Add languagetool

Add outline service
Add memos service
2025-08-16 19:04:10 -07:00 · 2025-08-10 20:49:50 -07:00 · 2025-08-10 19:03:35 -07:00 · 2025-08-10 19:02:47 -07:00 · 2025-08-10 15:18:29 -07:00 · 2025-08-10 15:17:52 -07:00
69 changed files with 1129 additions and 9888 deletions
--- a/12
+++ b/12
@ -24,4 +24,14 @@ clean-old-nixos-profiles:
 # Garbage Collect
 .PHONY: gc
 gc:
-	nix store gc
+	nix store gc
+
+# Update a flake input by name (ex: 'nixpkgs')
+.PHONY: update-input
+update-input:
+	nix flake update $(filter-out $@,$(MAKECMDGOALS))
+
+# Build Custom Install ISO
+.PHONY: iso
+iso:
+	nix build .#packages.x86_64-linux.iso
--- a/common/binary-cache.nix
+++ b/common/binary-cache.nix
@ -12,6 +12,13 @@
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
      ];
+
+      # Allow substituters to be offline
+      # This isn't exactly ideal since it would be best if I could set up a system
+      # so that it is an error if a derivation isn't available for any substituters
+      # and use this flag as intended for deciding if it should build missing
+      # derivations locally. See https://github.com/NixOS/nix/issues/6901
+      fallback = true;
    };
  };
 }
--- a/common/default.nix
+++ b/common/default.nix
@ -100,7 +100,5 @@
  security.acme.defaults.email = "zuckerberg@neet.dev";

  # Enable Desktop Environment if this is a PC (machine role is "personal")
-  de.enable = (
-    builtins.elem config.networking.hostName config.machines.roles.personal
-  );
+  de.enable = lib.mkDefault (config.thisMachine.hasRole."personal");
 }
--- a/common/machine-info/default.nix
+++ b/common/machine-info/default.nix
@ -5,6 +5,90 @@

 let
  machines = config.machines.hosts;
+
+  hostOptionsSubmoduleType = lib.types.submodule {
+    options = {
+      hostNames = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = ''
+          List of hostnames for this machine. The first one is the default so it is the target of deployments.
+          Used for automatically trusting hosts for ssh connections.
+        '';
+      };
+      arch = lib.mkOption {
+        type = lib.types.enum [ "x86_64-linux" "aarch64-linux" ];
+        description = ''
+          The architecture of this machine.
+        '';
+      };
+      systemRoles = lib.mkOption {
+        type = lib.types.listOf lib.types.str; # TODO: maybe use an enum?
+        description = ''
+          The set of roles this machine holds. Affects secrets available. (TODO add service config as well using this info)
+        '';
+      };
+      hostKey = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          The system ssh host key of this machine. Used for automatically trusting hosts for ssh connections
+          and for decrypting secrets with agenix.
+        '';
+      };
+      remoteUnlock = lib.mkOption {
+        default = null;
+        type = lib.types.nullOr (lib.types.submodule {
+          options = {
+
+            hostKey = lib.mkOption {
+              type = lib.types.str;
+              description = ''
+                The system ssh host key of this machine used for luks boot unlocking only.
+              '';
+            };
+
+            clearnetHost = lib.mkOption {
+              default = null;
+              type = lib.types.nullOr lib.types.str;
+              description = ''
+                The hostname resolvable over clearnet used to luks boot unlock this machine
+              '';
+            };
+
+            onionHost = lib.mkOption {
+              default = null;
+              type = lib.types.nullOr lib.types.str;
+              description = ''
+                The hostname resolvable over tor used to luks boot unlock this machine
+              '';
+            };
+
+          };
+        });
+      };
+      userKeys = lib.mkOption {
+        default = [ ];
+        type = lib.types.listOf lib.types.str;
+        description = ''
+          The list of user keys. Each key here can be used to log into all other systems as `googlebot`.
+
+          TODO: consider auto populating other programs that use ssh keys such as gitea
+        '';
+      };
+      deployKeys = lib.mkOption {
+        default = [ ];
+        type = lib.types.listOf lib.types.str;
+        description = ''
+          The list of deployment keys. Each key here can be used to log into all other systems as `root`.
+        '';
+      };
+      configurationPath = lib.mkOption {
+        type = lib.types.path;
+        description = ''
+          The path to this machine's configuration directory.
+        '';
+      };
+    };
+  };
 in
 {
  imports = [
@ -13,104 +97,16 @@ in
  ];

  options.machines = {
-
    hosts = lib.mkOption {
-      type = lib.types.attrsOf
-        (lib.types.submodule {
-          options = {
-
-            hostNames = lib.mkOption {
-              type = lib.types.listOf lib.types.str;
-              description = ''
-                List of hostnames for this machine. The first one is the default so it is the target of deployments.
-                Used for automatically trusting hosts for ssh connections.
-              '';
-            };
-
-            arch = lib.mkOption {
-              type = lib.types.enum [ "x86_64-linux" "aarch64-linux" ];
-              description = ''
-                The architecture of this machine.
-              '';
-            };
-
-            systemRoles = lib.mkOption {
-              type = lib.types.listOf lib.types.str; # TODO: maybe use an enum?
-              description = ''
-                The set of roles this machine holds. Affects secrets available. (TODO add service config as well using this info)
-              '';
-            };
-
-            hostKey = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                The system ssh host key of this machine. Used for automatically trusting hosts for ssh connections
-                and for decrypting secrets with agenix.
-              '';
-            };
-
-            remoteUnlock = lib.mkOption {
-              default = null;
-              type = lib.types.nullOr (lib.types.submodule {
-                options = {
-
-                  hostKey = lib.mkOption {
-                    type = lib.types.str;
-                    description = ''
-                      The system ssh host key of this machine used for luks boot unlocking only.
-                    '';
-                  };
-
-                  clearnetHost = lib.mkOption {
-                    default = null;
-                    type = lib.types.nullOr lib.types.str;
-                    description = ''
-                      The hostname resolvable over clearnet used to luks boot unlock this machine
-                    '';
-                  };
-
-                  onionHost = lib.mkOption {
-                    default = null;
-                    type = lib.types.nullOr lib.types.str;
-                    description = ''
-                      The hostname resolvable over tor used to luks boot unlock this machine
-                    '';
-                  };
-
-                };
-              });
-            };
-
-            userKeys = lib.mkOption {
-              default = [ ];
-              type = lib.types.listOf lib.types.str;
-              description = ''
-                The list of user keys. Each key here can be used to log into all other systems as `googlebot`.
-
-                TODO: consider auto populating other programs that use ssh keys such as gitea
-              '';
-            };
-
-            deployKeys = lib.mkOption {
-              default = [ ];
-              type = lib.types.listOf lib.types.str;
-              description = ''
-                The list of deployment keys. Each key here can be used to log into all other systems as `root`.
-              '';
-            };
-
-            configurationPath = lib.mkOption {
-              type = lib.types.path;
-              description = ''
-                The path to this machine's configuration directory.
-              '';
-            };
-
-          };
-        });
+      type = lib.types.attrsOf hostOptionsSubmoduleType;
    };
  };

+  options.thisMachine.config = lib.mkOption {
+    # For ease of use, a direct copy of the host config from machines.hosts.${hostName}
+    type = hostOptionsSubmoduleType;
+  };
+
  config = {
    assertions = (lib.concatLists (lib.mapAttrsToList
      (
@ -196,5 +192,16 @@ in
          builtins.map (p: { "${dirName p}" = p; }) propFiles;
      in
      properties ../../machines;
+
+    # Don't try to evaluate "thisMachine" when reflecting using moduleless.nix.
+    # When evaluated by moduleless.nix this will fail due to networking.hostName not
+    # existing. This is because moduleless.nix is not intended for reflection from the
+    # perspective of a perticular machine but is instead intended for reflecting on
+    # the properties of all machines as a whole system.
+    thisMachine.config = config.machines.hosts.${config.networking.hostName};
+
+    # Add ssh keys from KeepassXC
+    machines.ssh.userKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILACiZO7QnB4bcmziVaUkUE0ZPMR0M/yJbbHYsHIZz9g" ];
+    machines.ssh.deployKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID58MvKGs3GDMMcN8Iyi9S59SciSrVM97wKtOvUAl3li" ];
  };
 }
--- a/common/machine-info/roles.nix
+++ b/common/machine-info/roles.nix
@ -1,19 +1,55 @@
 { config, lib, ... }:

-# Maps roles to their hosts
+# Maps roles to their hosts.
+# machines.withRole = {
+#   personal = [
+#     "machine1" "machine3"
+#   ];
+#   cache = [
+#     "machine2"
+#   ];
+# };
+#
+# A list of all possible roles
+# machines.allRoles = [
+#   "personal"
+#   "cache"
+# ];
+#
+# For each role has true or false if the current machine has that role
+# thisMachine.hasRole = {
+#   personal = true;
+#   cache = false;
+# };

 {
-  options.machines.roles = lib.mkOption {
+  options.machines.withRole = lib.mkOption {
    type = lib.types.attrsOf (lib.types.listOf lib.types.str);
  };

+  options.machines.allRoles = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+  };
+
+  options.thisMachine.hasRole = lib.mkOption {
+    type = lib.types.attrsOf lib.types.bool;
+  };
+
  config = {
-    machines.roles = lib.zipAttrs
+    machines.withRole = lib.zipAttrs
      (lib.mapAttrsToList
        (host: cfg:
          lib.foldl (lib.mergeAttrs) { }
            (builtins.map (role: { ${role} = host; })
              cfg.systemRoles))
        config.machines.hosts);
+
+    machines.allRoles = lib.attrNames config.machines.withRole;
+
+    thisMachine.hasRole = lib.mapAttrs
+      (role: cfg:
+        builtins.elem config.networking.hostName config.machines.withRole.${role}
+      )
+      config.machines.withRole;
  };
 }
--- a/common/machine-info/ssh.nix
+++ b/common/machine-info/ssh.nix
@ -39,6 +39,6 @@ in
        builtins.map
          (host: machines.hosts.${host}.hostKey)
          hosts)
-      machines.roles;
+      machines.withRole;
  };
 }
--- a/common/nix-builder.nix
+++ b/common/nix-builder.nix
@ -1,18 +1,14 @@
 { config, lib, ... }:

 let
-  builderRole = "nix-builder";
  builderUserName = "nix-builder";

-  machinesByRole = role: lib.filterAttrs (hostname: cfg: builtins.elem role cfg.systemRoles) config.machines.hosts;
-  otherMachinesByRole = role: lib.filterAttrs (hostname: cfg: hostname != config.networking.hostName) (machinesByRole role);
-  thisMachineHasRole = role: builtins.hasAttr config.networking.hostName (machinesByRole role);
-
-  builders = machinesByRole builderRole;
-  thisMachineIsABuilder = thisMachineHasRole builderRole;
+  builderRole = "nix-builder";
+  builders = config.machines.withRole.${builderRole};
+  thisMachineIsABuilder = config.thisMachine.hasRole.${builderRole};

  # builders don't include themselves as a remote builder
-  otherBuilders = lib.filterAttrs (hostname: cfg: hostname != config.networking.hostName) builders;
+  otherBuilders = lib.filter (hostname: hostname != config.networking.hostName) builders;
 in
 lib.mkMerge [
  # configure builder
@ -40,9 +36,9 @@ lib.mkMerge [
    nix.distributedBuilds = true;

    nix.buildMachines = builtins.map
-      (builderCfg: {
-        hostName = builtins.elemAt builderCfg.hostNames 0;
-        system = builderCfg.arch;
+      (builderHostname: {
+        hostName = builderHostname;
+        system = config.machines.hosts.${builderHostname}.arch;
        protocol = "ssh-ng";
        sshUser = builderUserName;
        sshKey = "/etc/ssh/ssh_host_ed25519_key";
@ -50,7 +46,7 @@ lib.mkMerge [
        speedFactor = 10;
        supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
      })
-      (builtins.attrValues otherBuilders);
+      otherBuilders;

    # It is very likely that the builder's internet is faster or just as fast
    nix.extraOptions = ''
--- a/common/pc/default.nix
+++ b/common/pc/default.nix
@ -92,5 +92,7 @@ in

    # Enable wayland support in various chromium based applications
    environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+    fonts.packages = with pkgs; [ nerd-fonts.symbols-only ];
  };
 }
--- a/common/server/actualbudget.nix
+++ b/common/server/actualbudget.nix
@ -1,87 +1,16 @@
-# Starting point:
-# https://github.com/aldoborrero/mynixpkgs/commit/c501c1e32dba8f4462dcecb57eee4b9e52038e27
-
 { config, pkgs, lib, ... }:

 let
-  cfg = config.services.actual-server;
-  stateDir = "/var/lib/${cfg.stateDirName}";
+  cfg = config.services.actual;
 in
 {
-  options.services.actual-server = {
-    enable = lib.mkEnableOption "Actual Server";
-
-    hostname = lib.mkOption {
-      type = lib.types.str;
-      default = "localhost";
-      description = "Hostname for the Actual Server.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 25448;
-      description = "Port on which the Actual Server should listen.";
-    };
-
-    stateDirName = lib.mkOption {
-      type = lib.types.str;
-      default = "actual-server";
-      description = "Name of the directory under /var/lib holding the server's data.";
-    };
-
-    upload = {
-      fileSizeSyncLimitMB = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = null;
-        description = "File size limit in MB for synchronized files.";
-      };
-
-      syncEncryptedFileSizeLimitMB = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = null;
-        description = "File size limit in MB for synchronized encrypted files.";
-      };
-
-      fileSizeLimitMB = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = null;
-        description = "File size limit in MB for file uploads.";
-      };
-    };
-  };
-
  config = lib.mkIf cfg.enable {
-    systemd.services.actual-server = {
-      description = "Actual Server";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.actual-server}/bin/actual-server";
-        Restart = "always";
-        StateDirectory = cfg.stateDirName;
-        WorkingDirectory = stateDir;
-        DynamicUser = true;
-        UMask = "0007";
-      };
-      environment = {
-        NODE_ENV = "production";
-        ACTUAL_PORT = toString cfg.port;
-
-        # Actual is actually very bad at configuring it's own paths despite that information being readily available
-        ACTUAL_USER_FILES = "${stateDir}/user-files";
-        ACTUAL_SERVER_FILES = "${stateDir}/server-files";
-        ACTUAL_DATA_DIR = stateDir;
-
-        ACTUAL_UPLOAD_FILE_SYNC_SIZE_LIMIT_MB = toString (cfg.upload.fileSizeSyncLimitMB or "");
-        ACTUAL_UPLOAD_SYNC_ENCRYPTED_FILE_SIZE_LIMIT_MB = toString (cfg.upload.syncEncryptedFileSizeLimitMB or "");
-        ACTUAL_UPLOAD_FILE_SIZE_LIMIT_MB = toString (cfg.upload.fileSizeLimitMB or "");
-      };
+    services.actual.settings = {
+      port = 25448;
    };

