanup
+
+Collect garbage (run with sudo to collect root garbage)
+
+    nix-collect-garbage -d
+
+
+## Submodule management
+
+Trivionomicon
+
+    git subtree push --prefix=trivionomicon forgejo@git.posixlycorrect.com:deepState/trivionomicon.git master
+    git subtree pull --prefix=trivionomicon forgejo@git.posixlycorrect.com:deepState/trivionomicon.git master
+
+## About
+This is a unification of my old configs, which had a combined 506 commits.

flake.nix

@@ -1,21 +1,22 @@
 {
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
     unstable.url = "github:nixos/nixpkgs/nixos-unstable";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.11";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    nur.url = "github:nix-community/NUR";
+    trivionomicon = {
-    impermanence.url = "github:nix-community/impermanence";
+      url = "./trivionomicon";
-    hm-isolation.url = "github:3442/hm-isolation";
+      inputs.nixpkgs.follows = "nixpkgs";
-    nixGL.url = "github:guibou/nixGL";
+    };
-    flake-utils.url = "github:numtide/flake-utils";
-    vpsadminos.url = "github:vpsfreecz/vpsadminos";
 
-    homepage.url = "git+https://git.posixlycorrect.com/fabian/homepage.git?ref=master";
+    homepage = {
+      url = "git+https://git.posixlycorrect.com/fabian/homepage.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     authentik-nix = {
       url = "github:nix-community/authentik-nix";
@@ -26,105 +27,30 @@
       url = "github:StarCitizenTools/mediawiki-skins-Citizen/v2.27.0";
       flake = false;
     };
+
+    flake-utils.url = "github:numtide/flake-utils";
+    hm-isolation.url = "github:3442/hm-isolation";
+    impermanence.url = "github:nix-community/impermanence";
+    nixGL.url = "github:guibou/nixGL";
+    nur.url = "github:nix-community/NUR";
+    vpsadminos.url = "github:vpsfreecz/vpsadminos";
   };
 
-  outputs = flakes @ {
+  outputs = flakes:
-    self,
+    flakes.trivionomicon.lib.mkSystemFlake {
-    nixpkgs,
+      inherit flakes;
-    unstable,
-    home-manager,
-    nur,
-    impermanence,
-    hm-isolation,
-    nixGL,
-    flake-utils,
-    vpsadminos,
-    homepage,
-    conduwuit,
-    mediawikiSkinCitizen,
-    authentik-nix,
-  }: let
-    system = "x86_64-linux";
 
-    importPkgs = flake:
+      system = "x86_64-linux";
-      import flake {
-        inherit system;
 
-        config = import ./pkgs/config nixpkgs.lib;
+      paths = {
-        overlays = [
+        localOverlay = "pkgs";
-          self.overlays.default
+        nixpkgsConfig = "pkgs/config";
-          nur.overlays.default
+
-          nixGL.overlay
+        nixosSource = "sys";
-        ];
+        nixosPlatforms = "sys/platforms";
+
+        hmSource = "home";
+        hmPlatforms = "home/platforms";
       };
-
-    pkgs = importPkgs nixpkgs;
-
-    inherit (pkgs.local.lib) importAll;
-
-    local = final: prev: import ./pkgs {inherit final prev flakes;};
-  in
-    with pkgs.lib; {
-      formatter.${system} = pkgs.alejandra;
-      packages.${system} = pkgs.local;
-
-      overlays.default = final: prev: let
-        locals = local final prev;
-      in
-        locals.override
-        // {
-          local = locals;
-          unstable = importPkgs unstable;
-        };
-
-      nixosConfigurations = let
-        nixosSystem = {modules}:
-          makeOverridable nixpkgs.lib.nixosSystem {
-            inherit modules pkgs system;
-
-            specialArgs = {
-              inherit flakes;
-            };
-          };
-
-        hostConfig = host:
-          nixosSystem {
-            modules = [
-              ./sys
-              host
-            ];
-          };
-      in
-        mapAttrs (_: hostConfig) (importAll {root = ./sys/platforms;});
-
-      homeConfigurations = let
-        registry = {...}: {
-          config.nix.registry =
-            mapAttrs (_: value: {
-              flake = value;
-            })
-            flakes;
-        };
-
-        home = platform:
-          home-manager.lib.homeManagerConfiguration {
-            inherit pkgs;
-
-            modules = [
-              ./home
-              platform
-              registry
-              hm-isolation.homeManagerModule
-            ];
-
-            extraSpecialArgs = {
-              inherit flakes;
-            };
-          };
-
-        platformHome = name: platform:
-          nameValuePair name (home platform);
-      in
-        mapAttrs' platformHome (importAll {root = ./home/platforms;});
     };
 }

home/default.nix

@@ -8,5 +8,7 @@
 with lib; {
   imports = [
     ./modules
+    flakes.trivionomicon.homeManagerModules.default
+    flakes.hm-isolation.homeManagerModule
   ];
 }

home/modules/baseline.nix

@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  flakes,
   ...
 }:
 with lib; let
@@ -11,38 +12,50 @@ in {
     enable = mkEnableOption "Basic home settings";
   };
   config = mkIf cfg.enable {
+    programs.home-manager.enable = true;
+
+    nix.registry = {
+      "system".to = {
+        type = "path";
+        path = "/home/fabian/nix";
+      };
+
+      "nixpkgs".flake = flakes.nixpkgs;
+      "unstable".flake = flakes.unstable;
+    };
+
     xdg = {
       enable = true;
-      mimeApps = {
-        enable = true;
-        defaultApplications = {};
-      };
-      portal = {
-        # this shouldnt be on baseline, as servers have no GUI
-        enable = true;
-        xdgOpenUsePortal = true;
-        extraPortals = with pkgs; [xdg-desktop-portal-gtk]; #wtf is this
-        configPackages = with pkgs; [xdg-desktop-portal-gtk]; #wtf is this
-      };
     };
 
     home = {
       stateVersion = "24.05"; # DO NOT CHANGE
 
+      username = "fabian";
+      homeDirectory = "/home/fabian";
+
       packages = with pkgs; [
         calc
+        dysk
+        fd
         file
+        fzf
         gcc
         htop
         killall
         man-pages
         man-pages-posix
+        nmap
+        p7zip
         pv
+        ripgrep
         tree
         units
         unzip
         vim
+        wl-clipboard
         zip
+        zoxide
       ];
       keyboard = {
         layout = "us";
@@ -58,5 +71,14 @@ in {
       userEmail = "fabian@posixlycorrect.com";
       userName = "Fabian Montero";
     };
+
+    local = {
+      services = {
+        zsh.enable = true;
+      };
+      programs = {
+        neovim.enable = true;
+      };
+    };
   };
 }

home/modules/browsers.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.local.apps.browsers;
-in {
-  options.local.apps.browsers = {
-    enable = mkEnableOption "Browser home settings";
-  };
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      chromium
-      firefox
-    ];
-  };
-}

home/modules/default.nix

@@ -5,16 +5,21 @@
   ...
 }: {
   imports = [
-    ./terminal
+    ./terminal.nix
     ./neovim.nix
     ./baseline.nix
-    ./gaming
+    ./gaming.nix
     ./yubikey.nix
-    ./browsers.nix
+    ./firefox.nix
     ./gui
     ./zsh
     ./gpg.nix
     ./defaultDesktopPack.nix
     ./accounts.nix
+    ./syncthing.nix
+    ./mapping.nix
+    ./zed.nix
+    ./pass.nix
+    ./halloy.nix
   ];
 }

home/modules/defaultDesktopPack.nix

@@ -5,30 +5,67 @@
   ...
 }:
 with lib; let
-  cfg = config.local.apps.defaultDesktopPack;
+  cfg = config.local.defaultDesktopPack;
 in {
-  options.local.apps.defaultDesktopPack = {
+  options.local.defaultDesktopPack = {
-    enable = mkEnableOption "common desktop apps";
+    enable = mkEnableOption "common desktop programs and services";
+    laptop = mkOption {
+      type = types.bool;
+      default = false;
+    };
   };
   config = mkIf cfg.enable {
     home.packages = with pkgs; [
       calibre
+      chromium
       discord
-      gwenview
+      (gajim.override {
+        enableSecrets = true;
+        enableUPnP = true;
+        enableAppIndicator = true;
+        enableE2E = true;
+        enableRST = true;
+      })
       libreoffice-fresh
       mpv
       obs-studio
       pavucontrol
       pdfarranger
+      qimgv
       qpdfview
+      qbittorrent
       runelite
       spotify
       tdesktop
+      thunderbird
       usbutils
       vpsfree-client
       vscodium-fhs
       zola
-      zoom-us
     ];
+
+    trivium = {
+      waybar = {
+        enable = true;
+        fontFamily = "JetBrainsMono Nerd Font";
+      };
+    };
+
+    local = {
+      baseline.enable = true;
+
+      services = {
+        gpg.enable = true;
+        accounts.enable = true;
+        pass.enable = true;
+        syncthing.enable = true;
+      };
+      programs = {
+        firefox.enable = true;
+        zed.enable = true;
+        halloy.enable = true;
+        terminal.enable = true;
+      };
+    };
   };
 }

home/modules/firefox.nix

@@ -0,0 +1,37 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.programs.firefox;
+in {
+  options.local.programs.firefox = {
+    enable = mkEnableOption "firefox";
+  };
+
+  config = mkIf cfg.enable {
+    programs.firefox = {
+      enable = true;
+      package = pkgs.firefox.override {
+        nativeMessagingHosts = [pkgs.passff-host];
+      };
+    };
+
+    xdg = {
+      mimeApps = {
+        enable = true;
+        defaultApplications = {
+          "text/html" = ["firefox.desktop"];
+          "text/uri-list" = ["firefox.desktop"];
+          "x-scheme-handler/http" = ["firefox.desktop"];
+          "x-scheme-handler/https" = ["firefox.desktop"];
+          "x-scheme-handler/about" = ["firefox.desktop"];
+          "x-scheme-handler/unknown" = ["firefox.desktop"];
+        };
+      };
+    };
+    home.sessionVariables.DEFAULT_BROWSER = "${lib.getExe pkgs.firefox}";
+  };
+}

home/modules/gaming.nix

@@ -5,18 +5,13 @@
   ...
 }:
 with lib; let
-  cfg = config.local.apps.gaming;
+  cfg = config.local.programs.gaming;
 in {
-  options.local.apps.gaming = {
+  options.local.programs.gaming = {
     enable = mkEnableOption "gaming apps";
   };
   config = mkIf cfg.enable {
     home.packages = [
-      # Steam. todo: move to the steam module later
-      (pkgs.callPackage ./package.nix {})
-      pkgs.protonup
-      pkgs.winetricks
-      pkgs.protontricks
       pkgs.lutris
       pkgs.openrct2
       pkgs.prismlauncher

home/modules/gaming/package.nix

@@ -1,9 +0,0 @@
-{
-  writeShellScriptBin,
-  steam-run,
-  steam,
-  ...
-}:
-writeShellScriptBin "steam" ''
-  exec ${steam-run}/bin/steam-run ${steam}/bin/steam -console
-''

home/modules/gpg.nix

@@ -12,14 +12,15 @@ in {
     defaultKey = mkOption {
       type = types.str;
       description = "fingerprint of default public key to be used in gpg, git, email, etc.";
-      example = "7AA277E604A4173916BBB4E91FFAC35E1798174F";
+      example = "A8981D346F8F4130CA16A7775517E687FCCE0BB9";
     };
   };
   config = mkIf cfg.enable {
     programs.gpg = {
       enable = true;
       settings = {
-        default-key = config.local.services.gpg.defaultKey;
+        default-key = cfg.defaultKey;
+        encrypt-to = cfg.defaultKey;
       };
     };
 
@@ -38,7 +39,7 @@ in {
       maxCacheTtl = 3600 * 6;
       maxCacheTtlSsh = 3600 * 6;
 
-      pinentryPackage = pkgs.pinentry-emacs;
+      pinentry.package = pkgs.pinentry-emacs;
     };
 
     accounts.email.accounts = {
@@ -46,14 +47,14 @@ in {
         gpg = {
           encryptByDefault = true;
           signByDefault = true;
-          key = config.local.services.gpg.defaultKey;
+          key = cfg.defaultKey;
         };
       };
     };
 
     programs.git = {
       signing = {
-        key = config.local.services.gpg.defaultKey;
+        key = cfg.defaultKey;
         signByDefault = true;
       };
     };

home/modules/gui/autorandr.nix

@@ -1,32 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.local.gui;
-in {
-  programs.autorandr = {
-    profiles."default" = {
-      fingerprint =
-        mapAttrs
-        (monitorId: monitor: monitor.fingerprint)
-        cfg.monitors;
-
-      config =
-        mapAttrs (
-          monitorId:
-            filterAttrs
-            (k: v:
-              !elem k [
-                #list of options to exclude from this list
-                "fingerprint"
-                "initialI3Workspace"
-                "monitorId"
-              ])
-        )
-        cfg.monitors;
-    };
-  };
-}

home/modules/gui/default.nix

@@ -9,149 +9,61 @@ with lib; let
   monitorType = {setName}: (
     types.submodule ({name ? null, ...}: {
       options = {
-        monitorId = mkOption {
+        width = mkOption {
           type = types.str;
-          example = "DP-1";
+          default = "1920";
-          readOnly = true;
+          example = "1920";
-          internal = true;
         };
-        primary = mkOption {
+        height = mkOption {
-          type = types.bool;
-          default = false;
-          description = "is primary monitor";
-          example = "true";
-        };
-        position = mkOption {
           type = types.str;
-          example = "0x0";
+          default = "1080";
-        };
+          example = "1080";
-        mode = mkOption {
-          type = types.str;
-          description = "resolution";
-          default = "1920x1080";
-          example = "1920x1080";
         };
         rate = mkOption {
           type = types.str;
           description = "refresh rate";
           example = "143.85";
         };
-        rotate = mkOption {
+        posX = mkOption {
           type = types.str;
-          default = "normal";
+          description = "x axis position";
-          example = "left";
+          default = "0";
+          example = "0";
         };
-        fingerprint = mkOption {
+        posY = mkOption {
           type = types.str;
-          example = "00ffffffffffff003669a03bd4040000231e0104a5341d783bd005ac5048a627125054bfcf00814081809500714f81c0b30001010101023a801871382d40582c450009252100001e0882805070384d400820f80c09252100001a000000fd003090b4b422010a202020202020000000fc004d53492047323443340a20202001a2020320f14d010304131f120211900e0f1d1e230907078301000065030c001000866f80a0703840403020350009252100001a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e9";
+          description = "y axis position";
+          default = "0";
+          example = "0";
         };
-        initialI3Workspace = mkOption {
-          type = types.nullOr types.int;
-          default = null;
-          example = 1;
-        };
-      };
-      config = optionalAttrs setName {
-        # make this better later
-        monitorId = name;
       };
     })
   );
 in {
   options.local.gui = {
     enable = mkEnableOption "GUI settings";
-    primaryMonitor = mkOption {
-      type = monitorType {setName = false;};
-      readOnly = true;
-      internal = true;
-    };
     monitors = mkOption {
       type = types.attrsOf (monitorType {setName = true;});
     };
-    displayBatteryLevel = mkOption {
-      type = types.bool;
-      default = false;
-      description = "show battery level on polybar";
-      example = "true";
-    };
   };
 
   imports = [
-    ./autorandr.nix
     ./fonts.nix
-    ./i3.nix
+    ./theme.nix
-    ./polybar.nix
+    ./sway.nix
-    ./startx.nix # move to ly once 24.11 comes out :(
+    ./mako.nix
-    ./picom.nix
   ];
 
