flake.lock: update inputs

README.md

@@ -1,26 +1,16 @@
 # NixOS Configuration
 
-A NixOS flake managing multiple machines with role-based configuration, agenix secrets, sandboxed dev workspaces, and self-hosted services.
+A NixOS flake managing multiple machines with role-based configuration, agenix secrets, and sandboxed dev workspaces.
 
 ## Layout
 
 - `/common` - shared configuration imported by all machines
   - `/boot` - bootloaders, CPU microcode, remote LUKS unlock over Tor
-  - `/network` - Tailscale, PIA VPN with leak-proof containers, sandbox networking
+  - `/network` - Tailscale, VPN tunneling via PIA
   - `/pc` - desktop/graphical config (enabled by the `personal` role)
-  - `/server` - self-hosted service definitions (Gitea, Matrix, Nextcloud, media stack, etc.)
+  - `/server` - service definitions and extensions
   - `/sandboxed-workspace` - isolated dev environments (VM, container, or Incus)
-  - `/ntfy` - push notification integration (service failures, SSH logins, ZFS alerts)
-  - `binary-cache.nix` - nix binary cache configuration (nixos.org, cachix, self-hosted atticd)
-  - `nix-builder.nix` - distributed build delegation across machines
-  - `backups.nix` - snapshot-aware restic backups to Backblaze B2
 - `/machines` - per-machine config (`default.nix`, `hardware-configuration.nix`, `properties.nix`)
-  - `fry` - personal desktop
-  - `howl` - personal laptop
-  - `ponyo` - web/mail server (Gitea, Nextcloud, LibreChat, mail)
-  - `storage/s0` - storage/media server (Jellyfin, Home Assistant, monitoring, productivity apps)
-  - `zoidberg` - media center
-  - `ephemeral` - minimal config for building install ISOs and kexec images
 - `/secrets` - agenix-encrypted secrets, decryptable by machines based on their roles
 - `/home` - Home Manager user config
 - `/lib` - custom library functions extending nixpkgs lib
@@ -35,14 +25,8 @@ A NixOS flake managing multiple machines with role-based configuration, agenix s
 
 **Remote LUKS unlock over Tor** — Machines with encrypted root disks can be unlocked remotely via SSH. An embedded Tor hidden service starts in the initrd so the machine is reachable even without a known IP, using a separate SSH host key for the boot environment.
 
-**VPN containers** — A `pia-vpn` module provides leak-proof VPN networking for containers. The host creates a WireGuard interface and runs tinyproxy on a bridge network for PIA API bootstrap. A dedicated VPN container authenticates with PIA via the proxy, configures WireGuard, and masquerades bridge traffic through the tunnel. Service containers default-route exclusively through the VPN container — leakage is impossible by network topology. Supports port forwarding with automatic port assignment.
+**VPN containers** — A `vpn-container` module spins up an ephemeral NixOS container with a PIA WireGuard tunnel. The host creates the WireGuard interface and authenticates with PIA, then hands it off to the container's network namespace. This ensures that the container can **never** have direct internet access. Leakage is impossible.
 
-**Sandboxed workspaces** — Isolated dev environments backed by microVMs (cloud-hypervisor), systemd-nspawn containers, or Incus. Each workspace gets a static IP on a NAT'd bridge (`192.168.83.0/24`), auto-generated SSH host keys, shell aliases for management, and comes pre-configured with Claude Code. The sandbox network blocks access to the local LAN while allowing internet.
+**Sandboxed workspaces** — Isolated dev environments backed by microVMs (cloud-hypervisor), systemd-nspawn containers, or Incus. Each workspace gets a static IP on a NAT'd bridge, auto-generated SSH host keys, shell aliases for management, and comes pre-configured with Claude Code. The sandbox network blocks access to the local LAN while allowing internet.
 
