vps: add mealie

this was used for bepasty

README.md

@@ -0,0 +1,11 @@
+## Unified nix configuration
+
+Switch server: `nixos-rebuild switch --target-host root@posixlycorrect.com --use-substitutes --show-trace --flake .\#vps`
+
+Switch current machine: `sudo nixos-rebuild switch --flake . --show-trace`
+
+Switch current home manager: `home-manager switch --flake . --show-trace`
+
+Update homepage: `nix flake update --commit-lock-file --update-input homepage`
+
+Update whole flake: `nix flake update --commit-lock-file`

flake.lock

@@ -37,11 +37,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1732215451,
+        "lastModified": 1736445563,
-        "narHash": "sha256-P2VVlzRGKBNsiHsN1yMZcSMXpwtIx9ysMFZAqKFJ14o=",
+        "narHash": "sha256-+f1MWPtja+LRlTHJP/i/3yxmnzo2LGtZmxtJJTdAp8o=",
         "owner": "nix-community",
         "repo": "authentik-nix",
-        "rev": "9d9c0a3a94a91cfed654a18239e27cf56970daa4",
+        "rev": "bf5a5bf42189ff5f468f0ff26c9296233a97eb6c",
         "type": "github"
       },
       "original": {
@@ -53,16 +53,16 @@
     "authentik-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1732213300,
+        "lastModified": 1736440980,
-        "narHash": "sha256-4Pv35cnZGiTxe6j2O0F9L9sHzxVIC1SazeAUD5kWeBs=",
+        "narHash": "sha256-Z3rFFrXrOKaF9NpY/fInsEbzdOWnWqLfEYl7YX9hFEU=",
         "owner": "goauthentik",
         "repo": "authentik",
-        "rev": "527e584699abc93712114b05f70f59c5187caa66",
+        "rev": "9d81f0598c7735e2b4616ee865ab896056a67408",
         "type": "github"
       },
       "original": {
         "owner": "goauthentik",
-        "ref": "version/2024.10.4",
+        "ref": "version/2024.12.2",
         "repo": "authentik",
         "type": "github"
       }
@@ -153,24 +153,19 @@
         "flake-utils": "flake-utils_4",
         "liburing": "liburing",
         "nix-filter": "nix-filter",
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_4",
-          "unstable"
-        ],
         "rocksdb": "rocksdb"
       },
       "locked": {
         "lastModified": 1721105087,
         "narHash": "sha256-t74TUSswsCkOdZCKjgP74qEHKg78ShKTkP6x9/zqYX4=",
-        "owner": "girlbossceo",
+        "path": "/nix/store/sw263a1qb3z8qc6bb78fm4mslsz5ya7i-source",
-        "repo": "conduwuit",
         "rev": "c29197b3f457cf72197ef5251f9815107b2526d7",
-        "type": "github"
+        "type": "path"
       },
       "original": {
-        "owner": "girlbossceo",
+        "id": "conduwuit",
-        "ref": "v0.4.5",
+        "type": "indirect"
-        "repo": "conduwuit",
-        "type": "github"
       }
     },
     "crane": {
@@ -424,6 +419,27 @@
         "type": "github"
       }
     },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": [
@@ -593,11 +609,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732466619,
+        "lastModified": 1736373539,
-        "narHash": "sha256-T1e5oceypZu3Q8vzICjv1X/sGs9XfJRMW5OuXHgpB3c=",
+        "narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f3111f62a23451114433888902a55cf0692b408d",
+        "rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
         "type": "github"
       },
       "original": {
@@ -610,14 +626,14 @@
     "homepage": {
       "inputs": {
         "flake-utils": "flake-utils_6",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1732147487,
+        "lastModified": 1737639979,
-        "narHash": "sha256-RLJfwlKWbKIlpTG0ocVxVl8sONMI/iE9t+viBkbPP8U=",
+        "narHash": "sha256-GP4bOkJMWSp55OpkBmP4VP1S2MUxmXF36fBX6/qxyOw=",
         "ref": "master",
-        "rev": "e5a63ce5af105227df8ed01447919b013cb9a0f2",
+        "rev": "a07048bb01ee5fb12f683366315fd3fde4f15412",
-        "revCount": 23,
+        "revCount": 24,
         "type": "git",
         "url": "https://git.posixlycorrect.com/fabian/homepage.git"
       },
@@ -629,11 +645,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1731242966,
+        "lastModified": 1736688610,
-        "narHash": "sha256-B3C3JLbGw0FtLSWCjBxU961gLNv+BOOBC6WvstKLYMw=",
+        "narHash": "sha256-1Zl9xahw399UiZSJ9Vxs1W4WRFjO1SsNdVZQD4nghz0=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "3ed3f0eaae9fcc0a8331e77e9319c8a4abd8a71a",
+        "rev": "c64bed13b562fc3bb454b48773d4155023ac31b7",
         "type": "github"
       },
       "original": {
@@ -797,7 +813,7 @@
     "nixGL": {
       "inputs": {
         "flake-utils": "flake-utils_7",
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": "nixpkgs_6"
       },
       "locked": {
         "lastModified": 1713543440,
@@ -969,6 +985,22 @@
       }
     },
     "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1720768451,
+        "narHash": "sha256-EYekUHJE2gxeo2pM/zM9Wlqw1Uw2XTJXOSAO79ksc4Y=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7e7c39ea35c5cdd002cd4588b03a3fb9ece6fad9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1719426051,
         "narHash": "sha256-yJL9VYQhaRM7xs0M867ZFxwaONB9T2Q4LnGo1WovuR4=",
@@ -981,7 +1013,7 @@
         "type": "indirect"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_6": {
       "locked": {
         "lastModified": 1660551188,
         "narHash": "sha256-a1LARMMYQ8DPx1BgoI/UN4bXe12hhZkCNqdxNi6uS0g=",
@@ -996,13 +1028,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
       "locked": {
-        "lastModified": 1732824227,
+        "lastModified": 1737299813,
-        "narHash": "sha256-fYNXgpu1AEeLyd3fQt4Ym0tcVP7cdJ8wRoqJ+CtTRyY=",
+        "narHash": "sha256-Qw2PwmkXDK8sPQ5YQ/y/icbQ+TYgbxfjhgnkNJyT1X8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c71ad5c34d51dcbda4c15f44ea4e4aa6bb6ac1e9",
+        "rev": "107d5ef05c0b1119749e381451389eded30fb0d5",
         "type": "github"
       },
       "original": {
@@ -1012,13 +1044,34 @@
         "type": "github"
       }
     },
-    "nur": {
+    "nixpkgs_8": {
       "locked": {
-        "lastModified": 1733015936,
+        "lastModified": 1737062831,
-        "narHash": "sha256-d/wq3j57flyYQ1F3s/B2f0bHCaOKF6d7JTxzfMCGRmw=",
+        "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nur": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_8",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1737464637,
+        "narHash": "sha256-St/dzvMCXfPPZNJME5bi86n4mEuohG9pMKp+a9l5ZqI=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "d711073b26533360c2bc595b4e6a824b873f8e22",
+        "rev": "a44b412c5d24f7bb55d81370501a8f9e6e824ec6",
         "type": "github"
       },
       "original": {
@@ -1045,11 +1098,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1730284601,
+        "lastModified": 1735164664,
-        "narHash": "sha256-eHYcKVLIRRv3J1vjmxurS6HVdGphB53qxUeAkylYrZY=",
+        "narHash": "sha256-DaWy+vo3c4TQ93tfLjUgcpPaSoDw4qV4t76Y3Mhu84I=",
         "owner": "nix-community",
         "repo": "poetry2nix",
-        "rev": "43a898b4d76f7f3f70df77a2cc2d40096bc9d75e",
+        "rev": "1fb01e90771f762655be7e0e805516cd7fa4d58e",
         "type": "github"
       },
       "original": {
@@ -1138,7 +1191,7 @@
         "impermanence": "impermanence",
         "mediawikiSkinCitizen": "mediawikiSkinCitizen",
         "nixGL": "nixGL",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": "nixpkgs_7",
         "nur": "nur",
         "unstable": "unstable",
         "vpsadminos": "vpsadminos"
@@ -1258,13 +1311,34 @@
         "type": "github"
       }
     },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733222881,
+        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
     "unstable": {
       "locked": {
-        "lastModified": 1732837521,
+        "lastModified": 1737062831,
-        "narHash": "sha256-jNRNr49UiuIwaarqijgdTR2qLPifxsVhlJrKzQ8XUIE=",
+        "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "970e93b9f82e2a0f3675757eb0bfc73297cc6370",
+        "rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
         "type": "github"
       },
       "original": {
@@ -1276,11 +1350,11 @@
     },
     "vpsadminos": {
       "locked": {
-        "lastModified": 1732972373,
+        "lastModified": 1737136524,
-        "narHash": "sha256-n1JQ6x5nh7/sgKKe8uWWdrw2pz2tkJm6IRpI5+I1chI=",
+        "narHash": "sha256-wMy7IbQs87VUxJOqRSbfFIdxRRTUBQh8G1L/zwI36vY=",
         "owner": "vpsfreecz",
         "repo": "vpsadminos",
-        "rev": "adea302cd4033be844cd033d30bc552270025331",
+        "rev": "0af10d77ca146293b2ed19d5dcfd98474f1fc285",
         "type": "github"
       },
       "original": {