-  config = let
+  config = mkIf cfg.enable {
-    primaryMonitors =
+    xdg = {
-      filter (monitor: monitor.primary)
+      enable = true;
-      (attrValues cfg.monitors);
+      mimeApps = {
-  in
-    mkIf cfg.enable {
-      assertions = [
-        {
-          assertion = length primaryMonitors == 1;
-          message = "Exactly one (1) primary monitor is requiered.";
-        }
-      ];
-
-      local.gui.primaryMonitor = head primaryMonitors;
-
-      xsession = {
         enable = true;
-        windowManager.i3.enable = true;
+        defaultApplications = {
-      };
+          "application/pdf" = with pkgs; ["qpdfview.desktop"];
-
+          "x-scheme-handler/file" = with pkgs; ["foot.desktop"];
-      programs.autorandr.enable = true;
-      services = {
-        dunst.enable = true;
-        betterlockscreen.enable = true;
-        polybar.enable = true;
-        picom.enable = true;
-      };
-
-      gtk = {
-        enable = true;
-
-        iconTheme = {
-          name = "Papirus-Dark";
-          package = pkgs.papirus-icon-theme;
         };
-        theme = {
-          package = pkgs.materia-theme;
-          name = "Materia-dark";
-        };
-
-        gtk2.extraConfig = ''
-          gtk-toolbar-style=GTK_TOOLBAR_BOTH_HORIZ
-          gtk-menu-images=1
-          gtk-button-images=1
-        '';
-
-        gtk3.extraConfig = {
-          gtk-application-prefer-dark-theme = 1;
-        };
-        gtk4.extraConfig = {
-          gtk-application-prefer-dark-theme = 1;
-        };
-      };
-
-      #qt = { mentioning qt makes qt applications not work, I should probably check how to fix this
-      #  enable = true;
-      #  style.name = "bb10dark";
-      #};
-
-      home.sessionVariables = {
-        # Use gtk in jvm apps
-        _JAVA_OPTIONS = concatStringsSep " " [
-          "-Dawt.useSystemAAFontSettings=on"
-          "-Dswing.aatext=true"
-          "-Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
-          "-Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
-        ];
       };
     };
+  };
 }

home/modules/gui/fonts.nix

@@ -4,9 +4,37 @@
   pkgs,
   ...
 }: {
-  fonts.fontconfig.enable = true;
+  fonts.fontconfig = {
+    enable = true;
+    defaultFonts = {
+      monospace = [
+        "JetBrainsMono Nerd Font"
+        "Noto Sans Mono CJK SC"
+        "Noto Sans Mono"
+        "Noto Color Emoji"
+      ];
+      sansSerif = [
+        "Noto Sans"
+        "Noto Sans CJK SC"
+        "Noto Color Emoji"
+      ];
+      serif = [
+        "Noto Serif"
+        "Noto Serif CJK SC"
+        "Noto Color Emoji"
+      ];
+      emoji = ["Noto Color Emoji"];
+    };
+  };
 
+  # this is probably not necessary since they are already installed in sys
+  # with fonts.packages buy im too lazy to check
   home.packages = with pkgs; [
     jetbrains-mono
+    nerd-fonts.jetbrains-mono
+    noto-fonts
+    noto-fonts-cjk-sans
+    noto-fonts-emoji
+    noto-fonts-extra
   ];
 }

home/modules/gui/i3.nix

@@ -1,108 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  xsession.windowManager.i3 = {
-    package = pkgs.i3-gaps;
-
-    config = let
-      mod = "Mod4";
-    in {
-      modifier = mod;
-
-      fonts = {
-        names = ["JetBrains Mono"];
-        style = "Regular";
-        size = 8.0;
-      };
-
-      gaps = {
-        inner = 10;
-        outer = -10;
-      };
-
-      window = {
-        hideEdgeBorders = "both";
-        titlebar = false;
-      };
-
-      workspaceLayout = "tabbed";
-
-      colors = {
-        focused = {
-          background = "#222222";
-          border = "#4c7899";
-          childBorder = "#222222";
-          indicator = "#292d2e";
-          text = "#888888";
-        };
-      };
-
-      # mkOptionDefault hace que se ponga la config por default
-      # y se sobreescriba las cosas que pongo acá
-      # NO QUITARLO. ver man home-configuration.nix
-      keybindings = mkOptionDefault {
-        "${mod}+Return" = "exec ${pkgs.kitty}/bin/kitty ${pkgs.tmux}/bin/tmux";
-        "${mod}+Tab" = "focus right";
-        "${mod}+Shift+Tab" = "focus left";
-        "${mod}+Shift+s" = "exec ${pkgs.maim}/bin/maim -s -u | ${pkgs.xclip}/bin/xclip -selection clipboard -t image/png -i";
-        "${mod}+Shift+w" = "move workspace to output right";
-        "${mod}+l" = "exec ${pkgs.betterlockscreen}/bin/betterlockscreen -l";
-      };
-
-      startup = [
-        {
-          command = "${pkgs.xss-lock}/bin/xss-lock --transfer-sleep-lock -- ${pkgs.i3lock}/bin/i3lock --nofork";
-          notification = false;
-        }
-        {
-          command = "${pkgs.networkmanagerapplet}/bin/nm-applet";
-          notification = false;
-        }
-        #todo: sería nice hostear esta imagen en el server y fetchearla si no existe
-        {
-          command = "${pkgs.feh}/bin/feh --bg-fill ${config.home.homeDirectory}/Pictures/wallpapers/jupiter.png";
-          notification = false;
-          always = true;
-        }
-        {
-          #todo: move this to browsers module
-          command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 1; exec ${pkgs.firefox}/bin/firefox'";
-        }
-        {
-          #todo: move this to telegram module
-          command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 2; exec ${pkgs.tdesktop}/bin/telegram-desktop'";
-        }
-        #{
-        #  command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 2; exec ${pkgs.element-desktop}/bin/element-desktop'";
-        #}
-        {
-          command = "${pkgs.systemd}/bin/systemctl --user restart polybar.service";
-          notification = false;
-          always = true;
-        }
-        {
-          command = "${pkgs.autorandr}/bin/autorandr -c";
-          notification = false;
-          always = true;
-        }
-      ];
-
-      workspaceOutputAssign =
-        mapAttrsToList (
-          monitorId: v:
-            {
-              output = monitorId;
-            }
-            // optionalAttrs (v.initialI3Workspace != null) {
-              workspace = toString v.initialI3Workspace;
-            }
-        )
-        config.local.gui.monitors;
-      bars = [];
-    };
-  };
-}

home/modules/gui/mako.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.gui;
+in {
+  config = mkIf cfg.enable {
+    services.mako = {
+      enable = true;
+      settings = {
+        actions = true;
+        anchor = "top-right";
+        background-color = "#000000";
+        border-color = "#000000";
+        progress-color = "over #FFFFFF";
+        border-radius = 0;
+        default-timeout = 7000;
+        font = "JetBrainsMono Nerd Font 10";
+        icons = true;
+        ignore-timeout = false;
+        layer = "top";
+      };
+    };
+  };
+}

home/modules/gui/picom.nix

@@ -1,41 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  services.picom = {
-    fade = true;
-    fadeSteps = [0.1 0.1];
-    fadeDelta = 10;
-    settings = {
-      animations = [
-        {
-          triggers = [
-            "open"
-            "show"
-          ];
-
-          preset = "appear";
-          duration = "1";
-        }
-        {
-          triggers = [
-            "close"
-            "hide"
-          ];
-
-          preset = "disappear";
-          duration = "1";
-        }
-        {
-          triggers = [
-            "geometry"
-          ];
-          preset = "geometry-change";
-          duration = "1";
-        }
-      ];
-    };
-  };
-}

home/modules/gui/polybar.nix

@@ -1,460 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  services.polybar = {
-    package = pkgs.polybarFull;
-    script = ''
-      # Terminate already running bar instances
-      killall -q polybar
-
-      # Wait until the processes have been shut down
-      while pgrep -u $UID -x polybar >/dev/null; do sleep 1; done
-
-      # Launch Polybar, using default config location ~/.config/polybar/config
-      polybar -r main & polybar -r secondary &
-    '';
-
-    settings = {
-      "colors" = {
-        # background = "\${xrdb:color0:#222}";
-        background = "#AA000000";
-        background-alt = "#00000000";
-        # foreground = "\${xrdb:color7:#222}";
-        foreground = "#ffffff";
-        foreground-alt = "#ffffff";
-        primary = "#ffffff";
-        secondary = "#e60053";
-        alert = "#bd2c40";
-      };
-
-      "bar/main" = {
-        monitor = config.local.gui.primaryMonitor.monitorId;
-        width = "100%";
-        height = 30;
-        offset-x = "0%";
-        offset-y = "0%";
-        radius = 0.0;
-        fixed-center = false;
-
-        background = "\${colors.background}";
-        foreground = "\${colors.foreground}";
-
-        line-size = 1;
-        line-color = "#f0000000";
-
-        border-size = 0;
-        border-color = "#00000000";
-
-        padding-left = 0;
-        padding-right = 0;
-
-        module-margin-left = 1;
-        module-margin-right = 1;
-
-        # font-0 = "fixed:pixelsize=10;1";
-        font-0 = "JetBrains Mono Light:size=10;0";
-        font-1 = "unifont:fontformat=truetype:size=8:antialias=false;0";
-        font-2 = "siji:pixelsize=10;1";
-        # font-2 = "FontAwesome5Free:style=Regular:size=10;4";
-
-        modules-left = "i3";
-        modules-center = "xwindow";
-        modules-right = "xkeyboard pulseaudio filesystem memory cpu temperature gputemperature nvmetemperature wlan eth date semanatec";
-        separator = "|";
-
-        tray-position = "right";
-        tray-padding = 2;
-
-        # To allow other windows to be placed above the bar, or to avoid having the bar visible when in fullscreen mode,
-        # you need to use the following two parameters. Note that it will tell the window manager to back off so no
-        # area will be reserved, etc.
-        #
-        # wm-restack = "i3";
-        # override-redirect = true;
-
-        cursor-click = "pointer";
-        cursor-scroll = "ns-resize";
-      };
-
-      "bar/secondary" = {
-        monitor = head (attrNames (filterAttrs (monitorId: v:
-          !v.primary)
-        config.local.gui.monitors)); # this is bad. will fail if more than 2 monitors. this sets all monitors other than the primary one for this bar.
-        "inherit" = "bar/main";
-
-        modules-left = "i3";
-        modules-center = "xwindow";
-        modules-right = "xkeyboard pulseaudio date";
-        tray-position = "none";
-      };
-
-      "module/xwindow" = {
-        type = "internal/xwindow";
-        label = "%title:0:30:...%";
-      };
-
-      "module/xkeyboard" = {
-        type = "internal/xkeyboard";
-        blacklist-0 = "num lock";
-
-        format-prefix = "";
-        format-prefix-foreground = "\${colors.foreground-alt}";
-
-        label-layout = "%layout%";
-
-        label-indicator-padding = 2;
-        label-indicator-margin = 1;
-        label-indicator-background = "\${colors.secondary}";
-      };
-
-      "module/filesystem" = {
-        type = "internal/fs";
-        interval = 10;
-
-        mount-0 = "/";
-
-        label-mounted = "%{F#0a81f5}%mountpoint%%{F-}: %used%/%total%";
-        label-unmounted = "";
-      };
-
-      "module/i3" = {
-        type = "internal/i3";
-        format = "<label-state> <label-mode>";
-        index-sort = true;
-        wrapping-scroll = false;
-
-        # Only show workspaces on the same output as the bar
-        # pin-workspaces = true
-
-        label-mode-padding = 1;
-        label-mode-foreground = "#000";
-        label-mode-background = "\${colors.primary}";
-
-        # focused = Active workspace on focused monitor
-        label-focused = "%index%";
-        label-focused-background = "\${colors.background}";
-        label-focused-underline = "\${colors.primary}";
-        label-focused-padding = 1;
-
-        # unfocused = Inactive workspace on any monitor
-        label-unfocused = "%index%";
-        label-unfocused-padding = 1;
-
-        # visible = Active workspace on unfocused monitor
-        label-visible = "%index%";
-        label-visible-background = "\${self.label-focused-background}";
-        label-visible-underline = "\${self.label-focused-underline}";
-        label-visible-padding = "\${self.label-focused-padding}";
-
-        # urgent = Workspace with urgency hint set
-        label-urgent = "%index%";
-        label-urgent-background = "\${colors.alert}";
-        label-urgent-padding = 1;
-      };
-
-      "module/xbacklight" = {
-        type = "internal/xbacklight";
-
-        format = "<label> <bar>";
-        label = "BL";
-
-        bar-width = 10;
-        bar-indicator = "|";
-        bar-indicator-foreground = "#fff";
-        bar-indicator-font = 2;
-        bar-fill = "─";
-        bar-fill-font = 2;
-        bar-fill-foreground = "#9f78e1";
-        bar-empty = "─";
-        bar-empty-font = 2;
-        bar-empty-foreground = "\${colors.foreground-alt}";
-      };
-
-      "module/backlight-acpi" = {
-        "inherit" = "module/xbacklight";
-        type = "internal/backlight";
-        card = "intel_backlight";
-      };
-
-      "module/cpu" = {
-        type = "internal/cpu";
-        interval = 2;
-        format-prefix = "cpu ";
-        format-prefix-foreground = "\${colors.foreground-alt}";
-        label = "%percentage:2%%";
-      };
-
-      "module/memory" = {
-        type = "internal/memory";
-        interval = 2;
-        format-prefix = "mem ";
-        format-prefix-foreground = "\${colors.foreground-alt}";
-        label = "%percentage_used%%";
-      };
-
-      "module/wlan" = {
-        type = "internal/network";
-        interface = "wlp7s0";
-        interval = 3.0;
-
-        format-connected = "<ramp-signal> <label-connected>";
-        label-connected = "%essid%";
-
-        format-disconnected = "";
-        # format-disconnected = "<label-disconnected>";
-        # format-disconnected-underline = "\${self.format-connected-underline}";
-        # label-disconnected = "%ifname% disconnected";
-        # label-disconnected-foreground = "\${colors.foreground-alt}";
-
-        ramp-signal-0 = "";
-        ramp-signal-1 = "";
-        ramp-signal-2 = "";
-        ramp-signal-3 = "";
-        ramp-signal-4 = "";
-        ramp-signal-foreground = "\${colors.foreground-alt}";
-      };
-
-      "module/eth" = {
-        type = "internal/network";
-        interface = "enp8s0";
-        interval = 3.0;
-
-        format-connected-prefix = "";
-        format-connected-prefix-foreground = "\${colors.foreground-alt}";
-        label-connected = "%local_ip%";
-
-        format-disconnected = "";
-        # format-disconnected = "<label-disconnected>";
-        # format-disconnected-underline = "\${self.format-connected-underline}";
-        # label-disconnected = "%ifname% disconnected";
-        # label-disconnected-foreground = "\${colors.foreground-alt}";
-      };
-
-      "module/date" = {
-        type = "internal/date";
-        interval = 1;
-
-        date = " %d/%m/%Y";
-        date-alt = " %c";
-
-        time = "%H:%M";
-        time-alt = " [%s]";
-
-        format-prefix = "";
-        format-prefix-foreground = "\${colors.foreground-alt}";
-
-        label = "%date% %time%";
-      };
-
-      #      "module/semanatec" = {
-      #        type = "custom/script"
-      #        exec = "/home/fabian/bin/semanatec/target/release/semanatec"
-      #        interval = 3600
-      #        format-prefix = ""
-      #      };
-
-      "module/pulseaudio" = {
-        type = "internal/pulseaudio";
-
-        format-volume = "<label-volume>";
-        label-volume = "vol %percentage%%";
-        label-volume-foreground = "\${root.foreground}";
-
-        label-muted = "vol 0%";
-        label-muted-foreground = "\${root.foreground}";
-
-        bar-volume-width = 10;
-        bar-volume-foreground-0 = "#55aa55";
-        bar-volume-foreground-1 = "#55aa55";
-        bar-volume-foreground-2 = "#55aa55";
-        bar-volume-foreground-3 = "#55aa55";
-        bar-volume-foreground-4 = "#55aa55";
-        bar-volume-foreground-5 = "#f5a70a";
-        bar-volume-foreground-6 = "#ff5555";
-        bar-volume-gradient = false;
-        bar-volume-indicator = "|";
-        bar-volume-indicator-font = 2;
-        bar-volume-fill = "─";
-        bar-volume-fill-font = 2;
-        bar-volume-empty = "─";
-        bar-volume-empty-font = 2;
-        bar-volume-empty-foreground = "\${colors.foreground-alt}";
-      };
-
-      "module/alsa" = {
-        type = "internal/alsa";
-
-        format-volume = "<label-volume> <bar-volume>";
-        label-volume = "VOL";
-        label-volume-foreground = "\${root.foreground}";
-
-        format-muted-prefix = "vol ";
-        format-muted-foreground = "\${colors.foreground-alt}";
-        label-muted = "sound muted";
-
-        bar-volume-width = 10;
-        bar-volume-foreground-0 = "#55aa55";
-        bar-volume-foreground-1 = "#55aa55";
-        bar-volume-foreground-2 = "#55aa55";
-        bar-volume-foreground-3 = "#55aa55";
-        bar-volume-foreground-4 = "#55aa55";
-        bar-volume-foreground-5 = "#f5a70a";
-        bar-volume-foreground-6 = "#ff5555";
-        bar-volume-gradient = false;
-        bar-volume-indicator = "|";
-        bar-volume-indicator-font = 2;
-        bar-volume-fill = "─";
-        bar-volume-fill-font = 2;
-        bar-volume-empty = "─";
-        bar-volume-empty-font = 2;
-        bar-volume-empty-foreground = "\${colors.foreground-alt}";
-      };
-
-      "module/battery" = {
-        type = "internal/battery";
-        battery = "BAT0";
-        adapter = "ADP1";
-        full-at = 98;
-
-        format-charging = "<animation-charging> <label-charging>";
-        format-charging-underline = "#ffb52a";
-
-        format-discharging = "<animation-discharging> <label-discharging>";
-        format-discharging-underline = "\${self.format-charging-underline}";
-
-        format-full-prefix = " ";
-        format-full-prefix-foreground = "\${colors.foreground-alt}";
-        format-full-underline = "\${self.format-charging-underline}";
-
-        ramp-capacity-0 = "";
-        ramp-capacity-1 = "";
-        ramp-capacity-2 = "";
-        ramp-capacity-foreground = "\${colors.foreground-alt}";
-
-        animation-charging-0 = "";
-        animation-charging-1 = "";
-        animation-charging-2 = "";
-        animation-charging-foreground = "\${colors.foreground-alt}";
-        animation-charging-framerate = 750;
-
-        animation-discharging-0 = "";
-        animation-discharging-1 = "";
-        animation-discharging-2 = "";
-        animation-discharging-foreground = "\${colors.foreground-alt}";
-        animation-discharging-framerate = 750;
-      };
-
-      "module/temperature" = {
-        type = "internal/temperature";
-        warn-temperature = 60;
-        hwmon-path = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon1/temp2_input";
-
-        format = "<ramp> <label>";
-        format-warn = "<ramp> <label-warn>";
-
-        label = "cpu %temperature-c%";
-        label-warn = "cpu %temperature-c%";
-        label-warn-foreground = "\${colors.secondary}";
-
-        ramp-0 = "";
-        ramp-1 = "";
-        ramp-2 = "";
-        ramp-foreground = "\${colors.foreground-alt}";
-      };
-
-      "module/gputemperature" = {
-        type = "internal/temperature";
-        warn-temperature = 60;
-        hwmon-path = "/sys/devices/pci0000:00/0000:00:03.1/0000:09:00.0/hwmon/hwmon3/temp1_input";
-
-        format = "<ramp> <label>";
-        format-warn = "<ramp> <label-warn>";
-
-        label = "gpu %temperature-c%";
-        label-warn = "gpu %temperature-c%";
-        label-warn-foreground = "\${colors.secondary}";
-
-        ramp-0 = "";
-        ramp-1 = "";
-        ramp-2 = "";
-        ramp-foreground = "\${colors.foreground-alt}";
-      };
-
-      "module/nvmetemperature" = {
-        type = "internal/temperature";
-        warn-temperature = 60;
-        hwmon-path = "/sys/devices/pci0000:00/0000:00:01.1/0000:01:00.0/hwmon/hwmon0/temp1_input";
-
-        format = "<ramp> <label>";
-        format-warn = "<ramp> <label-warn>";
-
-        label = "M.2 %temperature-c%";
-        label-warn = "M.2 %temperature-c%";
-        label-warn-foreground = "\${colors.secondary}";
-
-        ramp-0 = "";
-        ramp-1 = "";
-        ramp-2 = "";
-        ramp-foreground = "\${colors.foreground-alt}";
-      };
-
-      "module/powermenu" = {
-        type = "custom/menu";
-
-        expand-right = true;
-
-        format-spacing = 1;
-
-        label-open = "";
-        label-open-foreground = "\${colors.secondary}";
-        label-close = " cancel";
-        label-close-foreground = "\${colors.secondary}";
-        label-separator = "|";
-        label-separator-foreground = "\${colors.foreground-alt}";
-
-        menu-0-0 = "reboot";
-        menu-0-0-exec = "menu-open-1";
-        menu-0-1 = "power off";
-        menu-0-1-exec = "menu-open-2";
-
-        menu-1-0 = "cancel";
-        menu-1-0-exec = "menu-open-0";
-        menu-1-1 = "reboot";
-        menu-1-1-exec = "sudo reboot";
-
-        menu-2-0 = "power off";
-        menu-2-0-exec = "sudo poweroff";
-        menu-2-1 = "cancel";
-        menu-2-1-exec = "menu-open-0";
-      };
-
-      "module/sink_changer" = {
-        type = "custom/script";
-        exec = "/home/fabian/bin/polybar_scripts/info.sh";
-        label = "%output%";
-        click-left = "/home/fabian/bin/polybar_scripts/sink_changer.sh";
-        # format-prefix = " ";
-        interval = "0";
-        # format-prefix-foreground = "${colors.foreground-alt}";
-      };
-
-      "settings" = {
-        screenchange-reload = true;
-        # compositing-background = "xor";
-        # compositing-background = "screen";
-        # compositing-foreground = "source";
-        # compositing-border = "over";
-        # pseudo-transparency = false;
-      };
-
-      "global/wm" = {
-        margin-top = 5;
-        margin-bottom = 5;
-      };
-    };
-  };
-}

