flake.lock: Update

Flake lock file updates: • Updated input 'deploy-rs': 'github:serokell/deploy-rs/c2ea4e642dc50fd44b537e9860ec95867af30d39' (2023-04-21) → 'github:serokell/deploy-rs/64160276cd6569694131ed8864d4d35470a84ec3' (2023-05-08) • Updated input 'nix-index-database': 'github:Mic92/nix-index-database/e3e320b19c192f40a5b98e8776e3870df62dee8a' (2023-04-25) → 'github:Mic92/nix-index-database/219067a5e3cf4b9581c8b4fcfc59ecd5af953d07' (2023-05-09) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/297187b30a19f147ef260abb5abd93b0706af238' (2023-04-30) → 'github:NixOS/nixpkgs/f431ee4a85cb985075b4ed27596913e8087f4264' (2023-05-10)
2023-05-10 12:07:18 -06:00
101 changed files with 780 additions and 11283 deletions
--- a/.gitea/workflows/check-flake.yaml
+++ b/.gitea/workflows/check-flake.yaml
@@ -4,16 +4,35 @@ on: [push]
 env:
  DEBIAN_FRONTEND: noninteractive
-  PATH: /run/current-system/sw/bin/
+  PATH: /run/current-system/sw/bin/:/nix/var/nix/profiles/per-user/gitea-runner/profile/bin
 # defaults:
 #   run:
 #     shell: nix shell nixpkgs#nodejs-18_x
 jobs:
  check-flake:
    runs-on: nixos
    steps:
      # - run: node --version
      # - name: Install basic dependencies
      #   run: apt-get update && apt-get install -y --no-install-recommends sudo curl ca-certificates xz-utils
      # - name: Install Nix
      #   uses: https://github.com/cachix/install-nix-action@v20
      #   with:
      #     github_access_token: ${{ secrets.__GITHUB_TOKEN }}
      - name: Install dependencies
        run: nix profile install nixpkgs#nodejs-18_x
      - name: Checkout the repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      # - name: Get ENV var names
      #   run: printenv | cut -d'=' -f1
      - name: Check Flake
-        run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace
+        run: nix flake check --show-trace
--- a/27
+++ b/27
@@ -1,27 +0,0 @@
 # Lockfile utils
 .PHONY: update-lockfile
 update-lockfile:
 	nix flake update --commit-lock-file
 .PHONY: update-lockfile-without-commit
 update-lockfile-without-commit:
 	nix flake update
 # Agenix utils
 .PHONY: edit-secret
 edit-secret:
 	cd secrets && agenix -e $(filter-out $@,$(MAKECMDGOALS))
 .PHONY: rekey-secrets
 rekey-secrets:
 	cd secrets && agenix -r
 # NixOS utils
 .PHONY: clean-old-nixos-profiles
 clean-old-nixos-profiles:
 	doas nix-collect-garbage -d
 # Garbage Collect
 .PHONY: gc
 gc:
 	nix store gc
--- a/common/binary-cache.nix
+++ b/common/binary-cache.nix
@@ -1,16 +1,6 @@
 { config, lib, ... }:
 let
 in
 {
  options.enableExtraSubstituters = lib.mkEnableOption "Enable extra substituters";
  config = lib.mkMerge [
    {
      enableExtraSubstituters = lib.mkDefault true;
    }
    (lib.mkIf config.enableExtraSubstituters {
  nix = {
    settings = {
      substituters = [
@@ -24,6 +14,4 @@ in
      ];
    };
  };
    })
  ];
 }
--- a/common/boot/bios.nix
+++ b/common/boot/bios.nix
@@ -10,20 +10,18 @@ in
    device = mkOption {
      type = types.str;
    };
    configurationLimit = mkOption {
      default = 20;
      type = types.int;
    };
  };
  config = mkIf cfg.enable {
    # Use GRUB 2 for BIOS
    boot.loader = {
      timeout = 2;
      grub = {
        enable = true;
        device = cfg.device;
        version = 2;
        useOSProber = true;
-        configurationLimit = cfg.configurationLimit;
+        configurationLimit = 20;
        theme = pkgs.nixos-grub2-theme;
      };
    };
--- a/common/boot/efi.nix
+++ b/common/boot/efi.nix
@@ -7,23 +7,21 @@ in
 {
  options.efi = {
    enable = mkEnableOption "enable efi boot";
    configurationLimit = mkOption {
      default = 20;
      type = types.int;
    };
  };
  config = mkIf cfg.enable {
    # Use GRUB2 for EFI
    boot.loader = {
      efi.canTouchEfiVariables = true;
      timeout = 2;
      grub = {
        enable = true;
        device = "nodev";
        version = 2;
        efiSupport = true;
        useOSProber = true;
        #       memtest86.enable = true;
-        configurationLimit = cfg.configurationLimit;
+        configurationLimit = 20;
        theme = pkgs.nixos-grub2-theme;
      };
    };
--- a/common/boot/remote-luks-unlock.nix
+++ b/common/boot/remote-luks-unlock.nix
@@ -1,7 +1,5 @@
 { config, pkgs, lib, ... }:
 # TODO: use tailscale instead of tor https://gist.github.com/antifuchs/e30d58a64988907f282c82231dde2cbc
 let
  cfg = config.remoteLuksUnlock;
 in
@@ -35,6 +33,11 @@ in
  };
  config = lib.mkIf cfg.enable {
    # boot.initrd.luks.devices.${cfg.device.name} = {
    #   device = cfg.device.path;
    #   allowDiscards = cfg.device.allowDiscards;
    # };
    # Unlock LUKS disk over ssh
    boot.initrd.network.enable = true;
    boot.initrd.kernelModules = cfg.kernelModules;
--- a/common/default.nix
+++ b/common/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, ... }:
 {
  imports = [
@@ -18,21 +18,15 @@
  nix.flakes.enable = true;
-  system.stateVersion = "23.11";
+  system.stateVersion = "21.11";
-  networking.useDHCP = lib.mkDefault true;
+  networking.useDHCP = false;
  networking.firewall.enable = true;
  networking.firewall.allowPing = true;
-  time.timeZone = "America/Los_Angeles";
+  time.timeZone = "America/Denver";
-  i18n = {
+  i18n.defaultLocale = "en_US.UTF-8";
    defaultLocale = "en_US.UTF-8";
    extraLocaleSettings = {
      LANGUAGE = "en_US.UTF-8";
      LC_ALL = "en_US.UTF-8";
    };
  };
  services.openssh = {
    enable = true;
@@ -61,8 +55,6 @@
    lm_sensors
    picocom
    lf
    gnumake
    tree
  ];
  nixpkgs.config.allowUnfree = true;
--- a/common/flakes.nix
+++ b/common/flakes.nix
@@ -10,6 +10,7 @@ in
  config = mkIf cfg.enable {
    nix = {
      package = pkgs.nixFlakes;
      extraOptions = ''
        experimental-features = nix-command flakes
      '';
--- a/common/network/pia-wireguard.nix
+++ b/common/network/pia-wireguard.nix
@@ -11,7 +11,6 @@
 # TODO implement this module such that the wireguard VPN doesn't have to live in a container
 # TODO don't add forward rules if the PIA port is the same as cfg.forwardedPort
 # TODO verify signatures of PIA responses
 # TODO `RuntimeMaxSec = "30d";` for pia-vpn-wireguard-init isn't allowed per the systemd logs. Find alternative.
 with builtins;
 with lib;
@@ -144,14 +143,14 @@ in
    systemd.services.pia-vpn-wireguard-init = {
      description = "Creates PIA VPN Wireguard Interface";
-      wants = [ "network-online.target" ];
+      requires = [ "network-online.target" ];
      after = [ "network.target" "network-online.target" ];
      before = [ containerServiceName ];
      requiredBy = [ containerServiceName ];
      partOf = [ containerServiceName ];
      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ wireguard-tools jq curl iproute iputils ];
+      path = with pkgs; [ wireguard-tools jq curl iproute ];
      serviceConfig = {
        Type = "oneshot";
@@ -163,11 +162,6 @@ in
      };
      script = ''
        echo Waiting for internet...
        while ! ping -c 1 -W 1 1.1.1.1; do
            sleep 1
        done
        # Prepare to connect by generating wg secrets and auth'ing with PIA since the container
        # cannot do without internet to start with. NAT'ing the host's internet would address this
        # issue but is not ideal because then leaking network outside of the VPN is more likely.
@@ -220,7 +214,7 @@ in
    vpn-container.config.systemd.services.pia-vpn-wireguard = {
      description = "Initializes the PIA VPN WireGuard Tunnel";
-      wants = [ "network-online.target" ];
+      requires = [ "network-online.target" ];
      after = [ "network.target" "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
--- a/common/network/vpn.nix
+++ b/common/network/vpn.nix
@@ -72,6 +72,9 @@ in
      config = {
        imports = allModules ++ [ cfg.config ];
        # speeds up evaluation
        nixpkgs.pkgs = pkgs;
        # networking.firewall.enable = mkForce false;
        networking.firewall.trustedInterfaces = [
          # completely trust internal interface to host
--- a/common/pc/audio.nix
+++ b/common/pc/audio.nix
@@ -19,15 +19,6 @@ in
      jack.enable = true;
    };
    services.pipewire.extraConfig.pipewire."92-fix-wine-audio" = {
      context.properties = {
        default.clock.rate = 48000;
        default.clock.quantum = 2048;
        default.clock.min-quantum = 512;
        default.clock.max-quantum = 2048;
      };
    };
    users.users.googlebot.extraGroups = [ "audio" ];
    # bt headset support
--- a/common/pc/chromium.nix
+++ b/common/pc/chromium.nix
@@ -17,6 +17,38 @@ let
      "PREFIX=$(out)"
    ];
  };
  nvidia-vaapi-driver = pkgs.stdenv.mkDerivation rec {
    pname = "nvidia-vaapi-driver";
    version = "0.0.5";
    src = pkgs.fetchFromGitHub {
      owner = "elFarto";
      repo = pname;
      rev = "v${version}";
      sha256 = "2bycqKolVoaHK64XYcReteuaON9TjzrFhaG5kty28YY=";
    };
    patches = [
      ./use-meson-v57.patch
    ];
    nativeBuildInputs = with pkgs; [
      meson
      cmake
      ninja
      pkg-config
    ];
    buildInputs = with pkgs; [
      nv-codec-headers-11-1-5-1
      libva
      gst_all_1.gstreamer
      gst_all_1.gst-plugins-bad
      libglvnd
    ];
  };
 in
 {
  config = lib.mkIf cfg.enable {
@@ -41,7 +73,7 @@ in
        "SpellcheckLanguage" = [ "en-US" ];
      };
      defaultSearchProviderSuggestURL = null;
-      defaultSearchProviderSearchURL = "https://duckduckgo.com/?q={searchTerms}&kp=-1&kl=us-en";
+      defaultSearchProviderSearchURL = " https://duckduckgo.com/?q={searchTerms}&kp=-1&kl=us-en";
    };
    # hardware accelerated video playback (on intel)
@@ -52,7 +84,7 @@ in
        # ungoogled = true;
        # --enable-native-gpu-memory-buffers # fails on AMD APU
        # --enable-webrtc-vp9-support
-        commandLineArgs = "--use-vulkan";
+        commandLineArgs = "--use-vulkan --use-gl=desktop --enable-zero-copy --enable-hardware-overlays --enable-features=VaapiVideoDecoder,CanvasOopRasterization --ignore-gpu-blocklist --enable-accelerated-mjpeg-decode --enable-accelerated-video  --enable-gpu-rasterization";
      };
    };
    # todo vulkan in chrome
--- a/common/pc/default.nix
+++ b/common/pc/default.nix
@@ -6,20 +6,19 @@ in
 {
  imports = [
    ./kde.nix
-    #    ./xfce.nix
+    ./xfce.nix
    ./yubikey.nix
    ./chromium.nix
-    ./firefox.nix
+    #    ./firefox.nix
    ./audio.nix
    #    ./torbrowser.nix
    ./pithos.nix
    ./spotify.nix
    ./vscodium.nix
    ./discord.nix
    ./steam.nix
    ./touchpad.nix
    ./mount-samba.nix
    ./udev.nix
    ./virtualisation.nix
  ];
  options.de = {
@@ -42,20 +41,21 @@ in
      mpv
      nextcloud-client
      signal-desktop
      minecraft
      gparted
      libreoffice-fresh
      thunderbird
-      spotify
+      spotifyd
      spotify-qt
      arduino
      yt-dlp
      jellyfin-media-player
      joplin-desktop
      config.inputs.deploy-rs.packages.${config.currentSystem}.deploy-rs
      lxqt.pavucontrol-qt
      barrier
      # For Nix IDE
      nixpkgs-fmt
      rnix-lsp
    ];
    # Networking
@@ -69,28 +69,12 @@ in
    ];
    # Printer discovery
    services.avahi.enable = true;
-    services.avahi.nssmdns4 = true;
+    services.avahi.nssmdns = true;
    programs.file-roller.enable = true;
    # Security
    services.gnome.gnome-keyring.enable = true;
    security.pam.services.googlebot.enableGnomeKeyring = true;
    # Android dev
    programs.adb.enable = true;
    # Mount personal SMB stores
    services.mount-samba.enable = true;
    # allow building ARM derivations
    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
    # for luks onlock over tor
    services.tor.enable = true;
    services.tor.client.enable = true;
    # Enable wayland support in various chromium based applications
    environment.sessionVariables.NIXOS_OZONE_WL = "1";
  };
 }
--- a/common/pc/firefox.nix
+++ b/common/pc/firefox.nix
@@ -20,6 +20,31 @@ let
  };
  firefox = pkgs.wrapFirefox somewhatPrivateFF {
    desktopName = "Sneed Browser";
    nixExtensions = [
      (pkgs.fetchFirefoxAddon {
        name = "ublock-origin";
        url = "https://addons.mozilla.org/firefox/downloads/file/3719054/ublock_origin-1.33.2-an+fx.xpi";
        sha256 = "XDpe9vW1R1iVBTI4AmNgAg1nk7BVQdIAMuqd0cnK5FE=";
      })
      (pkgs.fetchFirefoxAddon {
        name = "sponsorblock";
        url = "https://addons.mozilla.org/firefox/downloads/file/3720594/sponsorblock_skip_sponsorships_on_youtube-2.0.12.3-an+fx.xpi";
        sha256 = "HRtnmZWyXN3MKo4AvSYgNJGkBEsa2RaMamFbkz+YzQg=";
      })
      (pkgs.fetchFirefoxAddon {
        name = "KeePassXC-Browser";
        url = "https://addons.mozilla.org/firefox/downloads/file/3720664/keepassxc_browser-1.7.6-fx.xpi";
        sha256 = "3K404/eq3amHhIT0WhzQtC892he5I0kp2SvbzE9dbZg=";
      })
      (pkgs.fetchFirefoxAddon {
        name = "https-everywhere";
        url = "https://addons.mozilla.org/firefox/downloads/file/3716461/https_everywhere-2021.1.27-an+fx.xpi";
        sha256 = "2gSXSLunKCwPjAq4Wsj0lOeV551r3G+fcm1oeqjMKh8=";
      })
    ];
    extraPolicies = {
      CaptivePortal = false;
      DisableFirefoxStudies = true;
@@ -49,6 +74,12 @@ let
        ExtensionRecommendations = false;
        SkipOnboarding = true;
      };
      WebsiteFilter = {
        Block = [
          "http://paradigminteractive.io/"
          "https://paradigminteractive.io/"
        ];
      };
    };
    extraPrefs = ''
--- a/common/pc/kde.nix
+++ b/common/pc/kde.nix
@@ -5,11 +5,15 @@ let
 in
 {
  config = lib.mkIf cfg.enable {
-    services.displayManager.sddm.enable = true;
+    # kde plasma
-    services.displayManager.sddm.wayland.enable = true;
+    services.xserver = {
-    services.desktopManager.plasma6.enable = true;
+      enable = true;
      desktopManager.plasma5.enable = true;
      displayManager.sddm.enable = true;
    };
    # kde apps
    nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true;
    users.users.googlebot.packages = with pkgs; [
      # akonadi
      # kmail
--- a/common/pc/mount-samba.nix
+++ b/common/pc/mount-samba.nix
@@ -13,8 +13,6 @@ let
  auth_opts = "sec=ntlmv2i,credentials=/run/agenix/smb-secrets";
  version_opts = "vers=3.1.1";
  public_user_opts = "gid=${toString config.users.groups.users.gid}";
  opts = "${systemd_opts},${network_opts},${user_opts},${version_opts},${auth_opts}";
 in
 {
@@ -26,7 +24,7 @@ in
    fileSystems."/mnt/public" = {
      device = "//s0.koi-bebop.ts.net/public";
      fsType = "cifs";
-      options = [ "${opts},${public_user_opts}" ];
+      options = [ opts ];
    };
    fileSystems."/mnt/private" = {
--- a/common/pc/spotify.nix
+++ b/common/pc/spotify.nix
@@ -0,0 +1,86 @@
 { lib, config, pkgs, ... }:
 with lib;
 let
  cfg = config.services.spotifyd;
  toml = pkgs.formats.toml { };
  spotifydConf = toml.generate "spotify.conf" cfg.settings;
 in
 {
  disabledModules = [
    "services/audio/spotifyd.nix"
  ];
  options = {
    services.spotifyd = {
      enable = mkEnableOption "spotifyd, a Spotify playing daemon";
      settings = mkOption {
        default = { };
        type = toml.type;
        example = { global.bitrate = 320; };
        description = ''
          Configuration for Spotifyd. For syntax and directives, see
          <link xlink:href="https://github.com/Spotifyd/spotifyd#Configuration"/>.
        '';
      };
      users = mkOption {
        type = with types; listOf str;
        default = [ ];
        description = ''
          Usernames to be added to the "spotifyd" group, so that they
          can start and interact with the userspace daemon.