-    services.nginx.virtualHosts.${cfg.hostname} = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/".proxyPass = "http://localhost:${toString cfg.port}";
-    };
+    backup.group."actual-budget".paths = [
+      "/var/lib/actual"
+    ];
  };
 }
--- a/common/server/default.nix
+++ b/common/server/default.nix
@ -10,7 +10,6 @@
    ./matrix.nix
    ./zerobin.nix
    ./gitea.nix
-    ./radio.nix
    ./samba.nix
    ./owncast.nix
    ./mailserver.nix
--- a/common/server/gitea-actions-runner.nix
+++ b/common/server/gitea-actions-runner.nix
@ -9,10 +9,7 @@
 # TODO: skipping running inside of nixos container for now because of issues getting docker/podman running

 let
-  runnerRole = "gitea-actions-runner";
-  runners = config.machines.roles.${runnerRole};
-  thisMachineIsARunner = builtins.elem config.networking.hostName runners;
-
+  thisMachineIsARunner = config.thisMachine.hasRole."gitea-actions-runner";
  containerName = "gitea-runner";
 in
 {
--- a/common/server/mailserver.nix
+++ b/common/server/mailserver.nix
@ -28,7 +28,6 @@ in
      indexDir = "/var/lib/mailindex";
      enableManageSieve = true;
      fullTextSearch.enable = true;
-      fullTextSearch.indexAttachments = true;
      fullTextSearch.memoryLimit = 500;
      inherit domains;
      loginAccounts = {
--- a/common/server/nextcloud.nix
+++ b/common/server/nextcloud.nix
@ -3,28 +3,44 @@

 let
  cfg = config.services.nextcloud;
+
+  nextcloudHostname = "runyan.org";
+  collaboraOnlineHostname = "collabora.runyan.org";
+  whiteboardHostname = "whiteboard.runyan.org";
+  whiteboardPort = 3002; # Seems impossible to change
+
+  # Hardcoded public ip of ponyo... I wish I didn't need this...
+  public_ip_address = "147.135.114.130";
 in
 {
  config = lib.mkIf cfg.enable {
    services.nextcloud = {
      https = true;
-      package = pkgs.nextcloud30;
-      hostName = "neet.cloud";
+      package = pkgs.nextcloud31;
+      hostName = nextcloudHostname;
      config.dbtype = "sqlite";
      config.adminuser = "jeremy";
      config.adminpassFile = "/run/agenix/nextcloud-pw";
+
+      # Apps
      autoUpdateApps.enable = true;
+      extraAppsEnable = true;
      extraApps = with config.services.nextcloud.package.packages.apps; {
        # Want
        inherit end_to_end_encryption mail spreed;

+        # For file and document editing (collabora online and excalidraw)
+        inherit richdocuments whiteboard;
+
        # Might use
-        inherit bookmarks calendar cookbook deck memories onlyoffice qownnotesapi;
+        inherit calendar qownnotesapi;

        # Try out
-        # inherit maps music news notes phonetrack polls forms;
+        # inherit bookmarks cookbook deck memories maps music news notes phonetrack polls forms;
      };
-      extraAppsEnable = true;
+
+      # Allows installing Apps from the UI (might remove later)
+      appstoreEnable = true;
    };
    age.secrets.nextcloud-pw = {
      file = ../../secrets/nextcloud-pw.age;
@ -40,5 +56,100 @@ in
      enableACME = true;
      forceSSL = true;
    };
+
+    # collabora-online
+    # https://diogotc.com/blog/collabora-nextcloud-nixos/
+    services.collabora-online = {
+      enable = true;
+      port = 15972;
+      settings = {
+        # Rely on reverse proxy for SSL
+        ssl = {
+          enable = false;
+          termination = true;
+        };
+
+        # Listen on loopback interface only
+        net = {
+          listen = "loopback";
+          post_allow.host = [ "localhost" ];
+        };
+
+        # Restrict loading documents from WOPI Host
+        storage.wopi = {
+          "@allow" = true;
+          host = [ config.services.nextcloud.hostName ];
+        };
+
+        server_name = collaboraOnlineHostname;
+      };
+    };
+    services.nginx.virtualHosts.${config.services.collabora-online.settings.server_name} = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.collabora-online.port}";
+        proxyWebsockets = true;
+      };
+    };
+    systemd.services.nextcloud-config-collabora =
+      let
+        wopi_url = "http://localhost:${toString config.services.collabora-online.port}";
+        public_wopi_url = "https://${collaboraOnlineHostname}";
+        wopi_allowlist = lib.concatStringsSep "," [
+          "127.0.0.1"
+          "::1"
+          public_ip_address
+        ];
+      in
+      {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "nextcloud-setup.service" "coolwsd.service" ];
+        requires = [ "coolwsd.service" ];
+        path = [
+          config.services.nextcloud.occ
+        ];
+        script = ''
+          nextcloud-occ -- config:app:set richdocuments wopi_url --value ${lib.escapeShellArg wopi_url}
+          nextcloud-occ -- config:app:set richdocuments public_wopi_url --value ${lib.escapeShellArg public_wopi_url}
+          nextcloud-occ -- config:app:set richdocuments wopi_allowlist --value ${lib.escapeShellArg wopi_allowlist}
+          nextcloud-occ -- richdocuments:setup
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+        };
+      };
+
+    # Whiteboard
+    services.nextcloud-whiteboard-server = {
+      enable = true;
+      settings.NEXTCLOUD_URL = "https://${nextcloudHostname}";
+      secrets = [ "/run/agenix/whiteboard-server-jwt-secret" ];
+    };
+    systemd.services.nextcloud-config-whiteboard = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "nextcloud-setup.service" ];
+      requires = [ "coolwsd.service" ];
+      path = [
+        config.services.nextcloud.occ
+      ];
+      script = ''
+        nextcloud-occ -- config:app:set whiteboard collabBackendUrl --value="https://${whiteboardHostname}"
+        nextcloud-occ -- config:app:set whiteboard jwt_secret_key --value="$JWT_SECRET_KEY"
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        EnvironmentFile = [ "/run/agenix/whiteboard-server-jwt-secret" ];
+      };
+    };
+    age.secrets.whiteboard-server-jwt-secret.file = ../../secrets/whiteboard-server-jwt-secret.age;
+    services.nginx.virtualHosts.${whiteboardHostname} = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString whiteboardPort}";
+        proxyWebsockets = true;
+      };
+    };
  };
 }
--- a/common/server/radio.nix
+++ b/common/server/radio.nix
@ -1,75 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.services.radio;
-  radioPackage = config.inputs.radio.packages.${config.currentSystem}.radio;
-in
-{
-  options.services.radio = {
-    enable = lib.mkEnableOption "enable radio";
-    user = lib.mkOption {
-      type = lib.types.str;
-      default = "radio";
-      description = ''
-        The user radio should run as
-      '';
-    };
-    group = lib.mkOption {
-      type = lib.types.str;
-      default = "radio";
-      description = ''
-        The group radio should run as
-      '';
-    };
-    dataDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/radio";
-      description = ''
-        Path to the radio data directory
-      '';
-    };
-    host = lib.mkOption {
-      type = lib.types.str;
-      description = ''
-        Domain radio is hosted on
-      '';
-    };
-    nginx = lib.mkEnableOption "enable nginx";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.icecast = {
-      enable = true;
-      hostname = cfg.host;
-      mount = "stream.mp3";
-      fallback = "fallback.mp3";
-    };
-
-    services.nginx.virtualHosts.${cfg.host} = lib.mkIf cfg.nginx {
-      enableACME = true;
-      forceSSL = true;
-      locations."/".root = config.inputs.radio-web;
-    };
-
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      group = cfg.group;
-      home = cfg.dataDir;
-      createHome = true;
-    };
-    users.groups.${cfg.group} = { };
-    systemd.services.radio = {
-      enable = true;
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${radioPackage}/bin/radio ${config.services.icecast.listen.address}:${toString config.services.icecast.listen.port} ${config.services.icecast.mount} 5500";
-      serviceConfig.User = cfg.user;
-      serviceConfig.Group = cfg.group;
-      serviceConfig.WorkingDirectory = cfg.dataDir;
-      preStart = ''
-        mkdir -p ${cfg.dataDir}
-        chown ${cfg.user} ${cfg.dataDir}
-      '';
-    };
-  };
-}
--- a/common/shell.nix
+++ b/common/shell.nix
@ -21,8 +21,6 @@
    shellInit = ''
      # disable annoying fish shell greeting
      set fish_greeting
-
-      alias sudo="doas"
    '';
  };

--- a/common/ssh.nix
+++ b/common/ssh.nix
@ -31,8 +31,6 @@

  # TODO: Old ssh keys I will remove some day...
  machines.ssh.userKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMVR/R3ZOsv7TZbICGBCHdjh1NDT8SnswUyINeJOC7QG"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0dcqL/FhHmv+a1iz3f9LJ48xubO7MZHy35rW9SZOYM"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHSkKiRUUmnErOKGx81nyge/9KqjkPh8BfDk0D3oP586" # nat
  ];
 }
--- a/flake.lock
+++ b/flake.lock
@ -14,11 +14,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1750173260,
+        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
        "type": "github"
      },
      "original": {
@ -74,11 +74,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1700795494,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
        "type": "github"
      },
      "original": {
@ -101,11 +101,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1727447169,
-        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
+        "lastModified": 1749105467,
+        "narHash": "sha256-hXh76y/wDl15almBcqvjryB50B0BaiXJKk20f314RoE=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
+        "rev": "6bc76b872374845ba9d645a2f012b764fecd765f",
        "type": "github"
      },
      "original": {
@ -117,11 +117,11 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
        "type": "github"
      },
      "original": {
@ -137,11 +137,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1726560853,
-        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
@ -150,6 +150,54 @@
        "type": "github"
      }
    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "simple-nixos-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "simple-nixos-mailserver",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1750779888,
+        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "simple-nixos-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@ -157,15 +205,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1740845322,
-        "narHash": "sha256-AXEgFj3C0YJhu9k1OhbRhiA6FnDr81dQZ65U3DhaWpw=",
+        "lastModified": 1752208517,
+        "narHash": "sha256-aRY1cYOdVdXdNjcL/Twpa27CknO7pVHxooPsBizDraE=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "fcac3d6d88302a5e64f6cb8014ac785e08874c8d",
+        "rev": "c6a01e54af81b381695db796a43360bf6db5702f",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
+        "ref": "release-25.05",
        "repo": "home-manager",
        "type": "github"
      }
@ -177,11 +226,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1728263287,
-        "narHash": "sha256-GJDtsxz2/zw6g/Nrp4XVWBS5IaZ7ZUkuvxPOBEDe7pg=",
+        "lastModified": 1752346111,
+        "narHash": "sha256-SVxCIYnbED0rNYSpm3QQoOhqxYRp1GuE9FkyM5Y2afs=",
        "owner": "Mic92",
        "repo": "nix-index-database",
-        "rev": "5fce10c871bab6d7d5ac9e5e7efbb3a2783f5259",
+        "rev": "deff7a9a0aa98a08d8c7839fe2658199ce9828f8",
        "type": "github"
      },
      "original": {
@ -192,11 +241,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1728056216,
-        "narHash": "sha256-IrO06gFUDTrTlIP3Sz+mRB6WUoO2YsgMtOD3zi0VEt0=",
+        "lastModified": 1752048960,
+        "narHash": "sha256-gATnkOe37eeVwKKYCsL+OnS2gU4MmLuZFzzWCtaKLI8=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "b7ca02c7565fbf6d27ff20dd6dbd49c5b82eef28",
+        "rev": "7ced9122cff2163c6a0212b8d1ec8c33a1660806",
        "type": "github"
      },
      "original": {
@ -208,59 +257,42 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1740374225,
-        "narHash": "sha256-Dnmzy5YWUVj3BNaZo5jRpZslXexbNKEk3ADGGcz9RpY=",
+        "lastModified": 1752431364,
+        "narHash": "sha256-ciGIXIMq2daX5o4Tn6pnZTd1pf5FICHbqUlHu658G9c=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "3349acd765bdffe454f7c8bbc450855577c1a6cf",
+        "rev": "fb0f0dbfd95f0e19fdeab8e0f18bf0b5cf057b68",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "master",
+        "ref": "release-25.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "radio": {
-      "inputs": {
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1631585589,
-        "narHash": "sha256-q4o/4/2pEuJyaKZwNQC5KHnzG1obClzFB7zWk9XSDfY=",
-        "ref": "main",
-        "rev": "5bf607fed977d41a269942a7d1e92f3e6d4f2473",
-        "revCount": 38,
-        "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/radio.git"
-      },
-      "original": {
-        "ref": "main",
-        "rev": "5bf607fed977d41a269942a7d1e92f3e6d4f2473",
-        "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/radio.git"
-      }
-    },
-    "radio-web": {
+    "nixpkgs-linkwarden": {
      "flake": false,
      "locked": {
-        "lastModified": 1652121792,
-        "narHash": "sha256-j1Y9MAjUVNgyFSeGzPoqibAnEysJDjZSXukVfQ7+bsQ=",
-        "ref": "refs/heads/master",
-        "rev": "72e7a9e80b780c84ed8d4a6374bfbb242701f900",
-        "revCount": 5,
-        "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/radio-web.git"
+        "narHash": "sha256-wW3F+iRM/ATWkyq8+Romal8oFmsM/p98V96d5G0tasA=",
+        "type": "file",
+        "url": "https://github.com/NixOS/nixpkgs/pull/347353.diff"
      },
      "original": {
-        "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/radio-web.git"
+        "type": "file",
+        "url": "https://github.com/NixOS/nixpkgs/pull/347353.diff"
+      }
+    },
+    "nixpkgs-memos": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-UidUaQY+9vo90rNCVInX1E+JbJ1xKFVSTMNRYKQEKpQ=",
+        "type": "file",
+        "url": "https://github.com/NixOS/nixpkgs/pull/426687.diff"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://github.com/NixOS/nixpkgs/pull/426687.diff"
      }
    },
    "root": {
@ -274,8 +306,8 @@
        "nix-index-database": "nix-index-database",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs",
-        "radio": "radio",
-        "radio-web": "radio-web",
+        "nixpkgs-linkwarden": "nixpkgs-linkwarden",
+        "nixpkgs-memos": "nixpkgs-memos",
        "simple-nixos-mailserver": "simple-nixos-mailserver",
        "systems": "systems"
      }
@ -286,24 +318,25 @@
        "flake-compat": [
          "flake-compat"
        ],
+        "git-hooks": "git-hooks",
        "nixpkgs": [
          "nixpkgs"
        ],
-        "nixpkgs-24_05": [
+        "nixpkgs-25_05": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1722877200,
-        "narHash": "sha256-qgKDNJXs+od+1UbRy62uk7dYal3h98I4WojfIqMoGcg=",
+        "lastModified": 1747965231,
+        "narHash": "sha256-BW3ktviEhfCN/z3+kEyzpDKAI8qFTwO7+S0NVA0C90o=",
        "owner": "simple-nixos-mailserver",
        "repo": "nixos-mailserver",
-        "rev": "af7d3bf5daeba3fc28089b015c0dd43f06b176f2",
+        "rev": "53007af63fade28853408370c4c600a63dd97f41",
        "type": "gitlab"
      },
      "original": {
        "owner": "simple-nixos-mailserver",
-        "ref": "master",
+        "ref": "nixos-25.05",
        "repo": "nixos-mailserver",
        "type": "gitlab"
      }
--- a/flake.nix
+++ b/flake.nix
@ -1,7 +1,15 @@
 {
  inputs = {
    # nixpkgs
-    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/release-25.05";
+    nixpkgs-linkwarden = {
+      url = "https://github.com/NixOS/nixpkgs/pull/347353.diff";
+      flake = false;
+    };
+    nixpkgs-memos = {
+      url = "https://github.com/NixOS/nixpkgs/pull/426687.diff";
+      flake = false;
+    };

