Speed up attic

Add Attic binary cache and containerize gitea runner
Replace nix-serve-only setup with Attic for managed binary caching with upstream filtering and GC. Move gitea actions runner from host into an isolated NixOS container with private networking. nix-serve kept alongside Attic during migration.
2026-02-20 23:24:11 -08:00 · 2026-02-20 22:00:49 -08:00 · 2026-02-17 21:35:23 -08:00 · 2026-02-17 21:28:50 -08:00 · 2026-02-17 21:28:28 -08:00 · 2026-02-14 11:29:02 -08:00
89 changed files with 1666 additions and 1464 deletions
--- a/.claude/skills/create-workspace/SKILL.md
+++ b/.claude/skills/create-workspace/SKILL.md
@@ -0,0 +1,160 @@
+---
+name: create-workspace
+description: >
+  Creates a new sandboxed workspace (isolated dev environment) by adding
+  NixOS configuration for a VM, container, or Incus instance. Use when
+  the user wants to create, set up, or add a new sandboxed workspace.
+---
+
+# Create Sandboxed Workspace
+
+Creates an isolated development environment backed by a VM (microvm.nix), container (systemd-nspawn), or Incus instance. This produces:
+
+1. A workspace config file at `machines/<machine>/workspaces/<name>.nix`
+2. A registration entry in `machines/<machine>/default.nix`
+
+## Step 1: Parse Arguments
+
+Extract the workspace name and backend type from `$ARGUMENTS`. If either is missing, ask the user.
+
+- **Name**: lowercase alphanumeric with hyphens (e.g., `my-project`)
+- **Type**: one of `vm`, `container`, or `incus`
+
+## Step 2: Detect Machine
+
+Run `hostname` to get the current machine name. Verify that `machines/<hostname>/default.nix` exists.
+
+If the machine directory doesn't exist, stop and tell the user this machine isn't managed by this flake.
+
+## Step 3: Allocate IP Address
+
+Read `machines/<hostname>/default.nix` to find existing `sandboxed-workspace.workspaces` entries and their IPs.
+
+All IPs are in the `192.168.83.0/24` subnet. Use these ranges by convention:
+
+| Type | IP Range |
+|------|----------|
+| vm | 192.168.83.10 - .49 |
+| container | 192.168.83.50 - .89 |
+| incus | 192.168.83.90 - .129 |
+
+Pick the next available IP in the appropriate range. If no workspaces exist yet for that type, use the first IP in the range.
+
+## Step 4: Create Workspace Config File
+
+Create `machines/<hostname>/workspaces/<name>.nix`. Use this template:
+
+```nix
+{ config, lib, pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    # Add packages here
+  ];
+}
+```
+
+Ask the user if they want any packages pre-installed.
+
+Create the `workspaces/` directory if it doesn't exist.
+
+**Important:** After creating the file, run `git add` on it immediately. Nix flakes only see files tracked by git, so new files must be staged before `nix build` will work.
+
+## Step 5: Register Workspace
+
+Edit `machines/<hostname>/default.nix` to add the workspace entry inside the `sandboxed-workspace` block.
+
+The entry should look like:
+
+```nix
+workspaces.<name> = {
+  type = "<type>";
+  config = ./workspaces/<name>.nix;
+  ip = "<allocated-ip>";
+};
+```
+
+**If `sandboxed-workspace` block doesn't exist yet**, add the full block:
+
+```nix
+sandboxed-workspace = {
+  enable = true;
+  workspaces.<name> = {
+    type = "<type>";
+    config = ./workspaces/<name>.nix;
+    ip = "<allocated-ip>";
+  };
+};
+```
+
+The machine also needs `networking.sandbox.upstreamInterface` set. Check if it exists; if not, ask the user for their primary network interface name (they can find it with `ip route show default`).
+
+Do **not** set `hostKey` — it gets auto-generated on first boot and can be added later.
+
+## Step 6: Verify Build
+
+Run a build to check for configuration errors:
+
+```
+nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel --no-link
+```
+
+If the build fails, fix the configuration and retry.
+
+## Step 7: Deploy
+
+Tell the user to deploy by running:
+
+```
+doas nixos-rebuild switch --flake .
+```
+
+**Never run this command yourself** — it requires privileges.
+
+## Step 8: Post-Deploy Info
+
+Tell the user to deploy and then start the workspace so the host key gets generated. Provide these instructions:
+
+**Deploy:**
+```
+doas nixos-rebuild switch --flake .
+```
+
+**Starting the workspace:**
+```
+doas systemctl start <service>
+```
+
+Where `<service>` is:
+- VM: `microvm@<name>`
+- Container: `container@<name>`
+- Incus: `incus-workspace-<name>`
+
+Or use the auto-generated shell alias: `workspace_<name>_start`
+
+**Connecting:**
+```
+ssh googlebot@workspace-<name>
+```
+
+Or use the alias: `workspace_<name>`
+
+**Never run deploy or start commands yourself** — they require privileges.
+
+## Step 9: Add Host Key
+
+After the user has deployed and started the workspace, add the SSH host key to the workspace config. Do NOT skip this step — always wait for the user to confirm they've started the workspace, then proceed.
+
+1. Read the host key from `~/sandboxed/<name>/ssh-host-keys/ssh_host_ed25519_key.pub`
+2. Add `hostKey = "<contents>";` to the workspace entry in `machines/<hostname>/default.nix`
+3. Run the build again to verify
+4. Tell the user to redeploy with `doas nixos-rebuild switch --flake .`
+
+## Backend Reference
+
+| | VM | Container | Incus |
+|---|---|---|---|
+| Isolation | Full kernel (cloud-hypervisor) | Shared kernel (systemd-nspawn) | Unprivileged container |
+| Overhead | Higher (separate kernel) | Lower (bind mounts) | Medium |
+| Filesystem | virtiofs shares | Bind mounts | Incus-managed |
+| Use case | Untrusted code, kernel-level isolation | Fast dev environments | Better security than nspawn |
--- a/.gitea/workflows/check-flake.yaml
+++ b/.gitea/workflows/check-flake.yaml
@@ -5,6 +5,7 @@ on: [push]
 env:
  DEBIAN_FRONTEND: noninteractive
  PATH: /run/current-system/sw/bin/
+  XDG_CONFIG_HOME: ${{ runner.temp }}/.config

 jobs:
  check-flake:
@@ -15,5 +16,34 @@ jobs:
        with:
          fetch-depth: 0

+      - name: Configure Attic cache
+        run: |
+          attic login local "${{ vars.ATTIC_ENDPOINT }}" "${{ secrets.ATTIC_TOKEN }}"
+          attic use local:nixos
+
      - name: Check Flake
        run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace
+
+      - name: Build all systems
+        run: |
+          nix eval .#nixosConfigurations --apply 'cs: builtins.attrNames cs' --json \
+            | jq -r '.[]' \
+            | xargs -I{} nix build ".#nixosConfigurations.{}.config.system.build.toplevel" --no-link --print-build-logs --log-format raw
+
+      - name: Push to cache
+        run: |
+          set -euo pipefail
+          # Get all system toplevel store paths
+          toplevels=$(nix eval .#nixosConfigurations --apply 'cs: map (n: "${cs.${n}.config.system.build.toplevel}") (builtins.attrNames cs)' --json | jq -r '.[]')
+          echo "Found $(echo "$toplevels" | wc -l) system toplevels"
+          # Expand to full closures, deduplicate, and filter out paths that are:
+          # - already signed by cache.nixos.org (available upstream)
+          # - smaller than 0.5MB (insignificant build artifacts)
+          paths=$(echo "$toplevels" \
+            | xargs nix path-info -r --json \
+            | jq -r '[to_entries[] | select(
+                (.value.signatures | all(startswith("cache.nixos.org") | not))
+                and .value.narSize >= 524288
+              ) | .key] | unique[]')
+          echo "Pushing $(echo "$paths" | wc -l) unique paths to cache"
+          echo "$paths" | xargs attic push local:nixos
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -0,0 +1,81 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What This Is
+
+A NixOS flake managing multiple machines. All machines import `/common` for shared config, and each machine has its own directory under `/machines/<hostname>/` with a `default.nix` (machine-specific config), `hardware-configuration.nix`, and `properties.nix` (metadata: hostnames, arch, roles, SSH keys).
+
+## Common Commands
+
+```bash
+# Build a machine config (check for errors without deploying)
+nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel --no-link
+
+# Deploy to local machine (user must run this themselves - requires privileges)
+doas nixos-rebuild switch --flake .
+
+# Deploy to a remote machine (boot-only, no activate)
+deploy --remote-build --boot --debug-logs --skip-checks .#<hostname>
+
+# Deploy to a remote machine (activate immediately)
+deploy --remote-build --debug-logs --skip-checks .#<hostname>
+
+# Update flake lockfile
+make update-lockfile
+
+# Update a single flake input
+make update-input <input-name>
+
+# Edit an agenix secret
+make edit-secret <secret-filename>
+
+# Rekey all secrets (after adding/removing machine host keys)
+make rekey-secrets
+```
+
+## Architecture
+
+### Machine Discovery (Auto-Registration)
+
+Machines are **not** listed in `flake.nix`. Instead, `common/machine-info/default.nix` recursively scans `/machines/` for any `properties.nix` file and auto-registers that directory as a machine. To add a machine, create `machines/<name>/properties.nix` and `machines/<name>/default.nix`.
+
+`properties.nix` returns a plain attrset (no NixOS module args) with: `hostNames`, `arch`, `systemRoles`, `hostKey`, and optionally `userKeys`, `deployKeys`, `remoteUnlock`.
+
+### Role System
+
+Each machine declares `systemRoles` in its `properties.nix` (e.g., `["personal" "dns-challenge"]`). Roles drive conditional config:
+- `config.thisMachine.hasRole.<role>` - boolean, used to conditionally enable features (e.g., `de.enable` for `personal` role)
+- `config.machines.withRole.<role>` - list of hostnames with that role
+- Roles also determine which machines can decrypt which agenix secrets (see `secrets/secrets.nix`)
+
+### Secrets (agenix)
+
+Secrets in `/secrets/` are encrypted `.age` files. `secrets.nix` maps each secret to the SSH host keys (by role) that can decrypt it. After changing which machines have access, run `make rekey-secrets`.
+
+### Sandboxed Workspaces
+
+`common/sandboxed-workspace/` provides isolated dev environments. Three backends: `vm` (microvm/cloud-hypervisor), `container` (systemd-nspawn), `incus`. Workspaces are defined in machine `default.nix` files and their per-workspace config goes in `machines/<hostname>/workspaces/<name>.nix`. The base config (`base.nix`) handles networking, SSH, user setup, and Claude Code pre-configuration.
+
+IP allocation convention: VMs `.10-.49`, containers `.50-.89`, incus `.90-.129` in `192.168.83.0/24`.
+
+### Backups
+
+`common/backups.nix` defines a `backup.group` option. Machines declare backup groups with paths; restic handles daily backups to Backblaze B2 with automatic ZFS/btrfs snapshot support. Each group gets a `restic_<group>` CLI wrapper for manual operations.
+
+### Nixpkgs Patching
+
+`flake.nix` applies patches from `/patches/` to nixpkgs before building (workaround for nix#3920).
+
+### Key Conventions
+
+- Uses `doas` instead of `sudo` everywhere
+- Fish shell is the default user shell
+- Home Manager is used for user-level config (`home/googlebot.nix`)
+- `lib/default.nix` extends nixpkgs lib with custom utility functions (extends via `nixpkgs.lib.extend`)
+- Overlays are in `/overlays/` and applied globally via `flake.nix`
+- The Nix formatter for this project is `nixpkgs-fmt`
+- Do not add "Co-Authored-By" lines to commit messages
+- Always use `--no-link` when running `nix build`
+- Don't use `nix build --dry-run` unless you only need evaluation — it skips the actual build
+- Avoid `2>&1` on nix commands — it can cause error output to be missed
--- a/README.md
+++ b/README.md
@@ -1,11 +1,32 @@
-# My NixOS configurations
+# NixOS Configuration

-### Source Layout
- `/common` - common configuration imported into all `/machines`
-    - `/boot` - config related to bootloaders, cpu microcode, and unlocking LUKS root disks over tor
-    - `/network` - config for tailscale, and NixOS container with automatic vpn tunneling via PIA
-    - `/pc` - config that a graphical PC should have. Have the `personal` role set in the machine's `properties.nix` to enable everthing.
-    - `/server` - config that creates new nixos services or extends existing ones to meet my needs
- `/machines` - all my NixOS machines along with their machine unique configuration for hardware and services
-    - `/kexec` - a special machine for generating minimal kexec images. Does not import `/common`
- `/secrets` - encrypted shared secrets unlocked through `/machines` ssh host keys
+A NixOS flake managing multiple machines with role-based configuration, agenix secrets, and sandboxed dev workspaces.
+
+## Layout
+
+- `/common` - shared configuration imported by all machines
+  - `/boot` - bootloaders, CPU microcode, remote LUKS unlock over Tor
+  - `/network` - Tailscale, VPN tunneling via PIA
+  - `/pc` - desktop/graphical config (enabled by the `personal` role)
+  - `/server` - service definitions and extensions
+  - `/sandboxed-workspace` - isolated dev environments (VM, container, or Incus)
+- `/machines` - per-machine config (`default.nix`, `hardware-configuration.nix`, `properties.nix`)
+- `/secrets` - agenix-encrypted secrets, decryptable by machines based on their roles
+- `/home` - Home Manager user config
+- `/lib` - custom library functions extending nixpkgs lib
+- `/overlays` - nixpkgs overlays applied globally
+- `/patches` - patches applied to nixpkgs at build time
+
+## Notable Features
+
+**Auto-discovery & roles** — Machines register themselves by placing a `properties.nix` under `/machines/`. No manual listing in `flake.nix`. Roles declared per-machine (`"personal"`, `"dns-challenge"`, etc.) drive feature enablement via `config.thisMachine.hasRole.<role>` and control which agenix secrets each machine can decrypt.
+
+**Machine properties module system** — `properties.nix` files form a separate lightweight module system (`machine-info`) for recording machine metadata (hostnames, architecture, roles, SSH keys). Since every machine's properties are visible to every other machine, each system can reflect on the properties of the entire fleet — enabling automatic SSH trust, role-based secret access, and cross-machine coordination without duplicating information.
+
+**Remote LUKS unlock over Tor** — Machines with encrypted root disks can be unlocked remotely via SSH. An embedded Tor hidden service starts in the initrd so the machine is reachable even without a known IP, using a separate SSH host key for the boot environment.
+
+**VPN containers** — A `vpn-container` module spins up an ephemeral NixOS container with a PIA WireGuard tunnel. The host creates the WireGuard interface and authenticates with PIA, then hands it off to the container's network namespace. This ensures that the container can **never** have direct internet access. Leakage is impossible.
+
+**Sandboxed workspaces** — Isolated dev environments backed by microVMs (cloud-hypervisor), systemd-nspawn containers, or Incus. Each workspace gets a static IP on a NAT'd bridge, auto-generated SSH host keys, shell aliases for management, and comes pre-configured with Claude Code. The sandbox network blocks access to the local LAN while allowing internet.
+
+**Snapshot-aware backups** — Restic backups to Backblaze B2 automatically create ZFS snapshots or btrfs read-only snapshots before backing up, using mount namespaces to bind-mount frozen data over the original paths so restic records correct paths. Each backup group gets a `restic_<group>` CLI wrapper. Supports `.nobackup` marker files.
--- a/common/backups.nix
+++ b/common/backups.nix
@@ -2,13 +2,101 @@

 let
  cfg = config.backup;
-  hostname = config.networking.hostName;

  mkRespository = group: "s3:s3.us-west-004.backblazeb2.com/D22TgIt0-main-backup/${group}";