home/modules/gui/startx.nix

@@ -1,16 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  config = mkIf config.local.gui.enable {
-    home.file.".xinitrc".source = let
-      content = ''
-        exec ~/.xsession
-      '';
-    in
-      pkgs.writeShellScript "xinitrc" content;
-  };
-}

home/modules/gui/sway.nix

@@ -0,0 +1,189 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.gui;
+in {
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      wlr-randr
+      bemenu
+    ];
+
+    home.sessionVariables = {
+      "BEMENU_BACKEND" = "wayland";
+    };
+
+    services = {
+      swayidle = {
+        enable = true;
+        timeouts = [
+          {
+            timeout = 600;
+            command = "${getExe pkgs.gtklock} -d";
+          }
+        ];
+      };
+    };
+
+    systemd.user.services.wl-gammarelay-rs = {
+      Unit.After = ["sway-session.target"];
+      Install.WantedBy = ["sway-session.target"];
+
+      Service.ExecStart = getExe pkgs.wl-gammarelay-rs;
+    };
+
+    wayland.windowManager.sway = {
+      enable = true;
+
+      config = {
+        output =
+          lib.mapAttrs (k: v: {
+            mode = "${toString v.width}x${toString v.height}@${v.rate}Hz";
+            pos = "${toString v.posX} ${toString v.posY}";
+          })
+          cfg.monitors;
+
+        modifier = "Mod4";
+
+        focus = {
+          followMouse = true;
+          wrapping = "workspace";
+        };
+
+        input = {
+          "*" = {
+            xkb_layout = "us";
+            xkb_variant = "altgr-intl";
+          };
+        };
+
+        fonts = {
+          names = ["JetBrainsMono Nerd Font"];
+          style = "Regular";
+          size = 8.0;
+        };
+
+        gaps = {
+          inner = 8;
+          outer = -10;
+          smartBorders = "on";
+          smartGaps = true;
+        };
+
+        bars = singleton {
+          command = "waybar";
+          position = "top";
+        };
+
+        window = {
+          hideEdgeBorders = "both";
+          titlebar = false;
+          border = 2;
+        };
+
+        floating = {
+          border = 0;
+          titlebar = false;
+        };
+
+        menu = "bemenu-run";
+
+        workspaceLayout = "tabbed";
+
+        colors = {
+          background = "#141414";
+          focused = {
+            border = "#444444";
+            background = "#000000";
+            text = "#eaeaea";
+            indicator = "#000000";
+            childBorder = "#000000";
+          };
+          focusedInactive = {
+            border = "#000000";
+            background = "#000000";
+            text = "#eaeaea";
+            indicator = "#000000";
+            childBorder = "#000000";
+          };
+          unfocused = {
+            border = "#000000";
+            background = "#000000";
+            text = "#eaeaea";
+            indicator = "#000000";
+            childBorder = "#000000";
+          };
+          urgent = {
+            border = "#ff6666";
+            background = "#ff6666";
+            text = "#eaeaea";
+            indicator = "#ff6666";
+            childBorder = "#ff6666";
+          };
+          placeholder = {
+            border = "#000000";
+            background = "#000000";
+            text = "#eaeaea";
+            indicator = "#000000";
+            childBorder = "#000000";
+          };
+        };
+
+        keybindings = let
+          mod = config.wayland.windowManager.sway.config.modifier;
+          grimshot = getExe pkgs.sway-contrib.grimshot;
+          bemenuCommand = ''bemenu-run --center --width-factor 0.2 --fixed-height --list 10 --scrollbar none --auto-select --accept-single --fn "JetBrainsMono Nerd Font 12" --prompt "" --tb "#000000" --tf "#EAEAEA" --fb "#000000" --ff "#EAEAEA" --cb "#EAEAEA" --cf "#000000" --nb "#000000" --nf "#EAEAEA" --sb "#000000" --sf "#EAEAEA" --hb "#000000" --hf "#EAEAEA" --fbb "#000000" --fbf "#000000" --ab "#000000" --af "#EAEAEA"'';
+        in
+          mkOptionDefault {
+            "${mod}+a" = "focus parent";
+            "${mod}+c" = "focus child";
+            "${mod}+d" = "exec ${bemenuCommand}";
+            "${mod}+l" = "exec ${getExe pkgs.gtklock} -d";
+            "${mod}+Return" = "exec ${lib.getExe pkgs.foot} ${lib.getExe pkgs.tmux}";
+            "${mod}+Shift+s" = "exec ${grimshot} copy area";
+            "${mod}+Shift+a" = "exec ${grimshot} copy output";
+            "${mod}+Tab" = "focus right";
+            "${mod}+Shift+Tab" = "focus left";
+            "${mod}+Shift+w" = "move workspace to output right";
+          };
+
+        startup = [
+          {
+            command = "${lib.getExe pkgs.sway} 'workspace 1; exec ${lib.getExe pkgs.firefox}'";
+          }
+          {
+            command = "${lib.getExe pkgs.sway} 'workspace 2; exec ${lib.getExe pkgs.tdesktop}'";
+          }
+          {
+            command = "${lib.getExe pkgs.sway} 'workspace 2; exec ${lib.getExe pkgs.gajim}'";
+          }
+          {
+            command = "${lib.getExe pkgs.swaybg} -m fill -i ${config.home.homeDirectory}/Pictures/wallpapers/jupiter.png";
+            always = true;
+          }
+          {
+            command = "${lib.getExe pkgs.networkmanagerapplet}";
+          }
+        ];
+      };
+
+      extraSessionCommands = ''
+        export SDL_VIDEODRIVER=wayland
+        # needs qt5.qtwayland in systemPackages
+        export QT_QPA_PLATFORM=wayland
+        export QT_WAYLAND_DISABLE_WINDOWDECORATION="1"
+        # Fix for some Java AWT applications (e.g. Android Studio),
+        # use this if they aren't displayed properly:
+        export _JAVA_AWT_WM_NONREPARENTING=1
+      '';
+
+      swaynag.enable = true;
+      systemd.enable = true;
+      xwayland = true;
+    };
+  };
+}

home/modules/gui/theme.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  gtk = {
+    enable = true;
+
+    iconTheme = {
+      name = "Papirus-Dark";
+      package = pkgs.papirus-icon-theme;
+    };
+    theme = {
+      package = pkgs.materia-theme;
+      name = "Materia-dark";
+    };
+
+    gtk2.extraConfig = ''
+      gtk-toolbar-style=GTK_TOOLBAR_BOTH_HORIZ
+      gtk-menu-images=1
+      gtk-button-images=1
+    '';
+
+    gtk3.extraConfig = {
+      gtk-application-prefer-dark-theme = 1;
+    };
+    gtk4.extraConfig = {
+      gtk-application-prefer-dark-theme = 1;
+    };
+  };
+
+  home.sessionVariables = {
+    # Use gtk in jvm apps
+    _JAVA_OPTIONS = concatStringsSep " " [
+      "-Dawt.useSystemAAFontSettings=on"
+      "-Dswing.aatext=true"
+      "-Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
+      "-Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
+    ];
+  };
+}

home/modules/halloy.nix

@@ -0,0 +1,114 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.local.programs.halloy;
+in {
+  options.local.programs.halloy = {
+    enable = mkEnableOption "halloy irc client";
+  };
+  config = mkIf cfg.enable {
+    programs.halloy = {
+      enable = true;
+      settings = {
+        theme = "macawCustom";
+        font.size = 16;
+        preview.enabled = false;
+        sidebar = {
+          buffer_action = "replace-pane";
+          focused_buffer_action = "close-pane";
+        };
+        buffer = {
+          channel.topic = {
+            enabled = true;
+          };
+          chathistory.infinite_scroll = true;
+          server_messages = {
+            join.exclude = ["*"];
+            quit.exclude = ["*"];
+          };
+        };
+
+        servers.liberachat = {
+          nickname = "posixlycorrect";
+          nick_password_command = "pass show liberachat_irc";
+
+          username = "fabiansoju/irc.libera.chat";
+          password_command = "pass show soju";
+
+          server = "soju.posixlycorrect.com";
+          port = 6697;
+          chathistory = true;
+          channels = [
+            "##chat"
+            "##politics"
+            "##rust"
+            "#datahoarder"
+            "#git"
+            "#indieweb"
+            "#indieweb-dev"
+            "#linux"
+            "#lobsters"
+            "#nixos"
+            "#OSRS"
+            "#soju"
+          ];
+        };
+      };
+      themes = {
+        macawCustom = {
+          general = {
+            background = "#333333";
+            border = "#505050";
+            horizontal_rule = "#333333";
+            unread_indicator = "#2884FC";
+          };
+
+          text = {
+            primary = "#DFDFDF";
+            secondary = "#C2C2C2";
+            tertiary = "#8839EF";
+            success = "#959595";
+            error = "#959595";
+          };
+
+          buffer = {
+            action = "#959595";
+            background = "#1E1E1E";
+            background_text_input = "#2E2E2E";
+            background_title_bar = "#2E2E2E";
+            border = "#1A1A1A";
+            border_selected = "#1A1A1A";
+            code = "#7287FD";
+            highlight = "#454645";
+            nickname = "#00C8FF";
+            selection = "#777777";
+            timestamp = "#959595";
+            topic = "#DFDFDF";
+            url = "#2884FC";
+            buffer.server_messages = {
+              default = "#959595";
+            };
+          };
+
+          buttons.primary = {
+            background = "#00000000";
+            background_hover = "#484848";
+            background_selected = "#4A4A4A";
+            background_selected_hover = "#666666";
+          };
+
+          buttons.secondary = {
+            background = "#3B3B3B";
+            background_hover = "#484848";
+            background_selected = "#646464";
+            background_selected_hover = "#666666";
+          };
+        };
+      };
+    };
+  };
+}

home/modules/mapping.nix

@@ -0,0 +1,19 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.local.programs.mapping;
+in {
+  options.local.programs.mapping = {
+    enable = mkEnableOption "mapping apps";
+  };
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      qgis
+      openorienteering-mapper
+    ];
+  };
+}

home/modules/neovim.nix

@@ -5,9 +5,9 @@
   ...
 }:
 with lib; let
-  cfg = config.local.apps.neovim;
+  cfg = config.local.programs.neovim;
 in {
-  options.local.apps.neovim = {
+  options.local.programs.neovim = {
     enable = mkEnableOption "Neovim settings";
   };
   config = mkIf cfg.enable {
@@ -40,8 +40,66 @@ in {
       '';
 