    # Common Utils Among flake inputs
    systems.url = "github:nix-systems/default";
@ -19,16 +27,16 @@

    # Home Manager
    home-manager = {
-      url = "github:nix-community/home-manager";
+      url = "github:nix-community/home-manager/release-25.05";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    # Mail Server
    simple-nixos-mailserver = {
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-25.05";
      inputs = {
        nixpkgs.follows = "nixpkgs";
-        nixpkgs-24_05.follows = "nixpkgs";
+        nixpkgs-25_05.follows = "nixpkgs";
        flake-compat.follows = "flake-compat";
      };
    };
@ -43,19 +51,6 @@
      };
    };

-    # Radio
-    radio = {
-      url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-      };
-    };
-    radio-web = {
-      url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
-      flake = false;
-    };
-
    # Dailybot
    dailybuild_modules = {
      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
@ -84,13 +79,11 @@

  outputs = { self, nixpkgs, ... }@inputs:
    let
-      machines = (import ./common/machine-info/moduleless.nix
+      machineHosts = (import ./common/machine-info/moduleless.nix
        {
          inherit nixpkgs;
          assertionsModule = "${nixpkgs}/nixos/modules/misc/assertions.nix";
-        }).machines;
-      machineHosts = machines.hosts;
-      machineRoles = machines.roles;
+        }).machines.hosts;
    in
    {
      nixosConfigurations =
@ -115,10 +108,7 @@

                home-manager.useGlobalPkgs = true;
                home-manager.useUserPackages = true;
-                home-manager.users.googlebot = import ./home/googlebot.nix {
-                  inherit hostname;
-                  inherit machineRoles;
-                };
+                home-manager.users.googlebot = import ./home/googlebot.nix;
              };

              # because nixos specialArgs doesn't work for containers... need to pass in inputs a different way
@ -136,8 +126,14 @@
                name = "nixpkgs-patched";
                src = nixpkgs;
                patches = [
-                  ./patches/gamepadui.patch
+                  # ./patches/gamepadui.patch
                  ./patches/dont-break-nix-serve.patch
+                  # music-assistant needs a specific custom version of librespot
+                  # I tried to use an overlay but my attempts to override the rust package did not work out
+                  # despite me following guides and examples specific to rust packages.
+                  ./patches/librespot-pin.patch
+                  inputs.nixpkgs-linkwarden
+                  inputs.nixpkgs-memos
                ];
              };
              patchedNixpkgs = nixpkgs.lib.fix (self: (import "${patchedNixpkgsSrc}/flake.nix").outputs { self = nixpkgs; });
--- a/home/googlebot.nix
+++ b/home/googlebot.nix
@ -1,9 +1,8 @@
-{ hostname, machineRoles }:
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, osConfig, ... }:

 let
  # Check if the current machine has the role "personal"
-  thisMachineIsPersonal = builtins.elem hostname machineRoles.personal;
+  thisMachineIsPersonal = osConfig.thisMachine.hasRole."personal";
 in
 {
  home.username = "googlebot";
@ -12,6 +11,47 @@ in
  home.stateVersion = "24.11";
  programs.home-manager.enable = true;

+  services.ssh-agent.enable = true;
+
+  # System Monitoring
+  programs.btop.enable = true;
+  programs.bottom.enable = true;
+
+  # Modern "ls" replacement
+  programs.pls.enable = true;
+  programs.pls.enableFishIntegration = true;
+  programs.eza.enable = true;
+
+  # Graphical terminal
+  programs.ghostty.enable = thisMachineIsPersonal;
+  programs.ghostty.settings = {
+    theme = "Snazzy";
+    font-size = 10;
+  };
+
+  # Advanced terminal file explorer
+  programs.broot.enable = true;
+
+  # Shell promt theming
+  programs.fish.enable = true;
+  programs.starship.enable = true;
+  programs.starship.enableFishIntegration = true;
+  programs.starship.enableInteractive = true;
+  # programs.oh-my-posh.enable = true;
+  # programs.oh-my-posh.enableFishIntegration = true;
+
+  # Advanced search
+  programs.ripgrep.enable = true;
+
+  # tldr: Simplified, example based and community-driven man pages.
+  programs.tealdeer.enable = true;
+
+  home.shellAliases = {
+    sudo = "doas";
+    ls2 = "eza";
+    explorer = "broot";
+  };
+
  programs.zed-editor = {
    enable = thisMachineIsPersonal;
    extensions = [
--- a/machines/ephemeral/minimal.nix
+++ b/machines/ephemeral/minimal.nix
@ -7,12 +7,20 @@
    ../../common/ssh.nix
  ];

-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "e1000" "e1000e" "virtio_pci" "r8169" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "e1000"
+    "e1000e"
+    "virtio_pci"
+    "r8169"
+    "sdhci"
+    "sdhci_pci"
+    "mmc_core"
+    "mmc_block"
+  ];
  boot.kernelParams = [
-    "panic=30"
-    "boot.panic_on_fail" # reboot the machine upon fatal boot issues
    "console=ttyS0,115200" # enable serial console
-    "console=tty1"
  ];
  boot.kernel.sysctl."vm.overcommit_memory" = "1";

--- a/machines/howl/hardware-configuration.nix
+++ b/machines/howl/hardware-configuration.nix
@ -6,7 +6,8 @@
    nixos-hardware.nixosModules.framework-13-7040-amd
  ];

-  boot.kernelPackages = pkgs.linuxPackages_latest;
+  # boot.kernelPackages = pkgs.linuxPackages_6_14;
+  boot.kernelPackages = pkgs.linuxPackages_6_13;

  hardware.framework.amd-7040.preventWakeOnAC = true;
  services.fwupd.enable = true;
--- a/machines/howl/properties.nix
+++ b/machines/howl/properties.nix
@ -15,10 +15,6 @@
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKPnLt84bKhUgFxjQf10+Htro9Lo1Pabqm8mGalBUniv"
  ];

-  deployKeys = [
-    # TODO
-  ];
-
  remoteUnlock = {
    hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0N80r0Sl2WlJaUqfxZPkOtYyGumFazkIqq7eq3Gd2o";
    onionHost = "ll6yjnkh4psmfwmtkmqoutl4gq4elqzbmjxv4s6gpgoavyi3kwhjvnqd.onion";
--- a/machines/ponyo/default.nix
+++ b/machines/ponyo/default.nix
@ -56,44 +56,6 @@
    config.services.drastikbot.dataDir
  ];

-  # music radio
-  vpn-container.enable = true;
-  vpn-container.config = {
-    services.radio = {
-      enable = true;
-      host = "radio.runyan.org";
-    };
-  };
-  pia.wireguard.badPortForwardPorts = [ ];
-  services.nginx.virtualHosts = {
-    "radio.runyan.org" = {
-      enableACME = true;
-      forceSSL = true;
-      locations = {
-        "/stream.mp3" = {
-          proxyPass = "http://vpn.containers:8001/stream.mp3";
-          extraConfig = ''
-            add_header Access-Control-Allow-Origin *;
-          '';
-        };
-        "/".root = config.inputs.radio-web;
-      };
-    };
-    "radio.neet.space" = {
-      enableACME = true;
-      forceSSL = true;
-      locations = {
-        "/stream.mp3" = {
-          proxyPass = "http://vpn.containers:8001/stream.mp3";
-          extraConfig = ''
-            add_header Access-Control-Allow-Origin *;
-          '';
-        };
-        "/".root = config.inputs.radio-web;
-      };
-    };
-  };
-
  # matrix home server
  services.matrix = {
    enable = true;
@ -116,7 +78,7 @@
  services.postgresql.package = pkgs.postgresql_15;

  # iodine DNS-based vpn
-  services.iodine.server.enable = true;
+  # services.iodine.server.enable = true;

  # proxied web services
  services.nginx.enable = true;
@ -133,12 +95,12 @@
    root = "/var/www/tmp";
  };

-  # redirect runyan.org to github
-  services.nginx.virtualHosts."runyan.org" = {
+  # redirect neet.cloud to nextcloud instance on runyan.org
+  services.nginx.virtualHosts."neet.cloud" = {
    enableACME = true;
    forceSSL = true;
    extraConfig = ''
-      rewrite ^/(.*)$ https://github.com/GoogleBot42 redirect;
+      return 302 https://runyan.org$request_uri;
    '';
  };

@ -149,7 +111,4 @@
  # librechat
  services.librechat.enable = true;
  services.librechat.host = "chat.neet.dev";
-
-  services.actual-server.enable = true;
-  services.actual-server.hostname = "actual.runyan.org";
 }
--- a/machines/router/default.nix
+++ b/machines/router/default.nix
@ -22,8 +22,7 @@

  # networking.useDHCP = lib.mkForce true;

-  # TODO
-  # networking.usePredictableInterfaceNames = true;
+  networking.usePredictableInterfaceNames = false;

  powerManagement.cpuFreqGovernor = "ondemand";

--- a/machines/router/hardware-configuration.nix
+++ b/machines/router/hardware-configuration.nix
@ -10,8 +10,6 @@

  # Enable serial output
  boot.kernelParams = [
-    "panic=30"
-    "boot.panic_on_fail" # reboot the machine upon fatal boot issues
    "console=ttyS0,115200n8" # enable serial console
  ];
  boot.loader.grub.extraConfig = "
@ -23,6 +21,8 @@
  # firmware
  firmware.x86_64.enable = true;
  nixpkgs.config.allowUnfree = true;
+  hardware.enableRedistributableFirmware = true;
+  hardware.enableAllFirmware = true;

  # boot
  bios = {
@ -31,20 +31,18 @@
  };

  # disks
-  remoteLuksUnlock.enable = true;
-  boot.initrd.luks.devices."enc-pv".device = "/dev/disk/by-uuid/9b090551-f78e-45ca-8570-196ed6a4af0c";
  fileSystems."/" =
    {
-      device = "/dev/disk/by-uuid/421c82b9-d67c-4811-8824-8bb57cb10fce";
-      fsType = "btrfs";
+      device = "/dev/disk/by-uuid/6aa7f79e-bef8-4b0f-b22c-9d1b3e8ac94b";
+      fsType = "ext4";
    };
  fileSystems."/boot" =
    {
-      device = "/dev/disk/by-uuid/d97f324f-3a2e-4b84-ae2a-4b3d1209c689";
+      device = "/dev/disk/by-uuid/14dfc562-0333-4ddd-b10c-4eeefe1cd05f";
      fsType = "ext3";
    };
  swapDevices =
-    [{ device = "/dev/disk/by-uuid/45bf58dd-67eb-45e4-9a98-246e23fa7abd"; }];
+    [{ device = "/dev/disk/by-uuid/adf37c64-3b54-480c-a9a7-099d61c6eac7"; }];

  nixpkgs.hostPlatform = "x86_64-linux";
 }
--- a/machines/router/properties.nix
+++ b/machines/router/properties.nix
@ -0,0 +1,17 @@
+{
+  hostNames = [
+    "router"
+    "192.168.6.159"
+    "192.168.3.1"
+  ];
+
+  arch = "x86_64-linux";
+
+  systemRoles = [
+    "server"
+    "wireless"
+    "router"
+  ];
+
+  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDCMhEvWJxFBNyvpyuljv5Uun8AdXCxBK9HvPBRe5x6";
+}
--- a/machines/router/properties.nix.disabled
+++ b/machines/router/properties.nix.disabled
@ -1,21 +0,0 @@
-{
-  hostNames = [
-    "router"
-    "192.168.1.228"
-  ];
-
-  arch = "x86_64-linux";
-
-  systemRoles = [
-    "server"
-    "wireless"
-    "router"
-  ];
-
-  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFr2IHmWFlaLaLp5dGoSmFEYKA/eg2SwGXAogaOmLsHL";
-
-  remoteUnlock = {
-    hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOw5dTPmtKqiPBH6VKyz5MYBubn8leAh5Eaw7s/O85c";
-    onionHost = "jxx2exuihlls2t6ncs7rvrjh2dssubjmjtclwr2ysvxtr4t7jv55xmqd.onion";
-  };
-}
--- a/machines/router/router.nix
+++ b/machines/router/router.nix
@ -31,8 +31,10 @@ in
    networking.bridges = {
      br0 = {
        interfaces = [
-          "enp2s0"
-          "wlp4s0"
+          "eth2"
+          # "wlp4s0"
+          # "wlan1"
+          "wlan0"
          "wlan1"
        ];
      };
@ -64,142 +66,173 @@ in

    services.dnsmasq = {
      enable = true;
-      extraConfig = ''
+      settings = {
        # sensible behaviours
-        domain-needed
-        bogus-priv
-        no-resolv
+        domain-needed = true;
+        bogus-priv = true;
+        no-resolv = true;

        # upstream name servers
-        server=1.1.1.1
-        server=8.8.8.8
+        server = [
+          "1.1.1.1"
+          "8.8.8.8"
+        ];

        # local domains
-        expand-hosts
-        domain=home
-        local=/home/
+        expand-hosts = true;
+        domain = "home";
+        local = "/home/";

        # Interfaces to use DNS on
-        interface=br0
+        interface = "br0";

        # subnet IP blocks to use DHCP on
-        dhcp-range=${cfg.privateSubnet}.10,${cfg.privateSubnet}.254,24h
-      '';
+        dhcp-range = "${cfg.privateSubnet}.10,${cfg.privateSubnet}.254,24h";
+      };
    };

    services.hostapd = {
      enable = true;
      radios = {
-        # 2.4GHz
-        wlp4s0 = {
-          band = "2g";
-          noScan = true;
-          channel = 6;
+        # Simple 2.4GHz AP
+        wlan0 = {
          countryCode = "US";
-          wifi4 = {
-            capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40+" ];
-          };
-          wifi5 = {
-            operatingChannelWidth = "20or40";
-            capabilities = [ "MAX-A-MPDU-LEN-EXP0" ];
-          };
-          wifi6 = {
-            enable = true;
-            singleUserBeamformer = true;
-            singleUserBeamformee = true;
-            multiUserBeamformer = true;
-            operatingChannelWidth = "20or40";
-          };
-          networks = {
-            wlp4s0 = {
-              ssid = "CXNK00BF9176";
-              authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
-            };
-            # wlp4s0-1 = {
-            #   ssid = "- Experimental 5G Tower by AT&T";
-            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-            # };
-            # wlp4s0-2 = {
-            #   ssid = "FBI Surveillance Van 2";
-            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-            # };
-          };
-          settings = {
-            he_oper_centr_freq_seg0_idx = 8;
-            vht_oper_centr_freq_seg0_idx = 8;
+          networks.wlan0 = {
+            ssid = "CXNK00BF9176-1";
+            authentication.saePasswords = [{ passwordFile = "/run/agenix/hostapd-pw-CXNK00BF9176"; }];
          };
        };

