restructure desktop/wm and remove nur

microvm first running version

microvm first running version

README.md

@@ -1,2 +1,34 @@
 # nixos-config
 
+## Install
+
+### Patitioning
+
+- Easiest is to run [disko](https://git.kabtop.de/Kabbone/nixos-config/src/branch/main/disko)
+- **Classic way:**
+Partition disk with gdisk:
+1. EFI Partition, size 512M, type "EF00", Label "NIXBOOT"
+
+2. Root Partition, size 100%, type "8300", Label "NIXROOT"
+
+### Installing
+
+1. mount all the partitions and subvolumes to /mnt
+
+2. generate initial nixos config
+```
+# nixos-generate-config --root /mnt
+```
+
+3. clone flake and check config
+```
+# cd /mnt/etc/nixos/
+# git clone https://git.kabtop.de/Kabbone/nixos-config.git
+```
+
+4. install system
+```
+# nixos-install --flake .#<host>
+```
+
+5. reboot

disko/README.md

@@ -0,0 +1,37 @@
+## Step by step
+1. Boot the [installer](https://nixos.org/download.html#nixos-iso)
+
+2. Get disk name 
+```
+$ lsblk
+```
+
+3. Get disko config
+```
+$ curl https://git.kabtop.de/Kabbone/nixos-config/raw/branch/main/disko/btrfs_luks.nix -o /tmp/disko-config.nix
+```
+
+4. Adjust device name
+
+5. Let disko partition the disk
+```
+$ sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko -- --mode disko /tmp/disko-config.nix
+```
+
+6. Check if it got mounted
+```
+$ mount | grep /mnt
+```
+
+7. Continue with NixOS installation
+Filesystem definitions come from disko, hence "--no-filesystems"
+```
+$ nixos-generate-config --no-filesystems --root /mnt
+$ mv /tmp/disko-config.nix /mnt/etc/nixos
+```
+
+**Alternative:** continue with normal hardware-config
+```
+$ nixos-generate-config --root /mnt
+```
+

disko/btrfs.nix

@@ -0,0 +1,65 @@
+{
+  disko.devices = {
+    disk = {
+      nvme0n1 = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                extraArgs = [ "-n NIXBOOT" ];
+                mountpoint = "/boot";
+                mountOptions = [
+                  "defaults"
+                ];
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "btrfs";
+                extraArgs = [ "-f -L NIXROOT" ];
+                subvolumes = {
+                  "@" = {
+                    mountpoint = "/";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@home" = {
+                    mountpoint = "/home";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@nix" = {
+                    mountpoint = "/nix";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@snapshots" = {
+                    mountpoint = "/mnt";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@srv" = {
+                    mountpoint = "/srv";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@var" = {
+                    mountpoint = "/var";
+                    mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                  };
+                  "@swap" = {
+                    mountpoint = "/swap";
+                    swap.swapfile.size = "8G";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

disko/btrfs_luks.nix

@@ -0,0 +1,75 @@
+{
+  disko.devices = {
+    disk = {
+      nvme0n1 = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                extraArgs = [ "-n NIXBOOT" ];
+                mountpoint = "/boot";
+                mountOptions = [
+                  "defaults"
+                ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                askPassword = true;
+                # disable settings.keyFile if you want to use interactive password entry
+                #passwordFile = "/tmp/secret.key"; # Interactive
+                settings = {
+                  allowDiscards = true;
+                };
+                content = {
+                  type = "btrfs";
+                  extraArgs = [ "-f -L NIXROOT" ];
+                  subvolumes = {
+                    "@" = {
+                      mountpoint = "/";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@home" = {
+                      mountpoint = "/home";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@snapshots" = {
+                      mountpoint = "/mnt";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@srv" = {
+                      mountpoint = "/srv";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@var" = {
+                      mountpoint = "/var";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@swap" = {
+                      mountpoint = "/swap";
+                      swap.swapfile.size = "8G";
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