 **Snapshot-aware backups** — Restic backups to Backblaze B2 automatically create ZFS snapshots or btrfs read-only snapshots before backing up, using mount namespaces to bind-mount frozen data over the original paths so restic records correct paths. Each backup group gets a `restic_<group>` CLI wrapper. Supports `.nobackup` marker files.
-
-**Self-hosted services** — Comprehensive service stack across ponyo and s0: Gitea (git hosting + CI), Nextcloud (files/calendar), Matrix (chat), mail server, Jellyfin/Sonarr/Radarr/Lidarr (media), Home Assistant/Zigbee2MQTT/Frigate (home automation), LibreChat (AI), Gatus (monitoring), and productivity tools (Vikunja, Actual Budget, Outline, Linkwarden, Memos).
-
-**Push notifications** — ntfy integration alerts on systemd service failures, SSH logins, and ZFS pool issues. Gatus monitors all web-facing services and sends alerts via ntfy.
-
-**Remote deployment** — deploy-rs handles remote machine deployments with boot-only or immediate activation modes. A Makefile wraps common operations (`make deploy <host>`, `make deploy-activate <host>`).

common/network/pia-vpn/vpn-container.nix

@@ -226,86 +226,6 @@ in
               RandomizedDelaySec = "1m";
             };
           };
-
-          # Periodic VPN connectivity check — fails if VPN or internet is down,
-          # triggering ntfy alert via the OnFailure drop-in.
-          # Tracks failures with a counter file so only the first 3 failures per
-          # day trigger an alert (subsequent failures exit 0 to suppress noise).
-          systemd.services.pia-vpn-check = {
-            description = "Check PIA VPN connectivity";
-            after = [ "pia-vpn-setup.service" ];
-            requires = [ "pia-vpn-setup.service" ];
-
-            path = with pkgs; [ wireguard-tools iputils coreutils gawk jq ];
-
-            serviceConfig.Type = "oneshot";
-
-            script = ''
-              set -euo pipefail
-
-              COUNTER_FILE="/var/lib/pia-vpn/check-fail-count.json"
-              MAX_ALERTS=3
-
-              check_vpn() {
-                # Check that WireGuard has a peer with a recent handshake (within 3 minutes)
-                handshake=$(wg show ${cfg.interfaceName} latest-handshakes | awk '{print $2}')
-                if [ -z "$handshake" ] || [ "$handshake" -eq 0 ]; then
-                  echo "No WireGuard handshake recorded" >&2
-                  return 1
-                fi
-                now=$(date +%s)
-                age=$((now - handshake))
-                if [ "$age" -gt 180 ]; then
-                  echo "WireGuard handshake is stale (''${age}s ago)" >&2
-                  return 1
-                fi
-
-                # Verify internet connectivity through VPN tunnel
-                if ! ping -c1 -W10 1.1.1.1 >/dev/null 2>&1; then
-                  echo "Cannot reach internet through VPN" >&2
-                  return 1
-                fi
-
-                echo "PIA VPN connectivity OK (handshake ''${age}s ago)"
-                return 0
-              }
-
-              if check_vpn; then
-                rm -f "$COUNTER_FILE"
-                exit 0
-              fi
-
-              # Failed — read and update counter (reset if from a previous day)
-              today=$(date +%Y-%m-%d)
-              count=0
-              if [ -f "$COUNTER_FILE" ]; then
-                stored=$(jq -r '.date // ""' "$COUNTER_FILE")
-                if [ "$stored" = "$today" ]; then
-                  count=$(jq -r '.count // 0' "$COUNTER_FILE")
-                fi
-              fi
-              count=$((count + 1))
-              jq -n --arg date "$today" --argjson count "$count" \
-                '{"date": $date, "count": $count}' > "$COUNTER_FILE"
-
-              if [ "$count" -le "$MAX_ALERTS" ]; then
-                echo "Failure $count/$MAX_ALERTS today — alerting" >&2
-                exit 1
-              else
-                echo "Failure $count today — suppressing alert (already sent $MAX_ALERTS)" >&2
-                exit 0
-              fi
-            '';
-          };
-
-          systemd.timers.pia-vpn-check = {
-            description = "Periodic PIA VPN connectivity check";
-            wantedBy = [ "timers.target" ];
-            timerConfig = {
-              OnCalendar = "*:0/5";
-              RandomizedDelaySec = "30s";
-            };
-          };
         };
     };
   };

common/ntfy/default.nix

@@ -5,7 +5,6 @@
     ./service-failure.nix
     ./ssh-login.nix
     ./zfs.nix
-    ./dimm-temp.nix
   ];
 