flake.nix

@@ -17,12 +17,6 @@
 
     homepage.url = "git+https://git.posixlycorrect.com/fabian/homepage.git?ref=master";
 
-    conduwuit = {
-      url = "github:girlbossceo/conduwuit?ref=v0.4.5";
-      #FIXME: Podrá volver a "nixpkgs" una vez que rocksdb.enableLiburing llegue a stable
-      inputs.nixpkgs.follows = "unstable";
-    };
-
     authentik-nix = {
       url = "github:nix-community/authentik-nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -59,7 +53,7 @@
         config = import ./pkgs/config nixpkgs.lib;
         overlays = [
           self.overlays.default
-          nur.overlay
+          nur.overlays.default
           nixGL.overlay
         ];
       };

home/modules/baseline.nix

@@ -11,7 +11,9 @@ in {
     enable = mkEnableOption "Basic home settings";
   };
   config = mkIf cfg.enable {
-    xdg.enable = true;
+    xdg = {
+      enable = true;
+    };
 
     home = {
       stateVersion = "24.05"; # DO NOT CHANGE
@@ -24,6 +26,7 @@ in {
         killall
         man-pages
         man-pages-posix
+        pv
         tree
         units
         unzip

home/modules/browsers.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.local.apps.browsers;
-in {
-  options.local.apps.browsers = {
-    enable = mkEnableOption "Browser home settings";
-  };
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      chromium
-      firefox
-    ];
-  };
-}

home/modules/deepState.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.services.deepState;
+in {
+  options.local.services.deepState.enable = mkEnableOption "trivionomicon settings";
+  config =
+    mkIf cfg.enable {
+      home.sessionVariables = {
+        FSOCIETY_TELEGRAM_BACKUP_N = "0";
+        FSOCIETY_TELEGRAM_BACKUP_LOCATION = "/extern/var/fsociety_backup";
+      };
+    };
+}

home/modules/default.nix

@@ -8,13 +8,15 @@
     ./terminal
     ./neovim.nix
     ./baseline.nix
-    ./gaming
+    ./gaming.nix
     ./yubikey.nix
-    ./browsers.nix
+    ./firefox.nix
     ./gui
     ./zsh
     ./gpg.nix
     ./defaultDesktopPack.nix
     ./accounts.nix
+    ./syncthing.nix
+    ./deepState.nix
   ];
 }