-        # 5GHz
+        # WiFi 5 (5GHz) with two advertised networks
        wlan1 = {
          band = "5g";
-          noScan = true;
-          channel = 128;
+          channel = 0;
          countryCode = "US";
-          wifi4 = {
-            capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40-" ];
-          };
-          wifi5 = {
-            operatingChannelWidth = "160";
-            capabilities = [ "RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-3" "BF-ANTENNA-3" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7" ];
-          };
-          wifi6 = {
-            enable = true;
-            singleUserBeamformer = true;
-            singleUserBeamformee = true;
-            multiUserBeamformer = true;
-            operatingChannelWidth = "160";
-          };
-          networks = {
-            wlan1 = {
-              ssid = "CXNK00BF9176";
-              authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
-            };
-            # wlan1-1 = {
-            #   ssid = "- Experimental 5G Tower by AT&T";
-            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-            # };
-            # wlan1-2 = {
-            #   ssid = "FBI Surveillance Van 5";
-            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-            # };
-          };
-          settings = {
-            vht_oper_centr_freq_seg0_idx = 114;
-            he_oper_centr_freq_seg0_idx = 114;
+          networks.wlan1 = {
+            ssid = "CXNK00BF9176-1";
+            authentication.saePasswords = [{ passwordFile = "/run/agenix/hostapd-pw-CXNK00BF9176"; }];
          };
        };
      };
    };
-    age.secrets.hostapd-pw-experimental-tower.file = ../../secrets/hostapd-pw-experimental-tower.age;
    age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;

-    hardware.firmware = [
-      pkgs.mt7916-firmware
-    ];
+    # wlan0 5Ghz 00:0a:52:08:38:32
+    # wlp4s0 2.4Ghz 00:0a:52:08:38:33

-    nixpkgs.overlays = [
-      (self: super: {
-        mt7916-firmware = pkgs.stdenvNoCC.mkDerivation {
-          pname = "mt7916-firmware";
-          version = "custom-feb-02-23";
-          src = ./firmware/mediatek; # from here https://github.com/openwrt/mt76/issues/720#issuecomment-1413537674
-          dontBuild = true;
-          installPhase = ''
-            for i in \
-              mt7916_eeprom.bin \
-              mt7916_rom_patch.bin \
-              mt7916_wa.bin \
-              mt7916_wm.bin;
-            do
-              install -D -pm644 $i $out/lib/firmware/mediatek/$i
-            done
-          '';
-          meta = with lib; {
-            license = licenses.unfreeRedistributableFirmware;
-          };
-        };
-      })
-    ];
+    # services.hostapd = {
+    #   enable = true;
+    #   radios = {
+    #     # 2.4GHz
+    #     wlp4s0 = {
+    #       band = "2g";
+    #       noScan = true;
+    #       channel = 6;
+    #       countryCode = "US";
+    #       wifi4 = {
+    #         capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40+" ];
+    #       };
+    #       wifi5 = {
+    #         operatingChannelWidth = "20or40";
+    #         capabilities = [ "MAX-A-MPDU-LEN-EXP0" ];
+    #       };
+    #       wifi6 = {
+    #         enable = true;
+    #         singleUserBeamformer = true;
+    #         singleUserBeamformee = true;
+    #         multiUserBeamformer = true;
+    #         operatingChannelWidth = "20or40";
+    #       };
+    #       networks = {
+    #         wlp4s0 = {
+    #           ssid = "CXNK00BF9176";
+    #           authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
+    #         };
+    #         # wlp4s0-1 = {
+    #         #   ssid = "- Experimental 5G Tower by AT&T";
+    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+    #         # };
+    #         # wlp4s0-2 = {
+    #         #   ssid = "FBI Surveillance Van 2";
+    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+    #         # };
+    #       };
+    #       settings = {
+    #         he_oper_centr_freq_seg0_idx = 8;
+    #         vht_oper_centr_freq_seg0_idx = 8;
+    #       };
+    #     };
+
+    #     # 5GHz
+    #     wlan1 = {
+    #       band = "5g";
+    #       noScan = true;
+    #       channel = 128;
+    #       countryCode = "US";
+    #       wifi4 = {
+    #         capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40-" ];
+    #       };
+    #       wifi5 = {
+    #         operatingChannelWidth = "160";
+    #         capabilities = [ "RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-3" "BF-ANTENNA-3" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7" ];
+    #       };
+    #       wifi6 = {
+    #         enable = true;
+    #         singleUserBeamformer = true;
+    #         singleUserBeamformee = true;
+    #         multiUserBeamformer = true;
+    #         operatingChannelWidth = "160";
+    #       };
+    #       networks = {
+    #         wlan1 = {
+    #           ssid = "CXNK00BF9176";
+    #           authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
+    #         };
+    #         # wlan1-1 = {
+    #         #   ssid = "- Experimental 5G Tower by AT&T";
+    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+    #         # };
+    #         # wlan1-2 = {
+    #         #   ssid = "FBI Surveillance Van 5";
+    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+    #         # };
+    #       };
+    #       settings = {
+    #         vht_oper_centr_freq_seg0_idx = 114;
+    #         he_oper_centr_freq_seg0_idx = 114;
+    #       };
+    #     };
+    #   };
+    # };
+    # age.secrets.hostapd-pw-experimental-tower.file = ../../secrets/hostapd-pw-experimental-tower.age;
+    # age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;
+
+    # hardware.firmware = [
+    #   pkgs.mt7916-firmware
+    # ];
+
+    # nixpkgs.overlays = [
+    #   (self: super: {
+    #     mt7916-firmware = pkgs.stdenvNoCC.mkDerivation {
+    #       pname = "mt7916-firmware";
+    #       version = "custom-feb-02-23";
+    #       src = ./firmware/mediatek; # from here https://github.com/openwrt/mt76/issues/720#issuecomment-1413537674
+    #       dontBuild = true;
+    #       installPhase = ''
+    #         for i in \
+    #           mt7916_eeprom.bin \
+    #           mt7916_rom_patch.bin \
+    #           mt7916_wa.bin \
+    #           mt7916_wm.bin;
+    #         do
+    #           install -D -pm644 $i $out/lib/firmware/mediatek/$i
+    #         done
+    #       '';
+    #       meta = with lib; {
+    #         license = licenses.unfreeRedistributableFirmware;
+    #       };
+    #     };
+    #   })
+    # ];
  };
 }
--- a/machines/storage/s0/dashy.nix
+++ b/machines/storage/s0/dashy.nix
@ -214,15 +214,6 @@
            statusCheck = true;
            id = "0_836_matrix";
          };
-          radio = {
-            title = "Radio";
-            description = "Radio service";
-            icon = "generative";
-            url = "https://radio.runyan.org";
-            target = "sametab";
-            statusCheck = true;
-            id = "1_836_radio";
-          };
          mumble = {
            title = "Mumble";
            description = "voice.neet.space";
@ -280,7 +271,6 @@
        };
        servicesList = [
          servicesItems.matrix
-          servicesItems.radio
          servicesItems.mumble
          servicesItems.irc
          servicesItems.git
--- a/machines/storage/s0/default.nix
+++ b/machines/storage/s0/default.nix
@ -20,13 +20,13 @@
    secretKeyFile = "/run/agenix/binary-cache-private-key";
  };
  age.secrets.binary-cache-private-key.file = ../../../secrets/binary-cache-private-key.age;
-  users.users.cache-push = {
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB" ];
-  };
-  nix.settings = {
-    trusted-users = [ "cache-push" ];
-  };
+  # users.users.cache-push = {
+  #   isNormalUser = true;
+  #   openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB" ];
+  # };
+  # nix.settings = {
+  #   trusted-users = [ "cache-push" ];
+  # };

  services.iperf3.enable = true;
  services.iperf3.openFirewall = true;
@ -75,6 +75,32 @@
    services.lidarr.enable = true;
    services.lidarr.user = "public_data";
    services.lidarr.group = "public_data";
+    services.recyclarr = {
+      enable = true;
+      configuration = {
+        radarr.radarr_main = {
+          api_key = {
+            _secret = "/run/credentials/recyclarr.service/radarr-api-key";
+          };
+          base_url = "http://localhost:7878";
+
+          quality_definition.type = "movie";
+        };
+        sonarr.sonarr_main = {
+          api_key = {
+            _secret = "/run/credentials/recyclarr.service/sonarr-api-key";
+          };
+          base_url = "http://localhost:8989";
+
+          quality_definition.type = "series";
+        };
+      };
+    };
+
+    systemd.services.recyclarr.serviceConfig.LoadCredential = [
+      "radarr-api-key:/run/agenix/radarr-api-key"
+      "sonarr-api-key:/run/agenix/sonarr-api-key"
+    ];

    services.transmission = {
      enable = true;
@ -145,6 +171,8 @@
    8686 # lidarr
    9091 # transmission web
  ];
+  age.secrets.radarr-api-key.file = ../../../secrets/radarr-api-key.age;
+  age.secrets.sonarr-api-key.file = ../../../secrets/sonarr-api-key.age;

  # jellyfin
  # jellyfin cannot run in the vpn container and use hardware encoding
@ -209,7 +237,7 @@
            globalRedirect = "s0.neet.dev";
          };
        }
-        (mkVirtualHost "ha.s0.neet.dev" "http://localhost:8123") # home assistant
+        (mkVirtualHost "ha.s0.neet.dev" "http://localhost:${toString config.services.home-assistant.config.http.server_port}")
        (mkVirtualHost "esphome.s0.neet.dev" "http://localhost:6052")
        (mkVirtualHost "zigbee.s0.neet.dev" "http://localhost:55834")
        {
@ -222,6 +250,11 @@
        (mkVirtualHost "vacuum.s0.neet.dev" "http://192.168.1.125") # valetudo
        (mkVirtualHost "sandman.s0.neet.dev" "http://192.168.9.14:3000") # es
        (mkVirtualHost "todo.s0.neet.dev" "http://localhost:${toString config.services.vikunja.port}")
+        (mkVirtualHost "budget.s0.neet.dev" "http://localhost:${toString config.services.actual.settings.port}") # actual budget
+        (mkVirtualHost "linkwarden.s0.neet.dev" "http://localhost:${toString config.services.linkwarden.port}")
+        (mkVirtualHost "memos.s0.neet.dev" "http://localhost:${toString config.services.memos.port}")
+        (mkVirtualHost "outline.s0.neet.dev" "http://localhost:${toString config.services.outline.port}")
+        (mkVirtualHost "languagetool.s0.neet.dev" "http://localhost:${toString config.services.languagetool.port}")
      ];

    tailscaleAuth = {
@ -242,6 +275,11 @@
        "zigbee.s0.neet.dev"
        "vacuum.s0.neet.dev"
        "todo.s0.neet.dev"
+        "budget.s0.neet.dev"
+        "linkwarden.s0.neet.dev"
+        # "memos.s0.neet.dev" # messes up memos /auth route
+        # "outline.s0.neet.dev" # messes up outline /auth route
+        "languagetool.s0.neet.dev"
      ];
      expectedTailnet = "koi-bebop.ts.net";
    };
@ -270,7 +308,6 @@
    openMinimalFirewall = true;
  };

-  # TODO: setup backup
  services.vikunja = {
    enable = true;
    port = 61473;
@ -284,5 +321,65 @@
    "/var/lib/vikunja"
  ];

+  services.actual.enable = true;
+
+  services.linkwarden = {
+    enable = true;
+    enableRegistration = true;
+    port = 41709;
+    environment.NEXTAUTH_URL = "https://linkwarden.s0.neet.dev/api/v1/auth";
+    environment.FLARESOLVERR_URL = "http://localhost:${toString config.services.flaresolverr.port}/v1";
+    environmentFile = "/run/agenix/linkwarden-environment";
+    package = pkgs.linkwarden.overrideAttrs (oldAttrs: {
+      # Add patch that adds support for flaresolverr
+      patches = oldAttrs.patches or [ ] ++ [
+        # https://github.com/linkwarden/linkwarden/pull/1251
+        ../../../patches/linkwarden-flaresolverr.patch
+      ];
+    });
+  };
+  age.secrets.linkwarden-environment.file = ../../../secrets/linkwarden-environment.age;
+  services.meilisearch = {
+    enable = true;
+    package = pkgs.meilisearch;
+  };
+
+  services.flaresolverr = {
+    enable = true;
+    port = 48072;
+  };
+
+  services.memos = {
+    enable = true;
+    address = "127.0.0.1";
+    port = 57643;
+  };
+
+  services.outline = {
+    enable = true;
+    forceHttps = false; # https through nginx
+    port = 43933;
+    publicUrl = "https://outline.s0.neet.dev";
+    storage.storageType = "local";
+    smtp = {
+      secure = true;
+      fromEmail = "robot@runyan.org";
+      username = "robot@runyan.org";
+      replyEmail = "robot@runyan.org";
+      host = "mail.neet.dev";
+      port = 465;
+      passwordFile = "/run/agenix/robots-email-pw";
+    };
+  };
+  age.secrets.robots-email-pw = {
+    file = ../../../secrets/robots-email-pw.age;
+    owner = config.services.outline.user;
+  };
+
+  services.languagetool = {
+    enable = true;
+    port = 60613;
+  };
+
  boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
 }
--- a/machines/storage/s0/frigate.nix
+++ b/machines/storage/s0/frigate.nix
@ -136,37 +136,16 @@ lib.mkMerge [
  }
  {
    # hardware encode/decode with amdgpu vaapi
-    systemd.services.frigate = {
-      environment.LIBVA_DRIVER_NAME = "radeonsi";
-      serviceConfig = {
-        SupplementaryGroups = [ "render" "video" ]; # for access to dev/dri/*
-        AmbientCapabilities = "CAP_PERFMON";
-      };
-    };
+    services.frigate.vaapiDriver = "radeonsi";
    services.frigate.settings.ffmpeg.hwaccel_args = "preset-vaapi";
  }
  {
    # Coral TPU for frigate
-    services.udev.packages = [ pkgs.libedgetpu ];
-    users.groups.apex = { };
-    systemd.services.frigate.environment.LD_LIBRARY_PATH = "${pkgs.libedgetpu}/lib";
-    systemd.services.frigate.serviceConfig.SupplementaryGroups = [ "apex" ];
-
-    # Coral PCIe driver
-    boot.extraModulePackages = with config.boot.kernelPackages; [ gasket ];
-    services.udev.extraRules = ''
-      SUBSYSTEM=="apex", MODE="0660", GROUP="apex"
-    '';
-
    services.frigate.settings.detectors.coral = {
      type = "edgetpu";
      device = "pci";
    };
  }
-  {
-    # Fix bug in nixos module where cache is not cleared when starting the service because "rm" cannot be found
-    systemd.services.frigate.serviceConfig.ExecStartPre = lib.mkForce "${pkgs.bash}/bin/sh -c 'rm -f /var/cache/frigate/*.mp4'";
-  }
  {
    # Don't require authentication for frigate
    # This is ok because the reverse proxy already requires tailscale access anyway
--- a/machines/storage/s0/hardware-configuration.nix
+++ b/machines/storage/s0/hardware-configuration.nix
@ -58,7 +58,11 @@
    };
  swapDevices = [ ];