       plugins = with pkgs.vimPlugins; [
+        barbar-nvim
+        nvim-web-devicons
         vim-nix
         vim-visual-multi
+        {
+          plugin = nvim-tree-lua;
+          type = "lua";
+          config = ''
+            require("nvim-tree").setup({
+              renderer = {
+                icons = {
+                  show = {
+                    file = true,
+                    folder = true,
+                    folder_arrow = true,
+                    git = true,
+                  },
+                  glyphs = {
+                    git = {
+                      unstaged = "",
+                      staged = "",
+                      unmerged = "",
+                      renamed = "",
+                      untracked = "",
+                      deleted = "",
+                      ignored = "",
+                    },
+                  },
+                },
+              },
+              view = {
+                width = 30,
+                side = 'left',
+              },
+              sync_root_with_cwd = true, --fix to open cwd with tree
+              respect_buf_cwd = true,
+              update_cwd = true,
+              update_focused_file = {
+                enable = true,
+                update_cwd = true,
+                update_root = true,
+              },
+            })
+
+            vim.g.nvim_tree_respect_buf_cwd = 1
+
+            -- use g? for bindings help while in tree
+          '';
+        }
+        {
+          plugin = gruvbox-nvim;
+          type = "lua";
+          config = ''
+            require("gruvbox").setup({
+              contrast = "high",
+            })
+            vim.o.background = "dark"
+            vim.cmd([[colorscheme gruvbox]])
+          '';
+        }
       ];
     };
     home.sessionVariables = {

home/modules/pass.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.services.pass;
+in {
+  options.local.services.pass = {
+    enable = mkEnableOption "pass settings";
+  };
+  config = mkIf cfg.enable {
+    programs.password-store = {
+      enable = true;
+      package = pkgs.pass.withExtensions (exts:
+        with exts; [
+          pass-audit
+          pass-genphrase
+          pass-otp
+          pass-tomb
+          pass-update
+          pass-import
+        ]);
+
+      settings = {
+        PASSWORD_STORE_DIR = "${config.home.homeDirectory}/safe/trust";
+      };
+    };
+  };
+}

home/modules/syncthing.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.services.syncthing;
+in {
+  options.local.services.syncthing = {
+    enable = mkEnableOption "syncthing settings";
+  };
+
+  config = mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+      tray.enable = true;
+    };
+  };
+}

home/modules/terminal.nix

@@ -0,0 +1,125 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.programs.terminal;
+in {
+  options.local.programs.terminal = {
+    enable = mkEnableOption "terminal emulator settings";
+  };
+  config = mkIf cfg.enable {
+    programs = {
+      foot = {
+        enable = true;
+        settings = {
+          main = {
+            term = "xterm-256color";
+            font = "JetBrainsMono Nerd Font:style=Medium:size=15";
+            font-bold = "JetBrainsMono Nerd Font:style=Bold:size=15";
+            font-italic = "JetBrainsMono Nerd Font:style=Italic:size=15";
+            font-bold-italic = "JetBrainsMono Nerd Font:style=Bold Italic:size=15";
+            dpi-aware = "yes";
+            initial-window-size-pixels = "1200x600";
+          };
+
+          cursor = {
+            style = "block";
+            blink = "yes";
+          };
+
+          colors = {
+            background = "000000";
+            regular0 = "616161";
+            regular1 = "ff4d51";
+            regular2 = "35d450";
+            regular3 = "e9e836";
+            regular4 = "5dc5f8";
+            regular5 = "feabf2";
+            regular6 = "24dfc4";
+            regular7 = "ffffff";
+          };
+
+          bell = {
+            system = "no";
+            urgent = "no";
+            notify = "no";
+            visual = "no";
+            command-focused = "no";
+          };
+
+          mouse = {
+            hide-when-typing = "no";
+          };
+
+          key-bindings = {
+            clipboard-copy = "Control+Shift+c";
+            clipboard-paste = "Control+Shift+v";
+            font-increase = "Control+Shift+equal";
+            font-decrease = "Control+Shift+minus";
+            font-reset = "Control+Shift+BackSpace";
+          };
+
+          mouse-bindings = {
+            scrollback-up-mouse = "BTN_WHEEL_BACK";
+            scrollback-down-mouse = "BTN_WHEEL_FORWARD";
+            font-increase = "Control+BTN_WHEEL_BACK";
+            font-decrease = "Control+BTN_WHEEL_FORWARD";
+            select-begin = "BTN_LEFT";
+            select-begin-block = "Control+BTN_LEFT";
+            select-extend = "BTN_RIGHT";
+            select-extend-character-wise = "Control+BTN_RIGHT";
+            select-word = "BTN_LEFT-2";
+            select-word-whitespace = "Control+BTN_LEFT-2";
+            select-quote = " BTN_LEFT-3";
+            select-row = "BTN_LEFT-4";
+          };
+        };
+      };
+
+      tmux = {
+        enable = true;
+        aggressiveResize = true;
+        clock24 = true;
+        escapeTime = 10;
+        terminal = "xterm-256color";
+        keyMode = "emacs";
+        mouse = true;
+
+        extraConfig = ''
+          set -ga update-environment " LIFT_PID"
+          set -g set-titles on
+          set -g renumber-windows on
+          set -sa terminal-overrides ',xterm-termite:RGB'
+
+          set -g status-style bg=default,fg=colour250
+          set -g pane-border-style fg=colour236
+          set -g pane-active-border-style fg=colour240
+          set -g window-status-format " #I:#W "
+          set -g window-status-style bg=default,fg=colour244
+          set -g window-status-current-format " #I:#W "
+          set -g window-status-current-style bg=colour236,fg=white,bold
+          set -g status-position bottom
+          set -g status-left-length 20
+          set -g status-right-length 60
+          set -g status-left ""
+          set -g window-status-separator ""
+          set -g status-justify left
+        '';
+      };
+
+      fzf = {
+        enable = true;
+        enableZshIntegration = true;
+        tmux.enableShellIntegration = true;
+      };
+    };
+    home = {
+      sessionVariables = {
+        "TERMINAL" = "foot";
+      };
+    };
+  };
+}

home/modules/terminal/default.nix

@@ -1,42 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.local.apps.terminal;
-in {
-  options.local.apps.terminal.enable = mkEnableOption "terminal emulator settings";
-  config = mkIf cfg.enable {
-    programs = {
-      kitty = {
-        enable = true;
-        extraConfig = import ./kitty.conf.nix;
-      };
-
-      tmux = {
-        enable = true;
-        aggressiveResize = true;
-        clock24 = true;
-        escapeTime = 10;
-        terminal = "xterm-256color";
-        keyMode = "emacs";
-
-        extraConfig = ''
-          set -g mouse on
-          set -ga update-environment " LIFT_PID"
-          set -g set-titles on
-          set -g renumber-windows on
-          set -sa terminal-overrides ',xterm-termite:RGB'
-          set -g status-right "#{?window_bigger,[#{window_offset_x}#,#{window_offset_y}] ,} %H:%M %d-%b-%y"
-        '';
-      };
-    };
-    home = {
-      sessionVariables = {
-        "TERMINAL" = "kitty";
-      };
-    };
-  };
-}

home/modules/terminal/kitty.conf.nix

@@ -1,87 +0,0 @@
-''
-  # Fonts
-  font_family      JetBrains Mono Medium
-  bold_font        JetBrains Mono Bold
-  italic_font      JetBrains Mono Italic
-  bold_italic_font JetBrains Mono Bold Italic
-
-  font_size 15
-  disable_ligatures cursor
-
-  initial_window_width  1200
-  initial_window_height 600
-
-  # Cursor
-  cursor_shape beam
-  cursor_beam_thickness 1.9
-  cursor_stop_blinking_after 0
-
-  # Audio
-  enable_audio_bell no
-
-  # Tabs
-  tab_bar_style separator
-  tab_separator " | "
-  tab_title_template "{index}: {title}"
-
-  # Color
-  # special
-  foreground       #ffffff
-  foreground_bold  #ffffff
-  cursor           #ffffff
-  background       #000000
-  background_opacity 1
-
-  # Shortcuts
-  map ctrl+shift+c copy_to_clipboard
-  map ctrl+shift+v paste_from_clipboard
-  map ctrl+shift+s paste_from_selection
-  map shift+insert paste_from_selection
-
-  map ctrl+shift+up scroll_line_up
-  map ctrl+shift+down scroll_line_down
-  map ctrl+shift+page_up scroll_page_up
-  map ctrl+shift+page_down scroll_page_down
-  map ctrl+shift+home scroll_home
-  map ctrl+shift+end scroll_end
-
-  map ctrl+shift+enter new_window
-  map ctrl+alt+enter    launch --cwd=current
-  map ctrl+shift+w close_window
-  map ctrl+shift+] next_window
-  map ctrl+shift+[ previous_window
-  map ctrl+shift+1 first_window
-  map ctrl+shift+2 second_window
-  map ctrl+shift+3 third_window
-  map ctrl+shift+4 fourth_window
-  map ctrl+shift+5 fifth_window
-  map ctrl+shift+6 sixth_window
-  map ctrl+shift+7 seventh_window
-  map ctrl+shift+8 eighth_window
-  map ctrl+shift+9 ninth_window
-  map ctrl+shift+0 tenth_window
-
-  map ctrl+shift+right next_tab
-  map ctrl+shift+left previous_tab
-  map ctrl+shift+t new_tab
-  map ctrl+shift+q close_tab
-  map ctrl+shift+. move_tab_forward
-  map ctrl+shift+, move_tab_backward
-  map ctrl+shift+alt+t set_tab_title
-  map ctrl+alt+1 goto_tab 1
-  map ctrl+alt+2 goto_tab 2
-  map ctrl+alt+3 goto_tab 3
-  map ctrl+alt+4 goto_tab 4
-  map ctrl+alt+5 goto_tab 5
-  map ctrl+alt+6 goto_tab 6
-  map ctrl+alt+7 goto_tab 7
-  map ctrl+alt+8 goto_tab 8
-  map ctrl+alt+9 goto_tab 9
-  map ctrl+alt+0 goto_tab 10
-
-  map ctrl+shift+equal change_font_size all +1.0
-  map ctrl+shift+minus change_font_size all -1.0
-  map ctrl+shift+backspace change_font_size all 0
-
-  map ctrl+shift+delete clear_terminal reset active
-''

home/modules/yubikey.nix

@@ -5,9 +5,9 @@
   ...
 }:
 with lib; let
-  cfg = config.local.apps.yubikey;
+  cfg = config.local.services.yubikey;
 in {
-  options.local.apps.yubikey = {
+  options.local.services.yubikey = {
     enable = mkEnableOption "Yubikey home settings";
   };
   config = mkIf cfg.enable {

home/modules/zed.nix

@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.programs.zed;
+in {
+  options.local.programs.zed = {
+    enable = mkEnableOption "zed editor settings";
+  };
+  config = mkIf cfg.enable {
+    programs.zed-editor = {
+      enable = true;
+      extensions = [
+        "nix"
+        "codebook"
+        "vscode-dark-high-contrast"
+        "catppuccin-icons"
+      ];
+      extraPackages = with pkgs; [
+        nixd
+      ];
+      userSettings = {
+        disable_ai = true;
+        theme = {
+          dark = "VSCode Dark High Contrast";
+          light = "VSCode Dark High Contrast";
+        };
+        icon_theme = {
+          dark = "Catppuccin Latte";
+          light = "Catppuccin Latte";
+        };
+        file_icons = true;
+        rulers = [80 120];
+        preferred_line_length = 120;
+        scroll_past_end = true;
+        cursor = {
+          blink_interval = 600;
+          smooth_scroll = true;
+        };
+        autosave = "on_focus_change";
+        auto_update = false;
+        buffer_font_family = "JetBrainsMono Nerd Font";
+        buffer_font_size = 22;
+        hide_mouse = "never";
+        minimap.show = "auto";
+        tabs = {
+          file_icons = true;
+          git_status = true;
+          activate_on_close = "neighbour";
+          show_close_button = "always";
+        };
+        toolbar = {
+          breadcrumbs = true;
+          quick_actions = true;
+          selections_menu = true;
+          agent_review = false;
+          code_actions = false;
+        };
+        format_on_save = "off";
+        use_autoclose = false;
+        git = {
+          git_gutter = "tracked_files";
+          inline_blame = {
+            enabled = true;
+            delay_ms = 5000;
+          };
+        };
+        indent_guides = {
+          enabled = true;
+          line_width = 1;
+          active_line_width = 1;
+          coloring = "fixed";
+          background_coloring = "disabled";
+        };
+        hour_format = "hour24";
+        remove_trailing_whitespace_on_save = false;
+        use_smartcase_search = true;
+        soft_wrap = "editor_width";
+        tab_size = 2;
+        telemetry = {
+          diagnostics = false;
+          metrics = false;
+        };
+        auto_fold_dirs = false;
+        scrollbar = {
+          show = "always";
+        };
+        unnecessary_code_fade = 0.0;
+      };
+    };
+  };
+}

home/modules/zsh/default.nix

@@ -13,6 +13,7 @@ in {
       type = types.str;
       description = "prompt for your terminal";
       example = literalExpression "%B[%~] \${vcs_info_msg_0_}%b";
+      default = "%B[%~] \${vcs_info_msg_0_}%b";
     };
   };
   config = mkIf cfg.enable {
@@ -28,7 +29,7 @@ in {
         ignoreSpace = true;
       };
 
-      initExtra = import ./zshrc.nix {inherit config lib pkgs;};
+      initContent = import ./zshrc.nix {inherit config lib pkgs;};
     };
   };
 }

home/modules/zsh/zshrc.nix

@@ -78,12 +78,7 @@
   alias ls='ls --color -F'
   alias l='ls --color -FhAltr'
   alias x='killall --ignore-case --user=$(whoami) --interactive'
-  alias sc='${lib.getExe pkgs.maim} -s -u | ${lib.getExe pkgs.xclip} -selection clipboard -t image/png -i'
   alias tree='tree -CF'
-  alias lock="betterlockscreen -l"
-  alias nightmode="${lib.getExe pkgs.redshift} -P -O 1000"
-  alias lightmode="${lib.getExe pkgs.redshift} -x="
-  alias inbox="echo >> $HOME/gtd/inbox"
   alias nixoide="nix repl '<nixpkgs>'"
   alias vps="ssh -A vps"
   bindkey -e
@@ -103,8 +98,8 @@
     local pkg
     pkg="$1"
     shift
-    echo "nix shell unstable#$pkg --impure"
+    echo "nix shell nixpkgs#$pkg --impure"
-    nix shell "unstable#$pkg" "$@"  --impure
+    nix shell "nixpkgs#$pkg" "$@" --impure
   }
 
   function spawn () {
@@ -132,4 +127,6 @@
   export VISUAL=nvim
   export PATH="$PATH:$HOME/.local/bin:$HOME/.cargo/bin"
   export NIXPKGS_ALLOW_UNFREE=1
+
+  eval "$(fzf --zsh)"
 ''

home/platforms/fabian@posixlycorrect/default.nix

@@ -10,57 +10,26 @@
     ./isolation.nix
   ];
 
-  nix.registry = {
-    "system".to = {
-      type = "path";
-      path = "/home/fabian/nix";
-    };
-
-    "nixpkgs".flake = flakes.nixpkgs;
-    "unstable".flake = flakes.unstable;
-  };
-
   local = {
-    baseline.enable = true;
+    defaultDesktopPack.enable = true;
 
     services = {
-      zsh = {
+      gpg.defaultKey = "A8981D346F8F4130CA16A7775517E687FCCE0BB9";
-        enable = true;
+      yubikey.enable = true;
-        prompt = "%B[%~] \${vcs_info_msg_0_}%b";
-      };
-      accounts.enable = true;
-      gpg = {
-        enable = true;
-        defaultKey = "7AA277E604A4173916BBB4E91FFAC35E1798174F";
-      };
     };
 