home/modules/defaultDesktopPack.nix

@@ -13,6 +13,7 @@ in {
   config = mkIf cfg.enable {
     home.packages = with pkgs; [
       calibre
+      chromium
       discord
       gwenview
       libreoffice-fresh
@@ -28,7 +29,6 @@ in {
       vpsfree-client
       vscodium-fhs
       zola
-      zoom-us
     ];
   };
 }

home/modules/firefox.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.apps.firefox;
+in {
+  options.local.apps.firefox = {
+    enable = mkEnableOption "firefox settings";
+
+    workspace = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        i3 Workspace in which Firefox should open. If not set, Firefox will not open at startup
+      '';
+    };
+
+    makeDefaultBrowser = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Take a guess
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      programs.firefox.enable = true;
+
+      xsession.windowManager.i3.config.startup = optional (cfg.workspace != null) {
+        command = "${lib.getExe pkgs.i3-gaps} 'workspace ${cfg.workspace}; exec ${lib.getExe pkgs.firefox}'";
+      };
+    }
+
+    (mkIf cfg.makeDefaultBrowser {
+      xdg = {
+        mimeApps = {
+          enable = true;
+          defaultApplications = {
+            "text/html" = ["firefox"];
+            "text/uri-list" = ["firefox"];
+            "x-scheme-handler/http" = ["firefox"];
+            "x-scheme-handler/https" = ["firefox"];
+            "x-scheme-handler/about" = ["firefox"];
+            "x-scheme-handler/unknown" = ["firefox"];
+          };
+        };
+      };
+
+      home.sessionVariables.DEFAULT_BROWSER = "${lib.getExe pkgs.firefox}";
+    })
+  ]);
+}

home/modules/gaming.nix

@@ -12,11 +12,6 @@ in {
   };
   config = mkIf cfg.enable {
     home.packages = [
-      # Steam. todo: move to the steam module later
-      (pkgs.callPackage ./package.nix {})
-      pkgs.protonup
-      pkgs.winetricks
-      pkgs.protontricks
       pkgs.lutris
       pkgs.openrct2
       pkgs.prismlauncher

home/modules/gaming/package.nix

@@ -1,9 +0,0 @@
-{
-  writeShellScriptBin,
-  steam-run,
-  steam,
-  ...
-}:
-writeShellScriptBin "steam" ''
-  exec ${steam-run}/bin/steam-run ${steam}/bin/steam -console
-''

home/modules/gui/default.nix

@@ -81,8 +81,9 @@ in {
     ./fonts.nix
     ./i3.nix
     ./polybar.nix
-    ./startx.nix # move to ly once 24.11 comes out :(
+    ./startx.nix
     ./picom.nix
+    ./theme.nix
   ];
 
   config = let
@@ -112,5 +113,16 @@ in {
         polybar.enable = true;
         picom.enable = true;
       };
+
+      xdg = {
+        enable = true;
+        mimeApps = {
+          enable = true;
+          defaultApplications = {
+            "application/pdf" = with pkgs; ["qpdfview"];
+            "x-scheme-handler/file" = with pkgs; ["kitty"];
+          };
+        };
+      };
     };
 }

home/modules/gui/gtk.nix

@@ -1,11 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  home.packages = with pkgs; [
-    gruvbox-dark-icons-gtk
-    libsForQt5.breeze-gtk
-  ];
-}

home/modules/gui/i3.nix

@@ -26,8 +26,11 @@ with lib; {
 
       window = {
         hideEdgeBorders = "both";
+        titlebar = false;
       };
 
+      workspaceLayout = "tabbed";
+
       colors = {
         focused = {
           background = "#222222";
@@ -42,45 +45,43 @@ with lib; {
       # y se sobreescriba las cosas que pongo acá
       # NO QUITARLO. ver man home-configuration.nix
       keybindings = mkOptionDefault {
-        "${mod}+Return" = "exec ${pkgs.kitty}/bin/kitty ${pkgs.tmux}/bin/tmux";
+        "${mod}+Return" = "exec ${lib.getExe pkgs.kitty} ${lib.getExe pkgs.tmux}";
         "${mod}+Tab" = "focus right";
         "${mod}+Shift+Tab" = "focus left";
-        "${mod}+Shift+s" = "exec ${pkgs.maim}/bin/maim -s -u | ${pkgs.xclip}/bin/xclip -selection clipboard -t image/png -i";
+        "${mod}+Shift+s" = "exec ${lib.getExe pkgs.maim} -s -u | ${lib.getExe pkgs.xclip} -selection clipboard -t image/png -i";
         "${mod}+Shift+w" = "move workspace to output right";
-        "${mod}+l" = "exec ${pkgs.betterlockscreen}/bin/betterlockscreen -l";
+        "${mod}+l" = "exec ${lib.getExe pkgs.betterlockscreen} -l";
       };
 
       startup = [
         {
-          command = "${pkgs.xss-lock}/bin/xss-lock --transfer-sleep-lock -- ${pkgs.i3lock}/bin/i3lock --nofork";
+          command = "${lib.getExe pkgs.xss-lock} --transfer-sleep-lock -- ${lib.getExe pkgs.i3lock} --nofork";
           notification = false;
         }
         {
-          command = "${pkgs.networkmanagerapplet}/bin/nm-applet";
+          command = "${lib.getExe pkgs.networkmanagerapplet}";
           notification = false;
         }
-        # sería nice hostear esta imagen en el server y fetchearla si no existe
+        #todo: sería nice hostear esta imagen en el server y fetchearla si no existe
         {
-          command = "${pkgs.feh}/bin/feh --bg-fill ${config.home.homeDirectory}/Pictures/wallpapers/jupiter.png";
+          command = "${lib.getExe pkgs.feh} --bg-fill ${config.home.homeDirectory}/Pictures/wallpapers/jupiter.png";
           notification = false;
           always = true;
         }
         {
-          command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 1; exec ${pkgs.firefox}/bin/firefox'";
+          #todo: move this to telegram module
+          command = "${lib.getExe pkgs.i3-gaps} 'workspace 2; exec ${lib.getExe pkgs.tdesktop}'";
         }
         {
-          command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 2; exec ${pkgs.tdesktop}/bin/telegram-desktop'";
+          command = "${lib.getExe pkgs.i3-gaps} 'workspace 2; exec ${lib.getExe pkgs.gajim}'";
         }
-        #{
-        #  command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 2; exec ${pkgs.element-desktop}/bin/element-desktop'";
-        #}
         {
           command = "${pkgs.systemd}/bin/systemctl --user restart polybar.service";
           notification = false;
           always = true;
         }
         {
-          command = "${pkgs.autorandr}/bin/autorandr -c";
+          command = "${lib.getExe pkgs.autorandr} -c";
           notification = false;
           always = true;
         }