+  ### networking ###
+
+  # systemd.network.enable = true;
  networking = {
+    # useNetworkd = true;
    dhcpcd.enable = false;

    vlans = {
@ -77,24 +81,12 @@
      prefixLength = 22;
    }];

-    defaultGateway = "192.168.1.1";
+    defaultGateway = {
+      interface = "eth1";
+      address = "192.168.1.1";
+    };
    nameservers = [ "1.1.1.1" "8.8.8.8" ];
  };

-  # networking = {
-  #   vlans = {
-  #     iot = {
-  #       id = 2;
-  #       interface = "eth1";
-  #     };
-  #   };
-
-  #   defaultGateway = {
-  #     interface = "eth1";
-  #     address = "192.168.1.1";
-  #     metric = 10; # always use this route as default gateway
-  #   };
-  # };
-
  powerManagement.cpuFreqGovernor = "powersave";
 }
--- a/machines/storage/s0/home-automation.nix
+++ b/machines/storage/s0/home-automation.nix
@ -15,7 +15,15 @@
    ];
  };
  networking.firewall.allowedTCPPorts = [
-    1883 # mqtt
+    # mqtt
+    1883
+
+    # Must be exposed so some local devices (such as HA voice preview) can pair with home assistant
+    config.services.home-assistant.config.http.server_port
+
+    # Music assistant (must be exposed so local devices can fetch the audio stream from it)
+    8095
+    8097
  ];

  services.zigbee2mqtt = {
@ -47,6 +55,7 @@
    enable = true;
    extraComponents = [
      "default_config"
+      "rest_command"
      "esphome"
      "met"
      "radio_browser"
@ -74,13 +83,23 @@
      "homekit_controller"
      "zha"
      "bluetooth"
+      "whisper"
+      "piper"
+      "wyoming"
+      "tts"
+      "music_assistant"
+      "openai_conversation"
    ];
-    # config = null;
    config = {
      # Includes dependencies for a basic setup
      # https://www.home-assistant.io/integrations/default_config/
      default_config = { };

+      homeassistant = {
+        external_url = "https://ha.s0.neet.dev";
+        internal_url = "http://192.168.1.2:${toString config.services.home-assistant.config.http.server_port}";
+      };
+
      # Enable reverse proxy support
      http = {
        use_x_forwarded_for = true;
@ -94,6 +113,44 @@
      ];
      # Allow using automations generated from the UI
      "automation ui" = "!include automations.yaml";
+
+      "rest_command" = {
+        json_post_request = {
+          url = "{{ url }}";
+          method = "POST";
+          content_type = "application/json";
+          payload = "{{ payload | default('{}') }}";
+        };
+      };
    };
  };
+
+  services.wyoming.faster-whisper.servers."hass" = {
+    enable = true;
+    uri = "tcp://0.0.0.0:45785";
+    model = "distil-small.en";
+    language = "en";
+  };
+
+  services.wyoming.piper.servers."hass" = {
+    enable = true;
+    uri = "tcp://0.0.0.0:45786";
+    voice = "en_US-joe-medium";
+  };
+
+  services.music-assistant = {
+    enable = true;
+    providers = [
+      "hass"
+      "hass_players"
+      "jellyfin"
+      "radiobrowser"
+      "spotify"
+    ];
+  };
+  networking.hosts = {
+    # Workaround for broken spotify api integration
+    # https://github.com/librespot-org/librespot/issues/1527#issuecomment-3167094158
+    "0.0.0.0" = [ "apresolve.spotify.com" ];
+  };
 }
--- a/machines/storage/s0/properties.nix
+++ b/machines/storage/s0/properties.nix
@ -1,6 +1,7 @@
 {
  hostNames = [
    "s0"
+    "s0.neet.dev"
  ];

  arch = "x86_64-linux";
@ -13,12 +14,17 @@
    "gitea-actions-runner"
    "frigate"
    "zigbee"
+    "media-server"
+    "linkwarden"
+    "outline"
  ];

  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";