        '';
      };
    };
  };
  config = mkIf cfg.enable {
    # username specific stuff because i'm lazy...
    services.spotifyd.users = [ "googlebot" ];
    users.users.googlebot.packages = with pkgs; [
      spotify
      spotify-tui
    ];
    users.groups.spotifyd = {
      members = cfg.users;
    };
    age.secrets.spotifyd = {
      file = ../../secrets/spotifyd.age;
      group = "spotifyd";
      mode = "0440"; # group can read
    };
    # spotifyd to read secrets and run as user service
    services.spotifyd = {
      settings.global = {
        username_cmd = "sed '1q;d' /run/agenix/spotifyd";
        password_cmd = "sed '2q;d' /run/agenix/spotifyd";
        bitrate = 320;
        backend = "pulseaudio";
        device_name = config.networking.hostName;
        device_type = "computer";
        # on_song_change_hook = "command_to_run_on_playback_events"
        autoplay = true;
      };
    };
    systemd.user.services.spotifyd-daemon = {
      enable = true;
      wantedBy = [ "graphical-session.target" ];
      partOf = [ "graphical-session.target" ];
      description = "spotifyd, a Spotify playing daemon";
      environment.SHELL = "/bin/sh";
      serviceConfig = {
        ExecStart = "${pkgs.spotifyd}/bin/spotifyd --no-daemon --config-path ${spotifydConf}";
        Restart = "always";
        CacheDirectory = "spotifyd";
      };
    };
  };
 }
--- a/common/pc/touchpad.nix
+++ b/common/pc/touchpad.nix
@@ -9,7 +9,7 @@ in
  };
  config = lib.mkIf cfg.enable {
-    services.libinput.enable = true;
+    services.xserver.libinput.enable = true;
-    services.libinput.touchpad.naturalScrolling = true;
+    services.xserver.libinput.touchpad.naturalScrolling = true;
  };
 }
--- a/common/pc/udev.nix
+++ b/common/pc/udev.nix
@@ -1,25 +0,0 @@
 { config, lib, pkgs, ... }:
 let
  cfg = config.de;
 in
 {
  config = lib.mkIf cfg.enable {
    services.udev.extraRules = ''
      # depthai
      SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
      # Moonlander
      # Rules for Oryx web flashing and live training
      KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
      KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
      # Wally Flashing rules for the Moonlander and Planck EZ
      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
    '';
    services.udev.packages = [ pkgs.platformio ];
    users.groups.plugdev = {
      members = [ "googlebot" ];
    };
  };
 }
--- a/common/pc/use-meson-v57.patch
+++ b/common/pc/use-meson-v57.patch
@@ -0,0 +1,22 @@
 diff --git a/meson.build b/meson.build
 index dace367..8c0e290 100644
 --- a/meson.build
 +++ b/meson.build
@@ -8,7 +8,7 @@ project(
         'warning_level=0',
     ],
     license: 'MIT',
 -    meson_version: '>= 0.58.0',
 +    meson_version: '>= 0.57.0',
 )
 cc = meson.get_compiler('c')
@@ -47,8 +47,3 @@ shared_library(
     gnu_symbol_visibility: 'hidden',
 )
 -meson.add_devenv(environment({
 -    'NVD_LOG': '1',
 -    'LIBVA_DRIVER_NAME': 'nvidia',
 -    'LIBVA_DRIVERS_PATH': meson.project_build_root(),
 -}))
--- a/common/pc/virtualisation.nix
+++ b/common/pc/virtualisation.nix
@@ -1,23 +0,0 @@
 { config, lib, pkgs, ... }:
 let
  cfg = config.de;
 in
 {
  config = lib.mkIf cfg.enable {
    # AppVMs
    virtualisation.appvm.enable = true;
    virtualisation.appvm.user = "googlebot";
    # Use podman instead of docker
    virtualisation.podman.enable = true;
    virtualisation.podman.dockerCompat = true;
    # virt-manager
    virtualisation.libvirtd.enable = true;
    programs.dconf.enable = true;
    virtualisation.spiceUSBRedirection.enable = true;
    environment.systemPackages = with pkgs; [ virt-manager ];
    users.users.googlebot.extraGroups = [ "libvirtd" "adbusers" ];
  };
 }
--- a/common/pc/vscodium.nix
+++ b/common/pc/vscodium.nix
@@ -10,21 +10,12 @@ let
    dart-code.flutter
    golang.go
    jnoortheen.nix-ide
    ms-vscode.cpptools
    rust-lang.rust-analyzer
    vadimcn.vscode-lldb
  ] ++ pkgs.vscode-utils.extensionsFromVscodeMarketplace [
    {
      name = "platformio-ide";
      publisher = "platformio";
      version = "3.1.1";
-      sha256 = "g9yTG3DjVUS2w9eHGAai5LoIfEGus+FPhqDnCi4e90Q=";
+      sha256 = "fwEct7Tj8bfTOLRozSZJGWoLzWRSvYz/KxcnfpO8Usg=";
    }
    {
      name = "wgsl-analyzer";
      publisher = "wgsl-analyzer";
      version = "0.8.1";
      sha256 = "ckclcxdUxhjWlPnDFVleLCWgWxUEENe0V328cjaZv+Y=";
    }
  ];
--- a/common/server/actualbudget.nix
+++ b/common/server/actualbudget.nix
@@ -1,87 +0,0 @@
 # Starting point:
 # https://github.com/aldoborrero/mynixpkgs/commit/c501c1e32dba8f4462dcecb57eee4b9e52038e27
 { config, pkgs, lib, ... }:
 let
  cfg = config.services.actual-server;
  stateDir = "/var/lib/${cfg.stateDirName}";
 in
 {
  options.services.actual-server = {
    enable = lib.mkEnableOption "Actual Server";
    hostname = lib.mkOption {
      type = lib.types.str;
      default = "localhost";
      description = "Hostname for the Actual Server.";
    };
    port = lib.mkOption {
      type = lib.types.int;
      default = 25448;
      description = "Port on which the Actual Server should listen.";
    };
    stateDirName = lib.mkOption {
      type = lib.types.str;
      default = "actual-server";
      description = "Name of the directory under /var/lib holding the server's data.";
    };
    upload = {
      fileSizeSyncLimitMB = lib.mkOption {
        type = lib.types.nullOr lib.types.int;
        default = null;
        description = "File size limit in MB for synchronized files.";
      };
      syncEncryptedFileSizeLimitMB = lib.mkOption {
        type = lib.types.nullOr lib.types.int;
        default = null;
        description = "File size limit in MB for synchronized encrypted files.";
      };
      fileSizeLimitMB = lib.mkOption {
        type = lib.types.nullOr lib.types.int;
        default = null;
        description = "File size limit in MB for file uploads.";
      };
    };
  };
  config = lib.mkIf cfg.enable {
    systemd.services.actual-server = {
      description = "Actual Server";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = "${pkgs.actual-server}/bin/actual-server";
        Restart = "always";
        StateDirectory = cfg.stateDirName;
        WorkingDirectory = stateDir;
        DynamicUser = true;
        UMask = "0007";
      };
      environment = {
        NODE_ENV = "production";
        ACTUAL_PORT = toString cfg.port;
        # Actual is actually very bad at configuring it's own paths despite that information being readily available
        ACTUAL_USER_FILES = "${stateDir}/user-files";
        ACTUAL_SERVER_FILES = "${stateDir}/server-files";
        ACTUAL_DATA_DIR = stateDir;
        ACTUAL_UPLOAD_FILE_SYNC_SIZE_LIMIT_MB = toString (cfg.upload.fileSizeSyncLimitMB or "");
        ACTUAL_UPLOAD_SYNC_ENCRYPTED_FILE_SIZE_LIMIT_MB = toString (cfg.upload.syncEncryptedFileSizeLimitMB or "");
        ACTUAL_UPLOAD_FILE_SIZE_LIMIT_MB = toString (cfg.upload.fileSizeLimitMB or "");
      };
    };
    services.nginx.virtualHosts.${cfg.hostname} = {
      enableACME = true;
      forceSSL = true;
      locations."/".proxyPass = "http://localhost:${toString cfg.port}";
    };
  };
 }
--- a/common/server/dashy.nix
+++ b/common/server/dashy.nix
@@ -1,41 +0,0 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
  cfg = config.services.dashy;
 in
 {
  options.services.dashy = {
    enable = mkEnableOption "dashy";
    imageTag = mkOption {
      type = types.str;
      default = "latest";
    };
    port = mkOption {
      type = types.int;
      default = 56815;
    };
    configFile = lib.mkOption {
      type = lib.types.path;
      description = "Path to the YAML configuration file";
    };
  };
  config = mkIf cfg.enable {
    virtualisation.oci-containers.containers = {
      dashy = {
        image = "lissy93/dashy:${cfg.imageTag}";
        environment = {
          TZ = "${config.time.timeZone}";
        };
        ports = [
          "127.0.0.1:${toString cfg.port}:80"
        ];
        volumes = [
          "${cfg.configFile}:/app/public/conf.yml"
        ];
      };
    };
  };
 }
--- a/common/server/default.nix
+++ b/common/server/default.nix
@@ -10,6 +10,7 @@
    ./matrix.nix
    ./zerobin.nix
    ./gitea.nix
    ./gitea-runner.nix
    ./privatebin/privatebin.nix
    ./radio.nix
    ./samba.nix
@@ -18,10 +19,5 @@
    ./nextcloud.nix
    ./iodine.nix
    ./searx.nix
    ./gitea-actions-runner.nix
    ./dashy.nix
    ./librechat.nix
    ./actualbudget.nix
    ./unifi.nix
  ];
 }
--- a/common/server/gitea-actions-runner.nix
+++ b/common/server/gitea-actions-runner.nix
@@ -1,136 +0,0 @@
 { config, pkgs, lib, allModules, ... }:
 # Gitea Actions Runner. Starts 'host' runner that runs directly on the host inside of a nixos container
 # This is useful for providing a real Nix/OS builder to gitea.
 # Warning, NixOS containers are not secure. For example, the container shares the /nix/store
 # Therefore, this should not be used to run untrusted code.
 # To enable, assign a machine the 'gitea-actions-runner' system role
 # TODO: skipping running inside of nixos container for now because of issues getting docker/podman running
 let
  runnerRole = "gitea-actions-runner";
  runners = config.machines.roles.${runnerRole};
  thisMachineIsARunner = builtins.elem config.networking.hostName runners;
  containerName = "gitea-runner";
 in
 {
  config = lib.mkIf (thisMachineIsARunner && !config.boot.isContainer) {
    # containers.${containerName} = {
    #   ephemeral = true;
    #   autoStart = true;
    #   # for podman
    #   enableTun = true;
    #   # privateNetwork = true;
    #   # hostAddress = "172.16.101.1";
    #   # localAddress = "172.16.101.2";
    #   bindMounts =
    #     {
    #       "/run/agenix/gitea-actions-runner-token" = {
    #         hostPath = "/run/agenix/gitea-actions-runner-token";
    #         isReadOnly = true;
    #       };
    #       "/var/lib/gitea-runner" = {
    #         hostPath = "/var/lib/gitea-runner";
    #         isReadOnly = false;
    #       };
    #     };
    #   extraFlags = [
    #     # Allow podman
    #     ''--system-call-filter=thisystemcalldoesnotexistforsure''
    #   ];
    #   additionalCapabilities = [
    #     "CAP_SYS_ADMIN"
    #   ];
    #   config = {
    #     imports = allModules;
    #     # speeds up evaluation
    #     nixpkgs.pkgs = pkgs;
    #     networking.hostName = lib.mkForce containerName;
    #     # don't use remote builders
    #     nix.distributedBuilds = lib.mkForce false;
    #     environment.systemPackages = with pkgs; [
    #       git
    #       # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
    #       nodejs
    #     ];
    #     services.gitea-actions-runner.instances.inst = {
    #       enable = true;
    #       name = config.networking.hostName;
    #       url = "https://git.neet.dev/";
    #       tokenFile = "/run/agenix/gitea-actions-runner-token";
    #       labels = [
    #         "ubuntu-latest:docker://node:18-bullseye"
    #         "nixos:host"
    #       ];
    #     };
    #     # To allow building on the host, must override the the service's config so it doesn't use a dynamic user
    #     systemd.services.gitea-runner-inst.serviceConfig.DynamicUser = lib.mkForce false;
    #     users.users.gitea-runner = {
    #       home = "/var/lib/gitea-runner";
    #       group = "gitea-runner";
    #       isSystemUser = true;
    #       createHome = true;
    #     };
    #     users.groups.gitea-runner = { };
    #     virtualisation.podman.enable = true;
    #     boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
    #   };
    # };
    # networking.nat.enable = true;
    # networking.nat.internalInterfaces = [
    #   "ve-${containerName}"
    # ];
    # networking.ip_forward = true;
    # don't use remote builders
    nix.distributedBuilds = lib.mkForce false;
    services.gitea-actions-runner.instances.inst = {
      enable = true;
      name = config.networking.hostName;
      url = "https://git.neet.dev/";
      tokenFile = "/run/agenix/gitea-actions-runner-token";
      labels = [
        "ubuntu-latest:docker://node:18-bullseye"
        "nixos:host"
      ];
    };
    environment.systemPackages = with pkgs; [
      git
      # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
      nodejs
    ];
    # To allow building on the host, must override the the service's config so it doesn't use a dynamic user
    systemd.services.gitea-runner-inst.serviceConfig.DynamicUser = lib.mkForce false;
    users.users.gitea-runner = {
      home = "/var/lib/gitea-runner";
      group = "gitea-runner";
      isSystemUser = true;
      createHome = true;
    };
    users.groups.gitea-runner = { };
    virtualisation.podman.enable = true;
    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
    age.secrets.gitea-actions-runner-token.file = ../../secrets/gitea-actions-runner-token.age;
  };
 }
--- a/common/server/gitea-runner.nix
+++ b/common/server/gitea-runner.nix
@@ -0,0 +1,52 @@
 { config, pkgs, lib, ... }:
 let
  cfg = config.services.gitea-runner;
 in
 {
  options.services.gitea-runner = {
    enable = lib.mkEnableOption "Enables gitea runner";
    dataDir = lib.mkOption {
      default = "/var/lib/gitea-runner";
      type = lib.types.str;
      description = lib.mdDoc "gitea runner data directory.";
    };
  };
  config = lib.mkIf cfg.enable {
    virtualisation.docker.enable = true;
    users.users.gitea-runner = {
      description = "Gitea Runner Service";
      home = cfg.dataDir;
      useDefaultShell = true;
      group = "gitea-runner";
      isSystemUser = true;
      createHome = true;
      extraGroups = [
        "docker" # allow creating docker containers
      ];
    };
    users.groups.gitea-runner = { };
    systemd.services.gitea-runner = {
      description = "Gitea Runner";
      serviceConfig = {
        WorkingDirectory = cfg.dataDir;
        User = "gitea-runner";
        Group = "gitea-runner";
      };
      requires = [ "network-online.target" ];
      after = [ "network.target" "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
      path = with pkgs; [ gitea-actions-runner ];
      script = ''
        exec act_runner daemon
      '';
    };
  };
 }
--- a/common/server/gitea.nix
+++ b/common/server/gitea.nix
@@ -12,14 +12,12 @@ in
  };
  config = lib.mkIf cfg.enable {
    services.gitea = {
      domain = cfg.hostname;
      rootUrl = "https://${cfg.hostname}/";
      appName = cfg.hostname;
-      lfs.enable = true;
+      # lfs.enable = true;
      # dump.enable = true;
      settings = {
        server = {
          ROOT_URL = "https://${cfg.hostname}/";
          DOMAIN = cfg.hostname;
        };
        other = {
          SHOW_FOOTER_VERSION = false;
        };
@@ -31,9 +29,6 @@ in
        };
        session = {
          COOKIE_SECURE = true;
          PROVIDER = "db";
          SESSION_LIFE_TIME = 259200; # 3 days
          GC_INTERVAL_TIME = 259200; # 3 days
        };
        mailer = {
          ENABLED = true;
@@ -47,9 +42,6 @@ in
        actions = {
          ENABLED = true;
        };
        indexer = {
          REPO_INDEXER_ENABLED = true;
        };
      };
      mailerPasswordFile = "/run/agenix/robots-email-pw";
    };
@@ -68,7 +60,7 @@ in
      enableACME = true;
      forceSSL = true;
      locations."/" = {
-        proxyPass = "http://localhost:${toString cfg.settings.server.HTTP_PORT}";
+        proxyPass = "http://localhost:${toString cfg.httpPort}";
      };
    };
  };
--- a/common/server/librechat.nix
+++ b/common/server/librechat.nix
@@ -1,63 +0,0 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
  cfg = config.services.librechat;
 in
 {
  options.services.librechat = {
    enable = mkEnableOption "librechat";
    port = mkOption {
      type = types.int;
      default = 3080;
    };
    host = lib.mkOption {
      type = lib.types.str;
      example = "example.com";
    };
  };
  config = mkIf cfg.enable {
    virtualisation.oci-containers.containers = {
      librechat = {
        image = "ghcr.io/danny-avila/librechat:v0.6.6";
        environment = {
          HOST = "0.0.0.0";
          MONGO_URI = "mongodb://host.containers.internal:27017/LibreChat";
          ENDPOINTS = "openAI,google,bingAI,gptPlugins";
          REFRESH_TOKEN_EXPIRY = toString (1000 * 60 * 60 * 24 * 30); # 30 days
        };
        environmentFiles = [
          "/run/agenix/librechat-env-file"
        ];
        ports = [
          "${toString cfg.port}:3080"
        ];
      };
    };
    age.secrets.librechat-env-file.file = ../../secrets/librechat-env-file.age;
    services.mongodb.enable = true;
    services.mongodb.bind_ip = "0.0.0.0";
    # easier podman maintenance
    virtualisation.oci-containers.backend = "podman";
    virtualisation.podman.dockerSocket.enable = true;
    virtualisation.podman.dockerCompat = true;
    # For mongodb access
    networking.firewall.trustedInterfaces = [
      "podman0" # for librechat
    ];
    services.nginx.virtualHosts.${cfg.host} = {
      enableACME = true;
      forceSSL = true;
      locations."/" = {
        proxyPass = "http://localhost:${toString cfg.port}";
        proxyWebsockets = true;
      };
    };
  };
 }
--- a/common/server/mailserver.nix
+++ b/common/server/mailserver.nix
@@ -55,8 +55,6 @@ in
        "joslyn@runyan.org"
        "damon@runyan.org"
        "jonas@runyan.org"
        "simon@neet.dev"
        "ellen@runyan.org"
      ];
      forwards = {
        "amazon@runyan.org" = [
@@ -64,7 +62,7 @@ in
          "cris@runyan.org"
        ];
      };
-      certificateScheme = "acme-nginx"; # use let's encrypt for certs
+      certificateScheme = 3; # use let's encrypt for certs
    };
    age.secrets.hashed-email-pw.file = ../../secrets/hashed-email-pw.age;
    age.secrets.cris-hashed-email-pw.file = ../../secrets/cris-hashed-email-pw.age;
--- a/common/server/nextcloud.nix
+++ b/common/server/nextcloud.nix
@@ -8,23 +8,13 @@ in
  config = lib.mkIf cfg.enable {
    services.nextcloud = {
      https = true;
-      package = pkgs.nextcloud30;
+      package = pkgs.nextcloud25;
      hostName = "neet.cloud";
      config.dbtype = "sqlite";
      config.adminuser = "jeremy";
      config.adminpassFile = "/run/agenix/nextcloud-pw";
      autoUpdateApps.enable = true;
-      extraApps = with config.services.nextcloud.package.packages.apps; {
+      enableBrokenCiphersForSSE = false;
        # Want
        inherit end_to_end_encryption mail spreed;
        # Might use
        inherit bookmarks calendar cookbook deck memories onlyoffice qownnotesapi;
        # Try out
        # inherit maps music news notes phonetrack polls forms;
      };
      extraAppsEnable = true;
    };
    age.secrets.nextcloud-pw = {
      file = ../../secrets/nextcloud-pw.age;
--- a/common/server/nginx.nix
+++ b/common/server/nginx.nix
@@ -4,10 +4,6 @@ let
  cfg = config.services.nginx;
 in
 {
  options.services.nginx = {
    openFirewall = lib.mkEnableOption "Open firewall ports 80 and 443";
  };
  config = lib.mkIf cfg.enable {
    services.nginx = {
      recommendedGzipSettings = true;
@@ -16,8 +12,6 @@ in
      recommendedTlsSettings = true;
    };
-    services.nginx.openFirewall = lib.mkDefault true;
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 80 443 ];
  };