+  findmnt = "${pkgs.util-linux}/bin/findmnt";
+  mount = "${pkgs.util-linux}/bin/mount";
+  umount = "${pkgs.util-linux}/bin/umount";
+  btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
+  zfs = "/run/current-system/sw/bin/zfs";
+
+  # Creates snapshots and bind mounts them over original paths within the
+  # service's mount namespace, so restic sees correct paths but reads frozen data
+  snapshotHelperFn = ''
+    snapshot_for_path() {
+      local group="$1" path="$2" action="$3"
+      local pathhash fstype
+
+      pathhash=$(echo -n "$path" | sha256sum | cut -c1-8)
+      fstype=$(${findmnt} -n -o FSTYPE -T "$path" 2>/dev/null || echo "unknown")
+
+      case "$fstype" in
+        zfs)
+          local dataset mount subpath snapname snappath
+          dataset=$(${findmnt} -n -o SOURCE -T "$path")
+          mount=$(${findmnt} -n -o TARGET -T "$path")
+          subpath=''${path#"$mount"}
+          [[ "$subpath" != /* ]] && subpath="/$subpath"
+          snapname="''${dataset}@restic-''${group}-''${pathhash}"
+          snappath="''${mount}/.zfs/snapshot/restic-''${group}-''${pathhash}''${subpath}"
+          case "$action" in
+            create)
+              ${zfs} destroy "$snapname" 2>/dev/null || true
+              ${zfs} snapshot "$snapname"
+              ${mount} --bind "$snappath" "$path"
+              echo "$path"
+              ;;
+            destroy)
+              ${umount} "$path" 2>/dev/null || true
+              ${zfs} destroy "$snapname" 2>/dev/null || true
+              ;;
+          esac
+          ;;
+        btrfs)
+          local mount subpath snapdir snappath
+          mount=$(${findmnt} -n -o TARGET -T "$path")
+          subpath=''${path#"$mount"}
+          [[ "$subpath" != /* ]] && subpath="/$subpath"
+          snapdir="/.restic-snapshots/''${group}-''${pathhash}"
+          snappath="''${snapdir}''${subpath}"
+          case "$action" in
+            create)
+              ${btrfs} subvolume delete "$snapdir" 2>/dev/null || true
+              mkdir -p /.restic-snapshots
+              ${btrfs} subvolume snapshot -r "$mount" "$snapdir" >&2
+              ${mount} --bind "$snappath" "$path"
+              echo "$path"
+              ;;
+            destroy)
+              ${umount} "$path" 2>/dev/null || true
+              ${btrfs} subvolume delete "$snapdir" 2>/dev/null || true
+              ;;
+          esac
+          ;;
+        *)
+          echo "No snapshot support for $fstype ($path), using original" >&2
+          [ "$action" = "create" ] && echo "$path"
+          ;;
+      esac
+    }
+  '';
+
  mkBackup = group: paths: {
    repository = mkRespository group;
-    inherit paths;
+
+    dynamicFilesFrom = "cat /run/restic-backup-${group}/paths";
+
+    backupPrepareCommand = ''
+      mkdir -p /run/restic-backup-${group}
+      : > /run/restic-backup-${group}/paths
+
+      ${snapshotHelperFn}
+
+      for path in ${lib.escapeShellArgs paths}; do
+        snapshot_for_path ${lib.escapeShellArg group} "$path" create >> /run/restic-backup-${group}/paths
+      done
+    '';
+
+    backupCleanupCommand = ''
+      ${snapshotHelperFn}
+
+      for path in ${lib.escapeShellArgs paths}; do
+        snapshot_for_path ${lib.escapeShellArg group} "$path" destroy
+      done
+
+      rm -rf /run/restic-backup-${group}
+    '';

    initialize = true;

@@ -21,11 +109,11 @@ let
      ''--exclude-if-present ".nobackup"''
    ];

+    # Keeps backups from up to 6 months ago
    pruneOpts = [
      "--keep-daily 7" # one backup for each of the last n days
      "--keep-weekly 5" # one backup for each of the last n weeks
-      "--keep-monthly 12" # one backup for each of the last n months
-      "--keep-yearly 75" # one backup for each of the last n years
+      "--keep-monthly 6" # one backup for each of the last n months
    ];

    environmentFile = "/run/agenix/backblaze-s3-backups";
@@ -64,12 +152,25 @@ in
  };

  config = lib.mkIf (cfg.group != null) {
+    assertions = lib.mapAttrsToList (group: _: {
+      assertion = config.systemd.services."restic-backups-${group}".enable;
+      message = "Expected systemd service 'restic-backups-${group}' not found. The nixpkgs restic module may have changed its naming convention.";
+    }) cfg.group;
+
    services.restic.backups = lib.concatMapAttrs
      (group: groupCfg: {
        ${group} = mkBackup group groupCfg.paths;
      })
      cfg.group;

+    # Mount namespace lets us bind mount snapshots over original paths,
+    # so restic backs up from frozen snapshots while recording correct paths
+    systemd.services = lib.concatMapAttrs
+      (group: _: {
+        "restic-backups-${group}".serviceConfig.PrivateMounts = true;
+      })
+      cfg.group;
+
    age.secrets.backblaze-s3-backups.file = ../secrets/backblaze-s3-backups.age;
    age.secrets.restic-password.file = ../secrets/restic-password.age;

--- a/common/binary-cache.nix
+++ b/common/binary-cache.nix
@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, ... }:

 {
  nix = {
@@ -6,11 +6,11 @@
      substituters = [
        "https://cache.nixos.org/"
        "https://nix-community.cachix.org"
-        "http://s0.koi-bebop.ts.net:5000"
+        "http://s0.koi-bebop.ts.net:28338/nixos"
      ];
      trusted-public-keys = [
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
+        "nixos:SnTTQutdOJbAmxo6AQ3cbRt5w9f4byMXQODCieBH3PQ="
      ];

      # Allow substituters to be offline
@@ -19,6 +19,11 @@
      # and use this flag as intended for deciding if it should build missing
      # derivations locally. See https://github.com/NixOS/nix/issues/6901
      fallback = true;
+
+      # Authenticate to private nixos cache
+      netrc-file = config.age.secrets.attic-netrc.path;
    };
  };
+
+  age.secrets.attic-netrc.file = ../secrets/attic-netrc.age;
 }
--- a/common/boot/default.nix
+++ b/common/boot/default.nix
@@ -1,4 +1,4 @@
-{ lib, config, pkgs, ... }:
+{ ... }:

 {
  imports = [
--- a/common/boot/firmware.nix
+++ b/common/boot/firmware.nix
@@ -1,4 +1,4 @@
-{ lib, config, pkgs, ... }:
+{ lib, config, ... }:

 with lib;
 let
--- a/common/default.nix
+++ b/common/default.nix
@@ -14,6 +14,7 @@
    ./machine-info
    ./nix-builder.nix
    ./ssh.nix
+    ./sandboxed-workspace
  ];

  nix.flakes.enable = true;
@@ -55,7 +56,6 @@
    pciutils
    usbutils
    killall
-    screen
    micro
    helix
    lm_sensors
--- a/common/flakes.nix
+++ b/common/flakes.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, config, ... }:
+{ lib, config, ... }:
 with lib;
 let
  cfg = config.nix.flakes;
--- a/common/machine-info/default.nix
+++ b/common/machine-info/default.nix
@@ -1,7 +1,7 @@
 # Gathers info about each machine to constuct overall configuration
 # Ex: Each machine already trusts each others SSH fingerprint already

-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:

 let
  machines = config.machines.hosts;
--- a/common/network/default.nix
+++ b/common/network/default.nix
@@ -9,9 +9,9 @@ in
  imports = [
    ./pia-openvpn.nix
    ./pia-wireguard.nix
-    ./ping.nix
    ./tailscale.nix
    ./vpn.nix
+    ./sandbox.nix
  ];

  options.networking.ip_forward = mkEnableOption "Enable ip forwarding";
--- a/common/network/ping.nix
+++ b/common/network/ping.nix
@@ -1,59 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-# keeps peer to peer connections alive with a periodic ping
-
-with lib;
-with builtins;
-
-# todo auto restart
-
-let
-  cfg = config.keepalive-ping;
-
-  serviceTemplate = host:
-    {
-      "keepalive-ping@${host}" = {
-        description = "Periodic ping keep alive for ${host} connection";
-
-        requires = [ "network-online.target" ];
-        after = [ "network.target" "network-online.target" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig.Restart = "always";
-
-        path = with pkgs; [ iputils ];
-
-        script = ''
-          ping -i ${cfg.delay} ${host} &>/dev/null
-        '';
-      };
-    };
-
-  combineAttrs = foldl recursiveUpdate { };
-
-  serviceList = map serviceTemplate cfg.hosts;
-
-  services = combineAttrs serviceList;
-in
-{
-  options.keepalive-ping = {
-    enable = mkEnableOption "Enable keep alive ping task";
-    hosts = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-      description = ''
-        Hosts to ping periodically
-      '';
-    };
-    delay = mkOption {
-      type = types.str;
-      default = "60";
-      description = ''
-        Ping interval in seconds of periodic ping per host being pinged
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services = services;
-  };
-}
--- a/common/network/sandbox.nix
+++ b/common/network/sandbox.nix
@@ -0,0 +1,126 @@
+{ config, lib, ... }:
+
+# Network configuration for sandboxed workspaces (VMs and containers)
+# Creates a bridge network with NAT for isolated environments
+
+with lib;
+
+let
+  cfg = config.networking.sandbox;
+in
+{
+  options.networking.sandbox = {
+    enable = mkEnableOption "sandboxed workspace network bridge";
+
+    bridgeName = mkOption {
+      type = types.str;
+      default = "sandbox-br";
+      description = "Name of the bridge interface for sandboxed workspaces";
+    };
+
+    subnet = mkOption {
+      type = types.str;
+      default = "192.168.83.0/24";
+      description = "Subnet for sandboxed workspace network";
+    };
+
+    hostAddress = mkOption {
+      type = types.str;
+      default = "192.168.83.1";
+      description = "Host address on the sandbox bridge";
+    };
+
+    upstreamInterface = mkOption {
+      type = types.str;
+      description = "Upstream network interface for NAT";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.ip_forward = true;
+
+    # Create the bridge interface
+    systemd.network.netdevs."10-${cfg.bridgeName}" = {
+      netdevConfig = {
+        Kind = "bridge";
+        Name = cfg.bridgeName;
+      };
+    };
+
+    systemd.network.networks."10-${cfg.bridgeName}" = {
+      matchConfig.Name = cfg.bridgeName;
+      networkConfig = {
+        Address = "${cfg.hostAddress}/24";
+        DHCPServer = false;
+        IPv4Forwarding = true;
+        IPv6Forwarding = false;
+        IPMasquerade = "ipv4";
+      };
+      linkConfig.RequiredForOnline = "no";
+    };
+
+    # Automatically attach VM tap interfaces to the bridge
+    systemd.network.networks."11-vm" = {
+      matchConfig.Name = "vm-*";
+      networkConfig.Bridge = cfg.bridgeName;
+      linkConfig.RequiredForOnline = "no";
+    };
+
+    # Automatically attach container veth interfaces to the bridge
+    systemd.network.networks."11-container" = {
+      matchConfig.Name = "ve-*";
+      networkConfig.Bridge = cfg.bridgeName;
+      linkConfig.RequiredForOnline = "no";
+    };
+
+    # NAT configuration for sandboxed workspaces
+    networking.nat = {
+      enable = true;
+      internalInterfaces = [ cfg.bridgeName ];
+      externalInterface = cfg.upstreamInterface;
+    };
+
+    # Enable systemd-networkd (required for bridge setup)
+    systemd.network.enable = true;
+
+    # When NetworkManager handles primary networking, disable systemd-networkd-wait-online.
+    # The bridge is the only interface managed by systemd-networkd and it never reaches
+    # "online" state without connected workspaces. NetworkManager-wait-online.service already
+    # gates network-online.target for the primary interface.
+    # On pure systemd-networkd systems (no NM), we just ignore the bridge.
+    systemd.network.wait-online.enable =
+      !config.networking.networkmanager.enable;
+    systemd.network.wait-online.ignoredInterfaces =
+      lib.mkIf (!config.networking.networkmanager.enable) [ cfg.bridgeName ];
+
+    # If NetworkManager is enabled, tell it to ignore sandbox interfaces
+    # This allows systemd-networkd and NetworkManager to coexist
+    networking.networkmanager.unmanaged = [
+      "interface-name:${cfg.bridgeName}"
+      "interface-name:vm-*"
+      "interface-name:ve-*"
+      "interface-name:veth*"
+    ];
+
+    # Make systemd-resolved listen on the bridge for workspace DNS queries.
+    # By default resolved only listens on 127.0.0.53 (localhost).
+    # DNSStubListenerExtra adds the bridge address so workspaces can use the host as DNS.
+    services.resolved.settings.Resolve.DNSStubListenerExtra = cfg.hostAddress;
+
+    # Allow DNS traffic from workspaces to the host
+    networking.firewall.interfaces.${cfg.bridgeName} = {
+      allowedTCPPorts = [ 53 ];
+      allowedUDPPorts = [ 53 ];
+    };
+
+    # Block sandboxes from reaching the local network (private RFC1918 ranges)
+    # while still allowing public internet access via NAT.
+    # The sandbox subnet itself is allowed so workspaces can reach the host gateway.
+    networking.firewall.extraForwardRules = ''
+      iifname ${cfg.bridgeName} ip daddr ${cfg.hostAddress} accept
+      iifname ${cfg.bridgeName} ip daddr 10.0.0.0/8 drop
+      iifname ${cfg.bridgeName} ip daddr 172.16.0.0/12 drop
+      iifname ${cfg.bridgeName} ip daddr 192.168.0.0/16 drop
+    '';
+  };
+}
--- a/common/network/tailscale.nix
+++ b/common/network/tailscale.nix
@@ -10,6 +10,10 @@ in

  config.services.tailscale.enable = mkDefault (!config.boot.isContainer);

+  # Trust Tailscale interface - access control is handled by Tailscale ACLs.
+  # Required because nftables (used by Incus) breaks Tailscale's automatic iptables rules.
+  config.networking.firewall.trustedInterfaces = mkIf cfg.enable [ "tailscale0" ];
+
  # MagicDNS
  config.networking.nameservers = mkIf cfg.enable [ "1.1.1.1" "8.8.8.8" ];
  config.networking.search = mkIf cfg.enable [ "koi-bebop.ts.net" ];
--- a/common/network/vpn.nix
+++ b/common/network/vpn.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, allModules, ... }:
+{ config, lib, allModules, ... }:

 with lib;

--- a/common/pc/audio.nix
+++ b/common/pc/audio.nix
@@ -1,4 +1,4 @@
-{ lib, config, pkgs, ... }:
+{ lib, config, ... }:

 let
  cfg = config.de;
--- a/common/pc/default.nix
+++ b/common/pc/default.nix
@@ -11,7 +11,6 @@ in
    ./firefox.nix
    ./audio.nix
    ./pithos.nix
-    ./vscodium.nix
    ./discord.nix
    ./steam.nix
    ./touchpad.nix
@@ -52,11 +51,14 @@ in
      deskflow
      file-roller
      android-tools
+      logseq