disko/nas_luks.nix

@@ -0,0 +1,47 @@
+{
+  disko.devices = {
+    disk = {
+      sda = {
+        type = "disk";
+        device = "/dev/sda";
+        content = {
+          type = "gpt";
+          partitions = {
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "NAS-RAID";
+                askPassword = true;
+                # disable settings.keyFile if you want to use interactive password entry
+                #passwordFile = "/tmp/secret.key"; # Interactive
+                settings = {
+                  allowDiscards = true;
+                };
+                content = {
+                  type = "btrfs";
+                  extraArgs = [ "-f -L NAS-RAID" ];
+                  subvolumes = {
+                    "@" = {
+                      mountpoint = "/mnt/Pluto";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                    "@/Backups";
+                    "@/Media";
+                    "@/Games";
+                    "@/IT";
+                    "@/Rest";
+                    "@snapshots" = {
+                      mountpoint = "/mnt";
+                      mountOptions = [ "compress=zstd" "noatime" "ssd" "discard=async" ];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

flake.lock

@@ -6,14 +6,15 @@
         "home-manager": "home-manager",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1683866323,
+        "lastModified": 1715290355,
-        "narHash": "sha256-M2bEuh2jr0Ec13GnP5f8unD8q0AcPt2fHSUynOZJ8No=",
+        "narHash": "sha256-2T7CHTqBXJJ3ZC6R/4TXTcKoXWHcvubKNj9SfomURnw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "92197270a1eedd142a4aff853e4cc6d1e838c22f",
+        "rev": "8d37c5bdeade12b6479c85acd133063ab53187a0",
         "type": "github"
       },
       "original": {
@@ -22,6 +23,27 @@
         "type": "github"
       }
     },
+    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1711299236,
+        "narHash": "sha256-6/JsyozOMKN8LUGqWMopKTSiK8N79T8Q+hcxu2KkTXg=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "880573f80d09e18a11713f402b9e6172a085449f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -30,11 +52,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1673295039,
+        "lastModified": 1700795494,
-        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
         "type": "github"
       },
       "original": {
@@ -44,6 +66,229 @@
         "type": "github"
       }
     },
+    "devshell": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1713532798,
+        "narHash": "sha256-wtBhsdMJA3Wa32Wtm1eeo84GejtI43pMrFrmwLXrsEc=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "12e914740a25ea1891ec619bb53cf5e6ca922e40",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "revCount": 57,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709336216,
+        "narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715865404,
+        "narHash": "sha256-/GJvTdTpuDjNn84j82cU6bXztE0MSkdnTWClUCRub78=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "8dc45382d5206bd292f9c2768b8058a8fd8311d9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-root": {
+      "locked": {
+        "lastModified": 1713493429,
+        "narHash": "sha256-ztz8JQkI08tjKnsTpfLqzWoKFQF4JGu2LRz8bkdnYUk=",
+        "owner": "srid",
+        "repo": "flake-root",
+        "rev": "bc748b93b86ee76e2032eecda33440ceb2532fcd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "repo": "flake-root",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -52,11 +297,31 @@
         ]
       },
       "locked": {
-        "lastModified": 1682203081,
+        "lastModified": 1703113217,
-        "narHash": "sha256-kRL4ejWDhi0zph/FpebFYhzqlOBrk0Pl3dzGEKSAlEw=",
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "32d3e39c491e2f91152c84f8ad8b003420eab0a1",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager-unstable": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715930644,
+        "narHash": "sha256-W9pyM3/vePxrffHtzlJI6lDS3seANQ+Nqp+i58O46LI=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "e3ad5108f54177e6520535768ddbf1e6af54b59d",
         "type": "github"
       },
       "original": {
@@ -72,70 +337,176 @@
         ]
       },
       "locked": {
-        "lastModified": 1683929392,
+        "lastModified": 1715381426,
-        "narHash": "sha256-qJddrb/bgS58AXAv25iv5xJ+69G5g7FAYCWec1lLnW0=",
+        "narHash": "sha256-wPuqrAQGdv3ISs74nJfGb+Yprm23U/rFpcHFFNWgM94=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "eec22729990ddf53d1e45e74624ddf667cdbe11b",
+        "rev": "ab5542e9dbd13d0100f8baae2bc2d68af901f4b4",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
+        "ref": "release-23.11",