home/modules/gui/theme.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  gtk = {
+    enable = true;
+
+    iconTheme = {
+      name = "Papirus-Dark";
+      package = pkgs.papirus-icon-theme;
+    };
+    theme = {
+      package = pkgs.materia-theme;
+      name = "Materia-dark";
+    };
+
+    gtk2.extraConfig = ''
+      gtk-toolbar-style=GTK_TOOLBAR_BOTH_HORIZ
+      gtk-menu-images=1
+      gtk-button-images=1
+    '';
+
+    gtk3.extraConfig = {
+      gtk-application-prefer-dark-theme = 1;
+    };
+    gtk4.extraConfig = {
+      gtk-application-prefer-dark-theme = 1;
+    };
+  };
+
+  home.sessionVariables = {
+    # Use gtk in jvm apps
+    _JAVA_OPTIONS = concatStringsSep " " [
+      "-Dawt.useSystemAAFontSettings=on"
+      "-Dswing.aatext=true"
+      "-Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
+      "-Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
+    ];
+  };
+}

home/modules/syncthing.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.services.syncthing;
+in {
+  options.local.services.syncthing = {
+    enable = mkEnableOption "syncthing settings";
+  };
+
+  config = mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+      tray.enable = true;
+    };
+  };
+}

home/platforms/fabian@posixlycorrect/default.nix

@@ -29,10 +29,12 @@
         prompt = "%B[%~] \${vcs_info_msg_0_}%b";
       };
       accounts.enable = true;
+      deepState.enable = true;
       gpg = {
         enable = true;
         defaultKey = "7AA277E604A4173916BBB4E91FFAC35E1798174F";
       };
+      syncthing.enable = true;
     };
 
     apps = {
@@ -40,8 +42,11 @@
       neovim.enable = true;
       gaming.enable = true;
       yubikey.enable = true;
-      browsers.enable = true;
       defaultDesktopPack.enable = true;
+      firefox = {
+        enable = true;
+        workspace = "1"; #make this an int later
+      };
     };
 
     gui = {
@@ -70,7 +75,18 @@
     packages = with pkgs; [
       darktable
       deluge
+      (gajim.override {
+        enableSecrets = true;
+        # enableJingle = true;
+        # enableSpelling = true;
+        enableUPnP = true;
+        # enableAppIndicator = true;
+        enableE2E = true;
+        enableRST = true;
+      })
+      gnucash
       kdenlive
+      nmap
       virt-manager
     ];
 

pkgs/config/unfree.nix

@@ -8,5 +8,4 @@ with lib;
     "steam-original"
     "steam-unwrapped"
     "steam-run"
-    "zoom"
   ]

sys/modules/default.nix

@@ -13,5 +13,7 @@
     ./android.nix
     ./users.nix
     ./bluetooth.nix
+    ./net.nix
+    ./steam.nix
   ];
 }

sys/modules/net.nix

@@ -0,0 +1,186 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  options.local.sys.nets = with lib.types;
+    mkOption {
+      readOnly = true;
+
+      type = attrsOf (submodule ({config, ...}: {
+        options = let
+          v4config = config.v4;
+          v6config = config.v6;
+        in {
+          hosts = mkOption {
+            default = {};
+
+            type = attrsOf (submodule {
+              options = {
+                v4 = mkOption {
+                  default = null;
+
+                  type = nullOr (submodule ({config, ...}: {
+                    options = {
+                      suffix = mkOption {
+                        type = str;
+                      };
+
+                      address = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      cidr = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      single = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+                    };
+
+                    config = {
+                      address =
+                        if v4config.bits == 0
+                        then config.suffix
+                        else if v4config.bits == 32
+                        then v4config.subnet
+                        else "${v4config.prefix}.${config.suffix}";
+
+                      cidr = "${config.address}/${toString v4config.bits}";
+                      single = "${config.address}/32";
+                    };
+                  }));
+                };
+
+                v6 = mkOption {
+                  default = null;
+
+                  type = nullOr (submodule ({config, ...}: {
+                    options = {
+                      suffix = mkOption {
+                        type = str;
+                      };
+
+                      address = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      cidr = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      single = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+                    };
+
+                    config = {
+                      address = let
+                        hextets = fragment: length (splitString ":" fragment);
+                        separator =
+                          if doubleColon
+                          then "::"
+                          else ":";
+                        doubleColon = hextets v6config.prefix + hextets config.suffix < 8;
+
+                        joined =
+                          if v6config.bits == 128
+                          then v6config.prefix
+                          else if v6config.bits == 0
+                          then config.suffix
+                          else "${v6config.prefix}${separator}${config.suffix}";
+                      in
+                        joined;
+
+                      cidr = "${config.address}/${toString v6config.bits}";
+                      single = "${config.address}/128";
+                    };
+                  }));
+                };
+              };
+            });
+          };
+
+          v4 = mkOption {
+            default = null;
+
+            type = nullOr (submodule ({config, ...}: {
+              options = {
+                bits = mkOption {
+                  type = enum [0 8 16 24 32];
+                };
+
+                prefix = mkOption {
+                  type = str;
+                };
+
+                subnet = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+
+                cidr = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+              };
+
+              config = {
+                cidr = "${config.subnet}/${toString config.bits}";
+                subnet =
+                  if config.bits != 0
+                  then config.prefix + strings.replicate (4 - config.bits / 8) ".0"
+                  else "0.0.0.0";
+              };
+            }));
+          };
+
+          v6 = mkOption {
+            default = null;
+
+            type = nullOr (submodule ({config, ...}: {
+              options = {
+                bits = mkOption {
+                  type =
+                    addCheck (ints.between 0 128) (b: mod b 4 == 0)
+                    // {
+                      description = "IPv6 subnet bits at nibble boundary";
+                    };
+                };
+
+                prefix = mkOption {
+                  type = str;
+                };
+
+                subnet = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+
+                cidr = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+              };
+
+              config = {
+                cidr = "${config.subnet}/${toString config.bits}";
+                subnet =
+                  if config.bits == 128 || length (splitString "::" config.prefix) > 1
+                  then config.prefix
+                  else "${config.prefix}::";
+              };
+            }));
+          };
+        };
+      }));
+    };
+}