   options.ntfy-alerts = {

common/ntfy/dimm-temp.nix

@@ -1,73 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.ntfy-alerts;
-  hasNtfy = config.thisMachine.hasRole."ntfy";
-
-  checkScript = pkgs.writeShellScript "dimm-temp-check" ''
-    PATH="${lib.makeBinPath [ pkgs.lm_sensors pkgs.gawk pkgs.coreutils pkgs.curl ]}"
-
-    threshold=55
-    hot=""
-    summary=""
-
-    while IFS= read -r line; do
-      case "$line" in
-        spd5118-*)
-          chip="$line"
-          ;;
-        *temp1_input:*)
-          temp="''${line##*: }"
-          whole="''${temp%%.*}"
-          summary="''${summary:+$summary, }$chip: ''${temp}°C"
-          if [ "$whole" -ge "$threshold" ]; then
-            hot="$hot"$'\n'"  $chip: ''${temp}°C"
-          fi
-          ;;
-      esac
-    done < <(sensors -u 'spd5118-*' 2>/dev/null)
-
-    echo "$summary"
-
-    if [ -n "$hot" ]; then
-      message="DIMM temperature above ''${threshold}°C on ${config.networking.hostName}:$hot"
-
-      curl \
-        --fail --silent --show-error \
-        --max-time 30 --retry 3 \
-        -H "Authorization: Bearer $NTFY_TOKEN" \
-        -H "Title: High DIMM temperature on ${config.networking.hostName}" \
-        -H "Priority: high" \
-        -H "Tags: thermometer" \
-        -d "$message" \
-        "${cfg.serverUrl}/service-failures"
-
-      echo "$message" >&2
-    fi
-  '';
-in
-{
-  options.ntfy-alerts.dimmTempCheck.enable = lib.mkEnableOption "DDR5 DIMM temperature monitoring via spd5118";
-
-  config = lib.mkIf (cfg.dimmTempCheck.enable && hasNtfy) {
-    systemd.services.dimm-temp-check = {
-      description = "Check DDR5 DIMM temperatures and alert on overheating";
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
-      serviceConfig = {
-        Type = "oneshot";
-        EnvironmentFile = "/run/agenix/ntfy-token";
-        ExecStart = checkScript;
-      };
-    };
-
-    systemd.timers.dimm-temp-check = {
-      description = "Periodic DDR5 DIMM temperature check";
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "*:0/5";
-        Persistent = true;
-      };
-    };
-  };
-}

common/pc/default.nix

@@ -6,7 +6,6 @@ in
 {
   imports = [
     ./kde.nix
-    ./hyprland.nix
     ./yubikey.nix
     ./chromium.nix
     ./firefox.nix

common/pc/hyprland.nix

@@ -1,49 +0,0 @@
-{ lib, config, pkgs, ... }:
-
-let
-  cfg = config.de;
-in
-{
-  config = lib.mkIf cfg.enable {
-    programs.hyprland.enable = true;
-    programs.hyprland.withUWSM = true;
-    programs.hyprland.xwayland.enable = true;
-
-    xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
-
-    environment.systemPackages = with pkgs; [
-      # Bar
-      waybar
-
-      # Launcher
-      wofi
-
-      # Notifications
-      mako
-
-      # Lock/idle
-      hyprlock
-      hypridle
-
-      # Wallpaper
-      hyprpaper
-
-      # Polkit
-      hyprpolkitagent
-
-      # Screenshots
-      grim
-      slurp
-
-      # Clipboard
-      wl-clipboard
-      cliphist
-
-      # Color picker
-      hyprpicker
-
-      # Brightness (laptop keybinds)
-      brightnessctl
-    ];
-  };
-}

common/server/gatus.nix

@@ -270,16 +270,6 @@ in
             ];
             alerts = [{ type = "ntfy"; }];
           }
-          {
-            name = "Music Assistant";
-            group = "s0";
-            url = "http://s0.koi-bebop.ts.net:8095";
-            interval = "5m";
-            conditions = [
-              "[STATUS] == 200"
-            ];
-            alerts = [{ type = "ntfy"; }];
-          }
           {
             name = "Vikunja";
             group = "s0";
@@ -330,7 +320,16 @@ in
             ];
             alerts = [{ type = "ntfy"; }];
           }
-
+          {
+            name = "LanguageTool";
+            group = "s0";
+            url = "https://languagetool.s0.neet.dev";
+            interval = "5m";
+            conditions = [
+              "[STATUS] == 200"
+            ];
+            alerts = [{ type = "ntfy"; }];
+          }
           {
             name = "Unifi";
             group = "s0";