 }
--- a/common/server/samba.nix
+++ b/common/server/samba.nix
@@ -97,7 +97,7 @@
    # Printer discovery
    # (is this needed?)
    services.avahi.enable = true;
-    services.avahi.nssmdns4 = true;
+    services.avahi.nssmdns = true;
    # printer sharing
    systemd.tmpfiles.rules = [
--- a/common/server/unifi.nix
+++ b/common/server/unifi.nix
@@ -1,25 +0,0 @@
 { config, lib, pkgs, ... }:
 let
  cfg = config.services.unifi;
 in
 {
  options.services.unifi = {
    # Open select Unifi ports instead of using openFirewall to avoid opening access to unifi's control panel
    openMinimalFirewall = lib.mkEnableOption "Open bare minimum firewall ports";
  };
  config = lib.mkIf cfg.enable {
    services.unifi.unifiPackage = pkgs.unifi8;
    networking.firewall = lib.mkIf cfg.openMinimalFirewall {
      allowedUDPPorts = [
        3478 # STUN
        10001 # used for device discovery.
      ];
      allowedTCPPorts = [
        8080 # Used for device and application communication.
      ];
    };
  };
 }
--- a/common/shell.nix
+++ b/common/shell.nix
@@ -34,8 +34,6 @@
    io_seq_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=write --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
    io_rand_read = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randread --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=32 --runtime=60 --group_reporting; rm temp.file";
    io_rand_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randrw --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
    llsblk = "lsblk -o +uuid,fsType";
  };
  nixpkgs.overlays = [
--- a/flake.lock
+++ b/flake.lock
@@ -3,20 +3,16 @@
    "agenix": {
      "inputs": {
        "darwin": "darwin",
        "home-manager": "home-manager",
        "nixpkgs": [
          "nixpkgs"
        ],
        "systems": [
          "systems"
        ]
      },
      "locked": {
-        "lastModified": 1723293904,
+        "lastModified": 1682101079,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "narHash": "sha256-MdAhtjrLKnk2uiqun1FWABbKpLH090oeqCSiWemtuck=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "2994d002dcff5353ca1ac48ec584c7f6589fe447",
        "type": "github"
      },
      "original": {
@@ -25,6 +21,29 @@
        "type": "github"
      }
    },
    "archivebox": {
      "inputs": {
        "flake-utils": [
          "flake-utils"
        ],
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1648612759,
        "narHash": "sha256-SJwlpD2Wz3zFoX2mIYCQfwIOYHaOdeiWGFeDXsLGM84=",
        "ref": "refs/heads/master",
        "rev": "39d338b9b24159d8ef3309eecc0d32a2a9f102b5",
        "revCount": 2,
        "type": "git",
        "url": "https://git.neet.dev/zuckerberg/archivebox.git"
      },
      "original": {
        "type": "git",
        "url": "https://git.neet.dev/zuckerberg/archivebox.git"
      }
    },
    "blobs": {
      "flake": false,
      "locked": {
@@ -57,11 +76,11 @@
        "rev": "1290ddd9a2ff2bf2d0f702750768312b80efcd34",
        "revCount": 19,
        "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
      },
      "original": {
        "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
      }
    },
    "darwin": {
@@ -72,11 +91,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1700795494,
+        "lastModified": 1673295039,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
        "type": "github"
      },
      "original": {
@@ -88,22 +107,21 @@
    },
    "deploy-rs": {
      "inputs": {
-        "flake-compat": [
+        "flake-compat": "flake-compat",
          "flake-compat"
        ],
        "nixpkgs": [
          "nixpkgs"
        ],
        "utils": [
-          "flake-utils"
+          "simple-nixos-mailserver",
          "utils"
        ]
      },
      "locked": {
-        "lastModified": 1727447169,
+        "lastModified": 1683515103,
-        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
+        "narHash": "sha256-vWlnZ0twW+ekOC6JuAHDfupv+u4QNvWawG7+DaQJ4VA=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
+        "rev": "64160276cd6569694131ed8864d4d35470a84ec3",
        "type": "github"
      },
      "original": {
@@ -115,11 +133,11 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1668681692,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
        "type": "github"
      },
      "original": {
@@ -130,16 +148,14 @@
    },
    "flake-utils": {
      "inputs": {
-        "systems": [
+        "systems": "systems"
          "systems"
        ]
      },
      "locked": {
-        "lastModified": 1726560853,
+        "lastModified": 1681202837,
-        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
        "type": "github"
      },
      "original": {
@@ -148,27 +164,6 @@
        "type": "github"
      }
    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
          "agenix",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1703113217,
        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
        "owner": "nix-community",
        "repo": "home-manager",
        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "home-manager",
        "type": "github"
      }
    },
    "nix-index-database": {
      "inputs": {
        "nixpkgs": [
@@ -176,11 +171,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1728263287,
+        "lastModified": 1683638468,
-        "narHash": "sha256-GJDtsxz2/zw6g/Nrp4XVWBS5IaZ7ZUkuvxPOBEDe7pg=",
+        "narHash": "sha256-tQEaGZfZ2Hpw+XIVEHaJ8FaF1yNQyMDDhUyIQ7LTIEg=",
        "owner": "Mic92",
        "repo": "nix-index-database",
-        "rev": "5fce10c871bab6d7d5ac9e5e7efbb3a2783f5259",
+        "rev": "219067a5e3cf4b9581c8b4fcfc59ecd5af953d07",
        "type": "github"
      },
      "original": {
@@ -189,52 +184,47 @@
        "type": "github"
      }
    },
    "nixos-hardware": {
      "locked": {
        "lastModified": 1728056216,
        "narHash": "sha256-IrO06gFUDTrTlIP3Sz+mRB6WUoO2YsgMtOD3zi0VEt0=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
        "rev": "b7ca02c7565fbf6d27ff20dd6dbd49c5b82eef28",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "master",
        "repo": "nixos-hardware",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1728193676,
+        "lastModified": 1683741689,
-        "narHash": "sha256-PbDWAIjKJdlVg+qQRhzdSor04bAPApDqIv2DofTyynk=",
+        "narHash": "sha256-VY6gjqAFQe0Xyz+olc979zbsW9dC4VG+mINGffFKVEw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ecbc1ca8ffd6aea8372ad16be9ebbb39889e55b6",
+        "rev": "f431ee4a85cb985075b4ed27596913e8087f4264",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-24.05",
+        "ref": "master",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "nixpkgs-frigate": {
+    "nixpkgs-22_05": {
      "locked": {
-        "lastModified": 1695825837,
+        "lastModified": 1654936503,
-        "narHash": "sha256-4Ne11kNRnQsmSJCRSSNkFRSnHC4Y5gPDBIQGjjPfJiU=",
+        "narHash": "sha256-soKzdhI4jTHv/rSbh89RdlcJmrPgH8oMb/PLqiqIYVQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5cfafa12d57374f48bcc36fda3274ada276cf69e",
+        "rev": "dab6df51387c3878cdea09f43589a15729cae9f4",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
+        "id": "nixpkgs",
-        "repo": "nixpkgs",
+        "ref": "nixos-22.05",
-        "rev": "5cfafa12d57374f48bcc36fda3274ada276cf69e",
+        "type": "indirect"
-        "type": "github"
+      }
    },
    "nixpkgs-hostapd-pr": {
      "flake": false,
      "locked": {
        "narHash": "sha256-35+g1EJMcDFhb3UP15fyR1aD4AX1ifz2EqaYItITZ7U=",
        "type": "file",
        "url": "https://github.com/NixOS/nixpkgs/pull/222536.patch"
      },
      "original": {
        "type": "file",
        "url": "https://github.com/NixOS/nixpkgs/pull/222536.patch"
      }
    },
    "radio": {
@@ -281,44 +271,38 @@
    "root": {
      "inputs": {
        "agenix": "agenix",
        "archivebox": "archivebox",
        "dailybuild_modules": "dailybuild_modules",
        "deploy-rs": "deploy-rs",
        "flake-compat": "flake-compat",
        "flake-utils": "flake-utils",
        "nix-index-database": "nix-index-database",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-frigate": "nixpkgs-frigate",
+        "nixpkgs-hostapd-pr": "nixpkgs-hostapd-pr",
        "radio": "radio",
        "radio-web": "radio-web",
-        "simple-nixos-mailserver": "simple-nixos-mailserver",
+        "simple-nixos-mailserver": "simple-nixos-mailserver"
        "systems": "systems"
      }
    },
    "simple-nixos-mailserver": {
      "inputs": {
        "blobs": "blobs",
        "flake-compat": [
          "flake-compat"
        ],
        "nixpkgs": [
          "nixpkgs"
        ],
-        "nixpkgs-24_05": [
+        "nixpkgs-22_05": "nixpkgs-22_05",
-          "nixpkgs"
+        "utils": "utils"
        ]
      },
      "locked": {
-        "lastModified": 1722877200,
+        "lastModified": 1655930346,
-        "narHash": "sha256-qgKDNJXs+od+1UbRy62uk7dYal3h98I4WojfIqMoGcg=",
+        "narHash": "sha256-ht56HHOzEhjeIgAv5ZNFjSVX/in1YlUs0HG9c1EUXTM=",
        "owner": "simple-nixos-mailserver",
        "repo": "nixos-mailserver",
-        "rev": "af7d3bf5daeba3fc28089b015c0dd43f06b176f2",
+        "rev": "f535d8123c4761b2ed8138f3d202ea710a334a1d",
        "type": "gitlab"
      },
      "original": {
        "owner": "simple-nixos-mailserver",
-        "ref": "master",
+        "ref": "nixos-22.05",
        "repo": "nixos-mailserver",
        "type": "gitlab"
      }
@@ -337,6 +321,21 @@
        "repo": "default",
        "type": "github"
      }
    },
    "utils": {
      "locked": {
        "lastModified": 1605370193,
        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -1,79 +1,47 @@
 {
  inputs = {
-    # nixpkgs
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
+    # nixpkgs-patch-howdy.url = "https://github.com/NixOS/nixpkgs/pull/216245.diff";
-    nixpkgs-frigate.url = "github:NixOS/nixpkgs/5cfafa12d57374f48bcc36fda3274ada276cf69e";
+    # nixpkgs-patch-howdy.flake = false;
-    # Common Utils Among flake inputs
+    flake-utils.url = "github:numtide/flake-utils";
    systems.url = "github:nix-systems/default";
    flake-utils = {
      url = "github:numtide/flake-utils";
      inputs.systems.follows = "systems";
    };
    flake-compat = {
      url = "github:edolstra/flake-compat";
      flake = false;
    };
-    # NixOS hardware
+    # mail server
-    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-22.05";
    simple-nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
-    # Mail Server
+    # agenix
-    simple-nixos-mailserver = {
+    agenix.url = "github:ryantm/agenix";
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
      inputs = {
        nixpkgs.follows = "nixpkgs";
        nixpkgs-24_05.follows = "nixpkgs";
        flake-compat.follows = "flake-compat";
      };
    };
-    # Agenix
+    # radio
-    agenix = {
+    radio.url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
-      url = "github:ryantm/agenix";
+    radio.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    radio.inputs.flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
+    radio-web.url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
-        systems.follows = "systems";
+    radio-web.flake = false;
      };
    };
-    # Radio
+    # drastikbot
-    radio = {
+    dailybuild_modules.url = "git+https://git.neet.dev/zuckerberg/dailybuild_modules.git";
-      url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
+    dailybuild_modules.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    dailybuild_modules.inputs.flake-utils.follows = "flake-utils";
        nixpkgs.follows = "nixpkgs";
        flake-utils.follows = "flake-utils";
      };
    };
    radio-web = {
      url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
      flake = false;
    };
-    # Dailybot
+    # archivebox
-    dailybuild_modules = {
+    archivebox.url = "git+https://git.neet.dev/zuckerberg/archivebox.git";
-      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
+    archivebox.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    archivebox.inputs.flake-utils.follows = "flake-utils";
        nixpkgs.follows = "nixpkgs";
        flake-utils.follows = "flake-utils";
      };
    };
-    # NixOS deployment
+    # nixos config deployment
-    deploy-rs = {
+    deploy-rs.url = "github:serokell/deploy-rs";
-      url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    deploy-rs.inputs.utils.follows = "simple-nixos-mailserver/utils";
        nixpkgs.follows = "nixpkgs";
        flake-compat.follows = "flake-compat";
        utils.follows = "flake-utils";
      };
    };
-    # Prebuilt nix-index database
+    # prebuilt nix-index database
-    nix-index-database = {
+    nix-index-database.url = "github:Mic92/nix-index-database";
-      url = "github:Mic92/nix-index-database";
+    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
+
-    };
+    nixpkgs-hostapd-pr.url = "https://github.com/NixOS/nixpkgs/pull/222536.patch";
    nixpkgs-hostapd-pr.flake = false;
  };
  outputs = { self, nixpkgs, ... }@inputs:
@@ -92,12 +60,10 @@
            simple-nixos-mailserver.nixosModule
            agenix.nixosModules.default
            dailybuild_modules.nixosModule
            archivebox.nixosModule
            nix-index-database.nixosModules.nix-index
            self.nixosModules.kernel-modules
            ({ lib, ... }: {
              config = {
                nixpkgs.overlays = [ self.overlays.default ];
                environment.systemPackages = [
                  agenix.packages.${system}.agenix
                ];
@@ -120,7 +86,7 @@
                name = "nixpkgs-patched";
                src = nixpkgs;
                patches = [
-                  ./patches/gamepadui.patch
+                  inputs.nixpkgs-hostapd-pr
                ];
              };
              patchedNixpkgs = nixpkgs.lib.fix (self: (import "${patchedNixpkgsSrc}/flake.nix").outputs { self = nixpkgs; });
@@ -132,8 +98,6 @@
              specialArgs = {
                inherit allModules;
                lib = self.lib;
                nixos-hardware = inputs.nixos-hardware;
              };
            };
        in
@@ -162,9 +126,6 @@
          "aarch64-linux"."iso" = mkIso "aarch64-linux";
        };
      overlays.default = import ./overlays { inherit inputs; };
      nixosModules.kernel-modules = import ./overlays/kernel-modules;
      deploy.nodes =
        let
          mkDeploy = configName: arch: hostname: {
@@ -180,7 +141,5 @@
          machines;
      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
      lib = nixpkgs.lib.extend (final: prev: import ./lib { lib = nixpkgs.lib; });
    };
 }
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -1,56 +0,0 @@
 { lib, ... }:
 with lib;
 {
  # Passthrough trace for debugging
  pTrace = v: traceSeq v v;
  # find the total sum of a int list
  sum = foldr (x: y: x + y) 0;
  # splits a list of length two into two params then they're passed to a func
  splitPair = f: pair: f (head pair) (last pair);
  # Finds the max value in a list
  maxList = foldr max 0;
  # Sorts a int list. Greatest value first
  sortList = sort (x: y: x > y);
  # Cuts a list in half and returns the two parts in a list
  cutInHalf = l: [ (take (length l / 2) l) (drop (length l / 2) l) ];
  # Splits a list into a list of lists with length cnt
  chunksOf = cnt: l:
    if length l > 0 then
      [ (take cnt l) ] ++ chunksOf cnt (drop cnt l)
    else [ ];
  # same as intersectLists but takes an array of lists to intersect instead of just two
  intersectManyLists = ll: foldr intersectLists (head ll) ll;
  # converts a boolean to a int (c style)
  boolToInt = b: if b then 1 else 0;
  # drops the last element of a list
  dropLast = l: take (length l - 1) l;
  # transposes a matrix
  transpose = ll:
    let
      outerSize = length ll;
      innerSize = length (elemAt ll 0);
    in
    genList (i: genList (j: elemAt (elemAt ll j) i) outerSize) innerSize;
  # attriset recursiveUpdate but for a list of attrisets
  combineAttrs = foldl recursiveUpdate { };
  # visits every single attriset element of an attriset recursively
  # and accumulates the result of every visit in a flat list
  recurisveVisitAttrs = f: set:
    let
      visitor = n: v:
        if isAttrs v then [ (f n v) ] ++ recurisveVisitAttrs f v
        else [ (f n v) ];
    in
    concatLists (map (name: visitor name set.${name}) (attrNames set));
  # merges two lists of the same size (similar to map but both lists are inputs per iteration)
  mergeLists = f: a: imap0 (i: f (elemAt a i));
  map2D = f: ll:
    let
      outerSize = length ll;
      innerSize = length (elemAt ll 0);
      getElem = x: y: elemAt (elemAt ll y) x;
    in
    genList (y: genList (x: f x y (getElem x y)) innerSize) outerSize;
 }
--- a/lockfile-update.sh
+++ b/lockfile-update.sh
@@ -0,0 +1,4 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p bash
 nix flake update --commit-lock-file
--- a/machines/ephemeral/sdimg.nix
+++ b/machines/ephemeral/sdimg.nix
@@ -1,57 +0,0 @@
 { config, modulesPath, pkgs, lib, ... }:
 let
  pinecube-uboot = pkgs.buildUBoot {
    defconfig = "pinecube_defconfig";
    extraMeta.platforms = [ "armv7l-linux" ];
    filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