sys/modules/steam.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.sys.steam;
+in {
+  options.local.sys.steam = {
+    enable = mkEnableOption "steam settings";
+  };
+  config = mkIf cfg.enable {
+    programs.steam = {
+      enable = true;
+      remotePlay.openFirewall = true;
+      dedicatedServer.openFirewall = true;
+      localNetworkGameTransfers.openFirewall = true;
+    };
+
+    environment = {
+      systemPackages = with pkgs; [
+        protontricks
+        protonup
+        protonup-ng
+        winetricks
+      ];
+    };
+  };
+}

sys/platforms/posixlycorrect/default.nix

@@ -19,6 +19,7 @@
     graphics.enable = true;
     virtualisation.enable = true;
     androidSupport.enable = true;
+    steam.enable = true;
 
     users = {
       fabian = {

sys/platforms/vps/default.nix

@@ -13,6 +13,7 @@ with lib; {
     flakes.impermanence.nixosModule
     ./hardware-configuration.nix
     ./srv
+    ./networkMap.nix
   ];
 
   local.sys = {
@@ -24,12 +25,17 @@ with lib; {
     };
   };
 
-  networking.hostName = "vps";
+  networking = {
+    hostName = "vps";
+    domain = "posixlycorrect.com";
+  };
 
   services.openssh = {
     settings.PasswordAuthentication = false;
   };
 
+  programs.mosh.enable = true;
+
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;
@@ -45,9 +51,67 @@ with lib; {
     };
   };
 
-  systemd.extraConfig = ''
+  networking.firewall.allowedUDPPorts = [51820]; #TODO
+
+  systemd = {
+    extraConfig = ''
       DefaultTimeoutStartSec=900s
     '';
 
+    network = let
+      inherit (config.local.sys) nets;
+    in {
+      enable = true;
+
+      netdevs = {
+        wg-vpn = {
+          netdevConfig = {
+            Name = "wg-vpn";
+            Kind = "wireguard";
+          };
+
+          wireguardConfig = {
+            PrivateKeyFile = "/var/trust/wg/vpn/key.priv";
+            ListenPort = "51820";
+          };
+
+          wireguardPeers = [
+            {
+              PublicKey = "wwUp3Uu/rSxbp+6J745O+cpnZHGWOJYWfWEsTjRE3yU=";
+              PresharedKeyFile = "/var/trust/wg/vpn/vps-posixlycorrect.psk";
+              AllowedIPs = ["${nets.vpn-posixlycorrect.v6.cidr}"];
+            }
+            {
+              PublicKey = "YFqg/ED26KygSRSmGzvUXpwnXPqMOI3R3caVfAtHVks=";
+              PresharedKeyFile = "/var/trust/wg/vpn/vps-pixel8.psk";
+              AllowedIPs = ["${nets.vpn-pixel8.v6.cidr}"];
+            }
+          ];
+        };
+      };
+
+      networks = {
+        wg-vpn = {
+          name = "wg-vpn";
+
+          networkConfig = {
+            Address = [
+              nets.vpn-vps.hosts.vps.v6.cidr
+            ];
+          };
+
+          routes = [
+            {
+              Destination = nets.vpn.v6.cidr;
+            }
+            {
+              Source = nets.vpn.v6.cidr;
+            }
+          ];
+        };
+      };
+    };
+  };
+
   time.timeZone = "Europe/Amsterdam";
 }

sys/platforms/vps/hardware-configuration.nix

@@ -14,10 +14,16 @@ in {
       options = ["nofail" "noatime"];
     };
 
-    "/mnt/export2011" = {
+    "/mnt/export2178" = {
-      device = "172.16.129.151:/nas/5876/bepasty";
+      device = "172.16.129.151:/nas/5876/immich";
       fsType = "nfs";
-      options = ["nofail" "noatime" "noexec"];
+      options = ["nofail" "noatime"];
+    };
+
+    "/mnt/export2179" = {
+      device = "172.16.131.31:/nas/5876/syncthing";
+      fsType = "nfs";
+      options = ["nofail"];
     };
   };
 }

sys/platforms/vps/networkMap.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  lib,
+  flakes,
+  ...
+}:
+with lib; {
+  local.sys.nets = {
+    default = {
+      v4 = {
+        bits = 32;
+        prefix = "37.205.12.34";
+      };
+
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:fe:102";
+      };
+
+      hosts = {
+        vps.v6.suffix = "1";
+        vps.v4.suffix = "";
+      };
+    };
+
+    vpn = {
+      v6 = {
+        bits = 48;
+        prefix = "2a03:3b40:2b";
+      };
+    };
+
+    vpn-vps = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1000";
+      };
+
+      hosts = {
+        vps.v6.suffix = "1";
+      };
+    };
+
+    vpn-posixlycorrect = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1001";
+      };
+
+      hosts = {
+        posixlycorrect.v6.suffix = "1";
+      };
+    };
+
+    vpn-pixel8 = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1002";
+      };
+
+      hosts = {
+        pixel8.v6.suffix = "1";
+      };
+    };
+
+    vpn-t14 = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1003";
+      };
+
+      hosts = {
+        t14.v6.suffix = "1";
+      };
+    };
+  };
+}