flake.lock

@@ -53,11 +53,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772587858,
+        "lastModified": 1772841898,
-        "narHash": "sha256-w0/XBU20BdBeEIJ9i3ecr9Lc6c8uQaXUn/ri+aOsyJk=",
+        "narHash": "sha256-+5WdD9bo2XZIajeO5JPXCUyPotE9DFY9DL38OHYEy1s=",
         "owner": "sadjow",
         "repo": "claude-code-nix",
-        "rev": "0a5fc14be38fabfcfff18db749b63c9c15726765",
+        "rev": "635219a8ebb214a37e92220a0f292568cfb01da8",
         "type": "github"
       },
       "original": {
@@ -186,11 +186,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769939035,
+        "lastModified": 1772665116,
-        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
+        "narHash": "sha256-XmjUDG/J8Z8lY5DVNVUf5aoZGc400FxcjsNCqHKiKtc=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
+        "rev": "39f53203a8458c330f61cc0759fe243f0ac0d198",
         "type": "github"
       },
       "original": {
@@ -228,11 +228,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772569491,
+        "lastModified": 1772845525,
-        "narHash": "sha256-bdr6ueeXO1Xg91sFkuvaysYF0mVdwHBpdyhTjBEWv+s=",
+        "narHash": "sha256-Dp5Ir2u4jJDGCgeMRviHvEQDe+U37hMxp6RSNOoMMPc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "924e61f5c2aeab38504028078d7091077744ab17",
+        "rev": "27b93804fbef1544cb07718d3f0a451f4c4cd6c0",
         "type": "github"
       },
       "original": {
@@ -250,11 +250,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1772338235,
+        "lastModified": 1772922713,
-        "narHash": "sha256-9XcwtSIL/c+pkC3SBNuxCJuSktFOBV1TLvvkhekyB8I=",
+        "narHash": "sha256-+dn2D7gNrrld3q/AapoZZ6HL8xnBS/pcV4Gye1Nfsg0=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "9d1ff9b53532908a5eba7707931c9093508b6b92",
+        "rev": "6207a74a1ec31d3aa628cb98eb75795a10f49dea",
         "type": "github"
       },
       "original": {
@@ -270,11 +270,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772341813,
+        "lastModified": 1772945408,
-        "narHash": "sha256-/PQ0ubBCMj/MVCWEI/XMStn55a8dIKsvztj4ZVLvUrQ=",
+        "narHash": "sha256-PMt48sEQ8cgCeljQ9I/32uoBq/8t8y+7W/nAZhf72TQ=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "a2051ff239ce2e8a0148fa7a152903d9a78e854f",
+        "rev": "1c1d8ea87b047788fd7567adf531418c5da321ec",
         "type": "github"
       },
       "original": {
@@ -301,11 +301,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772542754,
+        "lastModified": 1772773019,
-        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
+        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
+        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
         "type": "github"
       },
       "original": {
@@ -344,11 +344,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772064816,
+        "lastModified": 1772941018,
-        "narHash": "sha256-ks1D9Rtmopd5F/8ENjEUJpSYYMxv603/v6TRen9Hq54=",
+        "narHash": "sha256-vjBCB54S76xLkdMztvXrnQIottyAU6S5IYGlt23EBW4=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "ea4dc17f4bc0f65eed082fa394509e4543072b56",
+        "rev": "80ce71e23624b32a24dbe84c230b9874d786eeb2",
         "type": "gitlab"
       },
       "original": {

home/googlebot.nix

@@ -8,7 +8,6 @@ let
   thisMachineIsPersonal = osConfig.thisMachine.hasRole."personal";
 in
 {
-  imports = [ ./hyprland.nix ];
   home.username = "googlebot";
   home.homeDirectory = "/home/googlebot";
 