  };
 in
 {
  imports = [
    (modulesPath + "/installer/sd-card/sd-image.nix")
    ./minimal.nix
  ];
  sdImage.populateFirmwareCommands = "";
  sdImage.populateRootCommands = ''
    mkdir -p ./files/boot
    ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot
  '';
  sdImage.postBuildCommands = ''
    dd if=${pinecube-uboot}/u-boot-sunxi-with-spl.bin of=$img bs=1024 seek=8 conv=notrunc
  '';
  ###
  networking.hostName = "pinecube";
  boot.loader.grub.enable = false;
  boot.loader.generic-extlinux-compatible.enable = true;
  boot.consoleLogLevel = 7;
  # cma is 64M by default which is waay too much and we can't even unpack initrd
  boot.kernelParams = [ "console=ttyS0,115200n8" "cma=32M" ];
  boot.kernelModules = [ "spi-nor" ]; # Not sure why this doesn't autoload. Provides SPI NOR at /dev/mtd0
  boot.extraModulePackages = [ config.boot.kernelPackages.rtl8189es ];
  zramSwap.enable = true; # 128MB is not much to work with
  sound.enable = true;
  environment.systemPackages = with pkgs; [
    ffmpeg
    (v4l_utils.override { withGUI = false; })
    usbutils
  ];
  services.getty.autologinUser = lib.mkForce "googlebot";
  users.users.googlebot = {
    isNormalUser = true;
    extraGroups = [ "wheel" "networkmanager" "video" ];
    openssh.authorizedKeys.keys = config.machines.ssh.userKeys;
  };
  networking.wireless.enable = true;
 }
--- a/machines/hotspot/default.nix
+++ b/machines/hotspot/default.nix
@@ -1,69 +0,0 @@
 { config, pkgs, lib, ... }:
 let
  internal = "end0";
  wireless = "wlan0";
  internal-gateway-ip = "192.168.0.1";
  internal-ip-lower = "192.168.0.10";
  internal-ip-upper = "192.168.0.100";
 in
 {
  imports = [
    ./hardware-configuration.nix
  ];
  enableExtraSubstituters = false;
  # networking.interfaces.${internal}.ipv4.addresses = [{
  #   address = internal-gateway-ip;
  #   prefixLength = 24;
  # }];
  # DHCP on all interfaces except for the internal interface
  networking.useDHCP = true;
  networking.interfaces.${internal}.useDHCP = true;
  networking.interfaces.${wireless}.useDHCP = true;
  # Enable NAT
  networking.ip_forward = true;
  networking.nat = {
    enable = true;
    internalInterfaces = [ internal ];
    externalInterface = wireless;
  };
  networking.wireless = {
    enable = true;
    networks = {
      "Pixel_6054".psk = "@PSK_Pixel_6054@";
    };
    interfaces = [ wireless ];
    environmentFile = "/run/agenix/hostspot-passwords";
  };
  age.secrets.hostspot-passwords.file = ../../secrets/hostspot-passwords.age;
  # dnsmasq for internal interface
  services.dnsmasq = {
    enable = true;
    settings = {
      server = [ "1.1.1.1" "8.8.8.8" ];
      dhcp-range = "${internal-ip-lower},${internal-ip-upper},24h";
      dhcp-option = [
        "option:router,${internal-gateway-ip}"
        "option:broadcast,10.0.0.255"
        "option:ntp-server,0.0.0.0"
      ];
    };
  };
  networking.firewall.interfaces.${internal}.allowedTCPPorts = [
    53 # dnsmasq
  ];
  # Make it appear we are not using phone tethering to the ISP
  networking.firewall = {
    extraCommands = ''
      iptables -t mangle -A POSTROUTING -o ${wireless} -j TTL --ttl-set 65
    '';
  };
 }
--- a/machines/hotspot/hardware-configuration.nix
+++ b/machines/hotspot/hardware-configuration.nix
@@ -1,27 +0,0 @@
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [
      (modulesPath + "/installer/scan/not-detected.nix")
    ];
  boot = {
    kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
    initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" ];
    loader = {
      grub.enable = false;
      generic-extlinux-compatible.enable = true;
    };
  };
  fileSystems."/" =
    {
      device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
      fsType = "ext4";
    };
  swapDevices = [ ];
  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
 }
--- a/machines/hotspot/properties.nix
+++ b/machines/hotspot/properties.nix
@@ -1,13 +0,0 @@
 {
  hostNames = [
    "hotspot"
  ];
  arch = "aarch64-linux";
  systemRoles = [
    "hotspot"
  ];
  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAION4IUAef687RIzWrP4HEZnpdSJswt06QmrdRMDPHHGY";
 }
--- a/machines/howl/default.nix
+++ b/machines/howl/default.nix
@@ -1,13 +0,0 @@
 { config, pkgs, lib, ... }:
 {
  imports = [
    ./hardware-configuration.nix
  ];
  # don't use remote builders
  nix.distributedBuilds = lib.mkForce false;
  de.enable = true;
  de.touchpad.enable = true;
 }
--- a/machines/howl/hardware-configuration.nix
+++ b/machines/howl/hardware-configuration.nix
@@ -1,58 +0,0 @@
 { config, lib, pkgs, modulesPath, nixos-hardware, ... }:
 {
  imports = [
    (modulesPath + "/installer/scan/not-detected.nix")
    nixos-hardware.nixosModules.framework-13-7040-amd
  ];
  boot.kernelPackages = pkgs.linuxPackages_latest;
  hardware.framework.amd-7040.preventWakeOnAC = true;
  services.fwupd.enable = true;
  # fingerprint reader has initially shown to be more of a nuisance than a help
  # it makes sddm log in fail most of the time and take several minutes to finish
  services.fprintd.enable = false;
  # boot
  boot.loader.systemd-boot.enable = true;
  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ "dm-snapshot" ];
  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];
  # thunderbolt
  services.hardware.bolt.enable = true;
  # firmware
  firmware.x86_64.enable = true;
  # disks
  remoteLuksUnlock.enable = true;
  boot.initrd.luks.devices."enc-pv" = {
    device = "/dev/disk/by-uuid/c801586b-f0a2-465c-8dae-532e61b83fee";
    allowDiscards = true;
  };
  fileSystems."/" =
    {
      device = "/dev/disk/by-uuid/95db6950-a7bc-46cf-9765-3ea675ccf014";
      fsType = "btrfs";
    };
  fileSystems."/boot" =
    {
      device = "/dev/disk/by-uuid/B087-2C20";
      fsType = "vfat";
      options = [ "fmask=0022" "dmask=0022" ];
    };
  swapDevices =
    [{ device = "/dev/disk/by-uuid/49fbdf62-eef4-421b-aac3-c93494afd23c"; }];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
--- a/machines/howl/properties.nix
+++ b/machines/howl/properties.nix
@@ -1,26 +0,0 @@
 {
  hostNames = [
    "howl"
  ];
  arch = "x86_64-linux";
  systemRoles = [
    "personal"
  ];
  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQi3q8jU6vRruExAL60J7GFO1gS8HsmXVJuKRT4ljrG";
  userKeys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKPnLt84bKhUgFxjQf10+Htro9Lo1Pabqm8mGalBUniv"
  ];
  deployKeys = [
    # TODO
  ];
  remoteUnlock = {
    hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0N80r0Sl2WlJaUqfxZPkOtYyGumFazkIqq7eq3Gd2o";
    onionHost = "ll6yjnkh4psmfwmtkmqoutl4gq4elqzbmjxv4s6gpgoavyi3kwhjvnqd.onion";
  };
 }
--- a/machines/phil/default.nix
+++ b/machines/phil/default.nix
@@ -6,4 +6,5 @@
  ];
  networking.hostName = "phil";
  services.gitea-runner.enable = true;
 }
--- a/machines/phil/properties.nix
+++ b/machines/phil/properties.nix
@@ -8,6 +8,7 @@
  systemRoles = [
    "server"
    "gitea-runner"
    "nix-builder"
  ];
--- a/machines/ponyo/default.nix
+++ b/machines/ponyo/default.nix
@@ -5,7 +5,7 @@
    ./hardware-configuration.nix
  ];
-  # system.autoUpgrade.enable = true;
+  system.autoUpgrade.enable = true;
  # p2p mesh network
  services.tailscale.exitNode = true;
@@ -63,8 +63,7 @@
    };
  };
  pia.wireguard.badPortForwardPorts = [ ];
-  services.nginx.virtualHosts = {
+  services.nginx.virtualHosts."radio.runyan.org" = {
    "radio.runyan.org" = {
    enableACME = true;
    forceSSL = true;
    locations = {
@@ -77,20 +76,6 @@
      "/".root = config.inputs.radio-web;
    };
  };
    "radio.neet.space" = {
      enableACME = true;
      forceSSL = true;
      locations = {
        "/stream.mp3" = {
          proxyPass = "http://vpn.containers:8001/stream.mp3";
          extraConfig = ''
            add_header Access-Control-Allow-Origin *;
          '';
        };
        "/".root = config.inputs.radio-web;
      };
    };
  };
  # matrix home server
  services.matrix = {
@@ -102,7 +87,7 @@
      host = "chat.neet.space";
    };
    jitsi-meet = {
-      enable = false; # disabled until vulnerable libolm dependency is removed/fixed
+      enable = true;
      host = "meet.neet.space";
    };
    turn = {
@@ -111,13 +96,21 @@
    };
  };
  # pin postgresql for matrix (will need to migrate eventually)
-  services.postgresql.package = pkgs.postgresql_15;
+  services.postgresql.package = pkgs.postgresql_11;
  # iodine DNS-based vpn
  services.iodine.server.enable = true;
  # proxied web services
  services.nginx.enable = true;
  services.nginx.virtualHosts."jellyfin.neet.cloud" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://s0.koi-bebop.ts.net";
      proxyWebsockets = true;
    };
  };
  services.nginx.virtualHosts."navidrome.neet.cloud" = {
    enableACME = true;
    forceSSL = true;
@@ -143,11 +136,4 @@
  # owncast live streaming
  services.owncast.enable = true;
  services.owncast.hostname = "live.neet.dev";
  # librechat
  services.librechat.enable = true;
  services.librechat.host = "chat.neet.dev";
  services.actual-server.enable = true;
  services.actual-server.hostname = "actual.runyan.org";
 }
--- a/machines/ponyo/hardware-configuration.nix
+++ b/machines/ponyo/hardware-configuration.nix
@@ -16,7 +16,6 @@
  bios = {
    enable = true;
    device = "/dev/sda";
    configurationLimit = 3; # Save room in /nix/store
  };
  remoteLuksUnlock.enable = true;
--- a/machines/ponyo/properties.nix
+++ b/machines/ponyo/properties.nix
@@ -15,7 +15,6 @@
    "nextcloud"
    "dailybot"
    "gitea"
    "librechat"
  ];
  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBBlTAIp38RhErU1wNNV5MBeb+WGH0mhF/dxh5RsAXN";
--- a/machines/ray/default.nix
+++ b/machines/ray/default.nix
@@ -0,0 +1,55 @@
 { config, pkgs, lib, ... }:
 {
  imports = [
    ./hardware-configuration.nix
  ];
  # for luks onlock over tor
  services.tor.enable = true;
  services.tor.client.enable = true;
  # services.howdy.enable = true;
  hardware.openrazer.enable = true;
  hardware.openrazer.users = [ "googlebot" ];
  hardware.openrazer.devicesOffOnScreensaver = false;
  users.users.googlebot.packages = [ pkgs.polychromatic ];
  services.udev.extraRules = ''
    # depthai
    SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
    # Moonlander
    # Rules for Oryx web flashing and live training
    KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
    KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
    # Wally Flashing rules for the Moonlander and Planck EZ
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
  '';
  users.groups.plugdev = {
    members = [ "googlebot" ];
  };
  # virt-manager
  virtualisation.libvirtd.enable = true;
  programs.dconf.enable = true;
  virtualisation.spiceUSBRedirection.enable = true;
  environment.systemPackages = with pkgs; [ virt-manager ];
  users.users.googlebot.extraGroups = [ "libvirtd" ];
  # allow building ARM derivations
  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
  services.spotifyd.enable = true;
  virtualisation.docker.enable = true;
  virtualisation.appvm.enable = true;
  virtualisation.appvm.user = "googlebot";
  services.mount-samba.enable = true;
  de.enable = true;
  de.touchpad.enable = true;
 }
--- a/machines/ray/hardware-configuration.nix
+++ b/machines/ray/hardware-configuration.nix
@@ -0,0 +1,62 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [
      (modulesPath + "/installer/scan/not-detected.nix")
    ];
  # boot
  efi.enable = true;
  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ "dm-snapshot" ];
  # kernel
  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];
  # firmware
  firmware.x86_64.enable = true;
  hardware.enableAllFirmware = true;
  # gpu
  services.xserver.videoDrivers = [ "nvidia" ];
  hardware.nvidia = {
    modesetting.enable = true; # for nvidia-vaapi-driver
    prime = {
      reverseSync.enable = true;
      offload.enableOffloadCmd = true;
      nvidiaBusId = "PCI:1:0:0";
      amdgpuBusId = "PCI:4:0:0";
    };
  };
  # disks
  remoteLuksUnlock.enable = true;
  boot.initrd.luks.devices."enc-pv" = {
    device = "/dev/disk/by-uuid/c1822e5f-4137-44e1-885f-954e926583ce";
    allowDiscards = true;
  };
  fileSystems."/" =
    {
      device = "/dev/vg/root";
      fsType = "btrfs";
      options = [ "subvol=root" ];
    };
  fileSystems."/home" =
    {
      device = "/dev/vg/root";
      fsType = "btrfs";
      options = [ "subvol=home" ];
    };
  fileSystems."/boot" =
    {
      device = "/dev/disk/by-uuid/2C85-2B59";
      fsType = "vfat";
    };
  swapDevices =
    [{ device = "/dev/vg/swap"; }];
 }
--- a/machines/ray/properties.nix
+++ b/machines/ray/properties.nix
@@ -0,0 +1,22 @@
 {
  hostNames = [
    "ray"
  ];
  arch = "x86_64-linux";
  systemRoles = [
    "personal"
    "deploy"
  ];
  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQM8hwKRgl8cZj7UVYATSLYu4LhG7I0WFJ9m2iWowiB";
  userKeys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeTK1iARlNIKP/DS8/ObBm9yUM/3L1Ub4XI5A2r9OzP"
  ];
  deployKeys = [
    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEaGIwLiUa6wQLlEF+keQOIYy/tCmJvV6eENzUQjSqW2AAAABHNzaDo="
  ];
 }
--- a/machines/router/properties.nix.disabled
+++ b/machines/router/properties.nix.disabled
--- a/machines/router/router.nix
+++ b/machines/router/router.nix
@@ -92,7 +92,7 @@ in
      radios = {
        # 2.4GHz
        wlp4s0 = {
-          band = "2g";
+          hwMode = "g";
          noScan = true;
          channel = 6;
          countryCode = "US";
@@ -124,15 +124,15 @@ in
            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
            # };
          };
-          settings = {
+          extraConfig = ''
-            he_oper_centr_freq_seg0_idx = 8;
+            he_oper_centr_freq_seg0_idx=8
-            vht_oper_centr_freq_seg0_idx = 8;
+            vht_oper_centr_freq_seg0_idx=8
-          };
+          '';
        };
        # 5GHz
        wlan1 = {
-          band = "5g";
+          hwMode = "a";
          noScan = true;
          channel = 128;
          countryCode = "US";
@@ -164,10 +164,10 @@ in
            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
            # };
          };
-          settings = {
+          extraConfig = ''
-            vht_oper_centr_freq_seg0_idx = 114;
+            vht_oper_centr_freq_seg0_idx=114
-            he_oper_centr_freq_seg0_idx = 114;
+            he_oper_centr_freq_seg0_idx=114
-          };
+          '';
        };
      };
    };
--- a/machines/storage/s0/dashy.yaml
+++ b/machines/storage/s0/dashy.yaml
@@ -1,241 +0,0 @@
 appConfig:
  theme: vaporware
  customColors:
    material-dark-original:
      primary: '#f36558'
      background: '#39434C'
      background-darker: '#eb615c'
      material-light: '#f36558'
      item-text-color: '#ff948a'
      curve-factor: 5px
  enableErrorReporting: false
  layout: auto
  iconSize: large
  language: en
  startingView: default
  defaultOpeningMethod: sametab
  statusCheck: true
  statusCheckInterval: 20
  faviconApi: faviconkit
  routingMode: history
  enableMultiTasking: false
  webSearch:
    disableWebSearch: false
    searchEngine: duckduckgo
    openingMethod: sametab
    searchBangs: {}
  enableFontAwesome: true
  cssThemes: []
  externalStyleSheet: []
  hideComponents:
    hideHeading: false
    hideNav: false
    hideSearch: false
    hideSettings: false
    hideFooter: false
    hideSplashScreen: false
  auth:
    enableGuestAccess: false
    users: []
    enableKeycloak: false
    keycloak: {}
  allowConfigEdit: true
  enableServiceWorker: false
  disableContextMenu: false
  disableUpdateChecks: false
  disableSmartSort: false
 pageInfo:
  title: s0
  description: s0
 sections:
  - name: Media & Entertainment
    icon: fas fa-photo-video
    displayData:
      sortBy: most-used
      cols: 1
      rows: 1
      collapsed: false
      hideForGuests: false
    items:
      - &ref_0
        title: Jellyfin
        icon: hl-jellyfin
        url: https://jellyfin.s0.neet.dev
        target: sametab
        statusCheck: false
        id: 0_1956_jellyfin
      - &ref_1
        title: Sonarr
        description: Manage TV
        icon: hl-sonarr
        url: https://sonarr.s0.neet.dev
        target: sametab
        statusCheck: false
        id: 1_1956_sonarr
      - &ref_2
        title: Radarr
        description: Manage Movies
        icon: hl-radarr
        url: https://radarr.s0.neet.dev
        target: sametab
        statusCheck: false
        id: 2_1956_radarr
      - &ref_3
        title: Lidarr
        description: Manage Music
        icon: hl-lidarr
        url: https://lidarr.s0.neet.dev
        target: sametab
        statusCheck: false
        id: 3_1956_lidarr
      - &ref_4
        title: Prowlarr
        description: Indexers
        icon: hl-prowlarr
        url: https://prowlarr.s0.neet.dev
        target: sametab
        statusCheck: false
        id: 4_1956_prowlarr
      - &ref_5
        title: Bazarr
        description: Subtitles
        icon: hl-bazarr
        url: https://bazarr.s0.neet.dev
        target: sametab
        statusCheck: false
        id: 5_1956_bazarr
      - &ref_6
        title: Navidrome
        description: Play Music
        icon: hl-navidrome
        url: https://music.s0.neet.dev
        target: sametab
        statusCheck: false
        id: 6_1956_navidrome