         "repo": "home-manager",
         "type": "github"
       }
     },
-    "hyprland": {
+    "home-manager_3": {
-      "inputs": {
-        "hyprland-protocols": "hyprland-protocols",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "wlroots": "wlroots",
-        "xdph": "xdph"
-      },
-      "locked": {
-        "lastModified": 1683850587,
-        "narHash": "sha256-ncnstS+f6kgTTqyT0+6Kjnro3PY9KtXh79MBMjRgAnM=",
-        "owner": "vaxerski",
-        "repo": "Hyprland",
-        "rev": "cc01550aff70a0cbee5b62db5f4a08789244998f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "vaxerski",
-        "repo": "Hyprland",
-        "type": "github"
-      }
-    },
-    "hyprland-protocols": {
       "inputs": {
         "nixpkgs": [
-          "hyprland",
+          "nixvim",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1681065697,
+        "lastModified": 1715930644,
-        "narHash": "sha256-QPzwwlGKX95tl6ZEshboZbEwwAXww6lNLdVYd6T9Mrc=",
+        "narHash": "sha256-W9pyM3/vePxrffHtzlJI6lDS3seANQ+Nqp+i58O46LI=",
-        "owner": "hyprwm",
+        "owner": "nix-community",
-        "repo": "hyprland-protocols",
+        "repo": "home-manager",
-        "rev": "4d29e48433270a2af06b8bc711ca1fe5109746cd",
+        "rev": "e3ad5108f54177e6520535768ddbf1e6af54b59d",
         "type": "github"
       },
       "original": {
-        "owner": "hyprwm",
+        "owner": "nix-community",
-        "repo": "hyprland-protocols",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1708968331,
+        "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
+    "jovian-nixos": {
+      "inputs": {
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1716107076,
+        "narHash": "sha256-aB15oIMUv6N/UFsLHzgcGRUvU4YfOjE3gEirIP/k82s=",
+        "owner": "Jovian-Experiments",
+        "repo": "Jovian-NixOS",
+        "rev": "e8de93b7b4c384650977a20c1f192e23c6e7a12f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Jovian-Experiments",
+        "repo": "Jovian-NixOS",
+        "type": "github"
+      }
+    },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1713369831,
+        "narHash": "sha256-G4OGxvlIIjphpkxcRAkf1QInYsAeqbfNh6Yl1JLy2uM=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "850f27322239f8cfa56b122cc9a278ab99a49015",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
+    "microvm": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1715787097,
+        "narHash": "sha256-TPp2j0ttvBvkk4oXidvo8Y071zEab0BtcNsC3ZEkluI=",
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "rev": "fa673bf8656fe6f28253b83971a36999bc9995d2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715901937,
+        "narHash": "sha256-eMyvWP56ZOdraC2IOvZo0/RTDcrrsqJ0oJWDC76JTak=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "ffc01182f90118119930bdfc528c1ee9a39ecef8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "jovian-nixos",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1690328911,
+        "narHash": "sha256-fxtExYk+aGf2YbjeWQ8JY9/n9dwuEt+ma1eUFzF8Jeo=",
+        "owner": "zhaofengli",
+        "repo": "nix-github-actions",
+        "rev": "96df4a39c52f53cb7098b923224d8ce941b64747",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "ref": "matrix-name",
+        "repo": "nix-github-actions",
         "type": "github"
       }
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1683965003,
+        "lastModified": 1716034089,
-        "narHash": "sha256-DrzSdOnLv/yFBvS2FqmwBA2xIbN/Lny/WlxHyoLR9zE=",
+        "narHash": "sha256-QBfab6V4TeQ6Y4NiXVrEATdQuhCNFNaXt/L1K/Zw+zc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "81cd886719e10d4822b2a6caa96e95d56cc915ef",
+        "rev": "b55712de78725c8fcde422ee0a0fe682046e73c3",
         "type": "github"
       },
       "original": {
@@ -147,11 +518,43 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1683408522,
+        "lastModified": 1716061101,
-        "narHash": "sha256-9kcPh6Uxo17a3kK3XCHhcWiV1Yu1kYj22RHiymUhMkU=",
+        "narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1710695816,
+        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1715961556,
+        "narHash": "sha256-+NpbZRCRisUHKQJZF3CT+xn14ZZQO+KjxIIanH3Pvn4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "897876e4c484f1e8f92009fd11b7d988a121a4e7",
+        "rev": "4a6b83b05df1a8bd7d99095ec4b4d271f2956b64",
         "type": "github"
       },
       "original": {
@@ -161,34 +564,89 @@
         "type": "github"
       }
     },
-    "nixpkgs-stable": {
+    "nixvim": {
+      "inputs": {
+        "devshell": "devshell",
+        "flake-compat": "flake-compat_2",
+        "flake-parts": "flake-parts_2",
+        "flake-root": "flake-root",