home/hyprland.nix

@@ -1,276 +0,0 @@
-{ lib, osConfig, pkgs, ... }:
-
-let
-  thisMachineIsPersonal = osConfig.thisMachine.hasRole."personal";
-in
-{
-  config = lib.mkIf thisMachineIsPersonal {
-    wayland.windowManager.hyprland = {
-      enable = true;
-      systemd.enable = false; # Required when using UWSM
-
-      settings = {
-        "$mod" = "SUPER";
-        "$terminal" = "ghostty";
-        "$menu" = "wofi --show drun";
-
-        general = {
-          gaps_in = 5;
-          gaps_out = 10;
-          border_size = 2;
-          "col.active_border" = "rgba(33ccffee) rgba(00ff99ee) 45deg";
-          "col.inactive_border" = "rgba(595959aa)";
-          layout = "dwindle";
-        };
-
-        decoration = {
-          rounding = 10;
-
-          blur = {
-            enabled = true;
-            size = 3;
-            passes = 1;
-          };
-
-          shadow = {
-            enabled = true;
-            range = 4;
-            render_power = 3;
-            color = "rgba(1a1a1aee)";
-          };
-        };
-
-        animations = {
-          enabled = true;
-          bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
-          animation = [
-            "windows, 1, 7, myBezier"
-            "windowsOut, 1, 7, default, popin 80%"
-            "border, 1, 10, default"
-            "borderangle, 1, 8, default"
-            "fade, 1, 7, default"
-            "workspaces, 1, 6, default"
-          ];
-        };
-
-        dwindle = {
-          pseudotile = true;
-          preserve_split = true;
-        };
-
-        input = {
-          follow_mouse = 1;
-          touchpad = {
-            natural_scroll = true;
-          };
-        };
-
-        misc = {
-          force_default_wallpaper = 0;
-        };
-
-        bind = [
-          # Applications
-          "$mod, Return, exec, $terminal"
-          "$mod, D, exec, $menu"
-          "$mod, L, exec, hyprlock"
-
-          # Window management
-          "$mod, Q, killactive"
-          "$mod, F, fullscreen"
-          "$mod, V, togglefloating"
-          "$mod, P, pseudo"
-          "$mod, J, togglesplit"
-
-          # Move focus
-          "$mod, left, movefocus, l"
-          "$mod, right, movefocus, r"
-          "$mod, up, movefocus, u"
-          "$mod, down, movefocus, d"
-
-          # Switch workspaces
-          "$mod, 1, workspace, 1"
-          "$mod, 2, workspace, 2"
-          "$mod, 3, workspace, 3"
-          "$mod, 4, workspace, 4"
-          "$mod, 5, workspace, 5"
-          "$mod, 6, workspace, 6"
-          "$mod, 7, workspace, 7"
-          "$mod, 8, workspace, 8"
-          "$mod, 9, workspace, 9"
-          "$mod, 0, workspace, 10"
-
-          # Move active window to workspace
-          "$mod SHIFT, 1, movetoworkspace, 1"
-          "$mod SHIFT, 2, movetoworkspace, 2"
-          "$mod SHIFT, 3, movetoworkspace, 3"
-          "$mod SHIFT, 4, movetoworkspace, 4"
-          "$mod SHIFT, 5, movetoworkspace, 5"
-          "$mod SHIFT, 6, movetoworkspace, 6"
-          "$mod SHIFT, 7, movetoworkspace, 7"
-          "$mod SHIFT, 8, movetoworkspace, 8"
-          "$mod SHIFT, 9, movetoworkspace, 9"
-          "$mod SHIFT, 0, movetoworkspace, 10"
-
-          # Scroll through workspaces
-          "$mod, mouse_down, workspace, e+1"
-          "$mod, mouse_up, workspace, e-1"
-
-          # Screenshots
-          ", Print, exec, grim -g \"$(slurp)\" - | wl-copy"
-          "SHIFT, Print, exec, grim - | wl-copy"
-
-          # Clipboard history
-          "$mod SHIFT, V, exec, cliphist list | wofi --dmenu | cliphist decode | wl-copy"
-        ];
-
-        bindm = [
-          # Move/resize with mouse
-          "$mod, mouse:272, movewindow"
-          "$mod, mouse:273, resizewindow"
-        ];
-
-        bindel = [
-          # Volume
-          ", XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"
-          ", XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
-
-          # Brightness
-          ", XF86MonBrightnessUp, exec, brightnessctl s 10%+"
-          ", XF86MonBrightnessDown, exec, brightnessctl s 10%-"
-        ];
-
-        bindl = [
-          ", XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"
-        ];
-
-        exec-once = [
-          "waybar"
-          "mako"
-          "hyprpaper"
-          "wl-paste --type text --watch cliphist store"
-          "wl-paste --type image --watch cliphist store"
-        ];
-      };
-    };
-
-    # Waybar
-    programs.waybar = {
-      enable = true;
-      settings = {
-        mainBar = {
-          layer = "top";
-          position = "top";
-          height = 30;
-          modules-left = [ "hyprland/workspaces" ];
-          modules-center = [ "clock" ];
-          modules-right = [ "network" "pulseaudio" "battery" "tray" ];
-
-          clock = {
-            format = "{:%H:%M  %Y-%m-%d}";
-          };
-
-          battery = {
-            format = "{capacity}% {icon}";
-            format-icons = [ "" "" "" "" "" ];
-          };
-
-          network = {
-            format-wifi = "{essid} ({signalStrength}%) ";
-            format-ethernet = "{ipaddr}/{cidr} ";
-            format-disconnected = "Disconnected ";
-          };
-
-          pulseaudio = {
-            format = "{volume}% {icon}";
-            format-muted = "";
-            format-icons = {
-              default = [ "" "" "" ];
-            };
-            on-click = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-          };
-
-          tray = {
-            spacing = 10;
-          };
-        };
-      };
-    };
-
-    # Notifications
-    services.mako = {
-      enable = true;
-      settings = {
-        default-timeout = 5000;
-        border-radius = 5;
-      };
-    };
-
-    # Idle daemon
-    services.hypridle = {
-      enable = true;
-      settings = {
-        general = {
-          lock_cmd = "pidof hyprlock || hyprlock";
-          before_sleep_cmd = "loginctl lock-session";
-          after_sleep_cmd = "hyprctl dispatch dpms on";
-        };
-
-        listener = [
-          {
-            timeout = 300;
-            on-timeout = "loginctl lock-session";
-          }
-          {
-            timeout = 330;
-            on-timeout = "hyprctl dispatch dpms off";
-            on-resume = "hyprctl dispatch dpms on";
-          }
-          {
-            timeout = 1800;
-            on-timeout = "systemctl suspend";
-          }
-        ];
-      };
-    };
-
-    # Lock screen
-    programs.hyprlock = {
-      enable = true;
-      settings = {
-        general = {
-          hide_cursor = true;
-          grace = 5;
-        };
-
-        background = [
-          {
-            monitor = "";
-            color = "rgba(25, 20, 20, 1.0)";
-            blur_passes = 2;
-            blur_size = 7;
-          }
-        ];
-
-        input-field = [
-          {
-            monitor = "";
-            size = "200, 50";
-            outline_thickness = 3;
-            dots_size = 0.33;
-            dots_spacing = 0.15;
-            outer_color = "rgb(151515)";
-            inner_color = "rgb(200, 200, 200)";
-            font_color = "rgb(10, 10, 10)";
-            fade_on_empty = true;
-            placeholder_text = "<i>Password...</i>";
-            hide_input = false;
-            position = "0, -20";
-            halign = "center";
-            valign = "center";
-          }
-        ];
-      };
-    };
-  };
-}