      - &ref_7
        title: Transmission
        description: Torrenting
        icon: hl-transmission
        url: https://transmission.s0.neet.dev
        target: sametab
        statusCheck: false
        id: 7_1956_transmission
    filteredItems:
      - *ref_0
      - *ref_1
      - *ref_2
      - *ref_3
      - *ref_4
      - *ref_5
      - *ref_6
      - *ref_7
  - name: Network
    icon: fas fa-network-wired
    items:
      - &ref_8
        title: Gateway
        description: openwrt
        icon: hl-openwrt
        url: http://openwrt.lan/
        target: sametab
        statusCheck: true
        id: 0_746_gateway
      - &ref_9
        title: Wireless
        description: openwrt (ish)
        icon: hl-openwrt
        url: http://PacketProvocateur.lan
        target: sametab
        statusCheck: true
        id: 1_746_wireless
    filteredItems:
      - *ref_8
      - *ref_9
    displayData:
      sortBy: default
      rows: 1
      cols: 1
      collapsed: false
      hideForGuests: false
  - name: Services
    icon: fas fa-monitor-heart-rate
    items:
      - &ref_10
        title: Matrix
        description: ''
        icon: hl-matrix
        url: https://chat.neet.space
        target: sametab
        statusCheck: true
        id: 0_836_matrix
      - &ref_11
        title: Radio
        description: Radio service
        icon: generative
        url: https://radio.runyan.org
        target: sametab
        statusCheck: true
        id: 1_836_radio
      - &ref_12
        title: Mumble
        description: voice.neet.space
        icon: hl-mumble
        url: https://voice.neet.space
        target: sametab
        statusCheck: false
        id: 2_836_mumble
      - &ref_13
        title: IRC
        description: irc.neet.dev
        icon: hl-thelounge
        url: https://irc.neet.dev
        target: sametab
        statusCheck: true
        id: 3_836_irc
      - &ref_14
        title: Git
        description: git.neet.dev
        icon: hl-gitea
        url: https://git.neet.dev
        target: sametab
        statusCheck: true
        id: 4_836_git
      - &ref_15
        title: Nextcloud
        description: neet.cloud
        icon: hl-nextcloud
        url: https://neet.cloud
        target: sametab
        statusCheck: true
        id: 5_836_nextcloud
      - &ref_16
        title: Roundcube
        description: mail.neet.dev
        icon: hl-roundcube
        url: https://mail.neet.dev
        target: sametab
        statusCheck: true
        id: 6_836_roundcube
      - &ref_17
        title: Jitsi Meet
        description: meet.neet.space
        icon: hl-jitsimeet
        url: https://meet.neet.space
        target: sametab
        statusCheck: true
        id: 7_836_jitsimeet
    filteredItems:
      - *ref_10
      - *ref_11
      - *ref_12
      - *ref_13
      - *ref_14
      - *ref_15
      - *ref_16
      - *ref_17
    displayData:
      sortBy: default
      rows: 1
      cols: 1
      collapsed: false
      hideForGuests: false
--- a/machines/storage/s0/default.nix
+++ b/machines/storage/s0/default.nix
@@ -3,14 +3,15 @@
 {
  imports = [
    ./hardware-configuration.nix
    ./frigate.nix
    ./home-automation.nix
  ];
  networking.hostName = "s0";
  # system.autoUpgrade.enable = true;
  # gitea runner and allow it to build ARM derivations
  services.gitea-runner.enable = true;
  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
  nix.gc.automatic = lib.mkForce false; # allow the nix store to serve as a build cache
  # binary cache
@@ -20,13 +21,6 @@
    secretKeyFile = "/run/agenix/binary-cache-private-key";
  };
  age.secrets.binary-cache-private-key.file = ../../../secrets/binary-cache-private-key.age;
  users.users.cache-push = {
    isNormalUser = true;
    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB" ];
  };
  nix.settings = {
    trusted-users = [ "cache-push" ];
  };
  services.iperf3.enable = true;
  services.iperf3.openFirewall = true;
@@ -41,6 +35,9 @@
  # samba
  services.samba.enable = true;
  # disable suspend on lid close
  services.logind.lidSwitch = "ignore";
  # navidrome
  services.navidrome = {
    enable = true;
@@ -50,6 +47,7 @@
      MusicFolder = "/data/samba/Public/Media/Music";
    };
  };
  networking.firewall.allowedTCPPorts = [ config.services.navidrome.settings.Port ];
  # allow access to transmisson data
  users.users.googlebot.extraGroups = [ "transmission" ];
@@ -117,19 +115,13 @@
        # "speed-limit-up-enabled" = true;
        /* seeding limit */
-        "ratio-limit" = 3;
+        "ratio-limit" = 2;
        "ratio-limit-enabled" = true;
        "download-queue-enabled" = true;
        "download-queue-size" = 20; # gotta go fast
      };
    };
    # https://github.com/NixOS/nixpkgs/issues/258793
    systemd.services.transmission.serviceConfig = {
      RootDirectoryStartOnly = lib.mkForce (lib.mkForce false);
      RootDirectory = lib.mkForce (lib.mkForce "");
    };
    users.groups.public_data.gid = 994;
    users.users.public_data = {
      isSystemUser = true;
@@ -166,111 +158,23 @@
  };
  # nginx
-  services.nginx = {
+  services.nginx.enable = true;
-    enable = true;
+  services.nginx.virtualHosts."bazarr.s0".locations."/".proxyPass = "http://vpn.containers:6767";
-    openFirewall = false; # All nginx services are internal
+  services.nginx.virtualHosts."radarr.s0".locations."/".proxyPass = "http://vpn.containers:7878";
-    virtualHosts =
+  services.nginx.virtualHosts."lidarr.s0".locations."/".proxyPass = "http://vpn.containers:8686";
-      let
+  services.nginx.virtualHosts."sonarr.s0".locations."/".proxyPass = "http://vpn.containers:8989";
-        mkVirtualHost = external: internal:
+  services.nginx.virtualHosts."prowlarr.s0".locations."/".proxyPass = "http://vpn.containers:9696";
-          {
+  services.nginx.virtualHosts."music.s0".locations."/".proxyPass = "http://localhost:4533";
-            ${external} = {
+  services.nginx.virtualHosts."jellyfin.s0".locations."/" = {
-              useACMEHost = "s0.neet.dev"; # Use wildcard cert
+    proxyPass = "http://localhost:8096";
              forceSSL = true;
              locations."/" = {
                proxyPass = internal;
    proxyWebsockets = true;
  };
  services.nginx.virtualHosts."jellyfin.neet.cloud".locations."/" = {
    proxyPass = "http://localhost:8096";
    proxyWebsockets = true;
  };
  services.nginx.virtualHosts."transmission.s0".locations."/" = {
    proxyPass = "http://vpn.containers:9091";
    proxyWebsockets = true;
  };
      in
      lib.mkMerge [
        (mkVirtualHost "bazarr.s0.neet.dev" "http://vpn.containers:6767")
        (mkVirtualHost "radarr.s0.neet.dev" "http://vpn.containers:7878")
        (mkVirtualHost "lidarr.s0.neet.dev" "http://vpn.containers:8686")
        (mkVirtualHost "sonarr.s0.neet.dev" "http://vpn.containers:8989")
        (mkVirtualHost "prowlarr.s0.neet.dev" "http://vpn.containers:9696")
        (mkVirtualHost "transmission.s0.neet.dev" "http://vpn.containers:9091")
        (mkVirtualHost "unifi.s0.neet.dev" "https://localhost:8443")
        (mkVirtualHost "music.s0.neet.dev" "http://localhost:4533")
        (mkVirtualHost "jellyfin.s0.neet.dev" "http://localhost:8096")
        (mkVirtualHost "s0.neet.dev" "http://localhost:56815")
        {
          # Landing page LAN redirect
          "s0" = {
            default = true;
            redirectCode = 302;
            globalRedirect = "s0.neet.dev";
          };
        }
        (mkVirtualHost "ha.s0.neet.dev" "http://localhost:8123") # home assistant
        (mkVirtualHost "esphome.s0.neet.dev" "http://localhost:6052")
        (mkVirtualHost "zigbee.s0.neet.dev" "http://localhost:55834")
        {
          "frigate.s0.neet.dev" = {
            # Just configure SSL, frigate module configures the rest of nginx
            useACMEHost = "s0.neet.dev";
            forceSSL = true;
          };
        }
        (mkVirtualHost "vacuum.s0.neet.dev" "http://192.168.1.125") # valetudo
        (mkVirtualHost "todo.s0.neet.dev" "http://localhost:${toString config.services.vikunja.port}")
      ];
    tailscaleAuth = {
      enable = true;
      virtualHosts = [
        "bazarr.s0.neet.dev"
        "radarr.s0.neet.dev"
        "lidarr.s0.neet.dev"
        "sonarr.s0.neet.dev"
        "prowlarr.s0.neet.dev"
        "transmission.s0.neet.dev"
        "unifi.s0.neet.dev"
        # "music.s0.neet.dev" # messes up navidrome
        "jellyfin.s0.neet.dev"
        "s0.neet.dev"
        # "ha.s0.neet.dev" # messes up home assistant
        "esphome.s0.neet.dev"
        "zigbee.s0.neet.dev"
        "vacuum.s0.neet.dev"
        "todo.s0.neet.dev"
      ];
      expectedTailnet = "koi-bebop.ts.net";
    };
  };
  # Get wildcard cert
  security.acme.certs."s0.neet.dev" = {
    dnsProvider = "digitalocean";
    credentialsFile = "/run/agenix/digitalocean-dns-credentials";
    extraDomainNames = [ "*.s0.neet.dev" ];
    group = "nginx";
    dnsResolver = "1.1.1.1:53";
    dnsPropagationCheck = false; # sadly this erroneously fails
  };
  age.secrets.digitalocean-dns-credentials.file = ../../../secrets/digitalocean-dns-credentials.age;
  virtualisation.oci-containers.backend = "podman";
  virtualisation.podman.dockerSocket.enable = true; # TODO needed?
  services.dashy = {
    enable = true;
    configFile = ./dashy.yaml;
  };
  services.unifi = {
    enable = true;
    openMinimalFirewall = true;
  };
  services.vikunja = {
    enable = true;
    port = 61473;
    frontendScheme = "https";
    frontendHostname = "todo.s0.neet.dev";
    settings = {
      service.enableregistration = false;
    };
  };
  boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
 }
--- a/machines/storage/s0/frigate.nix
+++ b/machines/storage/s0/frigate.nix
@@ -1,155 +0,0 @@
 { config, pkgs, lib, ... }:
 let
  frigateHostname = "frigate.s0.neet.dev";
  mkGo2RtcStream = name: url: withAudio: {
    ${name} = [
      url
      "ffmpeg:${name}#video=copy${if withAudio then "#audio=copy" else ""}"
    ];
  };
  # Assumes camera is set to output:
  # - rtsp
  # - H.264 + AAC
  # - a downscaled substream for detection
  mkCamera = name: primaryUrl: detectUrl: {
    # Reference https://docs.frigate.video/configuration/reference/
    services.frigate.settings = {
      cameras.${name} = {
        ffmpeg = {
          # Camera feeds are relayed through go2rtc
          inputs = [
            {
              path = "rtsp://127.0.0.1:8554/${name}";
              # input_args = "preset-rtsp-restream";
              input_args = "preset-rtsp-restream-low-latency";
              roles = [ "record" ];
            }
            {
              path = detectUrl;
              roles = [ "detect" ];
            }
          ];
          output_args = {
            record = "preset-record-generic-audio-copy";
          };
        };
      };
    };
    services.go2rtc.settings.streams = lib.mkMerge [
      (mkGo2RtcStream name primaryUrl false)
      # Sadly having the detection stream go through go2rpc too makes the stream unreadable by frigate for some reason.
      # It might need to be re-encoded to work.  But I am not interested in wasting the processing power if only frigate
      # need the detection stream anyway. So just let frigate grab the stream directly since it works.
      # (mkGo2RtcStream detectName detectUrl false)
    ];
  };
  mkDahuaCamera = name: address:
    let
      # go2rtc and frigate have a slightly different syntax for inserting env vars. So the URLs are not interchangable :(
      # - go2rtc: ${VAR}
      # - frigate: {VAR}
      primaryUrl = "rtsp://admin:\${FRIGATE_RTSP_PASSWORD}@${address}/cam/realmonitor?channel=1&subtype=0";
      detectUrl = "rtsp://admin:{FRIGATE_RTSP_PASSWORD}@${address}/cam/realmonitor?channel=1&subtype=1";
    in
    mkCamera name primaryUrl detectUrl;
  mkEsp32Camera = name: address: {
    services.frigate.settings.cameras.${name} = {
      ffmpeg = {
        input_args = "";
        inputs = [{
          path = "http://${address}:8080";
          roles = [ "detect" "record" ];
        }];
        output_args.record = "-f segment -pix_fmt yuv420p -segment_time 10 -segment_format mp4 -reset_timestamps 1 -strftime 1 -c:v libx264 -preset ultrafast -an ";
      };
    };
  };
 in
 lib.mkMerge [
  (mkDahuaCamera "dog-cam" "192.168.10.31")
  # (mkEsp32Camera "dahlia-cam" "dahlia-cam.lan")
  {
    services.frigate = {
      enable = true;
      hostname = frigateHostname;
      settings = {
        mqtt = {
          enabled = true;
          host = "localhost:1883";
        };
        rtmp.enabled = false;
        snapshots = {
          enabled = true;
          bounding_box = true;
        };
        record = {
          enabled = true;
          # sync_recordings = true; # detect if recordings were deleted outside of frigate (expensive)
          retain = {
            days = 2; # Keep video for 2 days
            mode = "motion";
          };
          events = {
            retain = {
              default = 10; # Keep video with detections for 10 days
              mode = "motion";
              # mode = "active_objects";
            };
          };
        };
        # Make frigate aware of the go2rtc streams
        go2rtc.streams = config.services.go2rtc.settings.streams;
        detect.enabled = true;
        objects = {
          track = [ "person" "dog" ];
        };
      };
    };
    services.go2rtc = {
      enable = true;
      settings = {
        rtsp.listen = ":8554";
        webrtc.listen = ":8555";
      };
    };
    # Pass in env file with secrets to frigate/go2rtc
    systemd.services.frigate.serviceConfig.EnvironmentFile = "/run/agenix/frigate-credentials";
    systemd.services.go2rtc.serviceConfig.EnvironmentFile = "/run/agenix/frigate-credentials";
    age.secrets.frigate-credentials.file = ../../../secrets/frigate-credentials.age;
  }
  {
    # hardware encode/decode with amdgpu vaapi
    systemd.services.frigate = {
      environment.LIBVA_DRIVER_NAME = "radeonsi";
      serviceConfig = {
        SupplementaryGroups = [ "render" "video" ]; # for access to dev/dri/*
        AmbientCapabilities = "CAP_PERFMON";
      };
    };
    services.frigate.settings.ffmpeg.hwaccel_args = "preset-vaapi";
  }
  {
    # Coral TPU for frigate
    services.udev.packages = [ pkgs.libedgetpu ];
    users.groups.apex = { };
    systemd.services.frigate.environment.LD_LIBRARY_PATH = "${pkgs.libedgetpu}/lib";
    systemd.services.frigate.serviceConfig.SupplementaryGroups = [ "apex" ];
    # Coral PCIe driver
    kernel.enableGasketKernelModule = true;
    services.frigate.settings.detectors.coral = {
      type = "edgetpu";
      device = "pci";
    };
  }
 ]
--- a/machines/storage/s0/hardware-configuration.nix
+++ b/machines/storage/s0/hardware-configuration.nix
@@ -8,7 +8,6 @@
  # boot
  boot.loader.systemd-boot.enable = true;
  boot.loader.systemd-boot.memtest86.enable = true;
  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "uas" "sd_mod" "rtsx_pci_sdmmc" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
@@ -32,14 +31,18 @@
  boot.initrd.luks.devices."enc-pv4".device = "/dev/disk/by-uuid/e2c7402a-e72c-4c4a-998f-82e4c10187bc";
  # mounts
  services.zfs.autoScrub.enable = true;
  services.zfs.trim.enable = true;
  fileSystems."/" =
    {
      device = "rpool/nixos/root";
      fsType = "zfs";
      options = [ "zfsutil" "X-mount.mkdir" ];
    };
  fileSystems."/home" =
    {
      device = "rpool/nixos/home";
      fsType = "zfs";
      options = [ "zfsutil" "X-mount.mkdir" ];
    };
  fileSystems."/var/lib" =
    {
      device = "rpool/nixos/var/lib";
@@ -52,6 +55,13 @@
      fsType = "zfs";
      options = [ "zfsutil" "X-mount.mkdir" ];
    };
  fileSystems."/data" =
    {
      device = "rpool/nixos/data";
      fsType = "zfs";
      options = [ "zfsutil" "X-mount.mkdir" ];
    };
  fileSystems."/boot" =
    {
      device = "/dev/disk/by-uuid/4FB4-738E";
@@ -59,12 +69,7 @@
    };
  swapDevices = [ ];
-  networking.vlans = {
+  networking.interfaces.eth0.useDHCP = true;
    iot = {
      id = 2;
      interface = "eth1";
    };
  };
  powerManagement.cpuFreqGovernor = "powersave";
 }
--- a/machines/storage/s0/home-automation.nix
+++ b/machines/storage/s0/home-automation.nix
@@ -1,93 +0,0 @@
 { config, lib, pkgs, ... }:
 {
  services.esphome.enable = true;
  # TODO lock down
  services.mosquitto = {
    enable = true;
    listeners = [
      {
        acl = [ "pattern readwrite #" ];
        omitPasswordAuth = true;
        settings.allow_anonymous = true;
      }
    ];
  };
  networking.firewall.allowedTCPPorts = [
    1883 # mqtt
  ];
  services.zigbee2mqtt = {
    enable = true;
    settings = {
      homeassistant = true;
      permit_join = false;
      serial = {
        port = "/dev/ttyACM0";
      };
      mqtt = {
        server = "mqtt://localhost:1883";
        # base_topic = "zigbee2mqtt";
      };
      frontend = {
        host = "localhost";
        port = 55834;
      };
    };
  };
  services.home-assistant = {
    enable = true;
    extraComponents = [
      "default_config"
      "esphome"
      "met"
      "radio_browser"
      "wled"
      "mqtt"
      "apple_tv" # why is this even needed? I get `ModuleNotFoundError: No module named 'pyatv'` errors otherwise for some reason.