  remoteUnlock = {
    hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNiceeFMos5ZXcYem4yFxh8PiZNNnuvhlyLbQLrgIZH";
+
+    clearnetHost = "192.168.1.2";
    onionHost = "r3zvf7f2ppaeithzswigma46pajt3hqytmkg3rshgknbl3jbni455fqd.onion";
  };
 }
--- a/overlays/actualbudget/default.nix
+++ b/overlays/actualbudget/default.nix
@ -1,39 +0,0 @@
-{ lib
-, buildNpmPackage
-, fetchFromGitHub
-, python3
-, nodejs
-, runtimeShell
-}:
-buildNpmPackage rec {
-  pname = "actual-server";
-  version = "24.10.1";
-
-  src = fetchFromGitHub {
-    owner = "actualbudget";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-VJAD+lNamwuYmiPJLXkum6piGi5zLOHBp8cUeZagb4s=";
-  };
-
-  npmDepsHash = "sha256-Z2e4+JMhI/keLerT0F4WYdLnXHRQCqL7NjNyA9SFEF8=";
-
-  patches = [
-    ./migrations-should-use-pkg-path.patch
-  ];
-
-  postPatch = ''
-    cp ${./package-lock.json} package-lock.json
-  '';
-
-  dontNpmBuild = true;
-
-  postInstall = ''
-    mkdir -p $out/bin
-    cat <<EOF > $out/bin/actual-server
-    #!${runtimeShell}
-    exec ${nodejs}/bin/node $out/lib/node_modules/actual-sync/app.js "\$@"
-    EOF
-    chmod +x $out/bin/actual-server
-  '';
-}
--- a/overlays/actualbudget/migrations-should-use-pkg-path.patch
+++ b/overlays/actualbudget/migrations-should-use-pkg-path.patch
@ -1,48 +0,0 @@
-diff --git a/src/load-config.js b/src/load-config.js
-index d99ce42..42d1351 100644
--- a/src/load-config.js
-+++ b/src/load-config.js
-@@ -3,7 +3,8 @@ import path from 'node:path';
- import { fileURLToPath } from 'node:url';
- import createDebug from 'debug';
- 
-const debug = createDebug('actual:config');
-+// const debug = createDebug('actual:config');
-+const debug = console.log;
- const debugSensitive = createDebug('actual-sensitive:config');
- 
- const projectRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-@@ -108,6 +109,7 @@ const finalConfig = {
-   serverFiles: process.env.ACTUAL_SERVER_FILES || config.serverFiles,
-   userFiles: process.env.ACTUAL_USER_FILES || config.userFiles,
-   webRoot: process.env.ACTUAL_WEB_ROOT || config.webRoot,
-+  dataDir: process.env.ACTUAL_DATA_DIR || config.dataDir,
-   https:
-     process.env.ACTUAL_HTTPS_KEY && process.env.ACTUAL_HTTPS_CERT
-       ? {
-diff --git a/src/migrations.js b/src/migrations.js
-index cba7db0..9983471 100644
--- a/src/migrations.js
-+++ b/src/migrations.js
-@@ -1,6 +1,12 @@
- import migrate from 'migrate';
- import path from 'node:path';
- import config from './load-config.js';
-+import { fileURLToPath } from 'url';
-+
-+const __filename = fileURLToPath(import.meta.url);
-+const __dirname = path.dirname(__filename);
-+const appRoot = path.dirname(__dirname);
-+const migrationsDirectory = path.join(appRoot, "migrations");
- 
- export default function run(direction = 'up') {
-   console.log(
-@@ -13,7 +19,7 @@ export default function run(direction = 'up') {
-         stateStore: `${path.join(config.dataDir, '.migrate')}${
-           config.mode === 'test' ? '-test' : ''
-         }`,
-        migrationsDirectory: `${path.join(config.projectRoot, 'migrations')}`,
-+        migrationsDirectory
-       },
-       (err, set) => {
-         if (err) {
--- a/overlays/actualbudget/package-lock.json
+++ b/overlays/actualbudget/package-lock.json
--- a/overlays/default.nix
+++ b/overlays/default.nix
@ -4,10 +4,4 @@ final: prev:
 let
  system = prev.system;
 in
-{
-  actual-server = prev.callPackage ./actualbudget { };
-
-  # Copied entire package from nixpkgs to downgrade to python 3.11 since 3.12 is broken.
-  # See: https://github.com/Py-KMS-Organization/py-kms/issues/117
-  pykms = prev.callPackage ./pykms.nix { };
-}
+{ }
--- a/overlays/pykms.nix
+++ b/overlays/pykms.nix
@ -1,103 +0,0 @@
-{ lib
-, fetchFromGitHub
-, python311
-, writeText
-, writeShellScript
-, sqlite
-, nixosTests
-}:
-let
-  pypkgs = python311.pkgs;
-
-  dbSql = writeText "create_pykms_db.sql" ''
-    CREATE TABLE clients(
-      clientMachineId TEXT,
-      machineName     TEXT,
-      applicationId   TEXT,
-      skuId           TEXT,
-      licenseStatus   TEXT,
-      lastRequestTime INTEGER,
-      kmsEpid         TEXT,
-      requestCount    INTEGER
-    );
-  '';
-
-  dbScript = writeShellScript "create_pykms_db.sh" ''
-    set -eEuo pipefail
-
-    db=''${1:-/var/lib/pykms/clients.db}
-
-    if [ ! -e $db ] ; then
-      ${lib.getBin sqlite}/bin/sqlite3 $db < ${dbSql}
-    fi
-  '';
-
-in
-pypkgs.buildPythonApplication rec {
-  pname = "pykms";
-  version = "unstable-2024-05-28";
-
-  src = fetchFromGitHub {
-    owner = "Py-KMS-Organization";
-    repo = "py-kms";
-    rev = "646f4766f4195dbea0695700a7ddaac70a3294f9";
-    hash = "sha256-YCqPo7WkCfXyuTjL4IYapdcUN/Vj465Jz6XhQessyz0=";
-  };
-
-  sourceRoot = "${src.name}/py-kms";
-
-  propagatedBuildInputs = with pypkgs; [
-    systemd
-    pytz
-    tzlocal
-    dnspython
-  ];
-
-  postPatch = ''
-    siteDir=$out/${python311.sitePackages}
-
-    substituteInPlace pykms_DB2Dict.py \
-      --replace "'KmsDataBase.xml'" "'$siteDir/KmsDataBase.xml'"
-  '';
-
-  format = "other";
-
-  # there are no tests
-  doCheck = false;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $siteDir
-
-    PYTHONPATH="$PYTHONPATH:$siteDir"
-
-    mv * $siteDir
-    for b in Client Server ; do
-      makeWrapper ${python311.interpreter} $out/bin/''${b,,} \
-        --argv0 pykms-''${b,,} \
-        --add-flags $siteDir/pykms_$b.py \
-        --set PYTHONPATH $PYTHONPATH
-    done
-
-    install -Dm755 ${dbScript} $out/libexec/create_pykms_db.sh
-
-    install -Dm644 ../README.md -t $out/share/doc/pykms
-
-    ${python311.interpreter} -m compileall $siteDir
-
-    runHook postInstall
-  '';
-
-  passthru.tests = { inherit (nixosTests) pykms; };
-
-  meta = with lib; {
-    description = "Windows KMS (Key Management Service) server written in Python";
-    homepage = "https://github.com/Py-KMS-Organization/py-kms";
-    license = licenses.unlicense;
-    maintainers = with maintainers; [
-      peterhoeg
-      zopieux
-    ];
-  };
-}
--- a/patches/librespot-pin.patch
+++ b/patches/librespot-pin.patch
@ -0,0 +1,28 @@
+diff --git a/pkgs/applications/audio/librespot/default.nix b/pkgs/applications/audio/librespot/default.nix
+index 9694c3d0cf4f..ca9502de7ee1 100644
+--- a/pkgs/applications/audio/librespot/default.nix
+++ b/pkgs/applications/audio/librespot/default.nix
+@@ -25,14 +25,19 @@ rustPlatform.buildRustPackage rec {
+   version = "0.6.0";
+ 
+   src = fetchFromGitHub {
+-    owner = "librespot-org";
+    owner = "googlebot42";
+     repo = "librespot";
+-    rev = "v${version}";
+-    sha256 = "sha256-dGQDRb7fgIkXelZKa+PdodIs9DxbgEMlVGJjK/hU3Mo=";
+    rev = "786cc46199e583f304a84c786acb0a9b37bc3fbd";
+    sha256 = "sha256-xaOrqC8yCjF23Tz31RD3CzqZ3xxrDM6ncW1yoovEaGQ=";
+   };
+ 
+   useFetchCargoVendor = true;
+-  cargoHash = "sha256-SqvJSHkyd1IicT6c4pE96dBJNNodULhpyG14HRGVWCk=";
+  cargoHash = "sha256-sUAZgOuBD9CGAy1mRqLRzVnVfxB0DqSCNAc2yzItTCA=";
+
+  cargoBuildFlags = [
+    "--features"
+    "passthrough-decoder"
+  ];
+ 
+   nativeBuildInputs = [
+     pkg-config
--- a/patches/linkwarden-flaresolverr.patch
+++ b/patches/linkwarden-flaresolverr.patch
@ -0,0 +1,144 @@
+commit 3dac9f081f267e4a528decbd9d50e1f45ea7c2ba
+Author: SteveImmanuel <steve@telepix.net>
+Date:   Fri Jun 27 13:07:38 2025 +0900
+
+    Add flaresolverr support into linkwarden
+
+diff --git a/.env.sample b/.env.sample
+index bd3abcb0..0ca96d92 100644
+--- a/.env.sample
+++ b/.env.sample
+@@ -43,6 +43,7 @@ TEXT_CONTENT_LIMIT=
+ SEARCH_FILTER_LIMIT=
+ INDEX_TAKE_COUNT=
+ MEILI_TIMEOUT=
+FLARESOLVERR_URL=
+ 
+ # AI Settings
+ NEXT_PUBLIC_OLLAMA_ENDPOINT_URL=
+diff --git a/apps/worker/lib/archiveHandler.ts b/apps/worker/lib/archiveHandler.ts
+index 8ae19e2c..6c8656b2 100644
+--- a/apps/worker/lib/archiveHandler.ts
+++ b/apps/worker/lib/archiveHandler.ts
+@@ -6,6 +6,7 @@ import {
+   chromium,
+   devices,
+ } from "playwright";
+import axios from 'axios';
+ import { prisma } from "@linkwarden/prisma";
+ import sendToWayback from "./preservationScheme/sendToWayback";
+ import { AiTaggingMethod } from "@linkwarden/prisma/client";
+@@ -75,6 +76,22 @@ export default async function archiveHandler(
+   });
+ 
+   const { browser, context } = await getBrowser();
+
+  const captchaSolve = await solveCaptcha(link.url);
+
+  if (captchaSolve.status === 'error') {
+    console.error('Error solving captcha');
+  } else if (captchaSolve.status === 'fail') {
+    console.warn('Failed solving captcha');
+  } else if (captchaSolve.status === 'skip') {
+    console.info('Skip solving captcha');
+  } else {
+    if (captchaSolve.solution) {
+      console.info('Solving captcha');
+      await context.addCookies(captchaSolve.solution.cookies);
+    }
+  }
+
+   const page = await context.newPage();
+ 
+   createFolder({ filePath: `archives/preview/${link.collectionId}` });
+@@ -105,6 +122,7 @@ export default async function archiveHandler(
+           aiTag: user.aiTaggingMethod !== AiTaggingMethod.DISABLED,
+         };
+ 
+  let newLinkName = '';
+   try {
+     await Promise.race([
+       (async () => {
+@@ -127,6 +145,7 @@ export default async function archiveHandler(
+           // archive url
+ 
+           await page.goto(link.url, { waitUntil: "domcontentloaded" });
+          newLinkName = await page.title();
+ 
+           const metaDescription = await page.evaluate(() => {
+             const description = document.querySelector(
+@@ -186,10 +205,16 @@ export default async function archiveHandler(
+       where: { id: link.id },
+     });
+ 
+-    if (finalLink)
+    if (finalLink) {
+      // Replace the captcha-blocked link name if it has not been updated by user, else keep the same name
+      if (newLinkName === '' || finalLink.name === newLinkName || finalLink.name !== 'Just a moment...') {
+        newLinkName = finalLink.name;
+      }
+
+       await prisma.link.update({
+         where: { id: link.id },
+         data: {
+          name: newLinkName,
+           lastPreserved: new Date().toISOString(),
+           readable: !finalLink.readable ? "unavailable" : undefined,
+           image: !finalLink.image ? "unavailable" : undefined,
+@@ -203,6 +228,7 @@ export default async function archiveHandler(
+               : undefined,
+         },
+       });
+    }
+     else {
+       await removeFiles(link.id, link.collectionId);
+     }
+@@ -271,6 +297,48 @@ export function getBrowserOptions(): LaunchOptions {
+   return browserOptions;
+ }
+ 
+async function solveCaptcha(url: string, maxTimeout: number = 60000): Promise<{
+  status: string,
+  solution?: {
+    cookies: {
+      name: string,
+      value: string,
+      domain: string,
+      path: string,
+      secure: boolean,
+      expires?: number,
+      httpOnly?: boolean,
+      sameSite?: "Strict" | "Lax" | "None"
+    }[],
+  }
+}> {
+  if (process.env.FLARESOLVERR_URL) {
+    try {
+      const response = await axios.post(process.env.FLARESOLVERR_URL,
+        {
+          cmd: 'request.get',
+          url,
+          maxTimeout
+        },
+        {
+          headers: { 'Content-Type': 'application/json' }
+        }
+      )
+
+      if (response.status !== 200) {