sys/platforms/vps/srv/authentik.nix

@@ -1,110 +0,0 @@
-{
-  lib,
-  pkgs,
-  flakes,
-  ...
-}:
-with lib; {
-  imports = [flakes.authentik-nix.nixosModules.default];
-
-  options = {
-    services.nginx.virtualHosts = mkOption {
-      type = with lib.types;
-        attrsOf (
-          submodule
-          (
-            {config, ...}: {
-              options = {
-                enableAuthentik = mkOption {
-                  default = false;
-                  type = bool;
-                };
-                locations = mkOption {
-                  type = attrsOf (
-                    submodule {
-                      config = mkIf config.enableAuthentik {
-                        extraConfig = ''
-                          auth_request        /outpost.goauthentik.io/auth/nginx;
-                          error_page          401 = @goauthentik_proxy_signin;
-                          auth_request_set $auth_cookie $upstream_http_set_cookie;
-                          add_header Set-Cookie $auth_cookie;
-
-                          # translate headers from the outposts back to the actual upstream
-                          auth_request_set $authentik_username $upstream_http_x_authentik_username;
-                          auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
-                          auth_request_set $authentik_email $upstream_http_x_authentik_email;
-                          auth_request_set $authentik_name $upstream_http_x_authentik_name;
-                          auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
-
-                          proxy_set_header X-authentik-username $authentik_username;
-                          proxy_set_header X-authentik-groups $authentik_groups;
-                          proxy_set_header X-authentik-email $authentik_email;
-                          proxy_set_header X-authentik-name $authentik_name;
-                          proxy_set_header X-authentik-uid $authentik_uid;
-                        '';
-                      };
-                    }
-                  );
-                };
-              };
-              config = mkIf config.enableAuthentik {
-                extraConfig = ''
-                  proxy_buffers 8 16k;
-                  proxy_buffer_size 32k;
-
-                  location /outpost.goauthentik.io {
-                    proxy_pass          http://localhost:9000/outpost.goauthentik.io;
-                    # ensure the host of this vserver matches your external URL you've configured
-                    # in authentik
-                    proxy_set_header    Host $host;
-                    proxy_redirect      http://localhost:9000 https://auth.posixlycorrect.com;
-                    proxy_set_header    X-Original-URL $scheme://$http_host$request_uri;
-                    add_header          Set-Cookie $auth_cookie;
-                    auth_request_set    $auth_cookie $upstream_http_set_cookie;
-
-                    # required for POST requests to work
-                    proxy_pass_request_body off;
-                    proxy_set_header Content-Length "";
-                  }
-
-                  location @goauthentik_proxy_signin {
-                    internal;
-                    add_header Set-Cookie $auth_cookie;
-                    return 302 /outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
-                    # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
-                    # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
-                  }
-                '';
-              };
-            }
-          )
-        );
-    };
-  };
-
-  config = {
-    services = {
-      authentik = {
-        enable = true;
-        environmentFile = "/var/trust/authentik/authentik-env";
-        nginx = {
-          enable = true;
-          enableACME = true;
-          host = "auth.posixlycorrect.com";
-        };
-        settings = {
-          email = {
-            host = "smtp.fastmail.com";
-            port = 587;
-            username = "fabianmontero@fastmail.com";
-            use_tls = true;
-            use_ssl = false;
-            from = "auth@posixlycorrect.com";
-          };
-          disable_startup_analytics = true;
-          avatars = "initials";
-        };
-      };
-    };
-  };
-}

sys/platforms/vps/srv/bepasty.nix

@@ -1,40 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  services = {
-    nginx = {
-      virtualHosts."send.posixlycorrect.com" = {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          proxy_headers_hash_max_size 512;
-          proxy_headers_hash_bucket_size 128;
-        '';
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:8989";
-        };
-      };
-    };
-
-    bepasty = {
-      enable = true;
-      servers = {
-        "send" = {
-          bind = "127.0.0.1:8989";
-          secretKeyFile = "/var/trust/bepasty/secretKeyFile";
-          dataDir = "/mnt/export2011/data";
-          defaultPermissions = "read,create,delete";
-          extraConfig = ''
-            SITENAME = 'send.posixlycorrect.com'
-            MAX_ALLOWED_FILE_SIZE = 4 * 1000 * 1000 * 1000
-            SESSION_COOKIE_SECURE = True
-            ASCIINEMA_THEME = 'asciinema'
-          '';
-        };
-      };
-    };
-  };
-}

sys/platforms/vps/srv/calibre-web.nix

@@ -6,7 +6,7 @@
 with lib; {
   services = {
     nginx = {
-      virtualHosts."stream.posixlycorrect.com" = {
+      virtualHosts."calibre.posixlycorrect.com" = {
         enableACME = true;
         forceSSL = true;
         extraConfig = ''
@@ -14,17 +14,18 @@ with lib; {
           proxy_headers_hash_bucket_size 128;
         '';
         locations."/" = {
-          proxyPass = "http://localhost:8096";
+          proxyPass = "http://[::1]:8083";
         };
       };
     };
 