      "unifi"
      "digital_ocean"
      "downloader"
      "mailgun"
      "minecraft_server"
      "mullvad"
      "nextcloud"
      "ollama"
      "openweathermap"
      "jellyfin"
      "transmission"
      "radarr"
      "sonarr"
      "syncthing"
      "tailscale"
      "weather"
      "whois"
      "youtube"
      "homekit_controller"
      "zha"
      "bluetooth"
    ];
    # config = null;
    config = {
      # Includes dependencies for a basic setup
      # https://www.home-assistant.io/integrations/default_config/
      default_config = { };
      # Enable reverse proxy support
      http = {
        use_x_forwarded_for = true;
        trusted_proxies = [
          "127.0.0.1"
          "::1"
        ];
      };
      "automation manual" = [
      ];
      # Allow using automations generated from the UI
      "automation ui" = "!include automations.yaml";
    };
  };
 }
--- a/machines/storage/s0/properties.nix
+++ b/machines/storage/s0/properties.nix
@@ -10,8 +10,6 @@
    "server"
    "pia"
    "binary-cache"
    "gitea-actions-runner"
    "frigate"
  ];
  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";
--- a/machines/zoidberg/default.nix
+++ b/machines/zoidberg/default.nix
@@ -1,109 +0,0 @@
 { config, pkgs, lib, ... }:
 {
  imports = [
    ./hardware-configuration.nix
  ];
  de.enable = true;
  # Login DE Option: Steam
  programs.steam.gamescopeSession.enable = true;
  # programs.gamescope.capSysNice = true;
  # Login DE Option: Kodi
  services.xserver.desktopManager.kodi.enable = true;
  services.xserver.desktopManager.kodi.package =
    (
      pkgs.kodi.passthru.withPackages (kodiPackages: with kodiPackages; [
        jellyfin
        joystick
      ])
    );
  services.mount-samba.enable = true;
  # Login DE Option: RetroArch
  services.xserver.desktopManager.retroarch.enable = true;
  services.xserver.desktopManager.retroarch.package = pkgs.retroarchFull;
  # wireless xbox controller support
  hardware.xone.enable = true;
  boot.kernelModules = [ "xone-wired" "xone-dongle" ];
  hardware.enableRedistributableFirmware = true;
  hardware.enableAllFirmware = true;
  # ROCm
  hardware.opengl.extraPackages = with pkgs; [
    rocm-opencl-icd
    rocm-opencl-runtime
  ];
  systemd.tmpfiles.rules = [
    "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
  ];
  # System wide barrier instance
  # systemd.services.barrier-sddm = {
  #   description = "Barrier mouse/keyboard share";
  #   requires = [ "display-manager.service" ];
  #   after = [ "network.target" "display-manager.service" ];
  #   wantedBy = [ "multi-user.target" ];
  #   serviceConfig = {
  #     Restart = "always";
  #     RestartSec = 10;
  #     # todo use user/group
  #   };
  #   path = with pkgs; [ barrier doas ];
  #   script = ''
  #     # Wait for file to show up. "display-manager.service" finishes a bit too soon
  #     while ! [ -e /run/sddm/* ]; do sleep 1; done;
  #     export XAUTHORITY=$(ls /run/sddm/*)
  #     # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
  #     barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
  #   '';
  # };
  # Login into X11 plasma so barrier works well
  services.displayManager.defaultSession = "plasma";
  users.users.cris = {
    isNormalUser = true;
    hashedPassword = "$y$j9T$LMGwHVauFWAcAyWSSmcuS/$BQpDyjDHZZbvj54.ijvNb03tr7IgX9wcjYCuCxjSqf6";
    uid = 1001;
    packages = with pkgs; [
      maestral
      maestral-gui
    ] ++ config.users.users.googlebot.packages;
  };
  # Dr. John A. Zoidberg
  users.users.john = {
    isNormalUser = true;
    inherit (config.users.users.googlebot) hashedPassword packages;
    uid = 1002;
  };
  # Auto login into Plasma in john zoidberg account
  services.displayManager.sddm.settings = {
    Autologin = {
      Session = "plasma";
      User = "john";
    };
  };
  environment.systemPackages = with pkgs; [
    jellyfin-media-player
    config.services.xserver.desktopManager.kodi.package
    spotify
    retroarchFull
  ];
  # Command and Conquer Ports
  networking.firewall.allowedUDPPorts = [ 4321 27900 ];
  networking.firewall.allowedTCPPorts = [ 6667 28910 29900 29920 ];
  nixpkgs.config.rocmSupport = true;
  services.ollama = {
    enable = true;
    acceleration = "rocm";
  };
 }
--- a/machines/zoidberg/hardware-configuration.nix
+++ b/machines/zoidberg/hardware-configuration.nix
@@ -1,46 +0,0 @@
 { config, lib, pkgs, modulesPath, ... }:
 {
  imports =
    [
      (modulesPath + "/installer/scan/not-detected.nix")
    ];
  # boot
  boot.loader.systemd-boot.enable = true;
  boot.loader.timeout = lib.mkForce 15;
  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
  boot.initrd.kernelModules = [ "dm-snapshot" ];
  # kernel
  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];
  boot.kernelPackages = pkgs.linuxPackages_latest;
  # disks
  remoteLuksUnlock.enable = true;
  boot.initrd.luks.devices."enc-pv" = {
    device = "/dev/disk/by-uuid/04231c41-2f13-49c0-8fce-0357eea67990";
    allowDiscards = true;
    # Fetch key from USB drive
    keyFileSize = 4096;
    keyFile = "/dev/disk/by-id/usb-Mass_Storage_Device_121220160204-0:0-part2";
    fallbackToPassword = true;
  };
  fileSystems."/" =
    {
      device = "/dev/disk/by-uuid/39ee326c-a42f-49f3-84d9-f10091a903cd";
      fsType = "btrfs";
    };
  fileSystems."/boot" =
    {
      device = "/dev/disk/by-uuid/954B-AB3E";
      fsType = "vfat";
    };
  swapDevices =
    [{ device = "/dev/disk/by-uuid/44e36954-9f1c-49ae-af07-72b240f93a95"; }];
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/machines/zoidberg/properties.nix
+++ b/machines/zoidberg/properties.nix
@@ -1,14 +0,0 @@
 {
  hostNames = [
    "zoidberg"
  ];
  arch = "x86_64-linux";
  systemRoles = [
    "personal"
    "media-center"
  ];
  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvdC1EiLqSNVmk5L1p7cWRIrrlelbK+NMj6tEBrwqIq";
 }
--- a/overlays/actualbudget/default.nix
+++ b/overlays/actualbudget/default.nix
@@ -1,39 +0,0 @@
 { lib
 , buildNpmPackage
 , fetchFromGitHub
 , python3
 , nodejs
 , runtimeShell
 }:
 buildNpmPackage rec {
  pname = "actual-server";
  version = "24.10.1";
  src = fetchFromGitHub {
    owner = "actualbudget";
    repo = pname;
    rev = "refs/tags/v${version}";
    hash = "sha256-VJAD+lNamwuYmiPJLXkum6piGi5zLOHBp8cUeZagb4s=";
  };
  npmDepsHash = "sha256-Z2e4+JMhI/keLerT0F4WYdLnXHRQCqL7NjNyA9SFEF8=";
  patches = [
    ./migrations-should-use-pkg-path.patch
  ];
  postPatch = ''
    cp ${./package-lock.json} package-lock.json
  '';
  dontNpmBuild = true;
  postInstall = ''
    mkdir -p $out/bin
    cat <<EOF > $out/bin/actual-server
    #!${runtimeShell}
    exec ${nodejs}/bin/node $out/lib/node_modules/actual-sync/app.js "\$@"
    EOF
    chmod +x $out/bin/actual-server
  '';
 }
--- a/overlays/actualbudget/migrations-should-use-pkg-path.patch
+++ b/overlays/actualbudget/migrations-should-use-pkg-path.patch
@@ -1,48 +0,0 @@
 diff --git a/src/load-config.js b/src/load-config.js
 index d99ce42..42d1351 100644
 --- a/src/load-config.js
 +++ b/src/load-config.js
@@ -3,7 +3,8 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import createDebug from 'debug';
 -const debug = createDebug('actual:config');
 +// const debug = createDebug('actual:config');
 +const debug = console.log;
 const debugSensitive = createDebug('actual-sensitive:config');
 const projectRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
@@ -108,6 +109,7 @@ const finalConfig = {
   serverFiles: process.env.ACTUAL_SERVER_FILES || config.serverFiles,
   userFiles: process.env.ACTUAL_USER_FILES || config.userFiles,
   webRoot: process.env.ACTUAL_WEB_ROOT || config.webRoot,
 +  dataDir: process.env.ACTUAL_DATA_DIR || config.dataDir,
   https:
     process.env.ACTUAL_HTTPS_KEY && process.env.ACTUAL_HTTPS_CERT
       ? {
 diff --git a/src/migrations.js b/src/migrations.js
 index cba7db0..9983471 100644
 --- a/src/migrations.js
 +++ b/src/migrations.js
@@ -1,6 +1,12 @@
 import migrate from 'migrate';
 import path from 'node:path';
 import config from './load-config.js';
 +import { fileURLToPath } from 'url';
 +
 +const __filename = fileURLToPath(import.meta.url);
 +const __dirname = path.dirname(__filename);
 +const appRoot = path.dirname(__dirname);
 +const migrationsDirectory = path.join(appRoot, "migrations");
 export default function run(direction = 'up') {
   console.log(
@@ -13,7 +19,7 @@ export default function run(direction = 'up') {
         stateStore: `${path.join(config.dataDir, '.migrate')}${
           config.mode === 'test' ? '-test' : ''
         }`,
 -        migrationsDirectory: `${path.join(config.projectRoot, 'migrations')}`,
 +        migrationsDirectory
       },
       (err, set) => {
         if (err) {
--- a/overlays/actualbudget/package-lock.json
+++ b/overlays/actualbudget/package-lock.json
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -1,15 +0,0 @@
 { inputs }:
 final: prev:
 let
  system = prev.system;
  frigatePkgs = inputs.nixpkgs-frigate.legacyPackages.${system};
 in
 {
  # It seems that libedgetpu needs to be built with the newer version of tensorflow in nixpkgs
  # but I am lazy so I instead just downgrade by using the old nixpkgs
  libedgetpu = frigatePkgs.callPackage ./libedgetpu { };
  frigate = frigatePkgs.frigate;
  actual-server = prev.callPackage ./actualbudget { };
 }
--- a/overlays/kernel-modules/default.nix
+++ b/overlays/kernel-modules/default.nix
@@ -1,19 +0,0 @@
 { config, lib, ... }:
 # Adds additional kernel modules to the nixos system
 # Not actually an overlay but a module. Has to be this way because kernel
 # modules are tightly coupled to the kernel version they were built against.
 # https://nixos.wiki/wiki/Linux_kernel
 let
  cfg = config.kernel;
  gasket = config.boot.kernelPackages.callPackage ./gasket.nix { };
 in
 {
  options.kernel.enableGasketKernelModule = lib.mkEnableOption "Enable Gasket Kernel Module";
  config = lib.mkIf cfg.enableGasketKernelModule {
    boot.extraModulePackages = [ gasket ];
  };
 }
--- a/overlays/kernel-modules/gasket.nix
+++ b/overlays/kernel-modules/gasket.nix
@@ -1,36 +0,0 @@
 { stdenv, lib, fetchFromGitHub, kernel }:
 stdenv.mkDerivation rec {
  pname = "gasket";
  version = "1.0-18-unstable-2023-09-05";
  src = fetchFromGitHub {
    owner = "google";
    repo = "gasket-driver";
    rev = "5815ee3908a46a415aac616ac7b9aedcb98a504c";
    sha256 = "sha256-O17+msok1fY5tdX1DvqYVw6plkUDF25i8sqwd6mxYf8=";
  };
  makeFlags = kernel.makeFlags ++ [
    "-C"
    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
    "M=$(PWD)"
  ];
  buildFlags = [ "modules" ];