+        return { status: 'fail' };
+      }
+
+      return { status: response.data.status, solution: response.data.solution };
+    } catch (error) {
+      console.error('Error during captcha solving:', error);
+      return { status: 'error' };
+    }
+  }
+
+  return { status: 'skip' };
+}
+
+ async function getBrowser(): Promise<{
+   browser: Browser;
+   context: BrowserContext;
--- a/secrets/backblaze-s3-backups.age
+++ b/secrets/backblaze-s3-backups.age
--- a/secrets/binary-cache-private-key.age
+++ b/secrets/binary-cache-private-key.age
--- a/secrets/binary-cache-push-sshkey.age
+++ b/secrets/binary-cache-push-sshkey.age
--- a/secrets/cris-hashed-email-pw.age
+++ b/secrets/cris-hashed-email-pw.age
@ -1,10 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g WZ9p/pCsEDpKbgGDLcTtisn25kExQX9iv+tL3wyPwiY
-vom2z9QRIQSFB0+4/7lSWUEB0eoAG+08nXgiUg/OSX4
-> ssh-ed25519 w3nu8g ECLZwCRJVJqyUMf70EOl2/3ExTruKaxCSQlY5fBZqxk
-VemnmGpzx1VprkybW1hPlkfmiDaNcBDoEzX0mDZgmu0
-> ssh-ed25519 dMQYog QiPsbFE8MtXnRNBwkUEC+6grqXEbDstEtxYR8uJks2w
-O3JWQGppFeZEd6o3W0KVTEIyNVGeLxKfTYTlgsAEVHQ
--- RncZzBFEyMAkpZRWrPORA0DPHuCTNswmWG5CMNnfm4A
-	ñ/¼ÔËõôŒ8nàÅ¥«¸7hîtä?T˜=‘%zˆ°[¤ÝØ!(…uÔdÇuò@
-×¢EbƒyŽ¦ù¦D=Ü!‹„XþtÞÔ:#¦þþãÞXÈX@ú_M‘
+-> ssh-ed25519 6AT2/g /5WB1i5RrjWIbnBErUWliedwnv8qTIsl8r8zbWNkOmA
+wr8fN2FbNnCRUNgV3aZPQibXHy1MNjMP9SMK7urHL+o
+-> ssh-ed25519 w3nu8g exWaIxM68nwycLphws0PRnRvvdOuT7h3xOZqndsAHxo
+EIUTjS57F5MKGt6bJjaFxHnbTFzUrpmrTVqNZoQ060Y
+-> ssh-ed25519 evqvfg SAQyzljqtBd65bpZo6yMsIAS1d5ymjKBoODjOQMUdTs
+/roobEvljSoREVHygqLNKTJHWG6rDdhXmlc4BM/7Em8
+--- Gp+OLOIN5aqR3G1fSM+Epdw4B6RTXrB99Ty/YUWI0S8
+ÊžÁ<EFBFBD>¶…Àoÿ;¥3ŽeºÉ<>„Ôu
âT
éÄdŸ«‡ñüÈ<²y{ Jëë¶ñg]nŸþ+QX˜Øéóå´qEÜ™çƒMþË/QàÓÔ#kÉ[8(‚ß5
--- a/secrets/digitalocean-dns-credentials.age
+++ b/secrets/digitalocean-dns-credentials.age
@ -1,11 +1,16 @@
 age-encryption.org/v1
-> ssh-ed25519 WBT1Hw TGdD8Nw+GPITDOXGhevSu+880DWET7WYN3nIyJ0xy2o
-69xepRTnmaFwa4IsGJjDdwZqTSf5fz6EZK0/q3oz/ZA
-> ssh-ed25519 6AT2/g EmqXrXXsRxSS6AsH+7VMgoJTYo9eGj8ebLiLT4IWNxg
-eKs5/3tQMdg5bGJKNz8PFh9C7HiV+IlOU9dzpYcGIjo
-> ssh-ed25519 hPp1nw wsIF676is8FquF6oANNauPrumsMnfVUZpPeVKEtBOzQ
-qZR8LSF+TQ2K3K0An69NHfk53ZqNEWev0IVcb71SR40
-> ssh-ed25519 w3nu8g TKHY/5JuzFMhbW9CQAOI3woX8M9b1H/XXUpIMT0Mylk
-byJV0/BJ3ftG5eYv5BeyIYBi0VoWG31HRiENUxSeYE8
--- fwHXHtE/sMLqCLSD8tR0oCPgNuif9Y/ncHU97hbf/Bw
-f"+ÉŒqc<71>H†Ñjï!JSšË¡Ì|yMìðX¼þMl<4D>ýçCy™îUXn»Égk¨ë)¤óOY§uº„¦²¶g%è Håvn·œ5ô!$Jœ¤Š…¶›$<24>#Dö;±¥àÖ	}ÏŸcçKšˆ{R/
+-> ssh-ed25519 WBT1Hw ZMrG+yubAhxfDf/hh8gSfxZuvM5hsOBQu/V/KfdcNyk
+un2XWeWmt9pYLAk4n54A52T96sgvasNgD65AiYL9YO0
+-> ssh-ed25519 6AT2/g KxgJ1UJ1amcXzpcFmFFi3C3umo70iwmL5GxDaqfk1j8
+VZkDd3vgf1xX9kdzrDhmv2w/Ubq6UUJyw7UAkqmWlOU
+-> ssh-ed25519 r848+g MXTm1V8lHIb4oHg0glttyooeECLn0uVrHaY5NzAE718
+Qv+vEeuFz+sew5GmR17ALXKmpfByjwi2j93dMVAU5WY
+-> ssh-ed25519 hPp1nw 7dxkddbQHdVi+7dpxBHXYi8pNgMsRjfj8KLqgJFYqQc
+984ysvTIvdjJirkUIfNMEUVKkzUTCBDAOgLbKZj5AhU
+-> ssh-ed25519 w3nu8g fC2KGM9/I2Sl0VHkYZy7YbvmF5CMWRIUahgGaGiZPVM
+IGvvjHj14bV9PS2r0L3pFNV+eDCE63ZmNdHfCG0yCw
+-> ssh-ed25519 evqvfg fAr1POoqc5y1stRkCJfgCHSW8QXIPEiFZT0STSP931s
+wFWWX6tPV0mV5HC3be7a2xr4Pax35rT16S0h7eiF990
+--- N5A6/IK5wKwzUT20Hxu/37ovLEkLGGj7Y30p1hu5fNM
+r&BãHA%ÇºhŒRÕ²~!Ä<>{bÝ[ØU?‹k(‹µD
+öB7[öùððb/ [¿YçÚÃy[yOCjT-9:†xâ²(;ÝüœXy\¬N‘hÄíòäLPö¼§y¿mG±—ÑÁfŽý4aT<²Š
‡çaŠè†@
--- a/secrets/frigate-credentials.age
+++ b/secrets/frigate-credentials.age
@ -1,7 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 hPp1nw zOXF7NsZjm+DCYrJ+Ap2mX35JUt37CLJP1RhyOjB/XE
-ePprJM2cnhYZhP8aJUXOZeGHJm/DHlRYomWN+lFaU6w
-> ssh-ed25519 w3nu8g gjeFAbFWXyPdGauKHXAzuIP9fmaj2Oysq9fHO8q7u38
-KiMR0pgEPtsfZnYAIsH7UHNhnsB6rtsW/hqV03uS2dI
--- BPzPECz1g6vEv4OlRn6+FnWP9oq3tn6TN2o867icxYA
-}ìjºùŽ+l&þàx<C3A0>-TïÝ‹b‡ÅèØÄ·<C384>€Dg‰ñgc’*ˆ0<CB86>÷µcp
…}uþ‹7Íßã%9Ð%ŽÒú›©S¥ ‰|ÂšôêöQœÃ*9Ø$ä ŽŠ
ÍÖi;)c?ÍÍýGh¤VvªnlÚs¤Ç)r }ÒhE5K‡bg–-<2D>®
+-> ssh-ed25519 hPp1nw p8uus03Jrn9HtEelmufFx2orYkSlyAq90L7bTm3n/GQ
+Ki+Pf1RG27H2wmgxXz2u7fqlU2hrxTmBZCn8RMIh8wI
+-> ssh-ed25519 w3nu8g UQQYC93hQLRIgaA5P3Upax2HzfNddWkjTkAyZF5/hFs
+33fVUBBaJFRhDIuZoM8Rn1fd0JwqjmyXsbu4pioxXw4
+-> ssh-ed25519 evqvfg /J1fpbZORlnYADjqAcF8kV81e+mlxXC4mhMwozG7YXw
+KYAtHd1MyNiEKoN/RgBCOsn/uCvXIjusXPFWW4urMFY
+--- KVdBWZjlOA44GAK3GubvPaXlbg1zdpxL7+rJ4hv4Lmo
+X/{×[PĽćÎĹ+ł$_Z,t\#e¶ĐĂfńř>„,0ié©Ě’;ţ°ÖVńB§QÍ8,Řëńú'JŞR×•=´ŐLś–ęÉäęLłÝ@běđp?HĹM¦2—uÁňł€ŕÝp'g:ÄWŔ;YXs©ÍóN ĂO´m»y~Łň
--- a/secrets/gitea-actions-runner-token.age
+++ b/secrets/gitea-actions-runner-token.age
@ -1,11 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 WBT1Hw PbGwwDeulHF6kdh073rq0RvD1hlx6spnKNgKU+QeDAw
-7dITwSQ2p1LZuaVEzLxcGOhB97MQT2zGoRrnNUMcOFk
-> ssh-ed25519 hPp1nw Dn+5Fpme+JmRZKkCkqtCuD87p+sDYDA6OZ2aUmBkCRs
-Dgg3orXF4RYT/fHtc2tRuIhOQu48zICMqgPyV47vpf4
-> ssh-ed25519 w3nu8g dghNLDH1Tm+sm42HXDhrLFtmU4iDF1yCGrO2VSgzZjo
-71scUVrGr4c4dunAFJYKd+uJ6aYJpSWBAk9swbv+IzM
-> ssh-ed25519 dMQYog Wnl1+rh0Q3YD2s1UD0OYVm39wY/Uw1NRK3K7EFhFMls
-wXF6QBonlCalS1vI9cxzWgv1Gi+yAtYn6HrYCfpl5Nw
--- rLOoGk0iX+wuNd1CKv7g2PRd2Ic+8JHCQhrVBaF9zbE
-<EFBFBD>òüüË¤/A¦Ì(ØiHC¸@¢Þð‰h`ˆ3ªá´'	¬ÚöáDì>ð¿¤~¸ÿÁö?ÑÃMêÙ@<40>t°(“Ò@ö×¿^xÆMÉ}
+-> ssh-ed25519 hPp1nw 5wFHyqBRdZxUDa180U3RgrL4DWNF3BO60C1ytWdZvXM
+anPvoQk7kvz/wBddKYquSZ7b6dslhIrhV8wnMpC725E
+-> ssh-ed25519 w3nu8g McO3H/GkcqQavMokZhXAsRijGq0wiXzmN1GH29n12wg
+ooFxa+vYd49JSwdj9Knc8iDFyxX4elDb3IjOjrC5Cmo
+-> ssh-ed25519 evqvfg pW/T4WXURnk7G+HL+O3STBWkQ+5by7EgwOPTcMNakyw
+HByJjWNhOg7PSms4Px9NO0FnFcMj1Ig2rOXhCNQri7Y
+--- LCgnSaNDEKv8du0OxZoLtyF4W02E/6pC/e1h0+XDDGA
+õViÁ°“ìbð[¾í<C2BE><C3AD>%þÚ{œtäL8àP‚[¦2z{g/KG®üÈAëZýåšœÂïàþ0pÃSg²…ó¶µ¿P³ÊYÊù—$•á
--- a/secrets/hashed-email-pw.age
+++ b/secrets/hashed-email-pw.age
@ -1,9 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g 98/m3t8axoVBE6WzdxBtRhV2uSQKSCXwQjyxfWXPmQk
-AxV0FTvqbWfk/gf65d05PcotbEnYr4PgDQnsaYxP/MU
-> ssh-ed25519 w3nu8g jys7B4COD4iINANeSCD3BqGFoghxTmsbuXoOOIiP+wQ
-b7eSN5fe4szfliINOr7ZQ7AoSsIK5akmIQ6uLDabcIE
-> ssh-ed25519 dMQYog ToNUqTPYmxpz9OUcC94egELcPfHQHCErfHN6l9kSrRY
-2KoSVoWp+FH29YfH57ri2KOvhkuqYew1+PXm99e0BaI
--- Cjk3E/MjgCF45aLlFeyoGiaUEZk/QuKtsvPb6GpzD8Q
-m°å>‹“~czÆêåŒ¦†``ÜÏqX«š'ÁÎ%ôwÔž~×ÄL·eä'a±]û‹0ò´LÉÀ‰%ÍY‚TÊÓc9f¡W¶Ã^¤9ÊõÙÝ2®™æ¶ÆBÌa ƒ™ 
+-> ssh-ed25519 6AT2/g kH4DufpuybglKzupJsGvWKfWsZ5xhRwefdPKkx/AuW4
+QrDu/vSbgEIgYSnraG5u37RNp6Mp6ARjqzAduy9iX/Y
+-> ssh-ed25519 w3nu8g mBt4VQNJAMwcseVhc8k/mB5XThbQT48OnstkWaGQ8zQ
+6w7lMJA8giG9PVux1ncjCPrN7ER0S7uWi8UjhOOeMS8
+-> ssh-ed25519 evqvfg uM4SAf1aMCvtRKdPn5BFr1EWlBGVgbgjp6OkuMV7GnU
+Zi5X5TL7phRpwsbUVsFgS0qHvqtLdckz01qDfVypn/s
+--- I92hNxGkHSHR/fQhUI5UAXvzIvMd+YBih9nFP5IZW3w
+áÎ_§ØN/	nÞúú®H<C2AE>ô¡ÒaŽeõâ¼ÈêÅhÊB¤ê»[Ô´ðªqÂ<71>\ý+M:F‹Üîñ‚gP¦¤¤nh’¨¼N/¸2ÞÇl8µ3q>	rHt’UJG×n
--- a/secrets/hashed-robots-email-pw.age
+++ b/secrets/hashed-robots-email-pw.age
--- a/secrets/hostapd-pw-CXNK00BF9176.age
+++ b/secrets/hostapd-pw-CXNK00BF9176.age
@ -1,7 +1,7 @@
 age-encryption.org/v1
-> ssh-ed25519 w3nu8g ER07FH17Wm9op5F4pCftNK76f+nNjtA6zQc/2dLyAHI
-nxxq/8tS3ENJhAEIhJCiSi7dV+68AmcEMh9zvZoWpdY
-> ssh-ed25519 dMQYog JelCfh+akP7C/i1kimq3fC5PRQa9gHbmBaOnjKu+PDw
-GVTwo7MzkpCereZRh0HVjGYmtdMY1gHowMZtUQl7XQw
--- p2l83t3bEdBrrp1ctaqqKhwB4l2McgZqZTtc2SXgd8Q
-ø±ôeÆd\Yå4lXVF§U©<55>þM||)Ø¯Ôûú•¶Ü8¿>ëž%ðóJ$à´Õè
+-> ssh-ed25519 w3nu8g 6127BAGsI/0p6vDXwo4W9ehh/Tzr/XblDYFYYtNfziU
+k0ZYtv6bTTKTdE81mPqwmuC3KSgimMn+noAm3LrzAkw
+-> ssh-ed25519 evqvfg n2/Ds6CbjTEGK0/faiUj+S1VbZ8cLjqAMBZEVM6PIwQ
+sPaFFL2bU2mUzKf8DLIHqXxGXZcER5gnKq9VpGA+GyU
+--- /KNS4o0n8Ol/i8vRJ1dBJklDR1UhR6kQNcM2rwqGNRw
+Îd;©<>_É•ÔŸ
ŽVë3_"ûÈ)“Ú(e…âßqÍþ$+ÓA¨æ±ÿç”Y#G
--- a/secrets/hostapd-pw-experimental-tower.age
+++ b/secrets/hostapd-pw-experimental-tower.age
--- a/secrets/iodine.age
+++ b/secrets/iodine.age
@ -1,9 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g Knb25oYknkiXyMqVBR3T0sFSO4hDjWUTq3xIml/b4ig
-n7xamnrZ+SCWiKqniF3r2JvH4G8q2pJaHzF0riNEDf4
-> ssh-ed25519 w3nu8g 7+2R5RpLjBf4jjj3S8ibMquUWgRMrifziGQubwuLrhA
-3jLCalnbA3Z2jr8Zs+qrpzSoi3Jv6E5OV2binpr3Kk4
-> ssh-ed25519 dMQYog Nh2e7me0tiG7ZwQK8669VS0LCYFSH+b33I9tr8uI5CY
-7Gs1N9eZa1CGR9pczzugHbqnghqevX7kQCOeqR4q0eI
--- OzW+omJsZA/b4DMF4hdQga7JVgiEYluZok3r8JM258I
-*³²ÝPŽ†AcèÈ1·@Át¸e÷nf&ù#I7‡a‰Ûâc†ÃÀ<C383>êbDâ–~aõ]1w=Á
+-> ssh-ed25519 6AT2/g +D1KEq8bDAErE5NJABbpoONsmolgc2aNDPucgzJZT2A
+jJpebutfcnNYT71oiwEATP89ZSnmjXx3skHrrk2MLOY
+-> ssh-ed25519 w3nu8g MHVAh0Jp4pTahZoHIw5wUsp8STJ3rlH1C6+jrA+sJFI
+sqMpGLw3HPumgAE7GYddT/iuewYZH3xy7mE5gyrWloA
+-> ssh-ed25519 evqvfg HoJqNfMckAJbHBCleHcSnI1VbOx3l7lQv1yM030G5mc
+cscFawOoA4rA3EAc/FtCafLYlVZ4vcDEEmzouOrwVVY
+--- sjGmx4I61x+AP72rCFeWyNJAEUlQz/az5rQ7jNfjXjU
+ËgîV&\÷MŒ²ÜuÊMm;ãY?‡úRDÆ`‰(2Õ·ÕøÒ‘à–é€Æ²)¸
Àò¦Ý£T
--- a/secrets/librechat-env-file.age
+++ b/secrets/librechat-env-file.age
--- a/secrets/linkwarden-environment.age
+++ b/secrets/linkwarden-environment.age
--- a/secrets/nextcloud-pw.age
+++ b/secrets/nextcloud-pw.age
--- a/secrets/oauth2-proxy-env.age
+++ b/secrets/oauth2-proxy-env.age
--- a/secrets/pia-login.age
+++ b/secrets/pia-login.age
@ -1,11 +1,12 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g MGKlbzVOk5+czgAOerwl+eIyOifXJm/q4UgQUXVpx1c
-43l6s4+5TSMQyO9tAg7v9Y5OdXOjKYz56lbr9Jm2r+o
-> ssh-ed25519 hPp1nw aOxni4sFPPgedUkBOuOyEWfFPJrhdTJnivIaWt5RJxM
-KNaxijzSMp7EjYKwWiAP66nPYYZK3/VXL8u+3uJt6bg
-> ssh-ed25519 w3nu8g qTAzEzQbFze35AtbvkYREw3wa7ApDN5u7RSZUXrEpms
-Dy0uGF458A9RJMvDl2XKOkEABbbRgT+eIgvb6ZOEQqg
-> ssh-ed25519 dMQYog 5DfYuGeWuN0/CO6WWbFIi7LaKl23FXYVdPROM+TFpCA
-PDBdDn+YUMKYNKFkCEfXesmkB/XUxZRK3ddQt0kqQ7g
--- JOeG87EVD+QBx6n+rMoPTOni0PyoG7xx4a2USNiapYI
-Zsý{ÅiÁ_QÂ\+ô@@Üòß¸Ã¹&_š5$¿Gt2¢rF“y×ÄQ§Iaž7ôÙÉzàgf%O(µÙ,VéÂ}ÿn|û'J¸2ø¨óQÑB
+-> ssh-ed25519 6AT2/g rk3jNJlQwab++isNOPpQJZlb4rL7nIAYfoAhlvY9QTc
+J+6/MRepeixmDQzz3bRd/AMJpZls60dUBjrHh+p759Y
+-> ssh-ed25519 hPp1nw GnjIH+V6mLcXvfNhiBBwqBvY6NO8W+1sPcgvu6fS0nI
+qP6jDxd+0h/AZhsBs7om0BDutrPmP/1NUEuZ7LBlxmw
+-> ssh-ed25519 w3nu8g QwztUaCCtEVeI9AbJn5dKH07Y2fal+Nn9/bsnBkTJgI
+/Ce0a9bGv6RmQiK8C3wIvMCh5DM+m/EujYFsXgNjieY
+-> ssh-ed25519 evqvfg VLoQNzz62Q1KawvTHWeyBfCGTlGYNPQcdTaPq7cLxDo
+eabkTR9iUPYqCj50R7rwYcrMqcs+RHWqRZai2KKzPMQ
+--- fQkT/xI/iptJd/UmihEcUWx77d2wr6bOj5lecPa/P8o
+,V„ý²lzºOP¿'Ìü2ÑÃ4¦o¸ü|ÅK‘m÷´»²FYL†Ì&ìâÓáéÊÁ>†©Ä\@emVÈnŒm½®6nôu—O@wRèãÁ‘åý^_
+ztFŠ©~
--- a/secrets/radarr-api-key.age
+++ b/secrets/radarr-api-key.age
@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw MRItBkM6GC+jht3ly0K04wCptE28UI9FmFAm2+8KHHw
+Pbz+oZcWtzSz4eyWyRbi/a89Q3PripNJ+PYM/wiLKq0
+-> ssh-ed25519 w3nu8g a5G6FrbGmglm2Ba2T6NPsaVP+/4g//jh9ui/BVzR0EU
+f0xNuCbhC0FqqFH6CD9jPAgWmTEZqga/fRjU6VMdfSk
+-> ssh-ed25519 evqvfg 1lhGzpY7I0fKimq6sQ/zWUHCFSEaN31rmGCckUepfHY
+3OfNrzAajS6azIT90CmVnBzXLXcwMw/BRhOfbcuuz3c
+--- vagzuZWeWUcZTBISnL4vNVcpMX2CbJGHwfaAFiIZeHM
+en¼!<z'ß‹û,W
8†}òÃ™ö=åà—lõÖŸê^^56èiÌ”½àÜd<C39C>æß»ü<C2BB>t.yçw>_%
--- a/secrets/restic-password.age
+++ b/secrets/restic-password.age
--- a/secrets/robots-email-pw.age
+++ b/secrets/robots-email-pw.age
--- a/secrets/sasl_relay_passwd.age
+++ b/secrets/sasl_relay_passwd.age
--- a/secrets/searx.age
+++ b/secrets/searx.age
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@ -17,7 +17,7 @@ with roles;
  "cris-hashed-email-pw.age".publicKeys = email-server;
  "sasl_relay_passwd.age".publicKeys = email-server;
  "hashed-robots-email-pw.age".publicKeys = email-server;
-  "robots-email-pw.age".publicKeys = gitea;
+  "robots-email-pw.age".publicKeys = gitea ++ outline;