-    apps = {
+    programs = {
-      terminal.enable = true;
-      neovim.enable = true;
       gaming.enable = true;
-      yubikey.enable = true;
+      mapping.enable = true;
-      browsers.enable = true;
-      defaultDesktopPack.enable = true;
     };
 
     gui = {
       enable = true;
       monitors = {
         DP-1 = {
-          primary = true;
+          width = "1920";
-          position = "0x0";
+          height = "1080";
-          mode = "1920x1080";
-          rate = "143.85";
-          fingerprint = "00ffffffffffff003669a03bd4040000231e0104a5341d783bd005ac5048a627125054bfcf00814081809500714f81c0b30001010101023a801871382d40582c450009252100001e0882805070384d400820f80c09252100001a000000fd003090b4b422010a202020202020000000fc004d53492047323443340a20202001a2020320f14d010304131f120211900e0f1d1e230907078301000065030c001000866f80a0703840403020350009252100001a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e9";
-          initialI3Workspace = 1;
-        };
-        DP-2 = {
-          position = "1920x0";
-          mode = "1920x1080";
           rate = "59.94";
-          fingerprint = "00ffffffffffff0009d1e77845540000061f0104a5351e783a0565a756529c270f5054a56b80d1c0b300a9c08180810081c001010101023a801871382d40582c45000f282100001e000000ff0039324d30303033323031510a20000000fd00324c1e5311010a202020202020000000fc0042656e51204757323438300a20019b02031cf14f901f041303120211011406071516052309070783010000023a801871382d40582c45000f282100001f011d8018711c1620582c25000f282100009f011d007251d01e206e2855000f282100001e8c0ad08a20e02d10103e96000f28210000180000000000000000000000000000000000000000000000000000008d";
-          initialI3Workspace = 10;
         };
       };
     };
@@ -69,24 +38,9 @@
   home = {
     packages = with pkgs; [
       darktable
-      deluge
-      (gajim.override {
-        enableSecrets = true;
-        # enableJingle = true;
-        # enableSpelling = true;
-        enableUPnP = true;
-        # enableAppIndicator = true;
-        enableE2E = true;
-        enableRST = true;
-      })
       gnucash
-      kdenlive
+      kdePackages.kdenlive
       virt-manager
     ];
-
-    username = "fabian";
-    homeDirectory = "/home/fabian";
   };
-
-  programs.home-manager.enable = true;
 }

home/platforms/fabian@t14/default.nix

@@ -10,50 +10,29 @@
     ./isolation.nix
   ];
 
-  nix.registry = {
-    "system".to = {
-      type = "path";
-      path = "/home/fabian/nix";
-    };
-
-    "nixpkgs".flake = flakes.nixpkgs;
-    "unstable".flake = flakes.unstable;
-  };
-
   local = {
-    baseline.enable = true;
+    defaultDesktopPack = {
+      enable = true;
+      laptop = true;
+    };
 
     services = {
-      zsh = {
+      gpg.defaultKey = "A8981D346F8F4130CA16A7775517E687FCCE0BB9";
-        enable = true;
+      yubikey.enable = true;
-        prompt = "%B[%~] \${vcs_info_msg_0_}%b";
-      };
-      accounts.enable = true;
-      gpg = {
-        enable = true;
-        defaultKey = "7206D8EE2474F3DF18EA876F0EC1691FF8C1A81F";
-      };
     };
 
-    apps = {
+    programs = {
-      terminal.enable = true;
-      neovim.enable = true;
       gaming.enable = true;
-      yubikey.enable = true;
+      mapping.enable = true;
-      browsers.enable = true;
-      defaultDesktopPack.enable = true;
     };
 
     gui = {
       enable = true;
       monitors = {
         eDP-1 = {
-          primary = true;
+          width = "1920";
-          position = "0x0";
+          height = "1080";
-          mode = "1920x1080";
           rate = "60.00";
-          fingerprint = "00ffffffffffff000dae0a1400000000291d0104a51f11780328659759548e271e505400000001010101010101010101010101010101363680a0703820403020a60035ad10000018000000fe004e3134304843412d4541450a20000000fe00434d4e0a202020202020202020000000fe004e3134304843412d4541450a200002";
-          initialI3Workspace = 1;
         };
       };
     };
@@ -62,10 +41,5 @@
   home = {
     packages = with pkgs; [
     ];
-
-    username = "fabian";
-    homeDirectory = "/home/fabian";
   };
-
-  programs.home-manager.enable = true;
 }

home/platforms/fabian@vps/default.nix

@@ -9,36 +9,16 @@ with lib; {
   imports = [
   ];
 
-  nix.registry = {
-    "system".to = {
-      type = "path";
-      path = "/home/fabian/nix";
-    };
-
-    "nixpkgs".flake = flakes.nixpkgs;
-    "unstable".flake = flakes.unstable;
-  };
-
   local = {
     baseline.enable = true;
 
     services = {
-      zsh = {
+      zsh.prompt = "%B<%~> \${vcs_info_msg_0_}%b";
-        enable = true;
-        prompt = "%B<%~> \${vcs_info_msg_0_}%b";
-      };
-    };
-
-    apps = {
-      neovim.enable = true;
     };
   };
 
   home = {
     packages = with pkgs; [
     ];
-
-    username = "fabian";
-    homeDirectory = "/home/fabian";
   };
 }

pkgs/config/default.nix

@@ -1,5 +1,5 @@
-lib:
+{lib}:
 with lib; {
-  android_sdk.accept_license = true; #TODO: what the fuck is this
+  android_sdk.accept_license = true;
   allowUnfreePredicate = pkg: import ./unfree.nix lib (getName pkg);
 }

pkgs/config/unfree.nix

@@ -8,5 +8,4 @@ with lib;
     "steam-original"
     "steam-unwrapped"
     "steam-run"
-    "zoom"
   ]

pkgs/default.nix

@@ -8,21 +8,9 @@ with prev.lib; let
 in {
   homepage = flakes.homepage.packages.${final.system}.default;
 
-  lib = callPackage ./lib {};
-
-  st = prev.st.override {
-    conf = import ./st.nix {};
-
-    patches = [
-      (fetchpatch {
-        url = "https://st.suckless.org/patches/clipboard/st-clipboard-0.8.3.diff";
-        sha256 = "cbb37675e9b4986836c19aadacc616a006df81c9bf394e9e3573e164fa1867cf";
-      })
-    ];
-  };
-
   override =
     {
+      # add python modules here to make them available in all versions
     }
     // (
       let

pkgs/lib/default.nix

@@ -1,3 +0,0 @@
-{callPackage}: {
-  importAll = callPackage ./importAll.nix {};
-}

sys/default.nix

@@ -7,6 +7,7 @@
 }:
 with lib; {
   imports = [
+    flakes.trivionomicon.nixosModules.default
     ./modules
   ];
 }

sys/modules/android.nix

@@ -14,5 +14,9 @@ in {
     services.udev.packages = with pkgs; [
       android-udev-rules
     ];
+
+    environment.systemPackages = with pkgs; [
+      android-tools
+    ];
   };
 }

sys/modules/baseline.nix

@@ -53,6 +53,17 @@ in {
         ];
     };
 
+    fonts.packages = with pkgs; [
+      jetbrains-mono
+      nerd-fonts.jetbrains-mono
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-emoji
+      noto-fonts-extra
+      nerd-fonts.fira-code
+      nerd-fonts.droid-sans-mono
+    ];
+
     services = {
       openssh.enable = mkDefault true;
 
@@ -62,6 +73,8 @@ in {
       };
     };
 
+    programs.dconf.enable = true;
+
     # Coredumps are a security risk and may use up a lot of disk space
     systemd.coredump.extraConfig = ''
       Storage=none
@@ -72,5 +85,7 @@ in {
       enable = true;
       defaultBitSize = 4096;
     };
+
+    i18n.defaultLocale = "en_US.UTF-8";
   };
 }

sys/modules/borgsync.nix

@@ -0,0 +1,63 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.sys.borgsync;
+in {
+  options.local.sys.borgsync = {
+    enable = mkEnableOption "borg backup to an rsync.net repo";
+    paths = mkOption {
+      type = with types; nullOr (coercedTo str singleton (listOf str));
+      default = null;
+      description = "Paths to back up.";
+    };
+    exclude = mkOption {
+      type = with types; listOf str;
+      description = "Exclude paths.";
+      default = [];
+    };
+    repoName = mkOption {
+      type = types.str;
+      description = "Remote rsync repository to back up to.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.borgbackup.jobs.rsync = {
+      paths = cfg.paths;
+      exclude = cfg.exclude;
+      user = "root";
+      group = "root";
+      doInit = true;
+      startAt = [
+        "hourly"
+      ];
+      inhibitsSleep = true;
+      persistentTimer = true;
+
+      repo = "zh5777@zh5777.rsync.net:${cfg.repoName}";
+      encryption = {
+        mode = "repokey-blake2";
+        passCommand = "cat /var/trust/borg/${cfg.repoName}_passphrase";
+      };
+      compression = "auto,lz4";
+      prune = {
+        keep = {
+          hourly = 24;
+          daily = 7;
+          weekly = 4;
+          monthly = 12;
+          yearly = 99;
+        };
+      };
+      extraArgs = [
+        "--remote-path=borg14"
+      ];
+    };
+
+    environment.sessionVariables.BORG_REMOTE_PATH = "borg14";
+  };
+}

sys/modules/default.nix

@@ -13,5 +13,11 @@
     ./android.nix
     ./users.nix
     ./bluetooth.nix
+    ./net.nix
+    ./steam.nix
+    ./gtklock.nix
+    ./borgsync.nix
+    ./dufs.nix
+    ./defaultDesktopPack.nix
   ];
 }

sys/modules/defaultDesktopPack.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.sys.defaultDesktopPack;
+in {
+  options.local.sys.defaultDesktopPack = {
+    enable = mkEnableOption "common desktop programs and services";
+  };
+  config = mkIf cfg.enable {
+    local.sys = {
+      baseline.enable = true;
+
+      audio.enable = true;
+      graphics.enable = true;
+      gtklock.enable = true;
+      steam.enable = true;
+
+      users = {
+        fabian = {
+          enable = true;
+          unixId = 1002; #TODO !!!!!!
+        };
+      };
+    };
+
+    trivium = {
+      sway.enable = true;
+      trivionomiconMotd.enable = true;
+    };
+
+    networking = {
+      networkmanager.enable = true;
+      useDHCP = false; # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+    };
+
+    services = {
+      fwupd.enable = true;
+    };
+  };
+}

sys/modules/dufs.nix

@@ -0,0 +1,233 @@
+# https://github.com/NixOS/nixpkgs/blob/c77cd68706b590b44334bb8c506239b3384c26a0/nixos/modules/services/misc/dufs.nix
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.sys.dufs;
+  types = lib.types;
+in {
+  options.local.sys.dufs = {
+    enable = lib.mkEnableOption "the dufs server";
+    package = lib.mkPackageOption pkgs "dufs" {};
+    settings = lib.mkOption {
+      type = types.submodule {
+        options = {
+          serve-path = lib.mkOption {
+            type = types.path;
+            description = "Specific path to serve.";
+          };
+          bind = lib.mkOption {
+            type = types.nullOr types.str;
+            description = "Specify bind address or unix socket.";
+            default = null;
+          };
+          port = lib.mkOption {
+            type = types.port;
+            description = "Specify port to listen on.";
+            default = 5000;
+          };
+          path-prefix = lib.mkOption {
+            type = types.nullOr types.path;
+            description = "Specify a path prefix.";
+            default = null;
+          };
+          hidden = lib.mkOption {
+            type = types.listOf types.str;
+            description = "Hide paths from directory listings, e.g. tmp,*.log,*.lock.";
+            default = [];
+            example = lib.literalExpression ''
+              [
+                "tmp"
+                "*.log"
+                "*.lock."
+              ]
+            '';
+          };
+          allow-all = lib.mkOption {
+            type = types.bool;
+            description = "Allow all operations.";
+            default = true;
+          };
+          allow-upload = lib.mkOption {
+            type = types.bool;
+            description = "Allow upload files/folders.";
+            default = false;
+          };
+          allow-delete = lib.mkOption {
+            type = types.bool;
+            description = "Allow delete files/folders.";
+            default = false;
+          };
+          allow-search = lib.mkOption {
+            type = types.bool;
+            description = "Allow search files/folders.";
+            default = false;
+          };
+          allow-symlink = lib.mkOption {
+            type = types.bool;
+            description = "Allow symlink to files/folders outside root directory.";
+            default = false;
+          };
+          allow-archive = lib.mkOption {
+            type = types.bool;
+            description = "Allow zip archive generation.";
+            default = false;
+          };
+          enable-cors = lib.mkOption {
+            type = types.bool;
+            description = "Enable CORS, sets `Access-Control-Allow-Origin: *`.";
+            default = false;
+          };
+          render-index = lib.mkOption {
+            type = types.bool;
+            description = "Serve index.html when requesting a directory, returns 404 if not found index.html.";
+            default = false;
+          };
+          render-try-index = lib.mkOption {
+            type = types.bool;
+            description = "Serve index.html when requesting a directory, returns directory listing if not found index.html.";
+            default = false;
+          };
+          render-spa = lib.mkOption {
+            type = types.bool;
+            description = "Serve SPA(Single Page Application).";
+            default = false;
+          };
+          assets = lib.mkOption {
+            type = types.nullOr types.path;
+            description = "Set the path to the assets directory for overriding the built-in assets.";
+            default = null;
+          };
+          log-format = lib.mkOption {
+            type = types.nullOr types.str;
+            description = "Customize http log format.";
+            default = null;
+            example = lib.literalExpression ''
+              "$remote_addr \"$request\" $status"
+            '';
+          };
+          compress = lib.mkOption {
+            type = types.enum [
+              "none"
+              "low"
+              "medium"
+              "high"
+            ];
+            description = "Customize http log format.";
+            default = "none";
+          };
+          tls-cert = lib.mkOption {
+            type = types.nullOr types.path;
+            description = "Path to an SSL/TLS certificate to serve with HTTPS.";
+            default = null;
+          };
+          tls-key = lib.mkOption {
+            type = types.nullOr types.path;
+            description = "Path to the SSL/TLS certificate's private key.";
+            default = null;
+          };
+        };
+      };
+      description = "Settings for dufs.";
+    };
+    authFile = lib.mkOption {
+      type = types.nullOr types.path;
+      description = ''
+        Path to file containing auth roles (e.g. user:pass@/dir1:rw,/dir2), one per line.
+
+        Passwords may be hashed, see https://github.com/sigoden/dufs#hashed-password.
+      '';
+      default = null;
+    };
+    openFirewall = lib.mkOption {
+      type = types.bool;
+      description = "Open firewall on configured port.";
+      default = false;
+    };
+    user = lib.mkOption {
+      type = types.str;
+      description = "User to run dufs under.";
+      default = "dufs";
+    };
+    group = lib.mkOption {
+      type = types.str;
+      description = "Group to run dufs under.";
+      default = "dufs";
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [cfg.settings.port];
+    systemd.services.dufs = let
+      settings = lib.filterAttrs (_: v: v != null) cfg.settings;
+      pathWritable = settings.allow-all || settings.allow-upload || settings.allow-delete;
+    in {
+      after = ["network.target"];
+      wantedBy = ["multi-user.target"];
+      environment.DUFS_CONFIG = (pkgs.formats.yaml {}).generate "dufs-config.yaml" settings;
+      script = ''
+        ${lib.optionalString (cfg.authFile != null) ''
+          export DUFS_AUTH=$(tr '\n' '|' < ${lib.escapeShellArg cfg.authFile} | sed 's/|$//')
+        ''}
+        exec ${lib.escapeShellArg (lib.getExe cfg.package)}
+      '';
+      serviceConfig = {
+        BindReadOnlyPaths =
+          [
+            builtins.storeDir
+          ]
+          ++ lib.optional (!pathWritable) settings.serve-path
+          ++ lib.optional (cfg.authFile != null) cfg.authFile;
+        BindPaths = lib.mkIf pathWritable settings.serve-path;
+        CapabilityBoundingSet = "";
+        DeviceAllow = "";
+        Group = cfg.group;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RootDirectory = "/run/dufs";
+        RuntimeDirectory = "dufs";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@resources"
+          "~@privileged"
+        ];
+        User = cfg.user;
+      };
+    };
+    users = {
+      users.dufs = lib.mkIf (cfg.user == "dufs") {
+        group = cfg.group;
+        home = cfg.settings.serve-path;
+        isSystemUser = true;
+      };
+      groups.dufs = lib.mkIf (cfg.group == "dufs") {};
+    };
+  };
+  meta.maintainers = with lib.maintainers; [jackwilsdon];
+}

sys/modules/graphics.nix

@@ -12,16 +12,9 @@ in {
   };
   config = mkIf cfg.enable {
     services = {
-      xserver = {
-        enable = true;
-        xkb.layout = "us";
-        displayManager.startx.enable = true;
-      };
       libinput.enable = true;
     };
 