  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
  installTargets = [ "modules_install" ];
  sourceRoot = "${src.name}/src";
  hardeningDisable = [ "pic" "format" ];
  nativeBuildInputs = kernel.moduleBuildDependencies;
  meta = with lib; {
    description = "The Coral Gasket Driver allows usage of the Coral EdgeTPU on Linux systems.";
    homepage = "https://github.com/google/gasket-driver";
    license = licenses.gpl2;
    maintainers = [ lib.maintainers.kylehendricks ];
    platforms = platforms.linux;
    broken = versionOlder kernel.version "5.15";
  };
 }
--- a/overlays/libedgetpu/default.nix
+++ b/overlays/libedgetpu/default.nix
@@ -1,72 +0,0 @@
 { stdenv
 , lib
 , fetchFromGitHub
 , libusb1
 , abseil-cpp
 , flatbuffers
 , xxd
 }:
 let
  flatbuffers_1_12 = flatbuffers.overrideAttrs (oldAttrs: rec {
    version = "1.12.0";
    NIX_CFLAGS_COMPILE = "-Wno-error=class-memaccess -Wno-error=maybe-uninitialized";
    cmakeFlags = (oldAttrs.cmakeFlags or [ ]) ++ [ "-DFLATBUFFERS_BUILD_SHAREDLIB=ON" ];
    NIX_CXXSTDLIB_COMPILE = "-std=c++17";
    configureFlags = (oldAttrs.configureFlags or [ ]) ++ [ "--enable-shared" ];
    src = fetchFromGitHub {
      owner = "google";
      repo = "flatbuffers";
      rev = "v${version}";
      sha256 = "sha256-L1B5Y/c897Jg9fGwT2J3+vaXsZ+lfXnskp8Gto1p/Tg=";
    };
  });
 in
 stdenv.mkDerivation rec {
  pname = "libedgetpu";
  version = "grouper";
  src = fetchFromGitHub {
    owner = "google-coral";
    repo = pname;
    rev = "release-${version}";
    sha256 = "sha256-73hwItimf88Iqnb40lk4ul/PzmCNIfdt6Afi+xjNiBE=";
  };
  patches = [ ./libedgetpu-stddef.diff ];
  makeFlags = [ "-f" "makefile_build/Makefile" "libedgetpu" ];
  buildInputs = [
    libusb1
    abseil-cpp
    flatbuffers_1_12
  ];
  nativeBuildInputs = [
    xxd
  ];
  NIX_CXXSTDLIB_COMPILE = "-std=c++17";
  TFROOT = "${fetchFromGitHub {
    owner = "tensorflow";
    repo = "tensorflow";
    rev = "v2.7.4";
    sha256 = "sha256-liDbUAdaVllB0b74aBeqNxkYNu/zPy7k3CevzRF5dk0=";
  }}";
  enableParallelBuilding = false;
  installPhase = ''
    mkdir -p $out/lib
    cp out/direct/k8/libedgetpu.so.1.0 $out/lib
    ln -s $out/lib/libedgetpu.so.1.0 $out/lib/libedgetpu.so.1
    mkdir -p $out/lib/udev/rules.d
    cp debian/edgetpu-accelerator.rules $out/lib/udev/rules.d/99-edgetpu-accelerator.rules
    # PCIe rule
    echo 'SUBSYSTEM=="apex", MODE="0660", GROUP="apex"' > $out/lib/udev/rules.d/65-apex.rules
  '';
 }
--- a/overlays/libedgetpu/libedgetpu-stddef.diff
+++ b/overlays/libedgetpu/libedgetpu-stddef.diff
@@ -1,12 +0,0 @@
 diff --git a/api/allocated_buffer.h b/api/allocated_buffer.h
 index 97740f0..7bc0547 100644
 --- a/api/allocated_buffer.h
 +++ b/api/allocated_buffer.h
@@ -16,6 +16,7 @@
 #define DARWINN_API_ALLOCATED_BUFFER_H_
 #include <functional>
 +#include <cstddef>
 namespace platforms {
 namespace darwinn {
--- a/patches/gamepadui.patch
+++ b/patches/gamepadui.patch
@@ -1,13 +0,0 @@
 diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix
 index 29c449c16946..f6c728eb7f0c 100644
 --- a/nixos/modules/programs/steam.nix
 +++ b/nixos/modules/programs/steam.nix
@@ -11,7 +11,7 @@ let
   in
     pkgs.writeShellScriptBin "steam-gamescope" ''
       ${builtins.concatStringsSep "\n" exports}
 -      gamescope --steam ${builtins.toString cfg.gamescopeSession.args} -- steam -tenfoot -pipewire-dmabuf
 +      gamescope --steam ${builtins.toString cfg.gamescopeSession.args} -- steam -gamepadui -steamdeck -pipewire-dmabuf &> /tmp/steamlog
     '';
   gamescopeSessionFile =
--- a/secrets/backblaze-s3-backups.age
+++ b/secrets/backblaze-s3-backups.age
--- a/secrets/binary-cache-private-key.age
+++ b/secrets/binary-cache-private-key.age
--- a/secrets/binary-cache-push-sshkey.age
+++ b/secrets/binary-cache-push-sshkey.age
--- a/secrets/cris-hashed-email-pw.age
+++ b/secrets/cris-hashed-email-pw.age
@@ -1,10 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g WZ9p/pCsEDpKbgGDLcTtisn25kExQX9iv+tL3wyPwiY
+-> ssh-ed25519 6AT2/g q8AlvC9Dt+b8320A4BP92FghOoPyKttivfrsxqG6DGM
-vom2z9QRIQSFB0+4/7lSWUEB0eoAG+08nXgiUg/OSX4
+GWz2QJY3QFc748DjHrybNxyAS/BmDgzIU8yoRFGbLjA
-> ssh-ed25519 w3nu8g ECLZwCRJVJqyUMf70EOl2/3ExTruKaxCSQlY5fBZqxk
+-> ssh-ed25519 dMQYog i/6mNjO8XZGAxnN1SxJGr5uD+hzCIrh28+N7cvvXZGA
-VemnmGpzx1VprkybW1hPlkfmiDaNcBDoEzX0mDZgmu0
+hC+J+F9hVs8HZjLhCQ6RnGAHRE45G+p1oBPnwB+nBtE
-> ssh-ed25519 dMQYog QiPsbFE8MtXnRNBwkUEC+6grqXEbDstEtxYR8uJks2w
+-> ]d^>n#.%-grease Qe6&35Kb ,",Wb`% 0SRX@d
-O3JWQGppFeZEd6o3W0KVTEIyNVGeLxKfTYTlgsAEVHQ
+yXZqn1+E675gpQyFGk/c15Sc1/iwjI/6VrOE1RTcp0gJcsbtVv4kgYCkY+mK
--- RncZzBFEyMAkpZRWrPORA0DPHuCTNswmWG5CMNnfm4A
+--- ykoio7g3wxV3VDvo2d3p/Y39NCh+cWPh7uL+Go30BLY
-	ñ/¼ÔËõôŒ8nàÅ¥«¸7hîtä?T˜=‘%zˆ°[¤ÝØ!(…uÔdÇuò@
+i“˜Q+€hnïI¼_MßGrrf¯EE~µ(fFyâÿé&Èƒ>sÀX<C380>›ú¤9~<7E>ä*Ç~ŽBãÕ4R¯ü=;’Â{Ý´+^<5E>P…¨ûrFza·Cä¢žî4V’
 ×¢EbƒyŽ¦ù¦D=Ü!‹„XþtÞÔ:#¦þþãÞXÈX@ú_M‘
--- a/secrets/digitalocean-dns-credentials.age
+++ b/secrets/digitalocean-dns-credentials.age
@@ -1,11 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 WBT1Hw wjZGPvilRXGZsC2+7dWm/Nbau8Allv29WwQCr0XSAWU
 uTOf/sokutOGDyc8fbTbBWXqCVQCFhGdHxwA6SXqhdA
 -> ssh-ed25519 6AT2/g NU068qwqOWiKk0QwqP9vU4xJaND2OR4bo8xkmdWATgY
 uGd0sb5PH+rREn9pgLOFwk29CX66aPBQMvr4rBazylc
 -> ssh-ed25519 hPp1nw r2JRiZ7fsHPYDlte6Oh2Gx1KkugekFeeg3xSjziI+hQ
 xnO0gscMdR25mj5uAX7D42FCbCQhqbU0wkiLX4OmVqk
 -> ssh-ed25519 w3nu8g F03mPU63WwEs1SLUFErLOVCkARoggGIvvz9TFZfMOBY
 HOdVA3xW9pqUPhclO6VueSfXg3ux06Ch3fucF6Vr4hM
 --- niyo231HPT/+2dzflP+zhYjL9XiWsk7svesCYdkU1jA
 DÑØQî¬5–-ô@<40>¢¿—ßÐN5<4E> Ãÿ$Ø‚™’Çž…êÐ<C3AA>X=ŒHŽDÁ`P×5ZA´÷¼YóäÓ?¡é^[³1”6ÕK*mPÝˆªæ1æç÷ß›ƒ:$^ÑfDœ*î†ÿ“š-zi´"·Tàuÿüò
--- a/secrets/frigate-credentials.age
+++ b/secrets/frigate-credentials.age
@@ -1,7 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 hPp1nw Chke1ZtpXxN1c1+AnJ6Cd5kpM1KfQKTwymrfPW53QCA
 jUcw8eitC7r0rwefjllndZjARIqpWoVqGCnefHfjQ6Y
 -> ssh-ed25519 w3nu8g KY/5bU1B5uvmfGHF2d6qBL1NYy64qo324rdvkgnXoDA
 OBvuFtzZXQ0RmmEXelyzHMMiVqZir7zQJMA36ZH2siE
 --- CSd7lYSYQ2fCTjkJLPGdaNGL8eVpE9IBEyFo0LW907M
 £³$šO†ÈIß/À//Êw*ƒ™õD¤@u5o[¼â:·äš¥t¾˜]Jñì®¸™@Ùhþu£Àk;?·XüÁHRº’Ñ°E5¥ÍçÜ9
--- a/secrets/gitea-actions-runner-token.age
+++ b/secrets/gitea-actions-runner-token.age
@@ -1,11 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 WBT1Hw PbGwwDeulHF6kdh073rq0RvD1hlx6spnKNgKU+QeDAw
 7dITwSQ2p1LZuaVEzLxcGOhB97MQT2zGoRrnNUMcOFk
 -> ssh-ed25519 hPp1nw Dn+5Fpme+JmRZKkCkqtCuD87p+sDYDA6OZ2aUmBkCRs
 Dgg3orXF4RYT/fHtc2tRuIhOQu48zICMqgPyV47vpf4
 -> ssh-ed25519 w3nu8g dghNLDH1Tm+sm42HXDhrLFtmU4iDF1yCGrO2VSgzZjo
 71scUVrGr4c4dunAFJYKd+uJ6aYJpSWBAk9swbv+IzM
 -> ssh-ed25519 dMQYog Wnl1+rh0Q3YD2s1UD0OYVm39wY/Uw1NRK3K7EFhFMls
 wXF6QBonlCalS1vI9cxzWgv1Gi+yAtYn6HrYCfpl5Nw
 --- rLOoGk0iX+wuNd1CKv7g2PRd2Ic+8JHCQhrVBaF9zbE
 <EFBFBD>òüüË¤/A¦Ì(ØiHC¸@¢Þð‰h`ˆ3ªá´'	¬ÚöáDì>ð¿¤~¸ÿÁö?ÑÃMêÙ@<40>t°(“Ò@ö×¿^xÆMÉ}
--- a/secrets/hashed-email-pw.age
+++ b/secrets/hashed-email-pw.age
@@ -1,9 +1,10 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g 98/m3t8axoVBE6WzdxBtRhV2uSQKSCXwQjyxfWXPmQk
+-> ssh-ed25519 6AT2/g 93Az2iuqeWL6H/S3XDPXFoEPcrY/n/z9mlSNb5wABkU
-AxV0FTvqbWfk/gf65d05PcotbEnYr4PgDQnsaYxP/MU
+LpMPjpDtBrY2aHpqHwT5AY7vtsYHNcOjpz+LFY4TGCg
-> ssh-ed25519 w3nu8g jys7B4COD4iINANeSCD3BqGFoghxTmsbuXoOOIiP+wQ
+-> ssh-ed25519 dMQYog 4qT0aF1IHsTtN1avMPWYG5Az2xmEZhVUhqcwyNFdfU4
-b7eSN5fe4szfliINOr7ZQ7AoSsIK5akmIQ6uLDabcIE
+wD0hE035JqYdDgJmkvNXwJyMzXrquA+RsD8QdK3xP8
-> ssh-ed25519 dMQYog ToNUqTPYmxpz9OUcC94egELcPfHQHCErfHN6l9kSrRY
+-> !vfM7-grease
-2KoSVoWp+FH29YfH57ri2KOvhkuqYew1+PXm99e0BaI
+7nQGFFUWY9UIjfrb+/VfaG0zJ21zmDnDh5khs/0tioJevrrrlhub9Bz8iM/Jsfxy
--- Cjk3E/MjgCF45aLlFeyoGiaUEZk/QuKtsvPb6GpzD8Q
+KUhwV8O8tL/5+30RFSlFRaAB6xPCGg24Yq6E
-m°å>‹“~czÆêåŒ¦†``ÜÏqX«š'ÁÎ%ôwÔž~×ÄL·eä'a±]û‹0ò´LÉÀ‰%ÍY‚TÊÓc9f¡W¶Ã^¤9ÊõÙÝ2®™æ¶ÆBÌa ƒ™ 
+--- jVsDtz2xpvK/XCHcdN5JVZx5zSxyEAM6D/xJIgN4YfY
 Ñì°ßév.rK,Æ$ 
--- a/secrets/hashed-robots-email-pw.age
+++ b/secrets/hashed-robots-email-pw.age
@@ -1,11 +1,11 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g 3E1kcHjq89rNd4NN6n3AcG2f5teA8+Rmt1NXNwatwnk
+-> ssh-ed25519 6AT2/g O0XP3tiD5bv5aFK54eTpo4I6oXHk+P0/zyy5A1GQlwg
-trLztKaYvmhNJYiT+SHZipePcZcSCDprNCugSjtVFjs
+0D5I+dRmW6Ak7VvQrNDa4NiHgBtD4sAS87U9iXKHrRs
-> ssh-ed25519 w3nu8g bR2A/UCxtD2POHI4Ky/rvfC23ZbGTGnBZc/1XtRq+3s
+-> ssh-ed25519 dMQYog pofEwx9ktCWDTYGp/rXwxq1ZkMLaR4q4JTWJxHl6rRw
-UyX6/DEC9boQb/Ktgw47DzsPo64Tn0LoITax95JdskE
+CoUEZHQaQd4wFi6pcZPZfhPACXI9qgrB1xAuSilGJpI
-> ssh-ed25519 dMQYog haLpVq9+Tq2FytfsXTwLvCk1ZUQsZ4JCiRLPFAb0SCg
+-> /5^-grease e yP^gopW&
-vZ5e8P1uEDTVS83MsWwh1j0tON9FeVc5F1O6wzwX5Vw
+8qWOBZeGzhSSfGdjHDOGhs2MoZEQneLFMj8DsBqTrnttzgjtg8VSwuMD2JA3yiA5
--- ZnZiddI8Uqr7da1gSahlryY004ii9G2mJS8C4u+lv6o
+43u5T24PCzhKor8puT830nMU3HfQ3FA1RtiUpu1FWPA
-
+--- gJaY0whK+GQ+F6m3jCfeGkPbJoIkGxmcJ++XVseDeWI
-¹e£g“-}Þ[&`Ú<E0LË÷-gõ_E<5F>W¹?íèJž¸ñ-Éµ#ÝŽ‚íJÙñZÔõŒ4Š3ñ\÷0ðómÝTúf9žºÛÆ@àÅ©;
+'½<14>¤	kª†süVûÊ
-øù©œÉ‰A–úß
+ƒ$÷"Ãý|ÕÞÆ^n“ÑàÆÜ hï~2Tô±Ì<>6/ ˆjÈO<C388>þõvMŠôé/e¯XÆr~GÚ&oèn;=,îÂÿô½ï2]?j
--- a/secrets/hostapd-pw-CXNK00BF9176.age
+++ b/secrets/hostapd-pw-CXNK00BF9176.age
@@ -1,7 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 w3nu8g ER07FH17Wm9op5F4pCftNK76f+nNjtA6zQc/2dLyAHI
+-> ssh-ed25519 VyYH/Q X+fXLJz227KkBLu45rb9mUkkIpENSMtZeEJjl6qj5Xw
-nxxq/8tS3ENJhAEIhJCiSi7dV+68AmcEMh9zvZoWpdY
+AFAFnvsiogoMMwsAJO0DDoaizL9lmCLsF4QHDjmubr0
-> ssh-ed25519 dMQYog JelCfh+akP7C/i1kimq3fC5PRQa9gHbmBaOnjKu+PDw
+-> ssh-ed25519 dMQYog P84+7TBcMFSALTn6FR/aXyqFE9DfOzp38ImkdWj7nE0
-GVTwo7MzkpCereZRh0HVjGYmtdMY1gHowMZtUQl7XQw
+PqOn1OL9Zt0x1pBIYOSKkkS//mbk1OX5pnDGp+OLYeI
--- p2l83t3bEdBrrp1ctaqqKhwB4l2McgZqZTtc2SXgd8Q
+-> @?-grease
-ø±ôeÆd\Yå4lXVF§U©<55>þM||)Ø¯Ôûú•¶Ü8¿>ëž%ðóJ$à´Õè
+3JvpmcTxdTgvv6vPL8dXEwjR+g
 --- aMYF1SbC+p01YWmg24+Ih78VPQcwzGU/P1cEfgRvXV8
 Ÿ	@$™sžQÂ¼z<15><>®xkÊNfÛuÕ;§¿ ÎvI0•ªÇÎ^4.?, 8…çî
--- a/secrets/hostapd-pw-experimental-tower.age
+++ b/secrets/hostapd-pw-experimental-tower.age
--- a/secrets/hostspot-passwords.age
+++ b/secrets/hostspot-passwords.age
@@ -1,7 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 cObvAg l/suU/M4AATK7lQuZv/qnjG/xqNGoVqhS7b3xirmNUM
 Ao2tP6BBSZdlL7jZJPmLyJQWfqdU89M9hCjkkuqtxlw
 -> ssh-ed25519 w3nu8g szQugiuFfzkzVndyIdP1agun4nmCsZzFG/6EEB2V1Gk
 5+DEUJ5tkVFUpm+w/tptUCByRpMxRigwfrVglTYc8XI
 --- pjviyhRustHHMipIpkKsQ4cpu+YA66JwvWXjceXopi4
 )˜Ö®Äý8³È6Y"@?Ý9”®@¡Ÿžè|ÂÄž+©Z*4ö2å“R<qef…êªG¹ïV+{©%CmÞd^™b
--- a/secrets/iodine.age
+++ b/secrets/iodine.age
@@ -1,9 +1,10 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g Knb25oYknkiXyMqVBR3T0sFSO4hDjWUTq3xIml/b4ig
+-> ssh-ed25519 6AT2/g yTW46JmDIftcOqogIDjheXJf2sw/dG2WEJxfCXU/LDk
-n7xamnrZ+SCWiKqniF3r2JvH4G8q2pJaHzF0riNEDf4
+0Co5/Rn22kmdcPr61ZOrmZJbPFHx2wJ8/YkbDjcjqKo