  # nix binary cache
  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
@ -31,12 +31,14 @@ with roles;

  # cloud
  "nextcloud-pw.age".publicKeys = nextcloud;
+  "whiteboard-server-jwt-secret.age".publicKeys = nextcloud;
  "smb-secrets.age".publicKeys = personal ++ media-center;
  "oauth2-proxy-env.age".publicKeys = server;

  # services
  "searx.age".publicKeys = nobody;
  "wolframalpha.age".publicKeys = dailybot;
+  "linkwarden-environment.age".publicKeys = linkwarden;

  # hostapd
  "hostapd-pw-experimental-tower.age".publicKeys = nobody;
@ -60,4 +62,8 @@ with roles;

  # zigbee2mqtt secrets
  "zigbee2mqtt.yaml.age".publicKeys = zigbee;
+
+  # Sonarr and Radarr secrets
+  "radarr-api-key.age".publicKeys = media-server;
+  "sonarr-api-key.age".publicKeys = media-server;
 }
--- a/secrets/smb-secrets.age
+++ b/secrets/smb-secrets.age
@ -1,19 +1,17 @@
 age-encryption.org/v1
-> ssh-ed25519 N7drjg x2s9QZ7Ijvg4t2peGng9/zX1ZmnGggsvWHJFHEktCgw
-o64an6DJ6Be8Jlhzn9ciQTByRAK5f2ckankCRH3y+Uw
-> ssh-ed25519 yHDAQw HYHo6anhKDnD74ab04Ql4RB8+WBA6EavYASX7532NCE
-aTp2V9g18yzUTq1ezqETj6jM2Yb1Bt5+JNkrIDT2Djs
-> ssh-ed25519 jQaHAA xGKcIQOkO/i4E2ZWZ+O4sAp7ADqCRqfRQHhKQu6yWh4
-RJnqK/t0YQrIej8fRDJGjOtQD7VvgJRfCUWR0/UYcSY
-> ssh-ed25519 w3nu8g P9DQy19TvDCi3nfOhFj73bNZEtUs1BrLubt5/BtLoU4
-Sx41bk41dQYa3eoBayUMRIHqMWaRiwXm8BqErDBSbDw
-> ssh-ed25519 dMQYog OWU92PMFo9tGtlkK9zlmMFhh81TGkYlcX1PrxZl35yc
-owDk8wWXETS+iybhTMDmQH+eBuzZRDJIlVGCwu4LqTI
-> ssh-ed25519 jQaHAA MzA8dSYZ/Ysp4ogKEEu84mal8779RgkT4Gy6rBEw+kM
-m75x/b83aP5G1vg7EXlcLizcm16fEAUAD+VNcdTMnnQ
-> ssh-ed25519 w3nu8g AAA3Me3KJgLvtQvyxLvlQ7pCnv7w73ja6Z2+3A82eGs
-+yCW7qCdjk0fiQJmH8poMoc7APKyX/PY7zZyAG1O+Yg
-> ssh-ed25519 dMQYog Dd8e6srT+EIl2PH0RP1bQVsDx+HCQjhFndx5TFyhfx8
-j7Met77pWZzK9cMTt29gWB+d9YFVH5T9qs+ulHS3kAo
--- MgOK/g5hOVkGuUNDBSgVeGc9+ndjxLEA7nKSfLJMr4s
-~Ÿ‹¬&”™)<29>ŠG®Ÿ¨‡'UÐÞzc¾uFGì(<ò¯ùçV"ƒÕ3þH0x0$•<>w$YvO3	"Ï×ðV~ÀŠ¸HÁ~XÛ]GœÆqµ®ã÷œ¢y'ãÓ*–Dê±ÏúœÕk#\ðAï<41>5ë{«Fe\~
+-> ssh-ed25519 N7drjg lVrCcpRGeAJ+62CF+fTT+iGKmaaiBk2rmtzS3jz4ux4
+BbMLKa0uCoopsV0BekIcApzyJggQf4uFICuC26inA/c
+-> ssh-ed25519 jQaHAA k7JCJlbAKDuH+bLhaoiQQssN5gfwPw9w30J3OAA4nWg
+fQ6te5iDG54mn5oXdarxMYPeze4ZWbk1yPAsLsTFby4
+-> ssh-ed25519 w3nu8g r3wLOavRLT++n+NaBRtcQqKXFTFhRYGl8naqUWNR0kE
+pYkqQIiwzpN/XkDBrfCuFPc3yzyFjRbdCcFmRaY8iIU
+-> ssh-ed25519 evqvfg b+BUWYHdu1z38I0BMqpkSf5qaeaCm2C+vf9Hcqgjlg4
+PK0y5MadYrM9ANyTMdHKXRTNi5cwD8/+19mN+vaTNiM
+-> ssh-ed25519 jQaHAA 86i8je5q4vVBfdi/Ws8/n4R/Z25uLw1e6zXDza8SwiI
+5yuvdl0InHxrjRyi4SJOWEo6pWZt/mX8BsaFer3NwlE
+-> ssh-ed25519 w3nu8g N2QWi7I8V//jfK2ZGsXwBkEt2Zh7/5zpWCKUNV30bFA
+ZmjY/lwFaVeM88FZSGwG+BYHi+32UPffZPZPbVcw+J8
+-> ssh-ed25519 evqvfg cZflDyFn9H85TnSbi2HFrdVvlT5uZ+6+l4stOaoyOxE
+3HpWWCbWoU1ufbi02xpXnU47Ti6YjrpMVh/mS5jgO0M
+--- wF990HQn1zh8JVo2alfC/QhpFimLsLDtj26DREVYr18
+QhE{+ĺ¸»R(+ ÝNYIľ›Ť<ýęţ’k¦/ČÖŻ„pA<70>Ý¶°Đ_ž'ËĹ«ž‰@3ů;»°÷-0‰Çˇa€b9W5ÔĂęźbU3)ASóĹ÷Śe÷ůQ/SMJ“_šĹe<16>Ža*‡:ť<>µ
--- a/secrets/sonarr-api-key.age
+++ b/secrets/sonarr-api-key.age
@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw aoj3IvYutQWfkOYOcDu0g7/FX05Y1t5NE2dP/x50gw8
+KV2kpClMmBPavyyhtC2coc3Gw9/QJQwXxfM13aKRrvQ
+-> ssh-ed25519 w3nu8g ZjQIXYV3oK5ppG9ltfojwZ0Z93wFvXdiVBnFz5ncSSQ
+CI3je4tMSb9ws+IyAgBVokFdy7z23n2EwtDrvLTziM8
+-> ssh-ed25519 evqvfg bWwaEp5s9nvzzQXbPd3rwmy4Ei9PWZg3Gk2I1nYBcCM
+PwLLVWVI0GY4snYRadT92NZFneuA54yzL+Ie4RWDxDk
+--- aqM1/sssbDgs4DNsGHqiaVH1LCyhh0vtoHSD3ju67Ew
+&ﾈﾞ<EFBE88>ﾀﾆg~ﾊ*Y<12>訷E┴<45>ﾞoE,yｾﾜE{濁ﾁ瑩ｬ*ﾚ訶_A=ｷ6=怨M'燕ﾍｧr0<72>
--- a/secrets/whiteboard-server-jwt-secret.age
+++ b/secrets/whiteboard-server-jwt-secret.age
--- a/secrets/wolframalpha.age
+++ b/secrets/wolframalpha.age
@ -1,10 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g Kw5/he5m/XAJUNv8XEJQU+e+Ou7hCYluMXXWlHiePXY
-GkhJOzSlcC9S7bs8FuDNMvMaFU3+fQ5z+o+Pb8wllp8
-> ssh-ed25519 w3nu8g fUORtXN1ygOeV42jveCosGXR/Y6R6OG6DK7LPDBEAk8
-yFpoasbY/sl6BQp0LVBQnInA4Kxd8A8meEObU1KD108
-> ssh-ed25519 dMQYog 75qVEe6/1yOV4DDLAOGaufs3ojx1/Sc1fIQOe+Oirz0
-iDFsr6/30AHKH6hUs/WTpHEM8WQ03QMlGbtQkGrnVCU
--- islx8t7a6bShXGxvYeDVuUxkmAMtpUfr0Gp7aYrJUkI
-2Ûí4¤†7Õ
-?Õw€À<E282AC>JÁÆØv	¨º9’,ËxÅŠò¨‰¦Æ¦ñnäH?>I
+-> ssh-ed25519 6AT2/g G3ahigKIYvEJNDgz97yprVfANFzbR2uKcvBPNAxgwWI
+iLpm56WMuc1Y10FwZ8HPOyBFNlhm1nWFS05DMXsjDD4
+-> ssh-ed25519 w3nu8g lx5NuJq4c4wwww887MFA1qwuLPVvddvG83l4xLzUYgk
+JgYBgcPw1jBa5yLSFBYVjf4jdoJJPoV6Q/d4Hkr3Efs
+-> ssh-ed25519 evqvfg Gw0pMtP3bxgZXeEseJ+2xSb21AFX46JCAeHMroEJg1c
+qj1BjH+J9HOwYxoL2PEMa74nxfk9nlakl+40qoFunJ4
+--- 5Om+5hhrNjOi0MRmrb8N1t9vVnM3wWosDsJCARknPNk
+©5HÉòÉ;)ôŽ\K“Au¯7ìx¢‹jûox…e›*FÈæ€†)èµ&<26>	úÑú}é<>
--- a/secrets/zigbee2mqtt.yaml.age
+++ b/secrets/zigbee2mqtt.yaml.age
@ -1,8 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 hPp1nw TSDuPaFp/Qcz4r819X4QmU/4J2TGpoX7jCCJCdFDog0
-SwQUqEp45xMOeTkvBG6uX28kB8YWG66laYqakSgl9w4
-> ssh-ed25519 w3nu8g tLZDNE0iBgOpUB3djpNu3CgimsRc0zcds+AgctzxyQ4
-Oyz6XORsApM4vFxWyaD3bR/ApIUFPY3q4yGvtbosUIY
--- vuXlQmuOFbJhBTACN5ciH2GlOCbRCMPZdlogG2O+KOk
-Áëÿ!}UIì	p0@Xž|°þ#æ™†0HÙõò#BÇRR<52>Ù
-òùø5¾Iÿ?vX?pÝ<70>—<>fqÍ[lž¸˜xÏG7ü;UäÀOUä¶
+-> ssh-ed25519 hPp1nw FnUaydWe7+2dVUIYrKqx2/0AzRPN3ZylczJBkTqeeXg
+boSEnMZmQyre4mJBQkEPuXuRP90woU1obqMdh+uQKhM
+-> ssh-ed25519 w3nu8g pIDzDUVLZuZUCn6tGKpCLVS7OmhQiMgtMvuCKfWcgiM
+zZxCUe0LslQ0ZqHV6sSMNQ5fhyscDFxVmJk0h2voEfc
+-> ssh-ed25519 evqvfg eukXn1jUoHwP/cVmYCJ1O0kYQw+Xsad1PswvbcFUMEk
+B0AvuWyfqK8ZFgCAW/iuXB0sKoKmB9d62ZNRTdDG43w
+--- 0aziJ5/DCB9kJUqWhIggCqRnsuqu9s/g4Rt4vbwsBJk
+FVÜçi`í1¥XFI–ÇI´@ŸoÞmf§Á³¤õ“ˆQ=ñè–å½ˆè‡¼i?²¿ƒb?Á
P6ŒA„-“°ÉY´°[Gö9<C3B6>ó î¥„½ÇÕ
Author	SHA1	Message	Date
Zuckerberg	0c455baebd	Add languagetool All checks were successful Check Flake / check-flake (push) Successful in 5m13s Details	2025-08-16 19:04:10 -07:00
Zuckerberg	b58df0632a	Add outline service All checks were successful Check Flake / check-flake (push) Successful in 15m2s Details	2025-08-10 20:49:50 -07:00
Zuckerberg	4956e41285	Add memos service	2025-08-10 19:03:35 -07:00
Zuckerberg	ead6653de1	Add services to tailscale auth	2025-08-10 19:02:47 -07:00
Zuckerberg	dd4a5729d4	Workaround for broken librespot spotify api integration All checks were successful Check Flake / check-flake (push) Successful in 4m49s Details	2025-08-10 15:18:29 -07:00
Zuckerberg	f248c129c8	Open port 8095 for music assistant too	2025-08-10 15:17:52 -07:00
Zuckerberg	c011faab18	Use flaresolverr with linkwarden	2025-08-10 15:17:27 -07:00
Zuckerberg	a5d0b3b748	Bring back APU2 router for more experimentation All checks were successful Check Flake / check-flake (push) Successful in 19m21s Details	2025-08-05 19:45:50 -07:00
Zuckerberg	ed3bee2e4e	Improve minimal iso so it can boot on APU2 from sd card	2025-08-05 19:44:49 -07:00
Zuckerberg	dbde2a40f2	Add linkwarden	2025-08-05 19:42:29 -07:00
Zuckerberg	6c69d82156	Add support for Home Assistant voice (whisper + piper + cloud llm) and Music Assistant via Spotify by librespot Music assistant has custom modifications they made to librespot that they haven't bothered to even try to upstream. Thus, they require a custom librespot. I tried and tried and tried and tried to just override the one already in nixpkgs but I had trouble doing so despite copying the pattern already shown in nixpkgs for overriding the src of a cargo pkg (See mopidy) but it just didn't work... Oh well. So I just patch nixpkgs instead with the new source. It works I guess. This is about where I gave up... ```nix nixpkgs.overlays = [ (final: prev: { # Cannot use librespot upstream because music-assistant requires custom changes # that they never bothered to even try to uptream librespot = prev.librespot.overrideAttrs (oldAttrs: rec { src = prev.fetchFromGitHub { owner = "music-assistant"; repo = "librespot"; rev = "786cc46199e583f304a84c786acb0a9b37bc3fbd"; sha256 = "sha256-xaOrqC8yCjF23Tz31RD3CzqZ3xxrDM6ncW1yoovEaGQ="; }; cargoDeps = oldAttrs.cargoDeps.overrideAttrs (oldAttrs': { vendorStaging = oldAttrs'.vendorStaging.overrideAttrs { outputHash = "sha256-SqvJSHkyd1IicT6c4pE96dBJNNodULhpyG14HRGVWCk="; }; }); }); }) ]; ```	2025-08-05 19:37:50 -07:00
Zuckerberg	01b01f06b4	Stop using systemd-networkd it has some flaws with NixOS' networking I need to figure out later. It is very elegant, easy to debug/understand, and I definitely want to use it but The most significant problem is it doesn't work with NixOS containers private networking. So I'll need to figure that out or maybe it will be fixed upstream soon.	2025-08-05 19:27:29 -07:00
Zuckerberg	cf560d4e53	Downgrade Howl's kernel because newer kernels just are horrible with Howl's network card	2025-08-05 19:24:46 -07:00
Zuckerberg	8cf4957e15	Add build iso helper command	2025-08-05 19:23:42 -07:00
Zuckerberg	dc02438a63	Finally a fix DHCP+VLANs thanks to systemd-networkd All checks were successful Check Flake / check-flake (push) Successful in 3m31s Details	2025-07-22 21:20:12 -07:00
Zuckerberg	948984af2d	Set ghostty preferences All checks were successful Check Flake / check-flake (push) Successful in 22m14s Details	2025-07-18 19:46:18 -07:00
Zuckerberg	be23526c2c	Add KeepassXC keys, remove some very old user keys, and rekey All checks were successful Check Flake / check-flake (push) Successful in 1m50s Details	2025-07-16 22:01:33 -07:00
Zuckerberg	e234577268	Disable inactive cache push experiment	2025-07-16 22:00:11 -07:00
Zuckerberg	82b67ed566	Add Whiteboard app to Nextcloud All checks were successful Check Flake / check-flake (push) Successful in 2m17s Details	2025-07-16 20:49:39 -07:00
Zuckerberg	53c2e2222c	Move shell aliases	2025-07-16 20:48:26 -07:00
Zuckerberg	846da159d0	Iodine stopped working again	2025-07-16 20:47:49 -07:00
Zuckerberg	a45125421e	Add collabora online and move nextcloud domain	2025-07-16 20:46:51 -07:00
Zuckerberg	f4e40955c8	Use upstreamed pcie coral and vaapi frigate configuration All checks were successful Check Flake / check-flake (push) Successful in 12m12s Details	2025-07-13 18:04:36 -07:00
Zuckerberg	af9e462b27	Allow substituters to be offline Some checks failed Check Flake / check-flake (push) Has been cancelled Details	2025-07-13 17:54:32 -07:00
Zuckerberg	2faea9d380	Update nixpkgs and other flake inputs	2025-07-13 17:52:08 -07:00
Zuckerberg	8571922796	Add new helpful utilities	2025-07-12 11:42:40 -07:00
Zuckerberg	131d5e9313	Add rest command for home assistant	2025-07-12 10:50:37 -07:00
Zuckerberg	fe0ce3a245	Get recyclarr initially running	2025-07-12 10:48:13 -07:00
Zuckerberg	7b26cfb4eb	update single input cmd	2025-07-12 10:27:09 -07:00
Zuckerberg	1c9fa418b3	Make s0 easier to unlock All checks were successful Check Flake / check-flake (push) Successful in 1m25s Details	2025-03-29 22:52:00 -07:00
Zuckerberg	8c4dc9cb74	Improve usage of roles. It should be much easier to read and use now.	2025-03-29 22:48:14 -07:00
Zuckerberg	1f9fbd87ac	Use upstream pykms and Actual Budget. Move Actual to s0. Add automated backups for Actual. All checks were successful Check Flake / check-flake (push) Successful in 1m37s Details	2025-03-29 18:36:13 -07:00