     hardware.graphics.enable = true;
-
-    programs.dconf.enable = true;
   };
 }

sys/modules/gtklock.nix

@@ -0,0 +1,84 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.sys.gtklock;
+in {
+  options.local.sys.gtklock = {
+    enable = mkEnableOption "gtklock settings";
+  };
+  config = mkIf cfg.enable {
+    programs.gtklock = {
+      enable = true;
+      config = {
+        main = {
+          idle-hide = true;
+          idle-timeout = 1;
+          time-format = "%H:%M:%S";
+          start-hidden = true;
+        };
+      };
+      style = ''
+        /* Main lockscreen window */
+        window {
+          background-color: black;
+          color: #eaeaea;
+          font-family: "JetBrainsMono Nerd Font", monospace;
+          font-size: 14px;
+        }
+
+        /* Container for clock + prompt */
+        #main-box {
+          background: black;
+          border: none;
+          border-radius: 0;
+          padding: 0;
+          margin: 0;
+        }
+
+        /* Clock text */
+        #clock {
+          font-size: 32px;
+          font-weight: bold;
+          color: #ffffff;
+          margin-bottom: 12px;
+        }
+
+        /* Date text */
+        #date {
+          font-size: 14px;
+          color: #aaaaaa;
+          margin-bottom: 24px;
+        }
+
+        /* Password entry */
+        entry {
+          background-color: black;
+          color: #ffffff;
+          border: none;
+          border-radius: 0;
+          padding: 6px 8px;
+          font-family: "JetBrains Mono", monospace;
+          font-size: 12px;
+        }
+
+        /* Hide any extra icons in the entry */
+        entry image {
+          opacity: 0;
+          width: 0;
+          height: 0;
+        }
+
+        /* Wrong password feedback */
+        #auth-failure {
+          color: #ff6666;
+          font-size: 12px;
+          margin-top: 6px;
+        }
+      '';
+    };
+  };
+}

sys/modules/net.nix

@@ -0,0 +1,186 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  options.local.sys.nets = with lib.types;
+    mkOption {
+      readOnly = true;
+
+      type = attrsOf (submodule ({config, ...}: {
+        options = let
+          v4config = config.v4;
+          v6config = config.v6;
+        in {
+          hosts = mkOption {
+            default = {};
+
+            type = attrsOf (submodule {
+              options = {
+                v4 = mkOption {
+                  default = null;
+
+                  type = nullOr (submodule ({config, ...}: {
+                    options = {
+                      suffix = mkOption {
+                        type = str;
+                      };
+
+                      address = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      cidr = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      single = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+                    };
+
+                    config = {
+                      address =
+                        if v4config.bits == 0
+                        then config.suffix
+                        else if v4config.bits == 32
+                        then v4config.subnet
+                        else "${v4config.prefix}.${config.suffix}";
+
+                      cidr = "${config.address}/${toString v4config.bits}";
+                      single = "${config.address}/32";
+                    };
+                  }));
+                };
+
+                v6 = mkOption {
+                  default = null;
+
+                  type = nullOr (submodule ({config, ...}: {
+                    options = {
+                      suffix = mkOption {
+                        type = str;
+                      };
+
+                      address = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      cidr = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      single = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+                    };
+
+                    config = {
+                      address = let
+                        hextets = fragment: length (splitString ":" fragment);
+                        separator =
+                          if doubleColon
+                          then "::"
+                          else ":";
+                        doubleColon = hextets v6config.prefix + hextets config.suffix < 8;
+
+                        joined =
+                          if v6config.bits == 128
+                          then v6config.prefix
+                          else if v6config.bits == 0
+                          then config.suffix
+                          else "${v6config.prefix}${separator}${config.suffix}";
+                      in
+                        joined;
+
+                      cidr = "${config.address}/${toString v6config.bits}";
+                      single = "${config.address}/128";
+                    };
+                  }));
+                };
+              };
+            });
+          };
+
+          v4 = mkOption {
+            default = null;
+
+            type = nullOr (submodule ({config, ...}: {
+              options = {
+                bits = mkOption {
+                  type = enum [0 8 16 24 32];
+                };
+
+                prefix = mkOption {
+                  type = str;
+                };
+
+                subnet = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+
+                cidr = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+              };
+
+              config = {
+                cidr = "${config.subnet}/${toString config.bits}";
+                subnet =
+                  if config.bits != 0
+                  then config.prefix + strings.replicate (4 - config.bits / 8) ".0"
+                  else "0.0.0.0";
+              };
+            }));
+          };
+
+          v6 = mkOption {
+            default = null;
+
+            type = nullOr (submodule ({config, ...}: {
+              options = {
+                bits = mkOption {
+                  type =
+                    addCheck (ints.between 0 128) (b: mod b 4 == 0)
+                    // {
+                      description = "IPv6 subnet bits at nibble boundary";
+                    };
+                };
+
+                prefix = mkOption {
+                  type = str;
+                };
+
+                subnet = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+
+                cidr = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+              };
+
+              config = {
+                cidr = "${config.subnet}/${toString config.bits}";
+                subnet =
+                  if config.bits == 128 || length (splitString "::" config.prefix) > 1
+                  then config.prefix
+                  else "${config.prefix}::";
+              };
+            }));
+          };
+        };
+      }));
+    };
+}

sys/modules/steam.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.sys.steam;
+in {
+  options.local.sys.steam = {
+    enable = mkEnableOption "steam settings";
+  };
+  config = mkIf cfg.enable {
+    programs.steam = {
+      enable = true;
+      remotePlay.openFirewall = true;
+      dedicatedServer.openFirewall = true;
+      localNetworkGameTransfers.openFirewall = true;
+    };
+
+    environment = {
+      systemPackages = with pkgs; [
+        protontricks
+        protonup
+        protonup-ng
+        winetricks
+      ];
+    };
+  };
+}

sys/modules/users.nix

@@ -35,18 +35,6 @@ in {
         unixId = mkDefault 1000;
         admin = true;
       };
-      vanessa = {
-        unixId = mkDefault 1001;
-        admin = false;
-      };
-      soto = {
-        unixId = mkDefault 1010;
-        admin = false;
-      };
-      diaz = {
-        unixId = mkDefault 1011;
-        admin = false;
-      };
     };
 
     users = let
@@ -66,7 +54,7 @@ in {
           shell = pkgs.zsh;
           extraGroups =
             ["users" "networkmanager"]
-            ++ optionals (v.admin) ["wheel" "libvirtd" "dialout" "adbusers"];
+            ++ optionals (v.admin) ["wheel" "libvirtd" "dialout" "adbusers" "video" "input"];
           openssh.authorizedKeys.keyFiles = v.sshKeyPublicFile;
         })
         enabledUsers;

sys/platforms/posixlycorrect/default.nix

@@ -12,30 +12,25 @@
   ];
 
   local.sys = {
-    baseline.enable = true;
+    defaultDesktopPack.enable = true;
 
     yubikey.enable = true;
-    audio.enable = true;
-    graphics.enable = true;
     virtualisation.enable = true;
     androidSupport.enable = true;
-
+    borgsync = {
-    users = {
+      enable = true;
-      fabian = {
+      paths = [
-        enable = true;
+        "/home/fabian/nix"
-        unixId = 1002;
+        "/home/fabian/safe"
-      };
+        "/xtern/backup"
-      vanessa.enable = true;
+      ];
+      repoName = "posixlycorrect";
     };
   };
 
   networking = {
     hostName = "posixlycorrect";
-    networkmanager.enable = true;
+    hostId = "0414a727";
-
-    useDHCP = false; # The global useDHCP flag is deprecated, therefore explicitly set to false here.
-    interfaces.enp7s0.useDHCP = true; # Per-interface useDHCP will be mandatory in the future, so this generated config
-    interfaces.wlp6s0.useDHCP = true; # replicates the default behaviour.
   };
 
   boot = {
@@ -44,11 +39,12 @@
       efi.canTouchEfiVariables = true;
     };
     tmp.useTmpfs = true;
-    kernelPackages = pkgs.linuxPackages_latest;
+    supportedFilesystems = ["zfs"];
+    zfs = {
+      forceImportRoot = false;
+      useKeyringForCredentials = true;
+    };
   };
 
-  # Select internationalisation properties.
+  time.timeZone = "America/Costa_Rica";
-  i18n.defaultLocale = "en_US.UTF-8"; #todo: move to baseline?
-
-  time.timeZone = "America/Costa_Rica"; #todo: move to baseline?
 }

sys/platforms/posixlycorrect/hardware-configuration.nix

@@ -32,12 +32,6 @@ in {
       fsType = "vfat";
       options = ["umask=027"];
     };
-
-    "/extern" = {
-      device = "/dev/disk/by-uuid/7d8d3ec9-b456-4e2a-9396-551dcaf7705b";
-      fsType = "btrfs";
-      options = ["noatime" "compress=zstd"];
-    };
   };
 
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

sys/platforms/t14/default.nix

@@ -12,32 +12,22 @@
   ];
 
   local.sys = {
-    baseline.enable = true;
+    defaultDesktopPack.enable = true;
 
     yubikey.enable = true;
-    audio.enable = true;
-    graphics.enable = true;
-    androidSupport.enable = true;
     bluetooth.enable = true;
-
+    androidSupport.enable = true;
-    users = {
-      fabian = {
-        enable = true;
-        unixId = 1002;
-      };
-      vanessa.enable = true;
-    };
   };
 
-  networking = {
+  trivium = {
-    hostName = "t14";
+    laptop.enable = true;
-    networkmanager.enable = true;
+    thinkpad.enable = true;
-
-    useDHCP = false; # The global useDHCP flag is deprecated, therefore explicitly set to false here.
-    interfaces.enp7s0.useDHCP = true; # Per-interface useDHCP will be mandatory in the future, so this generated config
-    interfaces.wlp6s0.useDHCP = true; # replicates the default behaviour.
   };
 
+  hardware.acpilight.enable = true;
+
+  networking.hostName = "t14";
+
   boot = {
     loader = {
       systemd-boot.enable = true;
@@ -47,21 +37,5 @@
     kernelPackages = pkgs.linuxPackages_latest;
   };
 
-  # Select internationalisation properties.
+  time.timeZone = "America/Costa_Rica";
-  i18n.defaultLocale = "en_US.UTF-8"; #todo: move to baseline?
-
-  time.timeZone = "America/Costa_Rica"; #todo: move to baseline?
-
-  ###### MODULARIZE AFTER THIS
-
-  services = {
-    fwupd.enable = true;
-    thinkfan.enable = true;
-    tlp.enable = true;
-    pcscd.enable = true;
-  };
-
-  hardware.acpilight.enable = true;
-
-  services.fprintd.enable = true;
 }

sys/platforms/t14/hardware-configuration.nix

@@ -57,6 +57,6 @@
 
   swapDevices = [];
 
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

sys/platforms/vps/default.nix

@@ -4,6 +4,7 @@
   pkgs,
   flakes,
   modulesPath,
+  doctrine,
   ...
 }:
 with lib; {
@@ -13,20 +14,32 @@ with lib; {
     flakes.impermanence.nixosModule
     ./hardware-configuration.nix
     ./srv
+    ./networkMap.nix
   ];
 
   local.sys = {
     baseline.enable = true;
 
+    borgsync = {
+      enable = true;
+      paths = [
+        "/var/lib/forgejo"
+        "/var/lib/mealie"
+        "/var/lib/trilium"
+        "/var/lib/forgejo"
+      ];
+      repoName = "vps";
+    };
+
     users.fabian = {
       enable = true;
-      sshKeyPublicFile = [public_files/pki/fabian.ssh];
+      sshKeyPublicFile = [pki/id_ed25519.pub]; # move this out someday
     };
   };
 
-  networking = {
+  trivium.soju = {
-    hostName = "vps";
+    enable = true;
-    domain = "posixlycorrect.com";
+    fullyQualifiedDomain = "soju.posixlycorrect.com";
   };
 
   services.openssh = {
@@ -35,11 +48,86 @@ with lib; {
 
   programs.mosh.enable = true;
 
+  networking = {
+    hostName = "vps";
+    domain = "posixlycorrect.com";
+    firewall.allowedUDPPorts = [51820]; #TODO
+  };
+
+  time.timeZone = "Europe/Amsterdam";
+
+  systemd = {
+    extraConfig = ''
+      DefaultTimeoutStartSec=900s
+    '';
+
+    network = let
+      inherit (config.local.sys) nets;
+    in {
+      enable = true;
+
+      netdevs = {
+        wg-vpn = {
+          netdevConfig = {
+            Name = "wg-vpn";
+            Kind = "wireguard";
+          };
+
+          wireguardConfig = {
+            PrivateKeyFile = "/var/trust/wg/vpn/key.priv";
+            ListenPort = "51820";
+          };
+
+          wireguardPeers = [
+            {
+              PublicKey = "wwUp3Uu/rSxbp+6J745O+cpnZHGWOJYWfWEsTjRE3yU=";
+              PresharedKeyFile = "/var/trust/wg/vpn/vps-posixlycorrect.psk";
+              AllowedIPs = ["${nets.vpn-posixlycorrect.v6.cidr}"];
+            }
+            {
+              PublicKey = "YFqg/ED26KygSRSmGzvUXpwnXPqMOI3R3caVfAtHVks=";
+              PresharedKeyFile = "/var/trust/wg/vpn/vps-pixel8.psk";
+              AllowedIPs = ["${nets.vpn-pixel8.v6.cidr}"];
+            }
+          ];
+        };
+      };
+
+      networks = {
+        wg-vpn = {
+          name = "wg-vpn";
+
+          networkConfig = {
+            Address = [
+              nets.vpn-vps.hosts.vps.v6.cidr
+            ];
+          };
+
+          routes = [
+            {
+              Destination = nets.vpn.v6.cidr;
+            }
+            {
+              Source = nets.vpn.v6.cidr;
+            }
+          ];
+        };
+      };
+    };
+  };
+
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;
 
-    extraSpecialArgs = {inherit flakes;};
+    extraSpecialArgs = {
+      inherit flakes;
+      doctrine = flakes.trivionomicon.lib.mkDoctrine {
+        inherit pkgs;
+        inherit (doctrine) prefix;
+        namespace = "home";
+      };
+    };
 
     users.fabian = {
       imports = [
@@ -49,10 +137,4 @@ with lib; {
       ];
     };
   };
-
-  systemd.extraConfig = ''
-    DefaultTimeoutStartSec=900s
-  '';
-
-  time.timeZone = "Europe/Amsterdam";
 }

sys/platforms/vps/networkMap.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  lib,
+  flakes,
+  ...
+}:
+with lib; {
+  local.sys.nets = {
+    default = {
+      v4 = {
+        bits = 32;
+        prefix = "37.205.12.34";
+      };
+
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:fe:102";
+      };
+
+      hosts = {
+        vps.v6.suffix = "1";
+        vps.v4.suffix = "";
+      };
+    };
+
+    vpn = {
+      v6 = {
+        bits = 48;
+        prefix = "2a03:3b40:2b";
+      };
+    };
+
+    vpn-vps = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1000";
+      };
+
+      hosts = {
+        vps.v6.suffix = "1";
+      };
+    };
+
+    vpn-posixlycorrect = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1001";
+      };
+
+      hosts = {
+        posixlycorrect.v6.suffix = "1";
+      };
+    };
+
+    vpn-pixel8 = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1002";
+      };
+
+      hosts = {
+        pixel8.v6.suffix = "1";
+      };
+    };
+
+    vpn-t14 = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1003";
+      };
+
+      hosts = {
+        t14.v6.suffix = "1";
+      };
+    };
+  };
+}

sys/platforms/vps/pki/id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICls/LbyzkIXj5HCp7Qc4eoGcUXzJdQFshNX2caPwgNh openpgp:0x1B7A8CB7

sys/platforms/vps/public_files/pki/fabian.ssh

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHkK2Cg3dozG78AEA2OTzydezcKVnNTTj0MUJZcP/mrN fabian@posixlycorrect.com