+        "home-manager": "home-manager_3",
+        "nix-darwin": "nix-darwin",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "pre-commit-hooks": "pre-commit-hooks",
+        "treefmt-nix": "treefmt-nix"
+      },
       "locked": {
-        "lastModified": 1683928319,
+        "lastModified": 1716125991,
-        "narHash": "sha256-maz0DRKixJVcNRMiAMWlJniiF8IuQ+WbfmlJJ8D+jfM=",
+        "narHash": "sha256-PmB9vmp383foiVi64RawbnkC+6SiYiWUjdzw2xgl3eM=",
-        "owner": "NixOS",
+        "owner": "nix-community",
-        "repo": "nIxpkgs",
+        "repo": "nixvim",
-        "rev": "9656e85a15a0fe67847ee8cdb99a20d8df499962",
+        "rev": "88ade1dfaa017499326103a078c66dd5d4d0606e",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nix-community",
-        "ref": "nixos-22.11",
+        "repo": "nixvim",
-        "repo": "nIxpkgs",
         "type": "github"
       }
     },
-    "nur": {
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat_3",
+        "gitignore": "gitignore_2",
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1683962403,
+        "lastModified": 1715870890,
-        "narHash": "sha256-wJaQhKet22vmyxA3bPGNUGSmWElqMzCPKEnf8IzIYDQ=",
+        "narHash": "sha256-nacSOeXtUEM77Gn0G4bTdEOeFIrkCBXiyyFZtdGwuH0=",
-        "owner": "nix-community",
+        "owner": "cachix",
-        "repo": "NUR",
+        "repo": "pre-commit-hooks.nix",
-        "rev": "2d85d8781e4fa1e793c92763733b6b131e5aabbb",
+        "rev": "fa606cccd7b0ccebe2880051208e4a0f61bfc8c1",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "cachix",
-        "repo": "NUR",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "lanzaboote",
+          "flake-utils"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1710923068,
+        "narHash": "sha256-6hOpUiuxuwpXXc/xfJsBUJeqqgGI+JMJuLo45aG3cKc=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "e611897ddfdde3ed3eaac4758635d7177ff78673",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
         "type": "github"
       }
     },
@@ -196,53 +654,136 @@
       "inputs": {
         "agenix": "agenix",
         "home-manager": "home-manager_2",
-        "hyprland": "hyprland",
+        "home-manager-unstable": "home-manager-unstable",
+        "impermanence": "impermanence",
+        "jovian-nixos": "jovian-nixos",
+        "lanzaboote": "lanzaboote",
+        "microvm": "microvm",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-stable": "nixpkgs-stable",
+        "nixpkgs-unstable": "nixpkgs-unstable",
-        "nur": "nur"
+        "nixvim": "nixvim"
       }
     },
-    "wlroots": {
+    "rust-overlay": {
-      "flake": false,
-      "locked": {
-        "host": "gitlab.freedesktop.org",
-        "lastModified": 1682436395,
-        "narHash": "sha256-GGEjkQO9m7YLYIXIXM76HWdhjg4Ye+oafOtyaFAYKI4=",
-        "owner": "wlroots",
-        "repo": "wlroots",
-        "rev": "6830bfc17fd94709e2cdd4da0af989f102a26e59",
-        "type": "gitlab"
-      },
-      "original": {
-        "host": "gitlab.freedesktop.org",
-        "owner": "wlroots",
-        "repo": "wlroots",
-        "type": "gitlab"
-      }
-    },
-    "xdph": {
       "inputs": {
-        "hyprland-protocols": [
+        "flake-utils": [
-          "hyprland",
+          "lanzaboote",
-          "hyprland-protocols"
+          "flake-utils"
         ],
         "nixpkgs": [
-          "hyprland",
+          "lanzaboote",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1682439384,
+        "lastModified": 1711246447,
-        "narHash": "sha256-zHDa8LCZs05TZHQSIZ3ucwyMPglBGHcqTBzfkLjYXTM=",
+        "narHash": "sha256-g9TOluObcOEKewFo2fR4cn51Y/jSKhRRo4QZckHLop0=",
-        "owner": "hyprwm",
+        "owner": "oxalica",
-        "repo": "xdg-desktop-portal-hyprland",
+        "repo": "rust-overlay",
-        "rev": "c0e233955568fbea4e859336f6d3d14d51294d7c",
+        "rev": "dcc802a6ec4e9cc6a1c8c393327f0c42666f22e4",
         "type": "github"
       },
       "original": {
-        "owner": "hyprwm",
+        "owner": "oxalica",
-        "repo": "xdg-desktop-portal-hyprland",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1708358594,
+        "narHash": "sha256-e71YOotu2FYA67HoC/voJDTFsiPpZNRwmiQb4f94OxQ=",
+        "ref": "refs/heads/main",
+        "rev": "6d0e73864d28794cdbd26ab7b37259ab0e1e044c",
+        "revCount": 614,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1715940852,
+        "narHash": "sha256-wJqHMg/K6X3JGAE9YLM0LsuKrKb4XiBeVaoeMNlReZg=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "2fba33a182602b9d49f0b2440513e5ee091d838b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
         "type": "github"
       }
     }