-    jellyfin = {
+    calibre-web = {
       enable = true;
-      user = "jellyfin";
+      openFirewall = true;
-      group = "jellyfin";
+      options = {
-      dataDir = "/mnt/export2008/jellyfin/dataDir";
+        enableBookUploading = true;
-      cacheDir = "/mnt/export2008/jellyfin/cacheDir";
+        calibreLibrary = "/var/lib/calibre-web/calibre_library";
+      };
     };
   };
 }

sys/platforms/vps/srv/default.nix

@@ -9,18 +9,16 @@ with lib; {
   imports = [
     ./net.nix
     ./mediawiki.nix
-    # ./jitsi.nix
-    # ./matrix.nix currently not being used
     ./forgejo.nix
     ./vaultwarden.nix
-    # ./bepasty.nix
-    # ./jellyfin.nix
     ./msmtp.nix
-    ./kuma.nix
-    # ./authentik.nix  consumes too much RAM and serves no purpose for now
     ./paperless.nix
     ./trilium.nix
-    # ./firefly.nix gnucash is better
+    ./syncthing.nix
-    ./roundcube.nix
+    ./shiori.nix
+    ./calibre-web.nix
+    ./immich.nix
+    ./wiki-js.nix
+    ./mealie.nix
   ];
 }

sys/platforms/vps/srv/firefly.nix

@@ -1,33 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  services = {
-    nginx = {
-      virtualHosts."firefly.posixlycorrect.com" = {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          proxy_headers_hash_max_size 512;
-          proxy_headers_hash_bucket_size 128;
-        '';
-      };
-    };
-
-    firefly-iii = {
-      enable = true;
-      user = "firefly-iii";
-      dataDir = "/var/lib/firefly-iii";
-      enableNginx = true;
-      virtualHost = "firefly.posixlycorrect.com";
-      settings = {
-        SITE_OWNER = "fabian@posixlycorrect.com";
-        DB_CONNECTION = "sqlite";
-        APP_ENV = "local";
-        APP_KEY_FILE = "/var/trust/firefly/key_file";
-      };
-    };
-  };
-}

sys/platforms/vps/srv/forgejo.nix

@@ -47,12 +47,10 @@ with lib; {
             LANDING_PAGE = "explore";
           };
 
-          # You can temporarily allow registration to create an admin user.
           service.DISABLE_REGISTRATION = true;
 
-          # ver https://github.com/nektos/act
           actions = {
-            ENABLED = false;
+            ENABLED = true;
           };
           mailer = {
             ENABLED = false;

sys/platforms/vps/srv/immich.nix

@@ -0,0 +1,73 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  services = {
+    nginx = {
+      virtualHosts."photos.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://localhost:2283";
+        };
+      };
+    };
+
+    immich = {
+      enable = true;
+      secretsFile = "/var/trust/immich/secrets.txt";
+      openFirewall = true;
+      mediaLocation = "/mnt/export2178/immich/media";
+      machine-learning.enable = false;
+      environment = {
+        IMMICH_TELEMETRY_EXCLUDE = "host,api,io,repo,job";
+      };
+      settings = {
+        machineLearning = {
+          enabled = false;
+        };
+        job = {
+          backgroundTask = {
+            concurrency = 1;
+          };
+          smartSearch = {
+            concurrency = 1;
+          };
+          metadataExtraction = {
+            concurrency = 1;
+          };
+          faceDetection = {
+            concurrency = 1;
+          };
+          search = {
+            concurrency = 1;
+          };
+          sidecar = {
+            concurrency = 1;
+          };
+          library = {
+            concurrency = 1;
+          };
+          migration = {
+            concurrency = 1;
+          };
+          thumbnailGeneration = {
+            concurrency = 1;
+          };
+          videoConversion = {
+            concurrency = 1;
+          };
+          notifications = {
+            concurrency = 1;
+          };
+        };
+      };
+    };
+  };
+}

sys/platforms/vps/srv/jitsi.nix

@@ -1,35 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  services = {
-    nginx = {
-      virtualHosts."meet.posixlycorrect.com" = {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          proxy_headers_hash_max_size 512;
-          proxy_headers_hash_bucket_size 128;
-        '';
-      };
-    };
-
-    jitsi-meet = {
-      enable = true;
-      hostName = "meet.posixlycorrect.com";
-      nginx.enable = true;
-      config = {
-        enableWelcomePage = true;
-        prejoinPageEnabled = true;
-        defaultLang = "en";
-      };
-      interfaceConfig = {
-        SHOW_JITSI_WATERMARK = false;
-        SHOW_WATERMARK_FOR_GUESTS = false;
-      };
-    };
-    jitsi-videobridge.openFirewall = true;
-  };
-}

sys/platforms/vps/srv/matrix.nix

@@ -1,58 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  flakes,
-  ...
-}:
-with lib; let
-  subdomain = "matrix.posixlycorrect.com";
-  baseUrl = "https://${subdomain}";
-in {
-  # ver https://nixos.org/manual/nixos/stable/#module-services-matrix
-  services = {
-    matrix-conduit = {
-      enable = true;
-      package = flakes.conduwuit.packages.${pkgs.system}.default;
-      settings.global = {
-        address = "::1";
-        port = 6167;
-        allow_encryption = true;
-        allow_federation = true;
-        allow_registration = false;
-        database_backend = "rocksdb";
-        server_name = "posixlycorrect.com";
-        allow_check_for_updates = true;
-        new_user_displayname_suffix = "";
-      };
-    };
-
-    nginx.virtualHosts = let
-      clientConfig."m.homeserver".base_url = baseUrl;
-      serverConfig."m.server" = "${subdomain}:443";
-      mkWellKnown = data: ''
-        default_type application/json;
-        add_header Access-Control-Allow-Origin *;
-        return 200 '${builtins.toJSON data}';
-      '';
-    in {
-      "posixlycorrect.com" = {
-        locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
-        locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
-      };
-      "${subdomain}" = {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          proxy_headers_hash_max_size 512;
-          proxy_headers_hash_bucket_size 128;
-        '';
-        locations."/".extraConfig = ''
-          return 403;
-        '';
-        locations."/_matrix".proxyPass = "http://[::1]:6167";
-        locations."/_synapse/client".proxyPass = "http://[::1]:6167";
-      };
-    };
-  };
-}

sys/platforms/vps/srv/mealie.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  systemd.services.wiki-js = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
+
+  services = {
+    nginx = {
+      virtualHosts."food.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:9000";
+        };
+      };
+    };
+
+    mealie = {
+      enable = true;
+      listenAddress = "127.0.0.1";
+      port = 9000;
+      credentialsFile = "/var/trust/mealie/credentials.env";
+      settings = {
+        ALLOW_SIGNUP = "false";
+      };
+    };
+  };
+}