sys/platforms/vps/public_files/pki/fabian_primary.gpg

@@ -1,25 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mDMEZHlROBYJKwYBBAHaRw8BAQdAhzA1JCghQ6KoHOuf6JPQhEmchHLVXFVye4I2
-pRUOUMO0KkZhYmlhbiBNb250ZXJvIDxmYWJpYW5AcG9zaXhseWNvcnJlY3QuY29t
-PoiUBBMWCgA8FiEEeqJ35gSkFzkWu7TpH/rDXheYF08FAmR5UTgCGwMFCQlmAYAE
-CwkIBwQVCgkIBRYCAwEAAh4FAheAAAoJEB/6w14XmBdPP2EA/i9ugFxpIFF6oOQs
-clMfr+sNj6Il0OUTJK0dqpp4mGorAP0awa6nfhU8T1Ju7UWr6cfSmnL4bM6M/4Z3
-D+AF/L5PBokCMwQQAQoAHRYhBOd6gIv5qVXWaO7qZHP6nJy18CSbBQJkeVKDAAoJ
-EHP6nJy18CSbzTkP/Reio0ObRrRW+QSw62ZXrUG0mFcNeeoM9amldCToFRyGnSDu
-wtZ9nqwLiTJ01VPBOsEZLsl4VonO3rdadqnMTZ3XqKK9VHBl6UNot3DQ8INDAcko
-GW1zvEdxNkpMxhtAja0JkcBdG7+zxc2aEGeKfEna2qDXA+xtYw5+pssOWYMip7hm
-jQ2NzYMYav2KYRBC7eXTkAIIIJi/l9pR1IwHtY3a0gfbkQymgCyt5wVG6LneYFIR
-+ycNVCObwyP8gFASdId0bWnA23rkilc9ZBOCps/cGfDLM+KQ+sLAWBFBQyQeEjcv
-tU+pLXncAEvWy/SFmprVSLDQMMooFaEJMZChojGcCkwAPG1twsihqIA3E44Q3/+G
-K0gZN57jGMnfvuQiuLuttOMdu27KwEu++t3YUt0P6S4kARpx51zZJ7A2Yj2u22aM
-7EL8qq6KTNdNoS7FgwQkrWbokdDZIl0HV+5TeMQfylPqOPhuFK/1A9qztqknBPVY
-QUx2t6FZUgH9sT7uD+5gXxyeqmEIFo2i6D8G/4TEPbKtWivJfeOqDEBn4QEY2nvE
-zgJLLU5XCv9xPz5rizRCa+h+kg+i4mH6fLCBCCAPXsbAAo0gUlGJvX4slPh7uPOa
-T2r7A/7uezResBzP/L/vostlmjO5c8cOl9Wc6D1kRZq17/AjMUgy6+KR3iVnuDgE
-ZHlROBIKKwYBBAGXVQEFAQEHQPRbCS2p8xpt3fRxfyRnDOdH9pULY4NtGmZUS0ve
-ZGkTAwEIB4h+BBgWCgAmFiEEeqJ35gSkFzkWu7TpH/rDXheYF08FAmR5UTgCGwwF
-CQlmAYAACgkQH/rDXheYF0/65AD+LtDeedCYv9zs+1Ia3DvejVZM256WEH+dRH5h
-Pm3RzQ8A/2+bXRnfsgGqacj/kKEL3spuos95ngRNRkrQ39nc1koP
-=PAxr
------END PGP PUBLIC KEY BLOCK-----

sys/platforms/vps/public_files/pki/fabian_yubikey.gpg

@@ -1,19 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mDMEZukhMBYJKwYBBAHaRw8BAQdAC/Gy2p7RPFw3k+ROFnKpJvCVqQb+BUYboE2u
-CP1kz/C0KkZhYmlhbiBNb250ZXJvIDxmYWJpYW5AcG9zaXhseWNvcnJlY3QuY29t
-PoiTBBMWCgA7FiEEcgbY7iR0898Y6odvDsFpH/jBqB8FAmbpITACGwMFCwkIBwIC
-IgIGFQoJCAsCBBYCAwECHgcCF4AACgkQDsFpH/jBqB+oGwEAhmegCZJAt8Opv/9+
-HBbL51f2035qymHPgkV/SyFM1GEBAOVQY6A5U+NrLNiaQTN5Z7jcfQuBobzk4ksn
-RzROhTcAiHUEEBYKAB0WIQR6onfmBKQXORa7tOkf+sNeF5gXTwUCZutnFQAKCRAf
-+sNeF5gXT1juAQDsH/lDorfMdWxuP87eV9OP8jQvibuTuZ9n2jUllXsLcQEA5gDJ
-05NW5Tw2g9mvlrocWr7N2/PC5UvFct4akwDXtA+4MwRm6SEwFgkrBgEEAdpHDwEB
-B0AHSmncE+krtL9ZGe4eq865vjaLiUAVnZQaVObKm11CBYh4BBgWCgAgFiEEcgbY
-7iR0898Y6odvDsFpH/jBqB8FAmbpITACGyAACgkQDsFpH/jBqB+hBwD/Y9vAcbPG
-CTmZvtgYlZW5Oey5T3hHoANv1THOZwv9G58BALEBZRvDztmYPjRaMyAMonrpc2P0
-GPHYLcqCPVbjkaAKuDgEZukhMBIKKwYBBAGXVQEFAQEHQC2+QJcHEJjdZikBYeMj
-ks53MjfeawAXU31KtAU60KACAwEIB4h4BBgWCgAgFiEEcgbY7iR0898Y6odvDsFp
-H/jBqB8FAmbpITACGwwACgkQDsFpH/jBqB+0TwD+K4IcFstNGLrijlgH2zuQaI+p
-8QT8AInjSpGfC4zcMlEBAIVYvdTYw4IXPSQOs0qPyR0nhfGIeoBMeWrAAfoxQ0oB
-=wpc0
------END PGP PUBLIC KEY BLOCK-----

sys/platforms/vps/srv/calibre-web.nix

@@ -21,7 +21,6 @@ with lib; {
 
     calibre-web = {
       enable = true;
-      openFirewall = true;
       options = {
         enableBookUploading = true;
         calibreLibrary = "/var/lib/calibre-web/calibre_library";

sys/platforms/vps/srv/default.nix

@@ -12,11 +12,14 @@ with lib; {
     ./forgejo.nix
     ./vaultwarden.nix
     ./msmtp.nix
-    ./paperless.nix
     ./trilium.nix
     ./syncthing.nix
-    ./shiori.nix
     ./calibre-web.nix
     ./immich.nix
+    ./mealie.nix
+    ./dufs.nix
+    ./isso.nix
+    ./miniflux.nix
+    ./radicale.nix
   ];
 }

sys/platforms/vps/srv/dufs.nix

@@ -1,12 +1,13 @@
 {
   lib,
   pkgs,
+  config,
   ...
 }:
 with lib; {
   services = {
     nginx = {
-      virtualHosts."bookmarks.posixlycorrect.com" = {
+      virtualHosts."public.posixlycorrect.com" = {
         enableACME = true;
         forceSSL = true;
         extraConfig = ''
@@ -14,16 +15,18 @@ with lib; {
           proxy_headers_hash_bucket_size 128;
         '';
         locations."/" = {
-          proxyPass = "http://127.0.0.1:8089";
+          proxyPass = "http://127.0.0.1:5000";
         };
       };
     };
+  };
 
-    shiori = {
+  local.sys.dufs = {
-      enable = true;
+    enable = true;
-      address = "127.0.0.1";
+    settings = {
-      port = 8089;
+      serve-path = "/var/public";
-      environmentFile = "/var/trust/shiori/env";
+      allow-all = false;
+      allow-archive = true;
     };
   };
 }

sys/platforms/vps/srv/forgejo.nix

@@ -47,12 +47,10 @@ with lib; {
             LANDING_PAGE = "explore";
           };
 
-          # You can temporarily allow registration to create an admin user.
           service.DISABLE_REGISTRATION = true;
 
-          # ver https://github.com/nektos/act
           actions = {
-            ENABLED = false;
+            ENABLED = true;
           };
           mailer = {
             ENABLED = false;

sys/platforms/vps/srv/immich.nix

@@ -22,12 +22,51 @@ with lib; {
     immich = {
       enable = true;
       secretsFile = "/var/trust/immich/secrets.txt";
-      openFirewall = true;
       mediaLocation = "/mnt/export2178/immich/media";
       machine-learning.enable = false;
       environment = {
         IMMICH_TELEMETRY_EXCLUDE = "host,api,io,repo,job";
       };
+      settings = {
+        machineLearning = {
+          enabled = false;
+        };
+        job = {
+          backgroundTask = {
+            concurrency = 1;
+          };
+          smartSearch = {
+            concurrency = 1;
+          };
+          metadataExtraction = {
+            concurrency = 1;
+          };
+          faceDetection = {
+            concurrency = 1;
+          };
+          search = {
+            concurrency = 1;
+          };
+          sidecar = {
+            concurrency = 1;
+          };
+          library = {
+            concurrency = 1;
+          };
+          migration = {
+            concurrency = 1;
+          };
+          thumbnailGeneration = {
+            concurrency = 1;
+          };
+          videoConversion = {
+            concurrency = 1;
+          };
+          notifications = {
+            concurrency = 1;
+          };
+        };
+      };
     };
   };
 }

sys/platforms/vps/srv/isso.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  services = {
+    nginx = {
+      virtualHosts."isso.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8888/";
+        };
+      };
+    };
+
+    isso = {
+      enable = true;
+      settings = {
+        general = {
+          host = "https://posixlycorrect.com/";
+          dbpath = "/var/lib/isso/comments.db";
+          notify = "stdout";
+        };
+        moderation = {
+          enabled = false;
+          approve-if-email-previously-approved = false;
+          purge-after = "365d";
+        };
+        server = {
+          listen = "http://127.0.0.1:8888/";
+        };
+        guard = {
+          require-author = true;
+          require-email = true;
+        };
+      };
+    };
+  };
+}

sys/platforms/vps/srv/mealie.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  systemd.services.wiki-js = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
+
+  services = {
+    nginx = {
+      virtualHosts."food.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:9000";
+        };
+      };
+    };
+
+    mealie = {
+      enable = true;
+      listenAddress = "127.0.0.1";
+      port = 9000;
+      credentialsFile = "/var/trust/mealie/credentials.env";
+      settings = {
+        ALLOW_SIGNUP = "false";
+      };
+    };
+  };
+}

sys/platforms/vps/srv/miniflux.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  services = {
+    nginx = {
+      virtualHosts."rss.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8087";
+        };
+      };
+    };
+
+    miniflux = {
+      enable = true;
+      adminCredentialsFile = "/var/trust/miniflux/adminCredentialsFile";
+      config = {
+        CLEANUP_FREQUENCY = 48;
+        LISTEN_ADDR = "127.0.0.1:8087";
+        BASE_URL = "https://rss.posixlycorrect.com";
+        CREATE_ADMIN = 1;
+      };
+    };
+  };
+}

sys/platforms/vps/srv/net.nix

@@ -1,79 +1,98 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
-with lib; {
+with lib; let
-  networking = {
+  inherit (config.local.sys) nets;
-    nftables.enable = true;
+in {
-    firewall = {
+  # adds "/var/lib/acme/acme-challenge" as a webroot fallback
-      enable = true;
+  options = {
-      allowedTCPPorts = [80 443];
+    security.acme = {
+      certs = mkOption {
+        type = with types;
+          attrsOf (submodule ({config, ...}: {
+            config = {
+              webroot =
+                if config.dnsProvider == null
+                then "/var/lib/acme/acme-challenge"
+                else null;
+            };
+          }));
+      };
     };
-    domain = "posixlycorrect.com";
   };
 
-  # ver https://nixos.org/manual/nixos/stable/index.html#module-security-acme-nginx
+  config = {
-  security.acme = {
+    networking = {
-    acceptTerms = true;
+      nftables.enable = false; # learn how to use this later
-    defaults.email = "fabian@posixlycorrect.com";
+      firewall = {
-  };
+        enable = true;
+        allowedTCPPorts = [80 443];
+      };
+      domain = "posixlycorrect.com";
+    };
 
-  services = {
+    # ver https://nixos.org/manual/nixos/stable/index.html#module-security-acme-nginx
-    nginx = {
+    security.acme = {
-      enable = true;
+      acceptTerms = true;
-      recommendedGzipSettings = true;
+      defaults = {
-      recommendedOptimisation = true;
+        email = "fabian@posixlycorrect.com";
-      recommendedProxySettings = true;
+      };
-      recommendedTlsSettings = true;
+    };
-      logError = "/var/log/nginx/error.log";
-      clientMaxBodySize = "99M";
-      virtualHosts = {
-        "posixlycorrect.com" = {
-          forceSSL = true;
-          enableACME = true;
-          locations = {
-            "/".root = "${pkgs.local.homepage}";
 
-            "~ ^/public(?:/(.*))?$" = {
+    services = {
-              # https://serverfault.com/a/476368
+      nginx = {
-              alias = "${../public_files}/$1";
+        enable = true;
-              extraConfig = ''
+        recommendedGzipSettings = true;
-                autoindex on;
+        recommendedOptimisation = true;
-                autoindex_exact_size on;
+        recommendedProxySettings = true;
-                autoindex_localtime on;
+        recommendedTlsSettings = true;
-                autoindex_format html;
+        logError = "/var/log/nginx/error.log";
-              '';
+        clientMaxBodySize = "99M";
+        virtualHosts = {
+          "posixlycorrect.com" = {
+            forceSSL = true;
+            enableACME = true;
+            locations = {
+              "/".root = "${pkgs.trivium.homepage}";
+              "/.well-known/openpgpkey/hu/".alias = "/var/public/wkd/";
             };
           };
         };
       };
-    };
+
-    fail2ban = {
+      fail2ban = {
-      enable = true;
-      bantime = "10m";
-      ignoreIP = ["37.205.12.34"]; # Never ban the server's own IP
-      bantime-increment = {
         enable = true;
-        formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+        bantime = "10m";
-        maxtime = "48h"; # Do not ban for more than 48h
+        ignoreIP = [
-        rndtime = "10m";
+          nets.default.hosts.vps.v6.cidr
-        overalljails = true; # Calculate the bantime based on all the violations
+          nets.default.hosts.vps.v4.address
-      };
+          nets.vpn.v6.cidr
-      jails = {
+        ];
-        # https://discourse.nixos.org/t/fail2ban-with-nginx-and-authelia/31419
+        bantime-increment = {
-        nginx-botsearch.settings = {
+          enable = true;
-          # Usar log en vez de journalctl
+          formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
-          # TODO: Pasar todo a systemd?
+          maxtime = "48h"; # Do not ban for more than 48h
-          backend = "pyinotify";
+          rndtime = "10m";
-          logpath = "/var/log/nginx/*.log";
+          overalljails = true; # Calculate the bantime based on all the violations
-          journalmatch = "";
         };
-        nginx-bad-request.settings = {
+        jails = {
-          backend = "pyinotify";
+          # https://discourse.nixos.org/t/fail2ban-with-nginx-and-authelia/31419
-          logpath = "/var/log/nginx/*.log";
+          nginx-botsearch.settings = {
-          journalmatch = "";
+            # Usar log en vez de journalctl
-          maxretry = 10;
+            # TODO: Pasar todo a systemd?
+            backend = "pyinotify";
+            logpath = "/var/log/nginx/*.log";
+            journalmatch = "";
+          };
+          nginx-bad-request.settings = {
+            backend = "pyinotify";
+            logpath = "/var/log/nginx/*.log";
+            journalmatch = "";
+            maxretry = 10;
+          };
         };
       };
     };

sys/platforms/vps/srv/paperless.nix

@@ -1,39 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  services = {
-    nginx = {
-      virtualHosts."docs.posixlycorrect.com" = {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          proxy_headers_hash_max_size 512;
-          proxy_headers_hash_bucket_size 128;
-        '';
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:28981";
-        };
-      };
-    };
-
-    paperless = {
-      enable = true;
-      user = "paperless";
-      passwordFile = "/var/trust/paperless/passwordFile";
-      openMPThreadingWorkaround = true; # see https://github.com/NixOS/nixpkgs/issues/240591
-      address = "127.0.0.1";
-      port = 28981;
-      settings = {
-        PAPERLESS_URL = "docs.posixlycorrect.com";
-        PAPERLESS_OCR_LANGUAGE = "eng+spa";
-        PAPERLESS_APP_TITLE = "posixlycorrect";
-        PAPERLESS_OCR_USER_ARGS = {
-          "invalidate_digital_signatures" = true;
-        };
-      };
-    };
-  };
-}

sys/platforms/vps/srv/radicale.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  services = {
+    nginx = {
+      virtualHosts."dav.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:5232";
+        };
+      };
+    };
+
+    radicale = {
+      enable = true;
+      settings = {
+        server = {
+          hosts = ["127.0.0.1:5232"];
+        };
+        auth = {
+          type = "htpasswd";
+          htpasswd_filename = "/var/trust/radicale/htpasswd";
+          htpasswd_encryption = "bcrypt";
+        };
+        storage = {
+          filesystem_folder = "/var/lib/radicale/collections";
+        };
+        web.type = "internal";
+        rights.type = "authenticated";
+      };
+    };
+  };
+}