machines/storage/s0/dashy.nix

@@ -401,15 +401,6 @@
             statusCheck = false;
             id = "5_4201_sandman";
           };
-          music-assistant = {
-            title = "Music Assistant";
-            description = "s0:8095";
-            icon = "hl-music-assistant";
-            url = "http://s0.koi-bebop.ts.net:8095";
-            target = "sametab";
-            statusCheck = false;
-            id = "6_4201_music-assistant";
-          };
         };
         haList = [
           haItems.home-assistant
@@ -418,7 +409,6 @@
           haItems.frigate
           haItems.valetudo
           haItems.sandman
-          haItems.music-assistant
         ];
       in
       {
@@ -484,6 +474,15 @@
             statusCheck = false;
             id = "4_5301_outline";
           };
+          languagetool = {
+            title = "LanguageTool";
+            description = "languagetool.s0.neet.dev";
+            icon = "hl-languagetool";
+            url = "https://languagetool.s0.neet.dev";
+            target = "sametab";
+            statusCheck = false;
+            id = "5_5301_languagetool";
+          };
         };
         prodList = [
           prodItems.vikunja
@@ -491,6 +490,7 @@
           prodItems.linkwarden
           prodItems.memos
           prodItems.outline
+          prodItems.languagetool
         ];
       in
       {

machines/storage/s0/default.nix

@@ -10,7 +10,6 @@
   networking.hostName = "s0";
 
   ntfy-alerts.ignoredUnits = [ "logrotate" ];
-  ntfy-alerts.dimmTempCheck.enable = true;
 