flake.nix

@@ -11,41 +11,64 @@
 
   inputs =                                                                  # All flake references used to build my NixOS setup. These are dependencies.
     {
-      nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";                  # Nix Packages
+      nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";                  # Nix Packages
-      nixpkgs-stable.url = "github:NixOS/nIxpkgs/nixos-22.11";
+      nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
       nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
+      microvm = {
+        url = "github:astro/microvm.nix";
+        inputs.nixpkgs.follows = "nixpkgs";
+      };
+
+      impermanence.url = "github:nix-community/impermanence";
+
       home-manager = {                                                      # User Package Management
+        url = "github:nix-community/home-manager/release-23.11";
+        inputs.nixpkgs.follows = "nixpkgs";
+      };
+
+      home-manager-unstable = {                                                      # User Package Management
         url = "github:nix-community/home-manager";
-        inputs.nixpkgs.follows = "nixpkgs";
+        inputs.nixpkgs.follows = "nixpkgs-unstable";
-      };
-
-      nur = {
-        url = "github:nix-community/NUR";                                   # NUR Packages
-      };
-
-      hyprland = {                                                          # Official Hyprland flake
-        url = "github:vaxerski/Hyprland";
-        inputs.nixpkgs.follows = "nixpkgs";
       };
 
       agenix = {
         url = "github:ryantm/agenix";
         inputs.nixpkgs.follows = "nixpkgs";
       };
+
+      jovian-nixos = {
+          url = "github:Jovian-Experiments/Jovian-NixOS";
+          inputs.nixpkgs.follows = "nixpkgs-unstable";
+      };
+
+      lanzaboote = {
+          url = "github:nix-community/lanzaboote/master";
+          inputs.nixpkgs.follows = "nixpkgs";
+       };
+
+       nixvim = {
+           url = "github:nix-community/nixvim";
+           inputs.nixpkgs.follows = "nixpkgs-unstable";
+       };
     };
 