sys/platforms/vps/srv/syncthing.nix

@@ -13,6 +13,7 @@ with lib; {
       openDefaultPorts = true;
       guiAddress = "127.0.0.1:8384";
       settings.options.urAccepted = -1;
+      dataDir = "/mnt/export2179/syncthing";
       relay = {
         enable = true;
         pools = [];
@@ -20,4 +21,22 @@ with lib; {
       };
     };
   };
+
+  # calibre web stuff. make this better someday, this is pure duct-tape
+  users.groups."calybresync".members = ["syncthing" "calibre-web"];
+  systemd = {
+    services."calybreown" = {
+      script = ''
+        chgrp -R calybresync /var/lib/calibre-web/calibre_library
+        chmod -R g+w /var/lib/calibre-web/calibre_library
+      '';
+      serviceConfig.Type = "oneshot";
+    };
+    timers."calybreown" = {
+      wantedBy = [
+        "timers.target"
+      ];
+      timerConfig.OnCalendar = "*-*-* *:00/30:00";
+    };
+  };
 }

sys/platforms/vps/srv/trilium.nix

@@ -22,6 +22,7 @@ with lib; {
       host = "127.0.0.1";
       port = 8458;
       noAuthentication = false;
+      noBackup = true; # I already backup the whole dataDir, so no need for this
       instanceName = "posixlycorrect";
       dataDir = "/var/lib/trilium";
       nginx = {

trivionomicon/.gitignore

@@ -0,0 +1,2 @@
+!**/.keep
+result

trivionomicon/COPYING

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

trivionomicon/README.md

@@ -0,0 +1,8 @@
+### Push:
+
+    git subtree push --prefix=trivionomicon forgejo@git.posixlycorrect.com:deepState/trivionomicon.git master
+
+
+### Pull:
+
+    git subtree pull --prefix=trivionomicon forgejo@git.posixlycorrect.com:deepState/trivionomicon.git master

trivionomicon/doctrine/default.nix

@@ -0,0 +1,16 @@
+{
+  lib ? pkgs.lib,
+  pkgs,
+  prefix ? "trivium",
+  namespace ? null,
+}: let
+  doctrine =
+    {
+      lib = import ./lib {inherit lib pkgs doctrine;};
+      inherit namespace prefix;
+    }
+    // lib.optionalAttrs (pkgs != null) {
+      inherit pkgs;
+    };
+in
+  doctrine

trivionomicon/doctrine/lib/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  doctrine,
+  pkgs,
+}: let
+  close = vars: f: args:
+    (
+      if builtins.isPath f
+      then import f
+      else f
+    )
+    (args // vars);
+
+  closeLib = close {inherit lib;};
+  closeFull = close {inherit lib pkgs doctrine;};
+in
+  {
+    inherit close;
+    importAll = closeLib ./import-all.nix;
+  }
+  // lib.optionalAttrs (doctrine.namespace != null) {
+    mkModule = closeFull ./mk-module.nix;
+  }

trivionomicon/doctrine/lib/import-all.nix

@@ -1,6 +1,7 @@
-{lib}: {
+{
+  lib,
   root,
-  exclude ? [],
+  exclude ? ["default"],
 }:
 with builtins;
 with lib;
@@ -10,7 +11,7 @@ with lib;
 
     isMatch = name: type:
       (hasSuffix ".nix" name || type == "directory")
-      && ! elem name (map basename exclude);
+      && ! elem (basename name) exclude;
 
     entry = name: _: {
       name = basename name;

trivionomicon/doctrine/lib/mk-module.nix

@@ -0,0 +1,51 @@
+{
+  # The first few arguments are implicitly passed by the 'close' helper
+  lib,
+  pkgs,
+  doctrine,
+  name,
+  config,
+  hm ? null,
+  sys ? null,
+  options ? null,
+  requires ? [],
+  prefix ? doctrine.prefix,
+  namespace ? doctrine.namespace,
+  passthru ? {},
+}: let
+  optionsSet = import options (passthru
+    // {
+      inherit config lib pkgs cfg name doctrine;
+    });
+
+  configSet = import configFiles.${namespace} (passthru
+    // {
+      inherit config lib pkgs doctrine cfg;
+    });
+
+  configFiles = lib.filterAttrs (k: v: v != null) {
+    inherit sys hm;
+  };
+
+  cfg = config.${prefix}.${name};
+in {
+  config =
+    lib.optionalAttrs (configFiles ? ${namespace})
+    (lib.mkIf cfg.enable (lib.mkMerge [
+      configSet
+      {
+        assertions =
+          map (dependency: {
+            assertion = cfg.enable -> config.${prefix}.${dependency}.enable;
+            message = "${prefix}.${name}.enable requires ${prefix}.${dependency}.enable";
+          })
+          requires;
+      }
+    ]));
+
+  options.${prefix}.${name} =
+    lib.optionalAttrs (options != null && optionsSet ? ${namespace}) optionsSet.${namespace}
+    // {
+      enable = lib.mkEnableOption name;
+    };
+}

trivionomicon/flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1754292888,
+        "narHash": "sha256-1ziydHSiDuSnaiPzCQh1mRFBsM2d2yRX9I+5OPGEmIE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "ce01daebf8489ba97bd1609d185ea276efdeb121",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

trivionomicon/flake.nix

@@ -0,0 +1,229 @@
+{
+  inputs = {
+    flake-utils.url = "github:numtide/flake-utils";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+  };
+
+  outputs = {
+    self,
+    nixpkgs,
+    flake-utils,
+  }: let
+    mapOverlayOverride = prefix: overlay: final: prev: let
+      overlayPkgs = overlay final prev;
+    in
+      {
+        "${prefix}" = (prev.${prefix} or {}) // builtins.removeAttrs overlayPkgs ["override"];
+      }
+      // (overlayPkgs.override or {});
+
+    doctrineNoPkgs = self.lib.mkDoctrine {
+      lib = nixpkgs.lib;
+      pkgs = null;
+    };
+  in
+    flake-utils.lib.eachDefaultSystem (system: let
+      pkgs = import nixpkgs {inherit system;};
+    in {
+      formatter = pkgs.alejandra;
+
+      packages =
+        (import nixpkgs {
+          inherit system;
+          overlays = [self.overlays.default];
+        }).${
+          doctrineNoPkgs.prefix
+        };
+    })
+    // {
+      templates = let
+        system-flake = {
+          path = ./templates/system-flake;
+          description = "Opinionated flake for a NixOS system with Home Manager";
+        };
+      in {
+        inherit system-flake;
+
+        default = system-flake;
+      };
+
+      overlays = let
+        overlay = mapOverlayOverride doctrineNoPkgs.prefix (import ./pkgs);
+      in {
+        default = overlay;
+        ${doctrineNoPkgs.prefix} = overlay;
+      };
+
+      homeManagerModules.default = ./modules;
+      nixosModules.default = ./modules;
+
+      lib = {
+        mkDoctrine = import ./doctrine;
+
+        mkSystemFlake = {
+          flakes,
+          system,
+          doctrinePrefix ? null,
+          formatter ? "alejandra",
+          paths ? {},
+        }: let
+          mkDoctrine = args:
+            self.lib.mkDoctrine
+            (args
+              // optionalAttrs (doctrinePrefix != null) {
+                prefix = doctrinePrefix;
+              });
+
+          doctrineNoPkgs = mkDoctrine {
+            lib = nixpkgs.lib;
+            pkgs = null;
+          };
+
+          optionalFlake = name:
+            if flakes ? "${name}"
+            then flakes.${name}
+            else null;
+
+          requireFlake = name:
+            if flakes ? "${name}"
+            then flakes.${name}
+            else throw "Required flake input '${name}' is missing";
+
+          nur = optionalFlake "nur";
+          nixpkgs = requireFlake "nixpkgs";
+          unstable = optionalFlake "unstable";
+
+          home-manager =
+            if hmSourcePath != null
+            then requireFlake "home-manager"
+            else null;
+
+          pathFromSelf = path: builtins.toPath "${flakes.self}" + "/${path}";
+
+          localOverlayPath = pathFromSelf paths.localOverlay;
+          nixpkgsConfigPath = pathFromSelf paths.nixpkgsConfig;
+          nixosSourcePath = pathFromSelf paths.nixosSource;
+          nixosPlatformsPath = pathFromSelf paths.nixosPlatforms;
+          hmSourcePath = pathFromSelf paths.hmSource;
+          hmPlatformsPath = pathFromSelf paths.hmPlatforms;
+
+          pkgs = importPkgs nixpkgs;
+
+          importPkgs = flake:
+            import flake ({
+                inherit system;
+
+                overlays = let
+                  conditions = [
+                    {
+                      overlay = nur.overlays.default;
+                      condition = nur != null;
+                    }
+                    # NB: Preserve the relative order
+                    {
+                      overlay = mapOverlayOverride prefix (import ./pkgs);
+                      condition = true;
+                    }
+                    {
+                      overlay = flakes.self.overlays.default;
+                      condition = true;
+                    }
+                  ];
+                in
+                  builtins.map (cond: cond.overlay) (builtins.filter (cond: cond.condition) conditions);
+              }
+              // optionalAttrs (paths ? nixpkgsConfig) {
+                config = import nixpkgsConfigPath {inherit (nixpkgs) lib;};
+              });
+
+          inherit (pkgs) lib;
+          inherit (nixpkgs.lib) optionalAttrs; # Prevents infinite recursion
+          inherit (doctrineNoPkgs) prefix;
+          inherit (doctrineNoPkgs.lib) importAll;
+        in
+          {
+            formatter.${system} =
+              if formatter == "alejandra"
+              then pkgs.alejandra
+              else if formatter == "nixpkgs-fmt"
+              then pkgs.nixpkgs-fmt
+              else throw "Unknown formatter: '${formatter}'";
+
+            packages.${system} = pkgs.${prefix};
+
+            overlays.default = final: prev: let
+              overlay = final: prev:
+                if paths ? localOverlay
+                then import localOverlayPath {inherit final prev flakes;}
+                else {};
+            in
+              mapOverlayOverride prefix overlay final prev
+              // optionalAttrs (unstable != null) {
+                unstable = importPkgs unstable;
+              };
+          }
+          // optionalAttrs (paths ? nixosSource) {
+            nixosConfigurations = let
+              hostConfig = platform:
+                self.lib.mkSystem {
+                  inherit flakes pkgs;
+                  doctrine = doctrineNoPkgs;
+
+                  modules = [
+                    nixosSourcePath
+                    platform
+                  ];
+                };
+            in
+              lib.mapAttrs (_: hostConfig) (importAll {root = nixosPlatformsPath;});
+          }
+          // optionalAttrs (paths ? hmSource) {
+            homeConfigurations = let
+              home = name: platform:
+                home-manager.lib.homeManagerConfiguration {
+                  inherit pkgs;
+
+                  extraSpecialArgs = {
+                    inherit flakes;
+
+                    doctrine = mkDoctrine {
+                      inherit pkgs;
+                      namespace = "hm";
+                    };
+                  };
+
+                  modules = [
+                    self.homeManagerModules.default
+                    hmSourcePath
+                    platform
+                  ];
+                };
+            in
+              lib.mapAttrs home (importAll {root = hmPlatformsPath;});
+          };
+
+        mkSystem = {
+          pkgs,
+          flakes,
+          doctrine,
+          modules,
+        }:
+          flakes.nixpkgs.lib.makeOverridable flakes.nixpkgs.lib.nixosSystem {
+            inherit pkgs;
+            inherit (pkgs) system;
+
+            modules = [self.nixosModules.default] ++ modules;
+
+            specialArgs = {
+              inherit flakes;
+
+              doctrine = self.lib.mkDoctrine {
+                inherit pkgs;
+                inherit (doctrine) prefix;
+                namespace = "sys";
+              };
+            };
+          };
+      };
+    };
+}

trivionomicon/modules/athena-bccr/default.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "athena-bccr";
+  hm = ./hm.nix;
+  sys = ./sys.nix;
+  options = ./options.nix;
+}

trivionomicon/modules/athena-bccr/hm.nix

@@ -0,0 +1,14 @@
+{
+  pkgs,
+  lib,
+  cfg,
+  doctrine,
+  ...
+}: let
+  athena = pkgs.${doctrine.prefix}.athena-bccr.${cfg.release};
+in {
+  home.packages = [
+    athena.firmador
+    (athena.gaudi.override {inherit (cfg) gaudiHash;})
+  ];
+}

trivionomicon/modules/athena-bccr/options.nix

@@ -0,0 +1,30 @@
+{lib, ...}:
+with lib.types; {
+  hm = {
+    gaudiHash = lib.mkOption {
+      type = nullOr str;
+      default = null;
+      description = "hash of the Gaudi client";
+    };
+
+    release = lib.mkOption {
+      type = str;
+      default = "latest";
+      description = "pinned athena-bccr release tag";
+    };
+  };
+
+  sys = {
+    group = lib.mkOption {
+      type = str;
+      default = "users";
+      description = "user group with full access to the smartcard reader";
+    };
+
+    release = lib.mkOption {
+      type = str;
+      default = "latest";
+      description = "pinned athena-bccr release tag";
+    };
+  };
+}

trivionomicon/modules/athena-bccr/sys.nix

@@ -0,0 +1,35 @@
+{
+  pkgs,
+  lib,
+  cfg,
+  doctrine,
+  ...
+}: let
+  athena = pkgs.${doctrine.prefix}.athena-bccr.${cfg.release};
+in {
+  environment = {
+    etc = {
+      "Athena".source = "${athena.ase-pkcs11}/etc/Athena";
+
+      "pkcs11/modules/asep11".text = ''
+        module: ${athena.libasep11}
+      '';
+    };
+
+    systemPackages = [athena.ase-pkcs11];
+  };
+
+  #FIXME: Extremadamente peligroso si BCCR o MICITT caen, investigar política nacional de root CA
+  security.pki.certificateFiles = ["${athena.bccr-cacerts}/root-ca.pem"];
+
+  services = {
+    pcscd.enable = true;
+
+    udev.extraRules = ''
+      # Athena Smartcard Solutions, Inc. ASEDrive V3CR
+      ATTRS{idVendor}=="0dc3", ATTRS{idProduct}=="1004", MODE="660", GROUP="${cfg.group}", TAG+="uaccess"
+    '';
+  };
+
+  users.groups.${cfg.group} = {};
+}

trivionomicon/modules/default.nix

@@ -0,0 +1,3 @@
+{doctrine, ...}: {
+  imports = builtins.attrValues (doctrine.lib.importAll {root = ./.;});
+}

trivionomicon/modules/laptop/default.nix

@@ -0,0 +1,10 @@
+{
+  config,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "laptop";
+  sys = ./sys.nix;
+}

trivionomicon/modules/laptop/sys.nix

@@ -0,0 +1,11 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  services = {
+    tlp.enable = lib.mkDefault true;
+    upower.enable = lib.mkDefault true;
+  };
+}

trivionomicon/modules/nix-registry/default.nix

@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  pkgs,
+  doctrine,
+  flakes,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "nix-registry";
+  hm = ./hm.nix;
+  options = ./options.nix;
+
+  passthru = {inherit flakes;};
+}

trivionomicon/modules/nix-registry/hm.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  lib,
+  cfg,
+  flakes,
+  ...
+}: let
+  registryName = name:
+    if name == "self"
+    then cfg.renameSelf
+    else name;
+
+  registryFilter = {
+    nixpkgs = true;
+    unstable = true;
+    self = cfg.renameSelf != null;
+  };
+in {
+  nix.registry =
+    lib.mapAttrs'
+    (name: value: lib.nameValuePair (registryName name) {flake = value;})
+    (lib.filterAttrs (name: _: registryFilter.${name} or cfg.allInputs) flakes);
+}

trivionomicon/modules/nix-registry/options.nix

@@ -0,0 +1,19 @@
+{lib, ...}:
+with lib.types; {
+  hm = {
+    allInputs = mkOption {
+      type = bool;
+      default = default;
+      description = ''
+        Include all flake inputs. If false, only 'nixpkgs' and 'unstable'
+        (if available) will be added to the flake registry by default.
+      '';
+    };
+
+    renameSelf = mkOption {
+      type = nullOr str;
+      default = "self";
+      description = "Registry name to use for the 'self' input";
+    };
+  };
+}

trivionomicon/modules/soju/default.nix

@@ -0,0 +1,13 @@
+{
+  config,
+  lib,
+  pkgs,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "soju";
+  sys = ./sys.nix;
+  options = ./options.nix;
+}