   # system.autoUpgrade.enable = true;
 
@@ -143,6 +142,30 @@
         services.lidarr.enable = true;
         services.lidarr.user = "public_data";
         services.lidarr.group = "public_data";
+        services.recyclarr = {
+          enable = true;
+          configuration = {
+            radarr.radarr_main = {
+              api_key = {
+                _secret = "/run/credentials/recyclarr.service/radarr-api-key";
+              };
+              base_url = "http://localhost:7878";
+              quality_definition.type = "movie";
+            };
+            sonarr.sonarr_main = {
+              api_key = {
+                _secret = "/run/credentials/recyclarr.service/sonarr-api-key";
+              };
+              base_url = "http://localhost:8989";
+              quality_definition.type = "series";
+            };
+          };
+        };
+
+        systemd.services.recyclarr.serviceConfig.LoadCredential = [
+          "radarr-api-key:/run/agenix/radarr-api-key"
+          "sonarr-api-key:/run/agenix/sonarr-api-key"
+        ];
 
         users.groups.public_data.gid = 994;
         users.users.public_data = {
@@ -153,6 +176,8 @@
       };
     };
   };
+  age.secrets.radarr-api-key.file = ../../../secrets/radarr-api-key.age;
+  age.secrets.sonarr-api-key.file = ../../../secrets/sonarr-api-key.age;
 
   # jellyfin
   # jellyfin cannot run in the vpn container and use hardware encoding
@@ -228,6 +253,7 @@
         (mkVirtualHost "linkwarden.s0.neet.dev" "http://localhost:${toString config.services.linkwarden.port}")
         (mkVirtualHost "memos.s0.neet.dev" "http://localhost:${toString config.services.memos.settings.MEMOS_PORT}")
         (mkVirtualHost "outline.s0.neet.dev" "http://localhost:${toString config.services.outline.port}")
+        (mkVirtualHost "languagetool.s0.neet.dev" "http://localhost:${toString config.services.languagetool.port}")
       ];
 
     tailscaleAuth = {
@@ -251,6 +277,7 @@
         "linkwarden.s0.neet.dev"
         # "memos.s0.neet.dev" # messes up memos /auth route
         # "outline.s0.neet.dev" # messes up outline /auth route
+        "languagetool.s0.neet.dev"
       ];
       expectedTailnet = "koi-bebop.ts.net";
     };
@@ -340,5 +367,10 @@
     owner = config.services.outline.user;
   };
 
+  services.languagetool = {
+    enable = true;
+    port = 60613;
+  };
+
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
 }

secrets/radarr-api-key.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw gfVRDt7ReEnz10WvPa8UfBBnsRsiw7sxxXQMuXRnCVs
+slBNX9Yc1qSu1P5ioNDNLPd97NGE/LWPS/A+u9QGo4E
+-> ssh-ed25519 ZDy34A e5MSY5qDP6WuEgbiK0p5esMQJBb3ScVpb15Ff8sTQgQ
+9nsimoUQncnbfiu13AnFWZXcpaiySUYdS1eH5O/3Fgg
+-> ssh-ed25519 w3nu8g op1KSUhJgM6w/nlaUssQDiraQpVzgnWd//JMu2vFgms
+KvEaJfsB7Qkf+PnzFJdZ3wAxm2qj23IS8RRxyuGN2G4
+-> ssh-ed25519 evqvfg 9L6pFuqkcChZq/W4zkATXm1Y76SEK+S4SyaiSlJd+C4
+j/UWJvo4Cr/UDfaN2milpJ6rU0w1EWdTAzV3SlrCcW8
+--- bdG4zC5dx6cSPetH3DNeHEk6EYCJ5TXGrn8OhUMknNU
+/¶ø+ÏpñR[¤àJ-*‚@ÌÿŸx0Ú©ò-ä.*&T·™~-i	2€eƒ¡`@ëQ8š<l™àQK0AÕ§

secrets/secrets.nix

@@ -63,4 +63,8 @@ with roles;
 
   # zigbee2mqtt secrets
   "zigbee2mqtt.yaml.age".publicKeys = zigbee;
+
+  # Sonarr and Radarr secrets
+  "radarr-api-key.age".publicKeys = media-server;
+  "sonarr-api-key.age".publicKeys = media-server;
 }