sys/platforms/vps/srv/mediawiki.nix

@@ -65,12 +65,6 @@ with lib; {
         SecureLinkFixer = null;
         WikiEditor = null;
         ParserFunctions = null;
-
-        TemplateStyles = pkgs.fetchzip {
-          url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/TemplateStyles/+archive/refs/heads/wmf/1.44.0-wmf.5.tar.gz";
-          sha256 = "sha256-Mb8svP8zt4d1U/NHd9Dd2oUe/SksB/zKYGNYdpmrRfc=";
-          stripRoot = false;
-        };
       };
     };
   };

sys/platforms/vps/srv/net.nix

@@ -1,11 +1,14 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
-with lib; {
+with lib; let
+  inherit (config.local.sys) nets;
+in {
   networking = {
-    nftables.enable = true;
+    nftables.enable = false; # learn how to use this later
     firewall = {
       enable = true;
       allowedTCPPorts = [80 443];
@@ -49,10 +52,15 @@ with lib; {
         };
       };
     };
+
     fail2ban = {
       enable = true;
       bantime = "10m";
-      ignoreIP = ["37.205.12.34"]; # Never ban the server's own IP
+      ignoreIP = [
+        nets.default.hosts.vps.v6.cidr
+        nets.default.hosts.vps.v4.address
+        nets.vpn.v6.cidr
+      ];
       bantime-increment = {
         enable = true;
         formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";

sys/platforms/vps/srv/roundcube.nix

@@ -1,62 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  services = {
-    nginx = {
-      virtualHosts."mail.posixlycorrect.com" = {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          proxy_headers_hash_max_size 512;
-          proxy_headers_hash_bucket_size 128;
-        '';
-      };
-    };
-
-    roundcube = {
-      enable = true;
-      hostName = "mail.posixlycorrect.com";
-      configureNginx = true;
-      maxAttachmentSize = 2048; #MB
-      package = pkgs.roundcube.withPlugins (plugins: [
-        #plugins.carddav
-        plugins.contextmenu
-        plugins.custom_from
-        plugins.persistent_login
-      ]);
-      plugins = [
-        "archive"
-        "attachment_reminder"
-        #"carddav"
-        "contextmenu"
-        "custom_from"
-        "emoticons"
-        #"enigma"
-        "hide_blockquote"
-        "managesieve"
-        "markasjunk"
-        "newmail_notifier"
-        "password"
-        "persistent_login"
-        "reconnect"
-        "show_additional_headers"
-        "userinfo"
-        "vcard_attachments"
-        "zipdownload"
-      ];
-      dicts = with pkgs.aspellDicts; [
-        es
-        en
-      ];
-      extraConfig = ''
-        $config['smtp_host'] = "ssl://smtp.fastmail.com:465";
-        $config['smtp_user'] = "%u";
-        $config['smtp_pass'] = "%p";
-        $config['imap_host'] = "ssl://imap.fastmail.com:993";
-      '';
-    };
-  };
-}

sys/platforms/vps/srv/shiori.nix

@@ -6,7 +6,7 @@
 with lib; {
   services = {
     nginx = {
-      virtualHosts."status.posixlycorrect.com" = {
+      virtualHosts."bookmarks.posixlycorrect.com" = {
         enableACME = true;
         forceSSL = true;
         extraConfig = ''
@@ -14,16 +14,16 @@ with lib; {
           proxy_headers_hash_bucket_size 128;
         '';
         locations."/" = {
-          proxyPass = "http://127.0.0.1:4456";
+          proxyPass = "http://127.0.0.1:8089";
         };
       };
     };
-    uptime-kuma = {
+
+    shiori = {
       enable = true;
-      settings = {
+      address = "127.0.0.1";
-        HOST = "127.0.0.1";
+      port = 8089;
-        PORT = "4456";
+      environmentFile = "/var/trust/shiori/env";
-      };
     };
   };
 }

sys/platforms/vps/srv/syncthing.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  services = {
+    syncthing = {
+      enable = true;
+      systemService = true;
+      overrideFolders = false;
+      overrideDevices = false;
+      openDefaultPorts = true;
+      guiAddress = "127.0.0.1:8384";
+      settings.options.urAccepted = -1;
+      dataDir = "/mnt/export2179/syncthing";
+      relay = {
+        enable = true;
+        pools = [];
+        providedBy = "vps.posixlycorrect.com";
+      };
+    };
+  };
+
+  # calibre web stuff. make this better someday, this is pure duct-tape
+  users.groups."calybresync".members = ["syncthing" "calibre-web"];
+  systemd = {
+    services."calybreown" = {
+      script = ''
+        chgrp -R calybresync /var/lib/calibre-web/calibre_library
+        chmod -R g+w /var/lib/calibre-web/calibre_library
+      '';
+      serviceConfig.Type = "oneshot";
+    };
+    timers."calybreown" = {
+      wantedBy = [
+        "timers.target"
+      ];
+      timerConfig.OnCalendar = "*-*-* *:00/30:00";
+    };
+  };
+}

sys/platforms/vps/srv/trilium.nix

@@ -18,6 +18,7 @@ with lib; {
 
     trilium-server = {
       enable = true;
+      package = pkgs.trilium-next-server;
       host = "127.0.0.1";
       port = 8458;
       noAuthentication = false;

sys/platforms/vps/srv/wiki-js.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  systemd.services.wiki-js = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
+
+  services = {
+    nginx = {
+      virtualHosts."wjs.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:3000";
+        };
+      };
+    };
+
+    wiki-js = {
+      enable = true;
+      environmentFile = "/var/trust/wiki-js/env.txt";
+      settings = {
+        bindIP = "127.0.0.1";
+        port = 3000;
+        db = {
+          db = "wiki-js";
+          user = "wiki-js";
+          type = "postgres";
+          host = "/run/postgresql";
+        };
+      };
+    };
+
+    postgresql = {
+      enable = true;
+      ensureDatabases = ["wiki-js"];
+      ensureUsers = [
+        {
+          name = "wiki-js";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+  };
+}