      # For Nix IDE
      nixpkgs-fmt
      nixd
      nil
+
+      godot-mono
    ];

    # Networking
--- a/common/pc/touchpad.nix
+++ b/common/pc/touchpad.nix
@@ -1,4 +1,4 @@
-{ lib, config, pkgs, ... }:
+{ lib, config, ... }:

 let
  cfg = config.de;
--- a/common/pc/vscodium.nix
+++ b/common/pc/vscodium.nix
@@ -1,39 +0,0 @@
-{ lib, config, pkgs, ... }:
-
-let
-  cfg = config.de;
-
-  extensions = with pkgs.vscode-extensions; [
-    bbenoist.nix # nix syntax support
-    arrterian.nix-env-selector # nix dev envs
-    dart-code.dart-code
-    dart-code.flutter
-    golang.go
-    jnoortheen.nix-ide
-    ms-vscode.cpptools
-    rust-lang.rust-analyzer
-    vadimcn.vscode-lldb
-    tauri-apps.tauri-vscode
-    platformio.platformio-vscode-ide
-    vue.volar
-  ] ++ pkgs.vscode-utils.extensionsFromVscodeMarketplace [
-    {
-      name = "wgsl-analyzer";
-      publisher = "wgsl-analyzer";
-      version = "0.12.105";
-      sha256 = "sha256-NheEVNIa8CIlyMebAhxRKS44b1bZiWVt8PgC6r3ExMA=";
-    }
-  ];
-
-  vscodium-with-extensions = pkgs.vscode-with-extensions.override {
-    vscode = pkgs.vscodium;
-    vscodeExtensions = extensions;
-  };
-in
-{
-  config = lib.mkIf cfg.enable {
-    users.users.googlebot.packages = [
-      vscodium-with-extensions
-    ];
-  };
-}
--- a/common/sandboxed-workspace/base.nix
+++ b/common/sandboxed-workspace/base.nix
@@ -0,0 +1,147 @@
+{ hostConfig, workspaceName, ip, networkInterface }:
+
+# Base configuration shared by all sandboxed workspaces (VMs and containers)
+# This provides common settings for networking, SSH, users, and packages
+#
+# Parameters:
+#   hostConfig      - The host's NixOS config (for inputs, ssh keys, etc.)
+#   workspaceName   - Name of the workspace (used as hostname)
+#   ip              - Static IP address for the workspace
+#   networkInterface - Match config for systemd-networkd (e.g., { Type = "ether"; } or { Name = "host0"; })
+
+{ config, lib, pkgs, ... }:
+
+let
+  claudeConfigFile = pkgs.writeText "claude-config.json" (builtins.toJSON {
+    hasCompletedOnboarding = true;
+    theme = "dark";
+    projects = {
+      "/home/googlebot/workspace" = {
+        hasTrustDialogAccepted = true;
+      };
+    };
+  });
+in
+{
+  imports = [
+    ../shell.nix
+    hostConfig.inputs.home-manager.nixosModules.home-manager
+    hostConfig.inputs.nix-index-database.nixosModules.default
+  ];
+
+  nixpkgs.overlays = [
+    hostConfig.inputs.claude-code-nix.overlays.default
+  ];
+
+  # Basic system configuration
+  system.stateVersion = "25.11";
+
+  # Set hostname to match the workspace name
+  networking.hostName = workspaceName;
+
+  # Networking with systemd-networkd
+  networking.useNetworkd = true;
+  systemd.network.enable = true;
+
+  # Enable resolved to populate /etc/resolv.conf from networkd's DNS settings
+  services.resolved.enable = true;
+
+  # Basic networking configuration
+  networking.useDHCP = false;
+
+  # Static IP configuration
+  # Uses the host as DNS server (host forwards to upstream DNS)
+  systemd.network.networks."20-workspace" = {
+    matchConfig = networkInterface;
+    networkConfig = {
+      Address = "${ip}/24";
+      Gateway = hostConfig.networking.sandbox.hostAddress;
+      DNS = [ hostConfig.networking.sandbox.hostAddress ];
+    };
+  };
+
+  # Disable firewall inside workspaces (we're behind NAT)
+  networking.firewall.enable = false;
+
+  # Enable SSH for access
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "prohibit-password";
+    };
+  };
+
+  # Use persistent SSH host keys from shared directory
+  services.openssh.hostKeys = lib.mkForce [
+    {
+      path = "/etc/ssh-host-keys/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+
+  # Basic system packages
+  environment.systemPackages = with pkgs; [
+    claude-code
+    kakoune
+    vim
+    git
+    htop
+    wget
+    curl
+    tmux
+    dnsutils
+  ];
+
+  # User configuration
+  users.mutableUsers = false;
+  users.users.googlebot = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.fish;
+    openssh.authorizedKeys.keys = hostConfig.machines.ssh.userKeys;
+  };
+
+  security.doas.enable = true;
+  security.sudo.enable = false;
+  security.doas.extraRules = [
+    { groups = [ "wheel" ]; noPass = true; }
+  ];
+
+  # Minimal locale settings
+  i18n.defaultLocale = "en_US.UTF-8";
+  time.timeZone = "America/Los_Angeles";
+
+  # Enable flakes
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.trusted-users = [ "googlebot" ];
+
+  # Make nixpkgs available in NIX_PATH and registry (like the NixOS ISO)
+  # This allows `nix-shell -p`, `nix repl '<nixpkgs>'`, etc. to work
+  nix.nixPath = [ "nixpkgs=${hostConfig.inputs.nixpkgs}" ];
+  nix.registry.nixpkgs.flake = hostConfig.inputs.nixpkgs;
+
+  # Enable fish shell
+  programs.fish.enable = true;
+
+  # Initialize Claude Code config on first boot (skips onboarding, trusts workspace)
+  systemd.services.claude-config-init = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      User = "googlebot";
+      Group = "users";
+    };
+    script = ''
+      if [ ! -f /home/googlebot/claude-config/.claude.json ]; then
+        cp ${claudeConfigFile} /home/googlebot/claude-config/.claude.json
+      fi
+    '';
+  };
+
+  # Home Manager configuration
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.users.googlebot = import ./home.nix;
+}
--- a/common/sandboxed-workspace/container.nix
+++ b/common/sandboxed-workspace/container.nix
@@ -0,0 +1,74 @@
+{ config, lib, pkgs, ... }:
+
+# Container-specific configuration for sandboxed workspaces using systemd-nspawn
+# This module is imported by default.nix for workspaces with type = "container"
+
+with lib;
+
+let
+  cfg = config.sandboxed-workspace;
+  hostConfig = config;
+
+  # Filter for container-type workspaces only
+  containerWorkspaces = filterAttrs (n: ws: ws.type == "container") cfg.workspaces;
+in
+{
+  config = mkIf (cfg.enable && containerWorkspaces != { }) {
+    # NixOS container module only sets restartIfChanged when autoStart=true
+    # Work around this by setting it directly on the systemd service
+    systemd.services = mapAttrs'
+      (name: ws: nameValuePair "container@${name}" {
+        restartIfChanged = lib.mkForce true;
+        restartTriggers = [
+          config.containers.${name}.path
+          config.environment.etc."nixos-containers/${name}.conf".source
+        ];
+      })
+      containerWorkspaces;
+
+    # Convert container workspace configs to NixOS containers format
+    containers = mapAttrs
+      (name: ws: {
+        autoStart = ws.autoStart;
+        privateNetwork = true;
+        ephemeral = true;
+        restartIfChanged = true;
+
+        # Attach container's veth to the sandbox bridge
+        # This creates the veth pair and attaches host side to the bridge
+        hostBridge = config.networking.sandbox.bridgeName;
+
+        bindMounts = {
+          "/home/googlebot/workspace" = {
+            hostPath = "/home/googlebot/sandboxed/${name}/workspace";
+            isReadOnly = false;
+          };
+          "/etc/ssh-host-keys" = {
+            hostPath = "/home/googlebot/sandboxed/${name}/ssh-host-keys";
+            isReadOnly = false;
+          };
+          "/home/googlebot/claude-config" = {
+            hostPath = "/home/googlebot/sandboxed/${name}/claude-config";
+            isReadOnly = false;
+          };
+        };
+
+        config = { config, lib, pkgs, ... }: {
+          imports = [
+            (import ./base.nix {
+              inherit hostConfig;
+              workspaceName = name;
+              ip = ws.ip;
+              networkInterface = { Name = "eth0"; };
+            })
+            (import ws.config)
+          ];
+
+          networking.useHostResolvConf = false;
+
+          nixpkgs.config.allowUnfree = true;
+        };
+      })
+      containerWorkspaces;
+  };
+}
--- a/common/sandboxed-workspace/default.nix
+++ b/common/sandboxed-workspace/default.nix
@@ -0,0 +1,164 @@
+{ config, lib, pkgs, ... }:
+
+# Unified sandboxed workspace module supporting both VMs and containers
+# This module provides isolated development environments with shared configuration
+
+with lib;
+
+let
+  cfg = config.sandboxed-workspace;
+in
+{
+  imports = [
+    ./vm.nix
+    ./container.nix
+    ./incus.nix
+  ];
+
+  options.sandboxed-workspace = {
+    enable = mkEnableOption "sandboxed workspace management";
+
+    workspaces = mkOption {
+      type = types.attrsOf (types.submodule {
+        options = {
+          type = mkOption {
+            type = types.enum [ "vm" "container" "incus" ];
+            description = ''
+              Backend type for this workspace:
+              - "vm": microVM with cloud-hypervisor (more isolation, uses virtiofs)
+              - "container": systemd-nspawn via NixOS containers (less overhead, uses bind mounts)
+              - "incus": Incus/LXD container (unprivileged, better security than NixOS containers)
+            '';
+          };
+
+          config = mkOption {
+            type = types.path;
+            description = "Path to the workspace configuration file";
+          };
+
+          ip = mkOption {
+            type = types.str;
+            example = "192.168.83.10";
+            description = ''
+              Static IP address for this workspace on the microvm bridge network.
+              Configures the workspace's network interface and adds an entry to /etc/hosts
+              on the host so the workspace can be accessed by name (e.g., ssh workspace-example).
+              Must be in the 192.168.83.0/24 subnet (or whatever networking.sandbox.subnet is).
+            '';
+          };
+
+          hostKey = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...";
+            description = ''
+              SSH host public key for this workspace. If set, adds to programs.ssh.knownHosts
+              so the host automatically trusts the workspace without prompting.
+              Get the key from: ~/sandboxed/<name>/ssh-host-keys/ssh_host_ed25519_key.pub
+            '';
+          };
+
+          autoStart = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether to automatically start this workspace on boot";
+          };
+
+          cid = mkOption {
+            type = types.nullOr types.int;
+            default = null;
+            description = ''
+              vsock Context Identifier for this workspace (VM-only, ignored for containers).
+              If null, auto-generated from workspace name.
+              Must be unique per host. Valid range: 3 to 4294967294.
+              See: https://man7.org/linux/man-pages/man7/vsock.7.html
+            '';
+          };
+        };
+      });
+      default = { };
+      description = "Sandboxed workspace configurations";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Automatically enable sandbox networking when workspaces are defined
+    networking.sandbox.enable = mkIf (cfg.workspaces != { }) true;
+
+    # Add workspace hostnames to /etc/hosts so they can be accessed by name
+    networking.hosts = lib.mkMerge (lib.mapAttrsToList
+      (name: ws: {
+        ${ws.ip} = [ "workspace-${name}" ];
+      })
+      cfg.workspaces);
+
+    # Add workspace SSH host keys to known_hosts so host trusts workspaces without prompting
+    programs.ssh.knownHosts = lib.mkMerge (lib.mapAttrsToList
+      (name: ws:
+        lib.optionalAttrs (ws.hostKey != null) {
+          "workspace-${name}" = {
+            publicKey = ws.hostKey;
+            extraHostNames = [ ws.ip ];
+          };
+        })
+      cfg.workspaces);
+
+    # Shell aliases for workspace management
+    environment.shellAliases = lib.mkMerge (lib.mapAttrsToList
+      (name: ws:
+        let
+          serviceName =
+            if ws.type == "vm" then "microvm@${name}"
+            else if ws.type == "incus" then "incus-workspace-${name}"
+            else "container@${name}";
+        in
+        {
+          "workspace_${name}" = "ssh googlebot@workspace-${name}";
+          "workspace_${name}_start" = "doas systemctl start ${serviceName}";
+          "workspace_${name}_stop" = "doas systemctl stop ${serviceName}";
+          "workspace_${name}_restart" = "doas systemctl restart ${serviceName}";
+          "workspace_${name}_status" = "doas systemctl status ${serviceName}";
+        })
+      cfg.workspaces);
+
+    # Automatically generate SSH host keys and directories for all workspaces
+    systemd.services = lib.mapAttrs'
+        (name: ws:
+          let
+            serviceName =
+              if ws.type == "vm" then "microvm@${name}"
+              else if ws.type == "incus" then "incus-workspace-${name}"
+              else "container@${name}";
+          in
+          lib.nameValuePair "workspace-${name}-setup" {
+            description = "Setup directories and SSH keys for workspace ${name}";
+            wantedBy = [ "multi-user.target" ];
+            before = [ "${serviceName}.service" ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+
+            script = ''
+              # Create directories if they don't exist
+              mkdir -p /home/googlebot/sandboxed/${name}/workspace
+              mkdir -p /home/googlebot/sandboxed/${name}/ssh-host-keys
+              mkdir -p /home/googlebot/sandboxed/${name}/claude-config
+
+              # Fix ownership
+              chown -R googlebot:users /home/googlebot/sandboxed/${name}
+
+              # Generate SSH host key if it doesn't exist
+              if [ ! -f /home/googlebot/sandboxed/${name}/ssh-host-keys/ssh_host_ed25519_key ]; then
+                ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" \
+                  -f /home/googlebot/sandboxed/${name}/ssh-host-keys/ssh_host_ed25519_key
+                chown googlebot:users /home/googlebot/sandboxed/${name}/ssh-host-keys/ssh_host_ed25519_key*
+                echo "Generated SSH host key for workspace ${name}"
+              fi
+            '';
+          }
+        )
+        cfg.workspaces;
+  };
+}
--- a/common/sandboxed-workspace/home.nix
+++ b/common/sandboxed-workspace/home.nix
@@ -0,0 +1,50 @@
+{ lib, pkgs, ... }:
+
+# Home Manager configuration for sandboxed workspace user environment
+# This sets up the shell and tools inside VMs and containers
+
+{
+  home.username = "googlebot";
+  home.homeDirectory = "/home/googlebot";
+  home.stateVersion = "24.11";
+
+  programs.home-manager.enable = true;
+
+  # Shell configuration
+  programs.fish.enable = true;
+  programs.starship.enable = true;
+  programs.starship.enableFishIntegration = true;
+  programs.starship.settings.container.disabled = true;
+
+  # Basic command-line tools
+  programs.btop.enable = true;
+  programs.ripgrep.enable = true;
+  programs.eza.enable = true;
+
+  # Git configuration
+  programs.git = {
+    enable = true;
+    settings = {
+      user.name = lib.mkDefault "googlebot";
+      user.email = lib.mkDefault "zuckerberg@neet.dev";
+    };
+  };
+
+  # Shell aliases
+  home.shellAliases = {
+    ls = "eza";
+    la = "eza -la";
+    ll = "eza -l";
+  };
+
+  # Environment variables for Claude Code
+  home.sessionVariables = {
+    # Isolate Claude config to a specific directory on the host
+    CLAUDE_CONFIG_DIR = "/home/googlebot/claude-config";
+  };
+
+  # Additional packages for development
+  home.packages = with pkgs; [
+    # Add packages as needed per workspace
+  ];
+}
--- a/common/sandboxed-workspace/incus.nix
+++ b/common/sandboxed-workspace/incus.nix
@@ -0,0 +1,182 @@
+{ config, lib, pkgs, ... }:
+
+# Incus-specific configuration for sandboxed workspaces
+# Creates fully declarative Incus containers from NixOS configurations
+
+with lib;
+
+let
+  cfg = config.sandboxed-workspace;
+  hostConfig = config;
+
+  incusWorkspaces = filterAttrs (n: ws: ws.type == "incus") cfg.workspaces;
+
+  # Build a NixOS LXC image for a workspace
+  mkContainerImage = name: ws:
+    let
+      nixpkgs = hostConfig.inputs.nixpkgs;
+      containerSystem = nixpkgs.lib.nixosSystem {
+        modules = [
+          (import ./base.nix {
+            inherit hostConfig;
+            workspaceName = name;
+            ip = ws.ip;
+            networkInterface = { Name = "eth0"; };
+          })
+
+          (import ws.config)
+
+          ({ config, lib, pkgs, ... }: {
+            nixpkgs.hostPlatform = hostConfig.currentSystem;
+            boot.isContainer = true;
+            networking.useHostResolvConf = false;
+            nixpkgs.config.allowUnfree = true;
+
+            # Incus containers don't support the kernel features nix sandbox requires
+            nix.settings.sandbox = false;
+
+            environment.systemPackages = [
+              (lib.hiPrio (pkgs.writeShellScriptBin "claude" ''
+                exec ${pkgs.claude-code}/bin/claude --dangerously-skip-permissions "$@"
+              ''))
+            ];
+          })
+        ];
+      };
+    in
+    {
+      rootfs = containerSystem.config.system.build.images.lxc;
+      metadata = containerSystem.config.system.build.images.lxc-metadata;
+      toplevel = containerSystem.config.system.build.toplevel;
+    };
+
+  mkIncusService = name: ws:
+    let
+      images = mkContainerImage name ws;
+      hash = builtins.substring 0 12 (builtins.hashString "sha256" "${images.rootfs}");
+      imageName = "nixos-workspace-${name}-${hash}";
+      containerName = "workspace-${name}";
+
+      bridgeName = config.networking.sandbox.bridgeName;
+      mac = lib.mkMac "incus-${name}";
+
+      addDevices = ''
+        incus config device add ${containerName} eth0 nic nictype=bridged parent=${bridgeName} hwaddr=${mac}
+        incus config device add ${containerName} workspace disk source=/home/googlebot/sandboxed/${name}/workspace path=/home/googlebot/workspace shift=true
+        incus config device add ${containerName} ssh-keys disk source=/home/googlebot/sandboxed/${name}/ssh-host-keys path=/etc/ssh-host-keys shift=true
+        incus config device add ${containerName} claude-config disk source=/home/googlebot/sandboxed/${name}/claude-config path=/home/googlebot/claude-config shift=true
+      '';
+    in
+    {
+      description = "Incus workspace ${name}";
+      after = [ "incus.service" "incus-preseed.service" "workspace-${name}-setup.service" ];
+      requires = [ "incus.service" ];
+      wants = [ "workspace-${name}-setup.service" ];
+      wantedBy = optional ws.autoStart "multi-user.target";
+
+      path = [ config.virtualisation.incus.package pkgs.gnutar pkgs.xz pkgs.util-linux ];
+
+      restartTriggers = [ images.rootfs images.metadata ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+
+      script = ''
+        set -euo pipefail
+
+        # Serialize incus operations - concurrent container creation causes race conditions
+        exec 9>/run/incus-workspace.lock
+        flock -x 9
+
+        # Import image if not present
+        if ! incus image list --format csv | grep -q "${imageName}"; then
+          metadata_tarball=$(echo ${images.metadata}/tarball/*.tar.xz)
+          rootfs_tarball=$(echo ${images.rootfs}/tarball/*.tar.xz)
+          incus image import "$metadata_tarball" "$rootfs_tarball" --alias ${imageName}
+
+          # Clean up old images for this workspace
+          incus image list --format csv | grep "nixos-workspace-${name}-" | grep -v "${imageName}" | cut -d, -f2 | while read old_image; do
+            incus image delete "$old_image" || true
+          done || true
+        fi
+
+        # Always recreate container for ephemeral behavior
+        incus stop ${containerName} --force 2>/dev/null || true
+        incus delete ${containerName} --force 2>/dev/null || true
+
+        incus init ${imageName} ${containerName}
+        ${addDevices}
+        incus start ${containerName}
+
+        # Wait for container to start
+        for i in $(seq 1 30); do
+          if incus list --format csv | grep -q "^${containerName},RUNNING"; then
+            exit 0
+          fi
+          sleep 1
+        done
+
+        exit 1
+      '';
+
+      preStop = ''
+        exec 9>/run/incus-workspace.lock
+        flock -x 9
+
+        incus stop ${containerName} --force 2>/dev/null || true
+        incus delete ${containerName} --force 2>/dev/null || true
+
+        # Clean up all images for this workspace
+        incus image list --format csv 2>/dev/null | grep "nixos-workspace-${name}-" | cut -d, -f2 | while read img; do
+          incus image delete "$img" 2>/dev/null || true
+        done
+      '';
+    };
+
+
+in
+{
+  config = mkIf (cfg.enable && incusWorkspaces != { }) {
+
+    virtualisation.incus.enable = true;
+    networking.nftables.enable = true;
+
+    virtualisation.incus.preseed = {
+      storage_pools = [{
+        name = "default";
+        driver = "dir";
+        config = {
+          source = "/var/lib/incus/storage-pools/default";
+        };
+      }];
+
+      profiles = [{
+        name = "default";
+        config = {
+          "security.privileged" = "false";
+          "security.idmap.isolated" = "true";
+        };
+        devices = {
+          root = {
+            path = "/";
+            pool = "default";
+            type = "disk";
+          };
+        };
+      }];
+    };
+
+    systemd.services = mapAttrs'
+      (name: ws: nameValuePair "incus-workspace-${name}" (mkIncusService name ws))
+      incusWorkspaces;
+
+    # Extra alias for incus shell access (ssh is also available via default.nix aliases)
+    environment.shellAliases = mkMerge (mapAttrsToList
+      (name: ws: {
+        "workspace_${name}_shell" = "doas incus exec workspace-${name} -- su -l googlebot";
+      })
+      incusWorkspaces);
+  };
+}
--- a/common/sandboxed-workspace/vm.nix
+++ b/common/sandboxed-workspace/vm.nix
@@ -0,0 +1,140 @@
+{ config, lib, pkgs, ... }:
+
+# VM-specific configuration for sandboxed workspaces using microvm.nix
+# This module is imported by default.nix for workspaces with type = "vm"
+
+with lib;
+
+let
+  cfg = config.sandboxed-workspace;
+  hostConfig = config;
+
+  # Generate a deterministic vsock CID from workspace name.
+  #
+  # vsock (virtual sockets) enables host-VM communication without networking.
+  # cloud-hypervisor uses vsock for systemd-notify integration: when a VM finishes
+  # booting, systemd sends READY=1 to the host via vsock, allowing the host's
+  # microvm@ service to accurately track VM boot status instead of guessing.
+  #
+  # Each VM needs a unique CID (Context Identifier). Reserved CIDs per vsock(7):
+  #   - VMADDR_CID_HYPERVISOR (0): reserved for hypervisor
+  #   - VMADDR_CID_LOCAL (1): loopback address
+  #   - VMADDR_CID_HOST (2): host address
+  # See: https://man7.org/linux/man-pages/man7/vsock.7.html
+  #      https://docs.kernel.org/virt/kvm/vsock.html
+  #
+  # We auto-generate from SHA256 hash to ensure uniqueness without manual assignment.
+  # Range: 100 - 16777315 (offset avoids reserved CIDs and leaves 3-99 for manual use)
+  nameToCid = name:
+    let
+      hash = builtins.hashString "sha256" name;
+      hexPart = builtins.substring 0 6 hash;
+    in
+    100 + (builtins.foldl'
+      (acc: c: acc * 16 + (
+        if c == "a" then 10
+        else if c == "b" then 11
+        else if c == "c" then 12
+        else if c == "d" then 13
+        else if c == "e" then 14
+        else if c == "f" then 15
+        else lib.strings.toInt c
+      )) 0
+      (lib.stringToCharacters hexPart));
+
+  # Filter for VM-type workspaces only
+  vmWorkspaces = filterAttrs (n: ws: ws.type == "vm") cfg.workspaces;
+
+  # Generate VM configuration for a workspace
+  mkVmConfig = name: ws: {
+    inherit pkgs;  # Use host's pkgs (includes allowUnfree)
+    config = import ws.config;
+    specialArgs = { inputs = hostConfig.inputs; };
+    extraModules = [
+      (import ./base.nix {
+        inherit hostConfig;
+        workspaceName = name;
+        ip = ws.ip;
+        networkInterface = { Type = "ether"; };
+      })
+      {
+        environment.systemPackages = [
+          (lib.hiPrio (pkgs.writeShellScriptBin "claude" ''
+            exec ${pkgs.claude-code}/bin/claude --dangerously-skip-permissions "$@"
+          ''))
+        ];
+
+        # MicroVM specific configuration
+        microvm = {
+          # Use cloud-hypervisor for better performance
+          hypervisor = lib.mkDefault "cloud-hypervisor";
+
+          # Resource allocation
+          vcpu = 8;
+          mem = 4096; # 4GB RAM
+
+          # Disk for writable overlay
+          volumes = [{
+            image = "overlay.img";
+            mountPoint = "/nix/.rw-store";
+            size = 8192; # 8GB
+          }];
+
+          # Shared directories with host using virtiofs
+          shares = [
+            {
+              # Share the host's /nix/store for accessing packages
+              proto = "virtiofs";
+              tag = "ro-store";
+              source = "/nix/store";
+              mountPoint = "/nix/.ro-store";
+            }
+            {
+              proto = "virtiofs";
+              tag = "workspace";
+              source = "/home/googlebot/sandboxed/${name}/workspace";
+              mountPoint = "/home/googlebot/workspace";
+            }
+            {
+              proto = "virtiofs";
+              tag = "ssh-host-keys";
+              source = "/home/googlebot/sandboxed/${name}/ssh-host-keys";
+              mountPoint = "/etc/ssh-host-keys";
+            }
+            {
+              proto = "virtiofs";
+              tag = "claude-config";
+              source = "/home/googlebot/sandboxed/${name}/claude-config";
+              mountPoint = "/home/googlebot/claude-config";
+            }
+          ];
+
+          # Writeable overlay for /nix/store
+          writableStoreOverlay = "/nix/.rw-store";
+
+          # TAP interface for bridged networking
+          # The interface name "vm-*" matches the pattern in common/network/microvm.nix
+          # which automatically attaches it to the microbr bridge
+          interfaces = [{
+            type = "tap";
+            id = "vm-${name}";
+            mac = lib.mkMac "vm-${name}";
+          }];
+
+          # Enable vsock for systemd-notify integration
+          vsock.cid =
+            if ws.cid != null
+            then ws.cid
+            else nameToCid name;
+        };
+      }
+    ];
+    autostart = ws.autoStart;
+  };
+in
+{
+  config = mkIf (cfg.enable && vmWorkspaces != { }) {
+    # Convert VM workspace configs to microvm.nix format
+    microvm.vms = mapAttrs mkVmConfig vmWorkspaces;
+  };
+}
--- a/common/server/actualbudget.nix
+++ b/common/server/actualbudget.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:

 let
  cfg = config.services.actual;
--- a/common/server/atticd.nix
+++ b/common/server/atticd.nix
@@ -0,0 +1,61 @@
+{ config, lib, ... }:
+
+{
+  config = lib.mkIf (config.thisMachine.hasRole."binary-cache") {
+    services.atticd = {
+      enable = true;
+      environmentFile = config.age.secrets.atticd-credentials.path;
+      settings = {
+        listen = "[::]:28338";
+        database.url = "postgresql:///atticd?host=/run/postgresql";
+        require-proof-of-possession = false;
+
+        # Disable chunking — the dedup savings don't justify the CPU/IO
+        # overhead for local storage, especially on ZFS which already
+        # does block-level compression.
+        chunking = {
+          nar-size-threshold = 0;
+          min-size = 16 * 1024;
+          avg-size = 64 * 1024;
+          max-size = 256 * 1024;
+        };
+
+        # Let ZFS handle compression instead of double-compressing.
+        compression.type = "none";
+
+        garbage-collection.default-retention-period = "6 months";
+      };
+    };
+
+    # PostgreSQL for atticd
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "atticd" ];
+      ensureUsers = [{
+        name = "atticd";
+        ensureDBOwnership = true;
+      }];
+    };
+
+    # Use a static user so the ZFS mountpoint at /var/lib/atticd works
+    # (DynamicUser conflicts with ZFS mountpoints)
+    users.users.atticd = {
+      isSystemUser = true;
+      group = "atticd";
+      home = "/var/lib/atticd";
+    };
+    users.groups.atticd = { };
+
+    systemd.services.atticd = {
+      after = [ "postgresql.service" ];
+      requires = [ "postgresql.service" ];
+      serviceConfig = {
+        DynamicUser = lib.mkForce false;
+        User = "atticd";
+        Group = "atticd";
+      };
+    };
+
+    age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
+  };
+}
--- a/common/server/ceph.nix
+++ b/common/server/ceph.nix
@@ -1,43 +0,0 @@
-{ config, lib, ... }:
-
-with lib;
-let
-  cfg = config.ceph;
-in
-{
-  options.ceph = { };
-
-  config = mkIf cfg.enable {
-    # ceph.enable = true;
-
-    ## S3 Object gateway
-    #ceph.rgw.enable = true;
-    #ceph.rgw.daemons = [
-    #];
-
-    # https://docs.ceph.com/en/latest/start/intro/
-
-    # meta object storage daemon
-    ceph.osd.enable = true;
-    ceph.osd.daemons = [
-
-    ];
-    # monitor's ceph state
-    ceph.mon.enable = true;
-    ceph.mon.daemons = [
-
-    ];
-    # manage ceph
-    ceph.mgr.enable = true;
-    ceph.mgr.daemons = [
-
-    ];
-    # metadata server
-    ceph.mds.enable = true;
-    ceph.mds.daemons = [
-
-    ];
-    ceph.global.fsid = "925773DC-D95F-476C-BBCD-08E01BF0865F";
-
-  };
-}
--- a/common/server/default.nix
+++ b/common/server/default.nix
@@ -1,22 +1,18 @@
-{ config, pkgs, ... }:
+{ ... }:

 {
  imports = [
    ./nginx.nix
    ./thelounge.nix
    ./mumble.nix
-    ./icecast.nix
-    ./nginx-stream.nix
    ./matrix.nix
-    ./zerobin.nix
    ./gitea.nix
    ./samba.nix
    ./owncast.nix
    ./mailserver.nix
    ./nextcloud.nix
-    ./iodine.nix
-    ./searx.nix
    ./gitea-actions-runner.nix
+    ./atticd.nix
    ./librechat.nix
    ./actualbudget.nix
    ./unifi.nix
--- a/common/server/gitea-actions-runner.nix
+++ b/common/server/gitea-actions-runner.nix
@@ -1,132 +1,78 @@
-{ config, pkgs, lib, allModules, ... }:
+{ config, lib, ... }:

-# Gitea Actions Runner. Starts 'host' runner that runs directly on the host inside of a nixos container
-# This is useful for providing a real Nix/OS builder to gitea.
-# Warning, NixOS containers are not secure. For example, the container shares the /nix/store
-# Therefore, this should not be used to run untrusted code.
-# To enable, assign a machine the 'gitea-actions-runner' system role
-
-# TODO: skipping running inside of nixos container for now because of issues getting docker/podman running
+# Gitea Actions Runner inside a NixOS container.
+# The container shares the host's /nix/store (read-only) and nix-daemon socket,
+# so builds go through the host daemon and outputs land in the host store.
+# Warning: NixOS containers are not fully secure — do not run untrusted code.
+# To enable, assign a machine the 'gitea-actions-runner' system role.

 let
  thisMachineIsARunner = config.thisMachine.hasRole."gitea-actions-runner";
  containerName = "gitea-runner";
+  giteaRunnerUid = 991;
+  giteaRunnerGid = 989;
 in
 {
  config = lib.mkIf (thisMachineIsARunner && !config.boot.isContainer) {
-    # containers.${containerName} = {
-    #   ephemeral = true;
-    #   autoStart = true;

-    #   # for podman
-    #   enableTun = true;
+    containers.${containerName} = {
+      autoStart = true;
+      ephemeral = true;

-    #   # privateNetwork = true;
-    #   # hostAddress = "172.16.101.1";
-    #   # localAddress = "172.16.101.2";
+      bindMounts = {
+        "/run/agenix/gitea-actions-runner-token" = {
+          hostPath = "/run/agenix/gitea-actions-runner-token";
+          isReadOnly = true;
+        };
+        "/var/lib/gitea-runner" = {
+          hostPath = "/var/lib/gitea-runner";
+          isReadOnly = false;
+        };
+      };

-    #   bindMounts =
-    #     {
-    #       "/run/agenix/gitea-actions-runner-token" = {
-    #         hostPath = "/run/agenix/gitea-actions-runner-token";
-    #         isReadOnly = true;
-    #       };
-    #       "/var/lib/gitea-runner" = {
-    #         hostPath = "/var/lib/gitea-runner";
-    #         isReadOnly = false;
-    #       };
-    #     };
-
-    #   extraFlags = [
-    #     # Allow podman
-    #     ''--system-call-filter=thisystemcalldoesnotexistforsure''
-    #   ];
-
-    #   additionalCapabilities = [
-    #     "CAP_SYS_ADMIN"
-    #   ];
-
-    #   config = {
-    #     imports = allModules;
-
-    #     # speeds up evaluation
-    #     nixpkgs.pkgs = pkgs;
-
-    #     networking.hostName = lib.mkForce containerName;
-
-    #     # don't use remote builders
-    #     nix.distributedBuilds = lib.mkForce false;
-
-    #     environment.systemPackages = with pkgs; [
-    #       git
-    #       # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
-    #       nodejs
-    #     ];
-
-    #     services.gitea-actions-runner.instances.inst = {
-    #       enable = true;
-    #       name = config.networking.hostName;
-    #       url = "https://git.neet.dev/";
-    #       tokenFile = "/run/agenix/gitea-actions-runner-token";
-    #       labels = [
-    #         "ubuntu-latest:docker://node:18-bullseye"
-    #         "nixos:host"
-    #       ];
-    #     };
-
-    #     # To allow building on the host, must override the the service's config so it doesn't use a dynamic user
-    #     systemd.services.gitea-runner-inst.serviceConfig.DynamicUser = lib.mkForce false;
-    #     users.users.gitea-runner = {
-    #       home = "/var/lib/gitea-runner";
-    #       group = "gitea-runner";
-    #       isSystemUser = true;
-    #       createHome = true;
-    #     };
-    #     users.groups.gitea-runner = { };
-
-    #     virtualisation.podman.enable = true;
-    #     boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-    #   };
-    # };
-
-    # networking.nat.enable = true;
-    # networking.nat.internalInterfaces = [
-    #   "ve-${containerName}"
-    # ];
-    # networking.ip_forward = true;
-
-    # don't use remote builders
-    nix.distributedBuilds = lib.mkForce false;
+      config = { config, lib, pkgs, ... }: {
+        system.stateVersion = "25.11";

        services.gitea-actions-runner.instances.inst = {
          enable = true;
-      name = config.networking.hostName;
+          name = containerName;
          url = "https://git.neet.dev/";
          tokenFile = "/run/agenix/gitea-actions-runner-token";
-      labels = [
-        "ubuntu-latest:docker://node:18-bullseye"
-        "nixos:host"
-      ];
+          labels = [ "nixos:host" ];
        };