-> ssh-ed25519 w3nu8g 7+2R5RpLjBf4jjj3S8ibMquUWgRMrifziGQubwuLrhA
+-> ssh-ed25519 dMQYog RtZT0PwVL4kxUHilOhH2GBp8Z9WfyBkaxB62pjKpHA4
-3jLCalnbA3Z2jr8Zs+qrpzSoi3Jv6E5OV2binpr3Kk4
+muMlIt8VYQftMYacfdnQFeejfWpKTEG5gxbFNy97GTc
-> ssh-ed25519 dMQYog Nh2e7me0tiG7ZwQK8669VS0LCYFSH+b33I9tr8uI5CY
+-> 4|)`7yq-grease P#\5k8 +f
-7Gs1N9eZa1CGR9pczzugHbqnghqevX7kQCOeqR4q0eI
+jMegn6ATsj2Ai9B5Xmy+tay1nppwxvF1IGJH+hLNanYMsTIDZypM6UsNdzYQ/3mw
--- OzW+omJsZA/b4DMF4hdQga7JVgiEYluZok3r8JM258I
+VZ9ooy8TKUgAJ7jsd6IrKw
-*³²ÝPŽ†AcèÈ1·@Át¸e÷nf&ù#I7‡a‰Ûâc†ÃÀ<C383>êbDâ–~aõ]1w=Á
+--- tLaPQWJA0Hh5MrxfhaySURgY02K16IlzvsxKpOWGva0
 5?lﾇ'ｼ!ｹｺ<EFBDB9><EFBDBA>ﾜｷ匪Nxｽ+<2B>A9ﾟﾑﾘl/ｸﾞ諟ﾎ|旙<>Sｵ&ｺｻ､繃<>Q;_<>K
--- a/secrets/librechat-env-file.age
+++ b/secrets/librechat-env-file.age
--- a/secrets/nextcloud-pw.age
+++ b/secrets/nextcloud-pw.age
--- a/secrets/oauth2-proxy-env.age
+++ b/secrets/oauth2-proxy-env.age
--- a/secrets/pia-login.age
+++ b/secrets/pia-login.age
@@ -1,11 +1,11 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g MGKlbzVOk5+czgAOerwl+eIyOifXJm/q4UgQUXVpx1c
+-> ssh-ed25519 6AT2/g J3H9xUUwUMB7VkHHGtsZaCm/GiyqTFUrEmsuwcrgrhE
-43l6s4+5TSMQyO9tAg7v9Y5OdXOjKYz56lbr9Jm2r+o
+tn+zbj5cISZzkUzJcu7JlaqhE4Dr4fhczSJU2kV91AU
-> ssh-ed25519 hPp1nw aOxni4sFPPgedUkBOuOyEWfFPJrhdTJnivIaWt5RJxM
+-> ssh-ed25519 hPp1nw 370YNPQn4mqeHjOvnIXkm+BzbrRNHkFICJaJhHCSHDQ
-KNaxijzSMp7EjYKwWiAP66nPYYZK3/VXL8u+3uJt6bg
+WLhDRA8jp50aKkY8t9GvyAHoLxYQD2Bhw3y01hwhoOA
-> ssh-ed25519 w3nu8g qTAzEzQbFze35AtbvkYREw3wa7ApDN5u7RSZUXrEpms
+-> ssh-ed25519 dMQYog 1dwQN8hmbLY54OnRTXtcwAXHoYLLNV0IK/rQQ9ZgV2A
-Dy0uGF458A9RJMvDl2XKOkEABbbRgT+eIgvb6ZOEQqg
+gP2HQinVYW72oJRFW69qAeF/iNEEtJqya1iRMOugNKk
-> ssh-ed25519 dMQYog 5DfYuGeWuN0/CO6WWbFIi7LaKl23FXYVdPROM+TFpCA
+-> ~-grease 2%p4s G:$f41y " vZ87PA*|
-PDBdDn+YUMKYNKFkCEfXesmkB/XUxZRK3ddQt0kqQ7g
+hI029392lrjxlsXUI8opFVcUK+JOjgBYGMH
--- JOeG87EVD+QBx6n+rMoPTOni0PyoG7xx4a2USNiapYI
+--- juX+tgNpNr8it5QnbcBkR9u88vZkC47L5fIlZQNxPYg
-Zsý{ÅiÁ_QÂ\+ô@@Üòß¸Ã¹&_š5$¿Gt2¢rF“y×ÄQ§Iaž7ôÙÉzàgf%O(µÙ,VéÂ}ÿn|û'J¸2ø¨óQÑB
+,J}¸œ}Y§˜B%ˆo~3M×½HÊ—]ºˆû©ðÔ¤–žËn0cVs(´;axc#o™Üüv'kˆù#]o<>N`ÆœøÁ´Ì¿<C38C>˜¼ûp<>ÒšKàøk†0(
--- a/secrets/rekey.sh
+++ b/secrets/rekey.sh
@@ -0,0 +1,5 @@
 #!/usr/bin/env bash
 set -e
 agenix -r
 git commit . -m "Rekey secrets"
--- a/secrets/restic-password.age
+++ b/secrets/restic-password.age
@@ -1,23 +1,20 @@
 age-encryption.org/v1
-> ssh-ed25519 N7drjg Njjfv0Etdr9U27s+wznqw5YmnKcj3lISQ2vudDPj7F0
+-> ssh-ed25519 yHDAQw LyoiocIPWoX81W5lD5OBD5P48QC3CtVHmpATJTfz70Y
-bw3SSPfReGSmJ5tQPv+niYn7USyZZffxvgs3J5VxiWw
+fnRfSV68RLkMc+W6WX5aqxMQxDz7UviTNQqB5KAtKYs
-> ssh-ed25519 yHDAQw DVlCM84Q1P087cmlS+NzH/i2noLprEbfqSpvFS3Pzig
+-> ssh-ed25519 dMQYog nQ49ARJDvvVmZEQu1YlYKGba5Dh5U4bGKsLAZfPDqUg
-PooFRhm8ofoTAT1UxJ3Y+0RMqK3CriwqpGrrKGfFYTs
+9Rs0zISa1FDT3ngBBwp5vXi8aR+a/Z+BrGIEKVUJWkQ
-> ssh-ed25519 jQaHAA rfoKG06gXsXPVfNql5Kk5OBebaXsRd4vCirzPB2y0jk
+-> ssh-ed25519 fwBF+g Zap6yPIuauggXP00/It4kYJV2G539vUblQsfwgVzVHg
-T0xv0iiWSi+FscI/OX6sT137VuiWpAS+P9XsMBT9K7Q
+83K5JgUeHjf6lYv8H3YvsbBzrFOgsQyqLVm4h5Be5gE
-> ssh-ed25519 w3nu8g 869dCSpsCphoOPZ0z6rzbI5QKieIA4M9tAyVP40P2hY
+-> ssh-ed25519 6AT2/g 7QlvTxNNubo2dRwVwfjxr+9MOge9XIsrJVLeAtpkewg
-N705ablrfdQWK2aEOFCkmdEQQmwJVcqVXOkhYIp1Z3o
+lxzXO7PIKNzrKwj0KhyHetavLM3zqjbXu4h/S7tDJns
-> ssh-ed25519 dMQYog ry0Qkn4YSLctLRzp1fZQ6EnbeGvv3Gge2UOsYBwbk2A
+-> ssh-ed25519 VyYH/Q tfgTbXGhdOru7FyVWPVf9tBLcuLZJQWnWZkL8yOjQyg
-LO1eyrU0rQJdAjZKCBr+WH2EP/juXcS7Iwrl8tZIMOM
+HIKUKzWhEM0PD+EKpI5asIwQF3Lx8CYeURVce2QAMZU
-> ssh-ed25519 WBT1Hw NbtlJrLEcf4yO/akQyE7b9TdyM2e6m8Aj9/MzV7SliY
+-> ssh-ed25519 hPp1nw xHd4/TCZAi/zwSL0fj7FVGHkykKAmvh29tJReIAUDFg
-JBWsIu/Aycys+uUxC2xSTE2gC0YUpC7Jkkxa0E0TfRI
+/TrZ77mu8vGmudrrPkDgQPiLr2o84lDrsVgY31xMHUQ
-> ssh-ed25519 6AT2/g kvri9lMh7mXuJTFh15sRPhkz8+75i2YYcdZL12cLPnI
+-> ssh-ed25519 dMQYog 20tuoqjWl4dQBpEKiiSrbEmwW9ZLml3F8MS7riyu1GI
-hsJETu9Xhbfhzzf6Z3YIKFLGN+Eczgn8EqEBPQl7a1s
+I/jrnGVCw37hxoKnf/yGPlvGlXPXy+c1sz1ouY44KF8
-> ssh-ed25519 hPp1nw sJtNVroSF/uQNwvnbLE8vXw+1e4LMu3Gurm+KM+0IwE
+-> 0UxZ/o4-grease V+d
-wlYZUEnr1Q3TlxUAUrKAMdVWUbVWy+3+q2fw+ssIoFs
+VgDtDiYRn+VzFbhXGHjOTbdN/V/vSW7STbKquW96A68DRzKH6yDn/4Ia4tX469eA
-> ssh-ed25519 w3nu8g gA7oDI/02jl+TjMjSUHZqevmHb6gSinWF4KtjDJgFF0
+y6swdFIvbsPFnldalFKxKhHqjKRSJPLAKeWECe/I
-KDgSWaZi99/PkKT8g5bTVHvu8EVcPBlF79APxeorABM
+--- ZEnygego6ke0cW4acYxInaRQXXOaKoSNklgTn7KPOfg
-> ssh-ed25519 dMQYog PDdSuky8g5OoqyF4K5N6SSa3ln6O8vlvL4viGqJ8mUc
+ZÔPÊ|>ªîÃÆÍË<C38D>+:NdÌñ*Pû¢i+¾¡ä§²çÙ3ôGÛ	J´”Ž÷bkc<>ìF<‡’Ö0zá€Í½÷<C2BD>`W/2 ƒ<>4‚¯{O"‘áüF°jS^f_¸£€
 LWanrtAIfekuzhr+AGR8e34CD41vPI0BA8YA8YkcyBA
 --- LENK2A8P2SxCmpQSI3QNCNz2RDhGwCqLQGybmD73ka8
 Ö{¹˜ô'Þú”|ãêã«ÅµÔjã.ùÄnG=ñY‰gï•‹c$T¬
--- a/secrets/robots-email-pw.age
+++ b/secrets/robots-email-pw.age
@@ -1,9 +1,10 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g bnExFj2dEhR0Jbf5Zs/4MqxIdPjeb1Dc7duQUHKfylw
+-> ssh-ed25519 6AT2/g QHqc7SI3Z2k1atMtYR9aFBJKf0oElbI9dd1vcQbchxg
-SV+oJGt24n7CAi4+N9CGZ+SlEgcuAlbLymmmLKffg88
+4bklX308iFaN35PYgA0rqO5ZoXDdgPkB9SO87AgwOwk
-> ssh-ed25519 w3nu8g UO35HobolhH4PRxhGQNxziel7pRhf3VOoGeRbMKH2Fc
+-> ssh-ed25519 dMQYog lF9CFZYQC1ELLuQ1mffIdN6WzHK6/gZzyrv5Ur5my1A
-uphjyV1UmrUxrqMqL6tc3UeFdTILKiVOPVM9uJlUsIU
+4MowtIVjMECAfAKxMxtwVi6kt1h8dLAkYItTeZtzNe8
-> ssh-ed25519 dMQYog v27Ibyt+wTVR/zh5ZH1xyPbgCsrqGug24eVOJ+KdY3E
+-> nRNy(o-grease &%h@^ BlVF[M? YjD3^0 |ey
-I5n+fUhGiHcg0vHTilTszjvFinqCY0ZLcwumiXXwzXE
+atUcl9jHhtLgHLr7qkguIZZtMjbqndHsq1UCkKzl/NhEXmlCp37PKq1vIbF81/Aj
--- jo6rKqQQTeJQusZM69EsvJFPCIHRTeN4OL1kwzapaJY
+RG+Cc0A9H5WsJ9OjmyDiU8r4P42fmdd0ocu7nSxMMhUbr1LvcPM+WxUZGPtV3gc
-m¸¡üi=féKúöœ“³·Û	¾¢¬î“9²Íq™²nTôyÎ¤@23p–‰ˆfêwˆ0 t1ºÎ•<<3C>‹ÅE%Á¢ëFIÃ¸‹½>#C
+--- LkZ3ouICKivFii191r+z57Ikz2wB8zTcicE3DoVOkPE
 žÜòØyäµW_*yÇ6i³¨¼®JZ†£æÆ‹g¦ƒz÷²Ú<18><>³NÇG>ŒÏÃÈ!ð‰>²éâ›``Ù•¤ÜéÒJN$ÚHêŸÑy›o_›×
--- a/secrets/sasl_relay_passwd.age
+++ b/secrets/sasl_relay_passwd.age
--- a/secrets/searx.age
+++ b/secrets/searx.age
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -22,8 +22,6 @@ with roles;
  # nix binary cache
  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
  "binary-cache-private-key.age".publicKeys = binary-cache;
  # public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB
  "binary-cache-push-sshkey.age".publicKeys = nobody; # this value is directly given to gitea
  # vpn
  "iodine.age".publicKeys = iodine;
@@ -31,33 +29,18 @@ with roles;
  # cloud
  "nextcloud-pw.age".publicKeys = nextcloud;
-  "smb-secrets.age".publicKeys = personal ++ media-center;
+  "smb-secrets.age".publicKeys = personal;
  "oauth2-proxy-env.age".publicKeys = server;
  # services
  "searx.age".publicKeys = nobody;
  "spotifyd.age".publicKeys = personal;
  "wolframalpha.age".publicKeys = dailybot;
  # hostapd
-  "hostapd-pw-experimental-tower.age".publicKeys = nobody;
+  "hostapd-pw-experimental-tower.age".publicKeys = wireless;
-  "hostapd-pw-CXNK00BF9176.age".publicKeys = nobody;
+  "hostapd-pw-CXNK00BF9176.age".publicKeys = wireless;
  # backups
  "backblaze-s3-backups.age".publicKeys = personal ++ server;
  "restic-password.age".publicKeys = personal ++ server;
  # gitea actions runner
  "gitea-actions-runner-token.age".publicKeys = gitea-actions-runner;
  # Librechat
  "librechat-env-file.age".publicKeys = librechat;
  # For ACME DNS Challenge
  "digitalocean-dns-credentials.age".publicKeys = server;
  # Frigate (DVR)
  "frigate-credentials.age".publicKeys = frigate;
  # Phone hotspot passwords
  "hostspot-passwords.age".publicKeys = hotspot;
 }
--- a/secrets/smb-secrets.age
+++ b/secrets/smb-secrets.age
@@ -1,19 +1,10 @@
 age-encryption.org/v1
-> ssh-ed25519 N7drjg x2s9QZ7Ijvg4t2peGng9/zX1ZmnGggsvWHJFHEktCgw
+-> ssh-ed25519 yHDAQw PhR4X0TShLFSW0ukaV2RhC+aNDc3wUg5KzD4x91K7jI
-o64an6DJ6Be8Jlhzn9ciQTByRAK5f2ckankCRH3y+Uw
+oY3NkfLrlYzoj4qV8Y2N+RPUveycUxTn7jX5gtKEaFo
-> ssh-ed25519 yHDAQw HYHo6anhKDnD74ab04Ql4RB8+WBA6EavYASX7532NCE
+-> ssh-ed25519 dMQYog YOOjjLAm6cO6jkfOhqbtb0MiVzML/pm9CVgfdlDmdSk
-aTp2V9g18yzUTq1ezqETj6jM2Yb1Bt5+JNkrIDT2Djs
+xnrXzif2IA7Ai1sGkaZKrOxcjMBER5KhsxYd8dk9qgI
-> ssh-ed25519 jQaHAA xGKcIQOkO/i4E2ZWZ+O4sAp7ADqCRqfRQHhKQu6yWh4
+-> rs-grease 6 V\t
-RJnqK/t0YQrIej8fRDJGjOtQD7VvgJRfCUWR0/UYcSY
+o8H+k1mjy1DY0YLxaOaYVgZe+bA93TiD1Bz6H7KSxwX+Hsem5ijjSaBiBVvpuQwK
-> ssh-ed25519 w3nu8g P9DQy19TvDCi3nfOhFj73bNZEtUs1BrLubt5/BtLoU4
+1emVGY1WhOXWc3Zpb7kwohY
-Sx41bk41dQYa3eoBayUMRIHqMWaRiwXm8BqErDBSbDw
+--- 1TIT9uR1Plo7w2XEnJSIpmZUF7wfDKCDF2SPCii50iM
-> ssh-ed25519 dMQYog OWU92PMFo9tGtlkK9zlmMFhh81TGkYlcX1PrxZl35yc
+\ùN"åÃÄíñ¨á:ùg´#ßŠóù•ˆY½5QåÕ[ÿ¤Å´#\øÈå›ÇËv ‹#ïÐ!Økp§Bò—å‘Ö¯<C396>Ö<1E>ÐpMq³ÜäÇ¯-ÚÝ¼(çßŒ)\Æ<><C386>Öô¨ê'1s°G–²e^ @Ž~
 owDk8wWXETS+iybhTMDmQH+eBuzZRDJIlVGCwu4LqTI
 -> ssh-ed25519 jQaHAA MzA8dSYZ/Ysp4ogKEEu84mal8779RgkT4Gy6rBEw+kM
 m75x/b83aP5G1vg7EXlcLizcm16fEAUAD+VNcdTMnnQ
 -> ssh-ed25519 w3nu8g AAA3Me3KJgLvtQvyxLvlQ7pCnv7w73ja6Z2+3A82eGs
 +yCW7qCdjk0fiQJmH8poMoc7APKyX/PY7zZyAG1O+Yg
 -> ssh-ed25519 dMQYog Dd8e6srT+EIl2PH0RP1bQVsDx+HCQjhFndx5TFyhfx8
 j7Met77pWZzK9cMTt29gWB+d9YFVH5T9qs+ulHS3kAo
 --- MgOK/g5hOVkGuUNDBSgVeGc9+ndjxLEA7nKSfLJMr4s
 ~Ÿ‹¬&”™)<29>ŠG®Ÿ¨‡'UÐÞzc¾uFGì(<ò¯ùçV"ƒÕ3þH0x0$•<>w$YvO3	"Ï×ðV~ÀŠ¸HÁ~XÛ]GœÆqµ®ã÷œ¢y'ãÓ*–Dê±ÏúœÕk#\ðAï<41>5ë{«Fe\~
--- a/secrets/spotifyd.age
+++ b/secrets/spotifyd.age
@@ -0,0 +1,10 @@
 age-encryption.org/v1
 -> ssh-ed25519 yHDAQw R1weIMur0s9HsBBwNn+XyBNfAB8CrQf6QEzIJFklcG8
 DTK0seypjzSX1B2ce2IWyYwygBeeKlbFpYgzH7i1DHA
 -> ssh-ed25519 dMQYog DU9sxA0/cG/O9EG3JYFjL1d2OiqOSZvFjZ1S2zTTWDw
 nGlUCvjpUp50ykTIUzSQ19uj2tiVMPo1Ois8xFSWB58
 -> z%z.3-grease lF#S
 H+5548VgikG9upeHi2GIQ3U71TC0ds+dn8yWOoixHnRhiYZRIhODffjI3D8T18gk
 1mjtW+c34E+ALRkSIf5iWwChJxsomS6LiMS3sqtJg4c
 --- o2hgAcfMDZyGIehN07CO7OjSCrmwUDRTrwxAKmGcfAY
 <<3C>¹ CÜGàÝ<C3A0>Ï0<C38F>
--- a/secrets/wolframalpha.age
+++ b/secrets/wolframalpha.age
@@ -1,10 +1,10 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g Kw5/he5m/XAJUNv8XEJQU+e+Ou7hCYluMXXWlHiePXY
+-> ssh-ed25519 6AT2/g xp04CsJvlYhBZS5W/MSDLWGiNCegAjg4XPv43wU5u0g
-GkhJOzSlcC9S7bs8FuDNMvMaFU3+fQ5z+o+Pb8wllp8
+i6q0YgKOFGaHOKVYMppNtcvjCFfHHqOS9M+oh2mqc1M
-> ssh-ed25519 w3nu8g fUORtXN1ygOeV42jveCosGXR/Y6R6OG6DK7LPDBEAk8
+-> ssh-ed25519 dMQYog Mk90WFb+fYCFV7afu3+VbuAtOlvRAgpJGFGqn4ZWGjE
-yFpoasbY/sl6BQp0LVBQnInA4Kxd8A8meEObU1KD108
+wHeScgV248lHiL0B/QEraD4QOBudezhJPrppY50u7S8
-> ssh-ed25519 dMQYog 75qVEe6/1yOV4DDLAOGaufs3ojx1/Sc1fIQOe+Oirz0
+-> G/9-grease
-iDFsr6/30AHKH6hUs/WTpHEM8WQ03QMlGbtQkGrnVCU
+0hCyP7pGu5xkk4eWJTpLWy6f8Zuo8wmgBSNFK7bgzfYdW29mdOrO2Ey3Oa2Gvtji
--- islx8t7a6bShXGxvYeDVuUxkmAMtpUfr0Gp7aYrJUkI
+rze9v27gMUFRXOqPHNmaSjAneCwtcqTMReV+LZr9q9FN6qZnzAE
-2Ûí4¤†7Õ
+--- /SN6cSyrvbDEHTiIvv4MdoVkIjz3yZkvtr2SVBE1rRk
-?Õw€À<E282AC>JÁÆØv	¨º9’,ËxÅŠò¨‰¦Æ¦ñnäH?>I
+=„ñ1fJ…XÍô‹~ÃÝÆD¬c¹aFâ¨@Ý¹c=89;¿sôv®Ïú´‘
--- a/Show More
+++ b/Show More