-    environment.systemPackages = with pkgs; [
-      git
-      # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
-      nodejs
-    ];
-
-    # To allow building on the host, must override the the service's config so it doesn't use a dynamic user
+        # Disable dynamic user so runner state persists via bind mount
        systemd.services.gitea-runner-inst.serviceConfig.DynamicUser = lib.mkForce false;
        users.users.gitea-runner = {
+          uid = giteaRunnerUid;
          home = "/var/lib/gitea-runner";
          group = "gitea-runner";
          isSystemUser = true;
          createHome = true;
        };
-    users.groups.gitea-runner = { };
+        users.groups.gitea-runner.gid = giteaRunnerGid;

-    virtualisation.podman.enable = true;
-    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+        nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+        environment.systemPackages = with pkgs; [
+          git
+          nodejs
+          jq
+          attic-client
+        ];
+      };
+    };
+
+    # Matching user on host — the container's gitea-runner UID must be
+    # recognized by the host's nix-daemon as trusted (shared UID namespace)
+    users.users.gitea-runner = {
+      uid = giteaRunnerUid;
+      home = "/var/lib/gitea-runner";
+      group = "gitea-runner";
+      isSystemUser = true;
+      createHome = true;
+    };
+    users.groups.gitea-runner.gid = giteaRunnerGid;

    age.secrets.gitea-actions-runner-token.file = ../../secrets/gitea-actions-runner-token.age;
  };
--- a/common/server/gitea.nix
+++ b/common/server/gitea.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, config, ... }:
+{ lib, config, ... }:

 let
  cfg = config.services.gitea;
--- a/common/server/gitlab.nix
+++ b/common/server/gitlab.nix
@@ -1,42 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  services.gitlab = {
-    enable = true;
-    databasePasswordFile = "/var/keys/gitlab/db_password";
-    initialRootPasswordFile = "/var/keys/gitlab/root_password";
-    https = true;
-    host = "git.neet.dev";
-    port = 443;
-    user = "git";
-    group = "git";
-    databaseUsername = "git";
-    smtp = {
-      enable = true;
-      address = "localhost";
-      port = 25;
-    };
-    secrets = {
-      dbFile = "/var/keys/gitlab/db";
-      secretFile = "/var/keys/gitlab/secret";
-      otpFile = "/var/keys/gitlab/otp";
-      jwsFile = "/var/keys/gitlab/jws";
-    };
-    extraConfig = {
-      gitlab = {
-        email_from = "gitlab-no-reply@neet.dev";
-        email_display_name = "neet.dev GitLab";
-        email_reply_to = "gitlab-no-reply@neet.dev";
-      };
-    };
-    pagesExtraArgs = [ "-listen-proxy" "127.0.0.1:8090" ];
-  };
-
-  services.nginx.virtualHosts = {
-    "git.neet.dev" = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-    };
-  };
-}
--- a/common/server/hydra.nix
+++ b/common/server/hydra.nix
@@ -1,25 +0,0 @@
-{ config, pkgs, ... }:
-
-let
-  domain = "hydra.neet.dev";
-  port = 3000;
-  notifyEmail = "hydra@neet.dev";
-in
-{
-  services.nginx.virtualHosts."${domain}" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://localhost:${toString port}";
-    };
-  };
-
-  services.hydra = {
-    enable = true;
-    inherit port;
-    hydraURL = "https://${domain}";
-    useSubstitutes = true;
-    notificationSender = notifyEmail;
-    buildMachinesFiles = [ ];
-  };
-}
--- a/common/server/icecast.nix
+++ b/common/server/icecast.nix
@@ -1,65 +0,0 @@
-{ lib, config, ... }:
-
-# configures icecast to only accept source from localhost
-# to a audio optimized stream on services.icecast.mount
-# made available via nginx for http access on
-# https://host/mount
-
-let
-  cfg = config.services.icecast;
-in
-{
-  options.services.icecast = {
-    mount = lib.mkOption {
-      type = lib.types.str;
-      example = "stream.mp3";
-    };
-    fallback = lib.mkOption {
-      type = lib.types.str;
-      example = "fallback.mp3";
-    };
-    nginx = lib.mkEnableOption "enable nginx";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.icecast = {
-      listen.address = "0.0.0.0";
-      listen.port = 8001;
-      admin.password = "hackme";
-      extraConf = ''
-        <authentication>
-          <source-password>hackme</source-password>
-        </authentication>
-        <http-headers>
-          <header type="cors" name="Access-Control-Allow-Origin" />
-        </http-headers>
-        <mount type="normal">
-          <mount-name>/${cfg.mount}</mount-name>
-          <max-listeners>30</max-listeners>
-          <bitrate>64000</bitrate>
-          <hidden>false</hidden>
-          <public>false</public>
-          <fallback-mount>/${cfg.fallback}</fallback-mount>
-          <fallback-override>1</fallback-override>
-        </mount>
-        <mount type="normal">
-          <mount-name>/${cfg.fallback}</mount-name>
-          <max-listeners>30</max-listeners>
-          <bitrate>64000</bitrate>
-          <hidden>false</hidden>
-          <public>false</public>
-        </mount>
-      '';
-    };
-    services.nginx.virtualHosts.${cfg.hostname} = lib.mkIf cfg.nginx {
-      enableACME = true;
-      forceSSL = true;
-      locations."/${cfg.mount}" = {
-        proxyPass = "http://localhost:${toString cfg.listen.port}/${cfg.mount}";
-        extraConfig = ''
-          add_header Access-Control-Allow-Origin *;
-        '';
-      };
-    };
-  };
-}
--- a/common/server/iodine.nix
+++ b/common/server/iodine.nix
@@ -1,21 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.services.iodine.server;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # iodine DNS-based vpn
-    services.iodine.server = {
-      ip = "192.168.99.1";
-      domain = "tun.neet.dev";
-      passwordFile = "/run/agenix/iodine";
-    };
-    age.secrets.iodine.file = ../../secrets/iodine.age;
-    networking.firewall.allowedUDPPorts = [ 53 ];
-
-    networking.nat.internalInterfaces = [
-      "dns0" # iodine
-    ];
-  };
-}
--- a/common/server/librechat.nix
+++ b/common/server/librechat.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:

 with lib;

--- a/common/server/nginx-stream.nix
+++ b/common/server/nginx-stream.nix
@@ -1,76 +0,0 @@
-{ lib, config, pkgs, ... }:
-
-let
-  cfg = config.services.nginx.stream;
-  nginxWithRTMP = pkgs.nginx.override {
-    modules = [ pkgs.nginxModules.rtmp ];
-  };
-in
-{
-  options.services.nginx.stream = {
-    enable = lib.mkEnableOption "enable nginx rtmp/hls/dash video streaming";
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 1935;
-      description = "rtmp injest/serve port";
-    };
-    rtmpName = lib.mkOption {
-      type = lib.types.str;
-      default = "live";
-      description = "the name of the rtmp application";
-    };
-    hostname = lib.mkOption {
-      type = lib.types.str;
-      description = "the http host to serve hls";
-    };
-    httpLocation = lib.mkOption {
-      type = lib.types.str;
-      default = "/tmp";
-      description = "the path of the tmp http files";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.nginx = {
-      enable = true;
-
-      package = nginxWithRTMP;
-
-      virtualHosts.${cfg.hostname} = {
-        enableACME = true;
-        forceSSL = true;
-        locations = {
-          "/stream/hls".root = "${cfg.httpLocation}/hls";
-          "/stream/dash".root = "${cfg.httpLocation}/dash";
-        };
-        extraConfig = ''
-          location /stat {
-            rtmp_stat all;
-          }
-        '';
-      };
-
-      appendConfig = ''
-        rtmp {
-          server {
-            listen ${toString cfg.port};
-            chunk_size 4096;
-            application ${cfg.rtmpName} {
-              allow publish all;
-              allow publish all;
-              live on;
-              record off;
-              hls on;
-              hls_path ${cfg.httpLocation}/hls;
-              dash on;
-              dash_path ${cfg.httpLocation}/dash;
-            }
-          }
-        }
-      '';
-    };
-
-    networking.firewall.allowedTCPPorts = [
-      cfg.port
-    ];
-  };
-}
--- a/common/server/nginx.nix
+++ b/common/server/nginx.nix
@@ -1,4 +1,4 @@
-{ lib, config, pkgs, ... }:
+{ lib, config, ... }:

 let
  cfg = config.services.nginx;
--- a/common/server/searx.nix
+++ b/common/server/searx.nix
@@ -1,30 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.services.searx;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.searx = {
-      environmentFile = "/run/agenix/searx";
-      settings = {
-        server.port = 43254;
-        server.secret_key = "@SEARX_SECRET_KEY@";
-        engines = [{
-          name = "wolframalpha";
-          shortcut = "wa";
-          api_key = "@WOLFRAM_API_KEY@";
-          engine = "wolframalpha_api";
-        }];
-      };
-    };
-    services.nginx.virtualHosts."search.neet.space" = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://localhost:${toString config.services.searx.settings.server.port}";
-      };
-    };
-    age.secrets.searx.file = ../../secrets/searx.age;
-  };
-}
--- a/common/server/video-stream.nix
+++ b/common/server/video-stream.nix
@@ -1,97 +0,0 @@
-{ config, pkgs, ... }:
-
-let
-  # external
-  rtp-port = 8083;
-  webrtc-peer-lower-port = 20000;
-  webrtc-peer-upper-port = 20100;
-  domain = "live.neet.space";
-
-  # internal
-  ingest-port = 8084;
-  web-port = 8085;
-  webrtc-port = 8086;
-  toStr = builtins.toString;
-in
-{
-  networking.firewall.allowedUDPPorts = [ rtp-port ];
-  networking.firewall.allowedTCPPortRanges = [{
-    from = webrtc-peer-lower-port;
-    to = webrtc-peer-upper-port;
-  }];
-  networking.firewall.allowedUDPPortRanges = [{
-    from = webrtc-peer-lower-port;
-    to = webrtc-peer-upper-port;
-  }];
-
-  virtualisation.docker.enable = true;
-
-  services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
-    locations = {
-      "/" = {
-        proxyPass = "http://localhost:${toStr web-port}";
-      };
-      "websocket" = {
-        proxyPass = "http://localhost:${toStr webrtc-port}/websocket";
-        proxyWebsockets = true;
-      };
-    };
-  };
-
-  virtualisation.oci-containers = {
-    backend = "docker";
-    containers = {
-      "lightspeed-ingest" = {
-        workdir = "/var/lib/lightspeed-ingest";
-        image = "projectlightspeed/ingest";
-        ports = [
-          "${toStr ingest-port}:8084"
-        ];
-        #        imageFile = pkgs.dockerTools.pullImage {
-        #          imageName = "projectlightspeed/ingest";
-        #          finalImageTag = "version-0.1.4";
-        #          imageDigest = "sha256:9fc51833b7c27a76d26e40f092b9cec1ac1c4bfebe452e94ad3269f1f73ff2fc";
-        #          sha256 = "19kxl02x0a3i6hlnsfcm49hl6qxnq2f3hfmyv1v8qdaz58f35kd5";
-        #        };
-      };
-      "lightspeed-react" = {
-        workdir = "/var/lib/lightspeed-react";
-        image = "projectlightspeed/react";
-        ports = [
-          "${toStr web-port}:80"
-        ];
-        #        imageFile = pkgs.dockerTools.pullImage {
-        #          imageName = "projectlightspeed/react";
-        #          finalImageTag = "version-0.1.3";
-        #          imageDigest = "sha256:b7c58425f1593f7b4304726b57aa399b6e216e55af9c0962c5c19333fae638b6";
-        #          sha256 = "0d2jh7mr20h7dxgsp7ml7cw2qd4m8ja9rj75dpy59zyb6v0bn7js";
-        #        };
-      };
-      "lightspeed-webrtc" = {
-        workdir = "/var/lib/lightspeed-webrtc";
-        image = "projectlightspeed/webrtc";
-        ports = [
-          "${toStr webrtc-port}:8080"
-          "${toStr rtp-port}:65535/udp"
-          "${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}:${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}/tcp"
-          "${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}:${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}/udp"
-        ];
-        cmd = [
-          "lightspeed-webrtc"
-          "--addr=0.0.0.0"
-          "--ip=${domain}"
-          "--ports=${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}"
-          "run"
-        ];
-        #        imageFile = pkgs.dockerTools.pullImage {
-        #          imageName = "projectlightspeed/webrtc";
-        #          finalImageTag = "version-0.1.2";
-        #          imageDigest = "sha256:ddf8b3dd294485529ec11d1234a3fc38e365a53c4738998c6bc2c6930be45ecf";
-        #          sha256 = "1bdy4ak99fjdphj5bsk8rp13xxmbqdhfyfab14drbyffivg9ad2i";
-        #        };
-      };
-    };
-  };
-}
--- a/common/server/vscode/LICENSE
+++ b/common/server/vscode/LICENSE
@@ -1,7 +0,0 @@
-Copyright 2020 Matthijs Steen
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
--- a/common/server/vscode/README.md
+++ b/common/server/vscode/README.md
@@ -1,37 +0,0 @@
-# Visual Studio Code Server support in NixOS
-
-Experimental support for VS Code Server in NixOS. The NodeJS by default supplied by VS Code cannot be used within NixOS due to missing hardcoded paths, so it is automatically replaced by a symlink to a compatible version of NodeJS that does work under NixOS.
-
-## Installation
-
-```nix
-{
-  imports = [
-    (fetchTarball "https://github.com/msteen/nixos-vscode-server/tarball/master")
-  ];
-
-  services.vscode-server.enable = true;
-}
-```
-
-And then enable them for the relevant users:
-
-```
-systemctl --user enable auto-fix-vscode-server.service
-```
-
-### Home Manager
-
-```nix
-{
-  imports = [
-    "${fetchTarball "https://github.com/msteen/nixos-vscode-server/tarball/master"}/modules/vscode-server/home.nix"
-  ];
-
-  services.vscode-server.enable = true;
-}
-```
-
-## Usage
-
-When the service is enabled and running it should simply work, there is nothing for you to do.
--- a/common/server/vscode/default.nix
+++ b/common/server/vscode/default.nix
@@ -1 +0,0 @@
-import ./modules/vscode-server
--- a/common/server/vscode/modules/vscode-server/default.nix
+++ b/common/server/vscode/modules/vscode-server/default.nix
@@ -1,8 +0,0 @@
-import ./module.nix ({ name, description, serviceConfig }:
-
-  {
-    systemd.user.services.${name} = {
-      inherit description serviceConfig;
-      wantedBy = [ "default.target" ];
-    };
-  })
--- a/common/server/vscode/modules/vscode-server/home.nix
+++ b/common/server/vscode/modules/vscode-server/home.nix
@@ -1,15 +0,0 @@
-import ./module.nix ({ name, description, serviceConfig }:
-
-  {
-    systemd.user.services.${name} = {
-      Unit = {
-        Description = description;
-      };
-
-      Service = serviceConfig;
-
-      Install = {
-        WantedBy = [ "default.target" ];
-      };
-    };
-  })
--- a/common/server/vscode/modules/vscode-server/module.nix
+++ b/common/server/vscode/modules/vscode-server/module.nix
@@ -1,42 +0,0 @@
-moduleConfig:
-{ lib, pkgs, ... }:
-
-with lib;
-
-{
-  options.services.vscode-server.enable = with types; mkEnableOption "VS Code Server";
-
-  config = moduleConfig rec {
-    name = "auto-fix-vscode-server";
-    description = "Automatically fix the VS Code server used by the remote SSH extension";
-    serviceConfig = {
-      # When a monitored directory is deleted, it will stop being monitored.
-      # Even if it is later recreated it will not restart monitoring it.
-      # Unfortunately the monitor does not kill itself when it stops monitoring,
-      # so rather than creating our own restart mechanism, we leverage systemd to do this for us.
-      Restart = "always";
-      RestartSec = 0;
-      ExecStart = pkgs.writeShellScript "${name}.sh" ''
-        set -euo pipefail
-        PATH=${makeBinPath (with pkgs; [ coreutils inotify-tools ])}
-        bin_dir=~/.vscode-server/bin
-        [[ -e $bin_dir ]] &&
-        find "$bin_dir" -mindepth 2 -maxdepth 2 -name node -type f -exec ln -sfT ${pkgs.nodejs-12_x}/bin/node {} \; ||
-        mkdir -p "$bin_dir"
-        while IFS=: read -r bin_dir event; do
-          # A new version of the VS Code Server is being created.
-          if [[ $event == 'CREATE,ISDIR' ]]; then
-            # Create a trigger to know when their node is being created and replace it for our symlink.
-            touch "$bin_dir/node"
-            inotifywait -qq -e DELETE_SELF "$bin_dir/node"
-            ln -sfT ${pkgs.nodejs-12_x}/bin/node "$bin_dir/node"
-          # The monitored directory is deleted, e.g. when "Uninstall VS Code Server from Host" has been run.
-          elif [[ $event == DELETE_SELF ]]; then
-            # See the comments above Restart in the service config.
-            exit 0
-          fi
-        done < <(inotifywait -q -m -e CREATE,ISDIR -e DELETE_SELF --format '%w%f:%e' "$bin_dir")
-      '';
-    };
-  };
-}
--- a/common/server/zerobin.nix
+++ b/common/server/zerobin.nix
@@ -1,34 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.services.zerobin;
-in
-{
-  options.services.zerobin = {
-    host = lib.mkOption {
-      type = lib.types.str;
-      example = "example.com";
-    };
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 33422;
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.zerobin.listenPort = cfg.port;
-    services.zerobin.listenAddress = "localhost";
-
-    services.nginx.virtualHosts.${cfg.host} = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://localhost:${toString cfg.port}";
-        proxyWebsockets = true;
-      };
-    };
-
-    # zerobin service is broken in nixpkgs currently
-    systemd.services.zerobin.serviceConfig.ExecStart = lib.mkForce
-      "${pkgs.zerobin}/bin/zerobin --host=${cfg.listenAddress} --port=${toString cfg.listenPort} --data-dir=${cfg.dataDir}";
-  };
-}
--- a/common/shell.nix
+++ b/common/shell.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:

 # Improvements to the default shell
 # - use nix-index for command-not-found
--- a/common/ssh.nix
+++ b/common/ssh.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:

 {
  programs.ssh.knownHosts = lib.filterAttrs (n: v: v != null) (lib.concatMapAttrs
--- a/flake.lock
+++ b/flake.lock
@@ -43,7 +43,30 @@
        "type": "gitlab"
      }
    },
-    "dailybuild_modules": {
+    "claude-code-nix": {
+      "inputs": {
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770491193,
+        "narHash": "sha256-zdnWeXmPZT8BpBo52s4oansT1Rq0SNzksXKpEcMc5lE=",
+        "owner": "sadjow",
+        "repo": "claude-code-nix",
+        "rev": "f68a2683e812d1e4f9a022ff3e0206d46347d019",
+        "type": "github"
+      },
+      "original": {
+        "owner": "sadjow",
+        "repo": "claude-code-nix",
+        "type": "github"
+      }
+    },
+    "dailybot": {
      "inputs": {
        "flake-utils": [
          "flake-utils"
@@ -219,6 +242,27 @@
        "type": "github"
      }
    },
+    "microvm": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1770310890,
+        "narHash": "sha256-lyWAs4XKg3kLYaf4gm5qc5WJrDkYy3/qeV5G733fJww=",
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "rev": "68c9f9c6ca91841f04f726a298c385411b7bfcd5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
    "nix-index-database": {
      "inputs": {
        "nixpkgs": [
@@ -239,42 +283,6 @@
        "type": "github"
      }
    },
-    "nixlib": {
-      "locked": {
-        "lastModified": 1736643958,
-        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixos-generators": {
-      "inputs": {
-        "nixlib": "nixlib",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1764234087,
-        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "type": "github"
-      }
-    },
    "nixos-hardware": {
      "locked": {
        "lastModified": 1767185284,
@@ -310,13 +318,14 @@
    "root": {
      "inputs": {
        "agenix": "agenix",
-        "dailybuild_modules": "dailybuild_modules",
+        "claude-code-nix": "claude-code-nix",
+        "dailybot": "dailybot",
        "deploy-rs": "deploy-rs",
        "flake-compat": "flake-compat",
        "flake-utils": "flake-utils",
        "home-manager": "home-manager",
+        "microvm": "microvm",
        "nix-index-database": "nix-index-database",
-        "nixos-generators": "nixos-generators",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs",
        "simple-nixos-mailserver": "simple-nixos-mailserver",
@@ -349,6 +358,22 @@
        "type": "gitlab"
      }
    },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1759482047,
+        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "ref": "refs/heads/main",
+        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
+        "revCount": 996,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
    "systems": {
      "locked": {
        "lastModified": 1681028828,
--- a/flake.nix
+++ b/flake.nix
@@ -3,11 +3,6 @@
    # nixpkgs
    nixpkgs.url = "github:NixOS/nixpkgs/master";

-    nixos-generators = {
-      url = "github:nix-community/nixos-generators";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
    # Common Utils Among flake inputs
    systems.url = "github:nix-systems/default";
    flake-utils = {
@@ -48,7 +43,7 @@
    };

    # Dailybot
-    dailybuild_modules = {
+    dailybot = {
      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
      inputs = {
        nixpkgs.follows = "nixpkgs";
@@ -71,6 +66,21 @@
      url = "github:Mic92/nix-index-database";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+
+    # MicroVM support
+    microvm = {
+      url = "github:astro/microvm.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Up to date claude-code
+    claude-code-nix = {
+      url = "github:sadjow/claude-code-nix";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-utils.follows = "flake-utils";
+      };
+    };
  };

  outputs = { self, nixpkgs, ... }@inputs:
@@ -88,13 +98,17 @@
            ./common
            simple-nixos-mailserver.nixosModule
            agenix.nixosModules.default
-            dailybuild_modules.nixosModule
+            dailybot.nixosModule
            nix-index-database.nixosModules.default
            home-manager.nixosModules.home-manager
+            microvm.nixosModules.host
            self.nixosModules.kernel-modules
            ({ lib, ... }: {
              config = {
-                nixpkgs.overlays = [ self.overlays.default ];
+                nixpkgs.overlays = [
+                  self.overlays.default
+                  inputs.claude-code-nix.overlays.default
+                ];

                environment.systemPackages = [
                  agenix.packages.${system}.agenix
@@ -144,23 +158,27 @@
            mkSystem cfg.arch nixpkgs cfg.configurationPath hostname)
          machineHosts;

+      # kexec produces a tarball; for a self-extracting bundle see:
+      # https://github.com/nix-community/nixos-generators/blob/master/formats/kexec.nix#L60
      packages =
-        with inputs;
        let
-          mkEphemeral = system: format: nixos-generators.nixosGenerate {
+          mkEphemeral = system: nixpkgs.lib.nixosSystem {
            inherit system;
-            inherit format;
            modules = [
              ./machines/ephemeral/minimal.nix
-              nix-index-database.nixosModules.default
+              inputs.nix-index-database.nixosModules.default
            ];
          };
        in
        {
-          "x86_64-linux".kexec = mkEphemeral "x86_64-linux" "kexec-bundle";
-          "x86_64-linux".iso = mkEphemeral "x86_64-linux" "iso";
-          "aarch64-linux".kexec = mkEphemeral "aarch64-linux" "kexec-bundle";
-          "aarch64-linux".iso = mkEphemeral "aarch64-linux" "iso";
+          "x86_64-linux" = {
+            kexec = (mkEphemeral "x86_64-linux").config.system.build.images.kexec;
+            iso = (mkEphemeral "x86_64-linux").config.system.build.images.iso;
+          };
+          "aarch64-linux" = {
+            kexec = (mkEphemeral "aarch64-linux").config.system.build.images.kexec;
+            iso = (mkEphemeral "aarch64-linux").config.system.build.images.iso;
+          };
        };

      overlays.default = import ./overlays { inherit inputs; };
--- a/home/googlebot.nix
+++ b/home/googlebot.nix
@@ -1,4 +1,7 @@
-{ config, lib, pkgs, osConfig, ... }:
+{ lib, pkgs, osConfig, ... }:
+
+# https://home-manager-options.extranix.com/
+# https://nix-community.github.io/home-manager/options.xhtml

 let
  # Check if the current machine has the role "personal"
@@ -55,4 +58,62 @@ in
  programs.zed-editor = {
    enable = thisMachineIsPersonal;
  };
+
+  programs.vscode = {
+    enable = thisMachineIsPersonal;
+    # Must use fhs version for vscode-lldb
+    package = pkgs.vscodium-fhs;
+    profiles.default = {
+      userSettings = {
+        editor.formatOnSave = true;
+        nix = {
+          enableLanguageServer = true;
+          serverPath = "${pkgs.nil}/bin/nil";
+          serverSettings.nil = {
+            formatting.command = [ "${pkgs.nixpkgs-fmt}/bin/nixpkgs-fmt" ];
+            nix.flake.autoArchive = true;
+          };
+        };
+        dotnetAcquisitionExtension.sharedExistingDotnetPath = "${pkgs.dotnet-sdk_9}/bin";
+        godotTools = {
+          lsp.serverPort = 6005; # port needs to match Godot configuration
+          editorPath.godot4 = "godot-mono";
+        };
+        rust-analyzer = {
+          restartServerOnConfigChange = true;
+          testExplorer = true;
+          server.path = "rust-analyzer"; # Use the rust-analyzer from PATH (which is set by nixEnvSelector from the project's flake)
+        };
+        nixEnvSelector = {
+          useFlakes = true; # This hasn't ever worked for me and I have to use shell.nix... but maybe someday
+          suggestion = false; # Stop really annoy nagging
+        };
+      };
+      extensions = with pkgs.vscode-extensions; [
+        bbenoist.nix # nix syntax support
+        arrterian.nix-env-selector # nix dev envs
+        dart-code.dart-code
+        dart-code.flutter
+        golang.go
+        jnoortheen.nix-ide
+        ms-vscode.cpptools
+        rust-lang.rust-analyzer
+        vadimcn.vscode-lldb
+        tauri-apps.tauri-vscode
+        platformio.platformio-vscode-ide
+        vue.volar
+        wgsl-analyzer.wgsl-analyzer
+
+        # Godot
+        geequlim.godot-tools # For Godot GDScript support
+        ms-dotnettools.csharp
+        ms-dotnettools.vscode-dotnet-runtime
+      ];
+    };
+  };
+
+  home.packages = lib.mkIf thisMachineIsPersonal [
+    pkgs.claude-code
+    pkgs.dotnetCorePackages.dotnet_9.sdk # For Godot-Mono VSCode-Extension CSharp
+  ];
 }
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -53,4 +53,13 @@ with lib;
      getElem = x: y: elemAt (elemAt ll y) x;
    in
    genList (y: genList (x: f x y (getElem x y)) innerSize) outerSize;
+
+  # Generate a deterministic MAC address from a name
+  # Uses locally administered unicast range (02:xx:xx:xx:xx:xx)
+  mkMac = name:
+    let
+      hash = builtins.hashString "sha256" name;
+      octets = map (i: builtins.substring i 2 hash) [ 0 2 4 6 8 ];
+    in
+    "02:${builtins.concatStringsSep ":" octets}";
 }
--- a/machines/fry/default.nix
+++ b/machines/fry/default.nix
@@ -10,6 +10,21 @@

  nix.gc.automatic = lib.mkForce false;

+  # Upstream interface for sandbox networking (NAT)
+  networking.sandbox.upstreamInterface = lib.mkDefault "enp191s0";
+
+  # Enable sandboxed workspace
+  sandboxed-workspace = {
+    enable = true;
+    workspaces.test-incus = {
+      type = "incus";
+      autoStart = true;
+      config = ./workspaces/test-container.nix;
+      ip = "192.168.83.90";
+      hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0SNSy/MdW38NqKzLr1SG8WKrs8XkrqibacaJtJPzgW";
+    };
+  };
+
  environment.systemPackages = with pkgs; [
    system76-keyboard-configurator
  ];
--- a/machines/fry/workspaces/test-container.nix
+++ b/machines/fry/workspaces/test-container.nix
@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+
+# Test container workspace configuration
+#
+# Add to sandboxed-workspace.workspaces in machines/fry/default.nix:
+#   sandboxed-workspace.workspaces.test-container = {
+#     type = "container" OR "incus";
+#     config = ./workspaces/test-container.nix;
+#     ip = "192.168.83.50";
+#   };
+#
+# The workspace name ("test-container") becomes the hostname automatically.
+# The IP is configured in default.nix, not here.
+
+{
+  # Install packages as needed
+  environment.systemPackages = with pkgs; [
+    # Add packages here
+  ];
+}
--- a/machines/howl/default.nix
+++ b/machines/howl/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ lib, ... }:

 {
  imports = [
--- a/machines/nat/configuration.nix
+++ b/machines/nat/configuration.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, fetchurl, lib, ... }:
+{ ... }:

 {
  imports = [
--- a/machines/nat/hardware-configuration.nix
+++ b/machines/nat/hardware-configuration.nix
@@ -1,7 +1,7 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ ... }:

 {
  imports = [ ];
--- a/machines/phil/default.nix
+++ b/machines/phil/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ lib, ... }:

 {
  imports = [
--- a/machines/phil/hardware-configuration.nix
+++ b/machines/phil/hardware-configuration.nix
@@ -1,7 +1,7 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ lib, modulesPath, ... }:

 {
  imports =
--- a/machines/ponyo/default.nix
+++ b/machines/ponyo/default.nix
@@ -77,9 +77,6 @@
  # pin postgresql for matrix (will need to migrate eventually)
  services.postgresql.package = pkgs.postgresql_15;

-  # iodine DNS-based vpn
-  # services.iodine.server.enable = true;
-
  # proxied web services
  services.nginx.enable = true;
  services.nginx.virtualHosts."navidrome.neet.cloud" = {
--- a/machines/ponyo/hardware-configuration.nix
+++ b/machines/ponyo/hardware-configuration.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{ lib, modulesPath, ... }:

 {
  imports =
--- a/machines/ponyo/properties.nix
+++ b/machines/ponyo/properties.nix
@@ -10,7 +10,6 @@
  systemRoles = [
    "server"
    "email-server"
-    "iodine"
    "pia"
    "nextcloud"
    "dailybot"
--- a/machines/router/default.nix
+++ b/machines/router/default.nix
@@ -1,37 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./router.nix
-  ];
-
-  # https://dataswamp.org/~solene/2022-08-03-nixos-with-live-usb-router.html
-  # https://github.com/mdlayher/homelab/blob/391cfc0de06434e4dee0abe2bec7a2f0637345ac/nixos/routnerr-2/configuration.nix
-  # https://github.com/skogsbrus/os/blob/master/sys/router.nix
-  # http://trac.gateworks.com/wiki/wireless/wifi 
-
-  system.autoUpgrade.enable = true;
-
-  services.tailscale.exitNode = true;
-
-  router.enable = true;
-  router.privateSubnet = "192.168.3";
-
-  services.iperf3.enable = true;
-
-  # networking.useDHCP = lib.mkForce true;
-
-  networking.usePredictableInterfaceNames = false;
-
-  powerManagement.cpuFreqGovernor = "ondemand";
-
-
-  services.irqbalance.enable = true;
-
-  #   services.miniupnpd = {
-  #     enable = true;
-  #     externalInterface = "eth0";
-  #     internalIPs = [ "br0" ];
-  # };
-}
--- a/machines/router/firmware/mediatek/mt7916_eeprom.bin
+++ b/machines/router/firmware/mediatek/mt7916_eeprom.bin
--- a/machines/router/firmware/mediatek/mt7916_rom_patch.bin
+++ b/machines/router/firmware/mediatek/mt7916_rom_patch.bin
--- a/machines/router/firmware/mediatek/mt7916_wa.bin
+++ b/machines/router/firmware/mediatek/mt7916_wa.bin
--- a/machines/router/firmware/mediatek/mt7916_wm.bin
+++ b/machines/router/firmware/mediatek/mt7916_wm.bin
--- a/machines/router/generate_hostapd_config.sh
+++ b/machines/router/generate_hostapd_config.sh
@@ -1,223 +0,0 @@
-#!/bin/sh
-
-# TODO allow adding custom parameters to ht_capab, vht_capab
-# TODO detect bad channel numbers (preferably not at runtime)
-# TODO error if 160mhz is not supported
-# TODO 'b' only goes up to 40mhz
-
-# gets the phy number using the input interface
-# Ex: get_phy_number("wlan0") -> "1"
-get_phy_number() {
-  local interface=$1
-  phy=$(iw dev "$interface" info | awk '/phy/ {gsub(/#/,"");print $2}')
-  if [[ -z "$phy" ]]; then
-    echo "Error: interface not found" >&2
-    exit 1
-  fi
-  phy=phy$phy
-}
-
-get_ht_cap_mask() {
-  ht_cap_mask=0
-
-  for cap in $(iw phy "$phy" info | grep 'Capabilities:' | cut -d: -f2); do
-    ht_cap_mask="$(($ht_cap_mask | $cap))"
-  done
-
-  local cap_rx_stbc
-  cap_rx_stbc=$((($ht_cap_mask >> 8) & 3))
-  ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"
-}
-
-get_vht_cap_mask() {
-  vht_cap_mask=0
-  for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
-    vht_cap_mask="$(($vht_cap_mask | $cap))"
-  done
-
-  local cap_rx_stbc
-  cap_rx_stbc=$((($vht_cap_mask >> 8) & 7))
-  vht_cap_mask="$(( ($vht_cap_mask & ~(0x700)) | ($cap_rx_stbc << 8) ))"
-}
-
-mac80211_add_capabilities() {
-  local __var="$1"; shift
-  local __mask="$1"; shift
-  local __out= oifs
-
-  oifs="$IFS"
-  IFS=:
-  for capab in "$@"; do
-    set -- $capab
-    [ "$(($4))" -gt 0 ] || continue
-    [ "$(($__mask & $2))" -eq "$((${3:-$2}))" ] || continue
-    __out="$__out[$1]"
-  done
-  IFS="$oifs"
-
-  export -n -- "$__var=$__out"
-}
-
-add_special_ht_capabilities() {
-  case "$hwmode" in
-    a)
-      case "$(( ($channel / 4) % 2 ))" in
-        1) ht_capab="$ht_capab[HT40+]";;
-        0) ht_capab="$ht_capab[HT40-]";;
-      esac
-    ;;
-    *)
-      if [ "$channel" -lt 7 ]; then
-        ht_capab="$ht_capab[HT40+]"
-      else
-        ht_capab="$ht_capab[HT40-]"
-      fi
-    ;;
-  esac
-}
-
-add_special_vht_capabilities() {
-  local cap_ant
-  [ "$(($vht_cap_mask & 0x800))" -gt 0 ] && {
-    cap_ant="$(( ( ($vht_cap_mask >> 16) & 3 ) + 1 ))"
-    [ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[SOUNDING-DIMENSION-$cap_ant]"
-  }
-
-  [ "$(($vht_cap_mask & 0x1000))" -gt 0 ] && {
-    cap_ant="$(( ( ($vht_cap_mask >> 13) & 3 ) + 1 ))"
-    [ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[BF-ANTENNA-$cap_ant]"
-  }
-
-  if [ "$(($vht_cap_mask & 12))" -eq 4 ]; then
-    vht_capab="$vht_capab[VHT160]"
-  fi
-
-  local vht_max_mpdu_hw=3895
-  [ "$(($vht_cap_mask & 3))" -ge 1 ] && \
-    vht_max_mpdu_hw=7991
-  [ "$(($vht_cap_mask & 3))" -ge 2 ] && \
-    vht_max_mpdu_hw=11454
-  [ "$vht_max_mpdu_hw" != 3895 ] && \
-    vht_capab="$vht_capab[MAX-MPDU-$vht_max_mpdu_hw]"
-
-  # maximum A-MPDU length exponent
-  local vht_max_a_mpdu_len_exp_hw=0
-  [ "$(($vht_cap_mask & 58720256))" -ge 8388608 ] && \
-    vht_max_a_mpdu_len_exp_hw=1
-  [ "$(($vht_cap_mask & 58720256))" -ge 16777216 ] && \
-    vht_max_a_mpdu_len_exp_hw=2
-  [ "$(($vht_cap_mask & 58720256))" -ge 25165824 ] && \
-    vht_max_a_mpdu_len_exp_hw=3
-  [ "$(($vht_cap_mask & 58720256))" -ge 33554432 ] && \
-    vht_max_a_mpdu_len_exp_hw=4
-  [ "$(($vht_cap_mask & 58720256))" -ge 41943040 ] && \
-    vht_max_a_mpdu_len_exp_hw=5
-  [ "$(($vht_cap_mask & 58720256))" -ge 50331648 ] && \
-    vht_max_a_mpdu_len_exp_hw=6
-  [ "$(($vht_cap_mask & 58720256))" -ge 58720256 ] && \
-    vht_max_a_mpdu_len_exp_hw=7
-  vht_capab="$vht_capab[MAX-A-MPDU-LEN-EXP$vht_max_a_mpdu_len_exp_hw]"
-
-  local vht_link_adapt_hw=0
-  [ "$(($vht_cap_mask & 201326592))" -ge 134217728 ] && \
-    vht_link_adapt_hw=2
-  [ "$(($vht_cap_mask & 201326592))" -ge 201326592 ] && \
-    vht_link_adapt_hw=3
-  [ "$vht_link_adapt_hw" != 0 ] && \
-    vht_capab="$vht_capab[VHT-LINK-ADAPT-$vht_link_adapt_hw]"
-}
-
-calculate_channel_offsets() {
-  vht_oper_chwidth=0
-  vht_oper_centr_freq_seg0_idx=
-
-  local idx="$channel"
-  case "$channelWidth" in
-    40)
-      case "$(( ($channel / 4) % 2 ))" in
-        1) idx=$(($channel + 2));;
-        0) idx=$(($channel - 2));;
-      esac
-      vht_oper_centr_freq_seg0_idx=$idx
-    ;;
-    80)
-      case "$(( ($channel / 4) % 4 ))" in
-        1) idx=$(($channel + 6));;
-        2) idx=$(($channel + 2));;
-        3) idx=$(($channel - 2));;
-        0) idx=$(($channel - 6));;
-      esac
-      vht_oper_chwidth=1
-      vht_oper_centr_freq_seg0_idx=$idx
-    ;;
-    160)
-      case "$channel" in
-        36|40|44|48|52|56|60|64) idx=50;;
-        100|104|108|112|116|120|124|128) idx=114;;
-      esac
-      vht_oper_chwidth=2
-      vht_oper_centr_freq_seg0_idx=$idx
-    ;;
-  esac
-
-  he_oper_chwidth=$vht_oper_chwidth
-  he_oper_centr_freq_seg0_idx=$vht_oper_centr_freq_seg0_idx
-}
-
-interface=$1
-channel=$2
-hwmode=$3
-channelWidth=$4
-
-get_phy_number $interface
-get_ht_cap_mask
-get_vht_cap_mask
-
-mac80211_add_capabilities vht_capab $vht_cap_mask \
-  RXLDPC:0x10::1 \
-  SHORT-GI-80:0x20::1 \
-  SHORT-GI-160:0x40::1 \
-  TX-STBC-2BY1:0x80::1 \
-  SU-BEAMFORMER:0x800::1 \
-  SU-BEAMFORMEE:0x1000::1 \
-  MU-BEAMFORMER:0x80000::1 \
-  MU-BEAMFORMEE:0x100000::1 \
-  VHT-TXOP-PS:0x200000::1 \
-  HTC-VHT:0x400000::1 \
-  RX-ANTENNA-PATTERN:0x10000000::1 \
-  TX-ANTENNA-PATTERN:0x20000000::1 \
-  RX-STBC-1:0x700:0x100:1 \
-  RX-STBC-12:0x700:0x200:1 \
-  RX-STBC-123:0x700:0x300:1 \
-  RX-STBC-1234:0x700:0x400:1 \
-
-mac80211_add_capabilities ht_capab $ht_cap_mask \
-  LDPC:0x1::1 \
-  GF:0x10::1 \
-  SHORT-GI-20:0x20::1 \
-  SHORT-GI-40:0x40::1 \
-  TX-STBC:0x80::1 \
-  RX-STBC1:0x300::1 \
-  MAX-AMSDU-7935:0x800::1 \
-
-  # TODO this is active when the driver doesn't support it?
-  # DSSS_CCK-40:0x1000::1 \
-
-  # TODO these are active when the driver doesn't support them?
-  # RX-STBC1:0x300:0x100:1 \
-  # RX-STBC12:0x300:0x200:1 \
-  # RX-STBC123:0x300:0x300:1 \
-
-add_special_ht_capabilities
-add_special_vht_capabilities
-
-echo ht_capab=$ht_capab
-echo vht_capab=$vht_capab
-
-if [ "$channelWidth" != "20" ]; then
-  calculate_channel_offsets
-  echo he_oper_chwidth=$he_oper_chwidth
-  echo vht_oper_chwidth=$vht_oper_chwidth
-  echo he_oper_centr_freq_seg0_idx=$he_oper_centr_freq_seg0_idx
-  echo vht_oper_centr_freq_seg0_idx=$vht_oper_centr_freq_seg0_idx
-fi
--- a/machines/router/hardware-configuration.nix
+++ b/machines/router/hardware-configuration.nix
@@ -1,48 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  # kernel
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-  boot.initrd.availableKernelModules = [ "igb" "mt7915e" "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  # Enable serial output
-  boot.kernelParams = [
-    "console=ttyS0,115200n8" # enable serial console
-  ];
-  boot.loader.grub.extraConfig = "
-    serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
-    terminal_input serial
-    terminal_output serial
-  ";
-
-  # firmware
-  firmware.x86_64.enable = true;
-  nixpkgs.config.allowUnfree = true;
-  hardware.enableRedistributableFirmware = true;
-  hardware.enableAllFirmware = true;
-
-  # boot
-  bios = {
-    enable = true;
-    device = "/dev/sda";
-  };
-
-  # disks
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/6aa7f79e-bef8-4b0f-b22c-9d1b3e8ac94b";
-      fsType = "ext4";
-    };
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/14dfc562-0333-4ddd-b10c-4eeefe1cd05f";
-      fsType = "ext3";
-    };
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/adf37c64-3b54-480c-a9a7-099d61c6eac7"; }];
-
-  nixpkgs.hostPlatform = "x86_64-linux";
-}
--- a/machines/router/properties.nix
+++ b/machines/router/properties.nix
@@ -1,17 +0,0 @@
-{
-  hostNames = [
-    "router"
-    "192.168.6.159"
-    "192.168.3.1"
-  ];
-
-  arch = "x86_64-linux";
-
-  systemRoles = [
-    "server"
-    "wireless"
-    "router"
-  ];
-
-  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDCMhEvWJxFBNyvpyuljv5Uun8AdXCxBK9HvPBRe5x6";
-}
--- a/machines/router/router.nix
+++ b/machines/router/router.nix
@@ -1,238 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.router;
-  inherit (lib) mapAttrs' genAttrs nameValuePair mkOption types mkIf mkEnableOption;
-in
-{
-  options.router = {
-    enable = mkEnableOption "router";
-
-    privateSubnet = mkOption {
-      type = types.str;
-      default = "192.168.1";
-      description = "IP block (/24) to use for the private subnet";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    networking.ip_forward = true;
-
-    networking.interfaces.enp1s0.useDHCP = true;
-
-    networking.nat = {
-      enable = true;
-      internalInterfaces = [
-        "br0"
-      ];
-      externalInterface = "enp1s0";
-    };
-
-    networking.bridges = {
-      br0 = {
-        interfaces = [
-          "eth2"
-          # "wlp4s0"
-          # "wlan1"
-          "wlan0"
-          "wlan1"
-        ];
-      };
-    };
-
-    networking.interfaces = {
-      br0 = {
-        useDHCP = false;
-        ipv4.addresses = [
-          {
-            address = "${cfg.privateSubnet}.1";
-            prefixLength = 24;
-          }
-        ];
-      };
-    };
-
-    networking.firewall = {
-      enable = true;
-      trustedInterfaces = [ "br0" "tailscale0" ];
-
-      interfaces = {
-        enp1s0 = {
-          allowedTCPPorts = [ ];
-          allowedUDPPorts = [ ];
-        };
-      };
-    };
-
-    services.dnsmasq = {
-      enable = true;
-      settings = {
-        # sensible behaviours
-        domain-needed = true;
-        bogus-priv = true;
-        no-resolv = true;
-
-        # upstream name servers
-        server = [
-          "1.1.1.1"
-          "8.8.8.8"
-        ];
-
-        # local domains
-        expand-hosts = true;
-        domain = "home";
-        local = "/home/";
-
-        # Interfaces to use DNS on
-        interface = "br0";
-
-        # subnet IP blocks to use DHCP on
-        dhcp-range = "${cfg.privateSubnet}.10,${cfg.privateSubnet}.254,24h";
-      };
-    };
-
-    services.hostapd = {
-      enable = true;
-      radios = {
-        # Simple 2.4GHz AP
-        wlan0 = {
-          countryCode = "US";
-          networks.wlan0 = {
-            ssid = "CXNK00BF9176-1";
-            authentication.saePasswords = [{ passwordFile = "/run/agenix/hostapd-pw-CXNK00BF9176"; }];
-          };
-        };
-
-        # WiFi 5 (5GHz) with two advertised networks
-        wlan1 = {
-          band = "5g";
-          channel = 0;
-          countryCode = "US";
-          networks.wlan1 = {
-            ssid = "CXNK00BF9176-1";
-            authentication.saePasswords = [{ passwordFile = "/run/agenix/hostapd-pw-CXNK00BF9176"; }];
-          };
-        };
-      };
-    };
-    age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;
-
-    # wlan0 5Ghz 00:0a:52:08:38:32
-    # wlp4s0 2.4Ghz 00:0a:52:08:38:33
-
-    # services.hostapd = {
-    #   enable = true;
-    #   radios = {
-    #     # 2.4GHz
-    #     wlp4s0 = {
-    #       band = "2g";
-    #       noScan = true;
-    #       channel = 6;
-    #       countryCode = "US";
-    #       wifi4 = {
-    #         capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40+" ];
-    #       };
-    #       wifi5 = {
-    #         operatingChannelWidth = "20or40";
-    #         capabilities = [ "MAX-A-MPDU-LEN-EXP0" ];
-    #       };
-    #       wifi6 = {
-    #         enable = true;
-    #         singleUserBeamformer = true;
-    #         singleUserBeamformee = true;
-    #         multiUserBeamformer = true;
-    #         operatingChannelWidth = "20or40";
-    #       };
-    #       networks = {
-    #         wlp4s0 = {
-    #           ssid = "CXNK00BF9176";
-    #           authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
-    #         };
-    #         # wlp4s0-1 = {
-    #         #   ssid = "- Experimental 5G Tower by AT&T";
-    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-    #         # };
-    #         # wlp4s0-2 = {
-    #         #   ssid = "FBI Surveillance Van 2";
-    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-    #         # };
-    #       };
-    #       settings = {
-    #         he_oper_centr_freq_seg0_idx = 8;
-    #         vht_oper_centr_freq_seg0_idx = 8;
-    #       };
-    #     };
-
-    #     # 5GHz
-    #     wlan1 = {
-    #       band = "5g";
-    #       noScan = true;
-    #       channel = 128;
-    #       countryCode = "US";
-    #       wifi4 = {
-    #         capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40-" ];
-    #       };
-    #       wifi5 = {
-    #         operatingChannelWidth = "160";
-    #         capabilities = [ "RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-3" "BF-ANTENNA-3" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7" ];
-    #       };
-    #       wifi6 = {
-    #         enable = true;
-    #         singleUserBeamformer = true;
-    #         singleUserBeamformee = true;
-    #         multiUserBeamformer = true;
-    #         operatingChannelWidth = "160";
-    #       };
-    #       networks = {
-    #         wlan1 = {
-    #           ssid = "CXNK00BF9176";
-    #           authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
-    #         };
-    #         # wlan1-1 = {
-    #         #   ssid = "- Experimental 5G Tower by AT&T";
-    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-    #         # };
-    #         # wlan1-2 = {
-    #         #   ssid = "FBI Surveillance Van 5";
-    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-    #         # };
-    #       };
-    #       settings = {
-    #         vht_oper_centr_freq_seg0_idx = 114;
-    #         he_oper_centr_freq_seg0_idx = 114;
-    #       };
-    #     };
-    #   };
-    # };
-    # age.secrets.hostapd-pw-experimental-tower.file = ../../secrets/hostapd-pw-experimental-tower.age;
-    # age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;
-
-    # hardware.firmware = [
-    #   pkgs.mt7916-firmware
-    # ];
-
-    # nixpkgs.overlays = [
-    #   (self: super: {
-    #     mt7916-firmware = pkgs.stdenvNoCC.mkDerivation {
-    #       pname = "mt7916-firmware";
-    #       version = "custom-feb-02-23";
-    #       src = ./firmware/mediatek; # from here https://github.com/openwrt/mt76/issues/720#issuecomment-1413537674
-    #       dontBuild = true;
-    #       installPhase = ''
-    #         for i in \
-    #           mt7916_eeprom.bin \
-    #           mt7916_rom_patch.bin \
-    #           mt7916_wa.bin \
-    #           mt7916_wm.bin;
-    #         do
-    #           install -D -pm644 $i $out/lib/firmware/mediatek/$i
-    #         done
-    #       '';
-    #       meta = with lib; {
-    #         license = licenses.unfreeRedistributableFirmware;
-    #       };
-    #     };
-    #   })
-    # ];
-  };
-}
--- a/machines/storage/s0/default.nix
+++ b/machines/storage/s0/default.nix
@@ -254,7 +254,7 @@
      ];

    tailscaleAuth = {
-      enable = true;
+      enable = false; # Disabled for now because it doesn't work with tailscale's ACL tagged groups
      virtualHosts = [
        "bazarr.s0.neet.dev"
        "radarr.s0.neet.dev"
--- a/machines/storage/s0/frigate.nix
+++ b/machines/storage/s0/frigate.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:

 let
  frigateHostname = "frigate.s0.neet.dev";
--- a/machines/storage/s0/hardware-configuration.nix
+++ b/machines/storage/s0/hardware-configuration.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{ lib, pkgs, modulesPath, ... }:

 {
  imports =
@@ -45,6 +45,12 @@
      fsType = "zfs";
      options = [ "zfsutil" "X-mount.mkdir" ];
    };
+  fileSystems."/var/lib/atticd" =
+    {
+      device = "rpool/nixos/var/lib/atticd";
+      fsType = "zfs";
+      options = [ "zfsutil" "X-mount.mkdir" ];
+    };
  fileSystems."/var/log" =
    {
      device = "rpool/nixos/var/log";
@@ -72,5 +78,5 @@
    };
  };

-  powerManagement.cpuFreqGovernor = "powersave";
+  powerManagement.cpuFreqGovernor = "schedutil";
 }
--- a/machines/storage/s0/home-automation.nix
+++ b/machines/storage/s0/home-automation.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, ... }:

 {
  services.esphome.enable = true;
--- a/machines/zoidberg/default.nix
+++ b/machines/zoidberg/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, ... }:

 {
  imports = [
--- a/overlays/kernel-modules/default.nix
+++ b/overlays/kernel-modules/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, ... }:

 # Adds additional kernel modules to the nixos system
 # Not actually an overlay but a module. Has to be this way because kernel
--- a/secrets/attic-netrc.age
+++ b/secrets/attic-netrc.age
--- a/secrets/atticd-credentials.age
+++ b/secrets/atticd-credentials.age
--- a/secrets/binary-cache-push-sshkey.age
+++ b/secrets/binary-cache-push-sshkey.age
--- a/secrets/gitea-actions-runner-token.age
+++ b/secrets/gitea-actions-runner-token.age
--- a/secrets/hostapd-pw-CXNK00BF9176.age
+++ b/secrets/hostapd-pw-CXNK00BF9176.age
--- a/secrets/hostapd-pw-experimental-tower.age
+++ b/secrets/hostapd-pw-experimental-tower.age
--- a/secrets/iodine.age
+++ b/secrets/iodine.age
@@ -1,11 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 6AT2/g 3s+reqcb4Hu/3Z7rICFZBOkW02ibISthFAT1sveyLBo
-Eh5ynxeqqXhNbv/ASWZxzKXAzKX41uI5iJI4KqluHRI
-> ssh-ed25519 ZDy34A cHcA2p0VrGr6jP/CUTOSU4Gef04ujh6wmJjmEWmWNE0
-wwaQnj7RABFzTbU74awlIJeHHePtO7jihNd2EUkNZPU
-> ssh-ed25519 w3nu8g hN/fWUHspXoJmpibR4NAL3EXkKExe2tRjUzmLGK6VnE
-F1KQnGe3M8eD9hjnHLc7hqFTw9iXh7ICz0u421DuFOs
-> ssh-ed25519 evqvfg r3AoIJ3KWCYIsV8+RTgYY+Eg+1EcBVNrX+ZRunKaug8
-KSXd4uq1/0ErZzSTPrCmY/66v4TT5PmFqv9LRSHNi9A
--- 3bGqZANqdfEgdiUzu38n4dzPOShgGUzQGtO7l2S+hwU
-Ì?\<5C>•Öå¢aÚ'¤¤ÐÚ{˜/}ÉýÝL„:¨|¸G`†Ó+ºMÜÈY$s¸+‚Uk¥áäg‡ID¾K·
--- a/secrets/oauth2-proxy-env.age
+++ b/secrets/oauth2-proxy-env.age
@@ -1,21 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 WBT1Hw QyirfN0ibrERO2bNZrb/8xqT5thl8LQmjn+xAFVMryc
-bLND1Cb4eO2VAGtM+ehm4YW8jN5Tcki+jc3JxLHSZuo
-> ssh-ed25519 6AT2/g DqNkPFZ/b96oYl8RiUkVxi9vmv8RG0Pbs2y0cqKRGX4
-5FLcVYepU/bNRq2Cr9zdHDN/vM9OFO6Q7QlWX+PPa4Q
-> ssh-ed25519 r848+g iSF57inO0hafZ0N6hIWGML1kRE48fN3WooeeHXXIRSs
-RdYVTCEwMc31x9yl2VBmRCEJXUGCVeJjBBdO1rAL3A8
-> ssh-ed25519 hPp1nw mhanVdWbVK7OAinjTmEqx1jawd8pTlPe6YTIa/sEckQ
-MVBgbEa8uNYIoCCmEBmFzMQR5cO033C57lMze5z+n54
-> ssh-ed25519 ZDy34A su3VVvWZhGKTR11mNKoOLzYjvnBCOG+U4qIeHUY6VXE
-DRscTOjNk5BpejadPMVABLeLC+0mB6uAYxsSm5HqUgw
-> ssh-ed25519 w3nu8g kZXxRHeMvnzk96IhW73XUkXo6lM0CfUjgFFcio5e4TA
-1vWdp3DVAH74cBd2hUujCz4J4ztQzFseP9SKYk2juAM
-> ssh-ed25519 evqvfg xRV4zs+y8jaqkLH7qMbRsThjptxuokIn1h1S2eIUmXg
-6+a1IS7X2qucszKXa1XOeEgVDeNf3PF2HgQMixGPR7s
--- 6gSqjzHmrwlNUz8bmuoeB/2zUIOvQ82RDu77vaCtnvs
-]‹qˆªÓ®ÓñAz}µeÂUª(‡ˆeÿmŸ{^c¤ñ’Þ<1E>ìÖ°)Á7ê¡»ÏÞ[H
-ªgKÜ‰Þù#ÞF$ô)ÎÝOE…Á5Œ{³Á6‚‡ ÌÖ‹µÓÚQNJ.Î3YN<59>oXS`bZ
-W§„ü;*
-AÑUÛ¾&¢wîj@BLç/
-<¢xËSµHì‡…h
--- a/secrets/searx.age
+++ b/secrets/searx.age
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -7,6 +7,9 @@ let

  # nobody is using this secret but I still need to be able to r/w it
  nobody = sshKeys.userKeys;
+
+  # For secrets that all machines need to know
+  everyone = roles.personal ++ roles.server;
 in

 with roles;
@@ -22,28 +25,23 @@ with roles;
  # nix binary cache
  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
  "binary-cache-private-key.age".publicKeys = binary-cache;
-  # public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB
-  "binary-cache-push-sshkey.age".publicKeys = nobody; # this value is directly given to gitea
+
+  # attic binary cache
+  "atticd-credentials.age".publicKeys = binary-cache;
+  "attic-netrc.age".publicKeys = everyone;

  # vpn
-  "iodine.age".publicKeys = iodine;
  "pia-login.age".publicKeys = pia;

  # cloud
  "nextcloud-pw.age".publicKeys = nextcloud;
  "whiteboard-server-jwt-secret.age".publicKeys = nextcloud;
  "smb-secrets.age".publicKeys = personal ++ media-center;
-  "oauth2-proxy-env.age".publicKeys = server;

  # services
-  "searx.age".publicKeys = nobody;
  "wolframalpha.age".publicKeys = dailybot;
  "linkwarden-environment.age".publicKeys = linkwarden;

-  # hostapd
-  "hostapd-pw-experimental-tower.age".publicKeys = nobody;
-  "hostapd-pw-CXNK00BF9176.age".publicKeys = nobody;
-
  # backups
  "backblaze-s3-backups.age".publicKeys = personal ++ server;
  "restic-password.age".publicKeys = personal ++ server;
Author	SHA1	Message	Date
Zuckerberg	123f53cf91	Speed up attic Some checks failed Check Flake / check-flake (push) Failing after 20m46s Details	2026-02-20 23:24:11 -08:00
Zuckerberg	fb17d81d49	Add Attic binary cache and containerize gitea runner Replace nix-serve-only setup with Attic for managed binary caching with upstream filtering and GC. Move gitea actions runner from host into an isolated NixOS container with private networking. nix-serve kept alongside Attic during migration.	2026-02-20 22:00:49 -08:00
Zuckerberg	9154595910	Ad Incus sandbox on fry I've already been using for a while now All checks were successful Check Flake / check-flake (push) Successful in 3m35s Details	2026-02-17 21:35:23 -08:00
Zuckerberg	1b92363b08	Fix rust analyzer in vscode	2026-02-17 21:28:50 -08:00
Zuckerberg	136f024cf0	Fix tailscale networking when incus is on	2026-02-17 21:28:28 -08:00
Zuckerberg	3d08a3e9bc	Improve nix settings for sandboxed workspaces All checks were successful Check Flake / check-flake (push) Successful in 1m15s Details	2026-02-14 11:29:02 -08:00
Zuckerberg	99ef62d31a	Fix unused vars All checks were successful Check Flake / check-flake (push) Successful in 1m21s Details	2026-02-11 23:12:00 -08:00
Zuckerberg	298f473ceb	Remove unused vscode-server module	2026-02-11 23:00:48 -08:00
Zuckerberg	546bd08f83	Fix CI build. Ephemeral targets should not be in nixosConfigurations All checks were successful Check Flake / check-flake (push) Successful in 17m45s Details	2026-02-11 22:49:11 -08:00
Zuckerberg	10f3e3a7bf	Remove old stale/unused configuration	2026-02-11 22:47:38 -08:00
Zuckerberg	d44bd12e17	Update README.md	2026-02-11 21:58:38 -08:00
Zuckerberg	60e89dfc90	Clean up CLAUDE.md and make the claude skill correctly this time Some checks failed Check Flake / check-flake (push) Failing after 6s Details	2026-02-10 21:08:13 -08:00
Zuckerberg	869b6af7f7	Block sandbox access to local network Add nftables forward rules to prevent sandboxed workspaces from reaching RFC1918 private addresses while allowing public internet and the host gateway (for DNS/NAT).	2026-02-09 20:16:02 -08:00
Zuckerberg	d6a0e8ec49	Disable tailscaleAuth for now because it doesn't work with tailscale's ACL tagged group Some checks failed Check Flake / check-flake (push) Failing after 35s Details	2026-02-09 19:57:20 -08:00
Zuckerberg	8293a7dc2a	Rework Claude Code config in sandboxed workspaces Remove credential passing to sandboxes (didn't work well enough). Move onboarding config init from host-side setup into base.nix so each workspace initializes its own Claude config on first boot. Wrap claude command in VM and Incus workspaces to always skip permission prompts.	2026-02-09 19:56:11 -08:00
Zuckerberg	cbf2aedcad	Add use flake for fresh claude code	2026-02-09 18:04:09 -08:00
Zuckerberg	69fc3ad837	Add ZFS/btrfs snapshot support to backups Creates filesystem snapshots before backup for point-in-time consistency. Uses mount namespaces to bind mount snapshots over original paths, so restic records correct paths while reading from frozen snapshot data. - Auto-detects filesystem type via findmnt - Deterministic snapshot names using path hash - Graceful fallback for unsupported filesystems	2026-02-08 20:16:37 -08:00
Zuckerberg	6041d4d09f	Replace nixos-generators with upstream nixpkgs image support	2026-02-08 17:57:16 -08:00
Zuckerberg	cf71b74d6f	Add Incus container support to sandboxed workspaces - Add incus.nix module for fully declarative Incus/LXC containers - Build NixOS LXC images using nixpkgs.lib.nixosSystem - Ephemeral containers: recreated on each start, cleaned up on stop - Use flock to serialize concurrent container operations - Deterministic MAC addresses via lib.mkMac to prevent ARP cache issues - Add veth* to NetworkManager unmanaged interfaces - Update CLAUDE.md with coding conventions and shared lib docs	2026-02-08 15:16:40 -08:00
Zuckerberg	5178ea6835	Configure Claude Code for sandboxed workspaces - Add credentials bind mount in container.nix - Create claude-credentials-dir service to copy credentials for VMs - Generate .claude.json with onboarding skipped and workspace trusted - Add allowUnfree to container config	2026-02-08 14:53:31 -08:00
Zuckerberg	87db330e5b	Add sandboxed-workspace module for isolated dev environments Provides isolated development environments using either VMs (microvm.nix) or containers (systemd-nspawn) with a unified configuration interface. Features: - Unified options with required type field ("vm" or "container") - Shared base configuration for networking, SSH, users, packages - Automatic SSH host key generation and persistence - Shell aliases for workspace management (start/stop/status/ssh) - Automatic /etc/hosts entries for workspace hostnames - restartIfChanged support for both VMs and containers - Passwordless doas in workspaces Container backend: - Uses hostBridge for proper bridge networking with /24 subnet - systemd-networkd for IP configuration - systemd-resolved for DNS VM backend: - TAP interface with deterministic MAC addresses - virtiofs shares for workspace directories - vsock CID generation	2026-02-07 22:43:08 -08:00
Zuckerberg	70f0064d7b	Add claude-code to personal machines	2026-02-07 22:37:35 -08:00
Zuckerberg	cef8456332	Add CLAUDE.md with project conventions	2026-02-07 22:36:11 -08:00
Zuckerberg	c22855175a	Add logseq and godot-mono All checks were successful Check Flake / check-flake (push) Successful in 3m51s Details	2026-02-06 21:12:18 -08:00
Zuckerberg	0a06e3c1ae	Move vscodium config to home manager and add vscodium profile	2026-02-06 21:11:59 -08:00