-  outputs = inputs @ { self, nixpkgs, nixpkgs-stable, nixos-hardware, home-manager, nur, hyprland, agenix, ... }:   # Function that tells my flake which to use and what do what to do with the dependencies.
+  outputs = inputs @ { self, nixpkgs, nixpkgs-unstable, nixos-hardware, home-manager, home-manager-unstable, agenix, jovian-nixos, microvm, impermanence, lanzaboote, nixvim, ... }:   # Function that tells my flake which to use and what do what to do with the dependencies.
     let                                                                     # Variables that can be used in the config files
       user = "kabbone";
+      userdmz = "diablo";
+      userserver = "mephisto";
       location = "$HOME/.setup";
     in                                                                      # Use above variables in ...
     {
       nixosConfigurations = (                                               # NixOS configurations
         import ./hosts {                                                    # Imports ./hosts/default.nix
           inherit (nixpkgs) lib;
-          inherit inputs nixpkgs nixpkgs-stable nixos-hardware home-manager nur user location hyprland agenix;   # Also inherit home-manager so it does not need to be defined here.
+          inherit inputs nixpkgs nixpkgs-unstable nixos-hardware home-manager home-manager-unstable user userdmz userserver location agenix jovian-nixos microvm impermanence lanzaboote nixvim;   # Also inherit home-manager so it does not need to be defined here.
+          nix.allowedUsers = [ "@wheel" ];
+          security.sudo.execWheelOnly = true;
         }
       );
     };
+
 }

hosts/configuration_desktop.nix

@@ -20,7 +20,7 @@
 
   users.users.${user} = {                   # System User
     isNormalUser = true;
-    extraGroups = [ "wheel" "video" "audio" "camera" "networkmanager" "lp" "kvm" "libvirtd" "adb" "dialout" ];
+    extraGroups = [ "wheel" "video" "audio" "camera" "networkmanager" "lp" "kvm" "libvirtd" "adb" "dialout" "tss" ];
     shell = pkgs.zsh;                       # Default shell
     uid = 2000;
 #    initialPassword = "password95";
@@ -31,7 +31,6 @@
       "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
     ];
   };
-  #security.sudo.wheelNeedsPassword = true; # User does not need to give password when using sudo.
 
   time.timeZone = "Europe/Berlin";        # Time zone and internationalisation
   i18n = {
@@ -47,26 +46,34 @@
     keyMap = "us";	                    # or us/azerty/etc
   };
 
-  security.rtkit.enable = true;
+  security = {
-  security.pki.certificateFiles = [
+    rtkit.enable = true;
+    pki.certificateFiles = [
       ./rootCA.pem
-  ];
+    ];
+    #tpm2 = {
+    #    enable = true;
+    #    pkcs11.enable = true;
+    #    tctiEnvironment.enable = true;
+    #  };
+  };
 
   sound = {                                 # ALSA sound enable
-    enable = true;
+    #enable = true;
     mediaKeys = {                           # Keyboard Media Keys (for minimal desktop) enable = true;
       enable = true;
     };
   };
 
-  fonts.fonts = with pkgs; [                # Fonts
+  fonts.packages = with pkgs; [                # Fonts
     carlito                                 # NixOS
     vegur                                   # NixOS
     source-code-pro
-    jetbrains-mono
     font-awesome                            # Icons
     hack-font
     corefonts                               # MS
+    intel-one-mono
+    cascadia-code
     (nerdfonts.override {                   # Nerdfont Icons override
       fonts = [
         "FiraCode"
@@ -105,6 +112,10 @@
       powerline-fonts
       powerline-symbols
       tree
+      direnv
+      linuxPackages_latest.cpupower
+      btop
+      sbctl
     ];
   };
 
@@ -136,11 +147,11 @@
 #      extraConfig = ''
 #        HostKeyAlgorithms +ssh-rsa
 #      '';                                   # Temporary extra config so ssh will work in guacamole
-      settings.passwordAuthentication = false;
+      settings.PasswordAuthentication = false;
     };
     pcscd.enable = true;
     yubikey-agent.enable = true;
-    udev.packages = [ pkgs.yubikey-personalization ];
+    udev.packages = [ pkgs.yubikey-personalization pkgs.nitrokey-udev-rules ];
     #flatpak.enable = true;                  # download flatpak file from website - sudo flatpak install <path> - reboot if not showing up
                                             # sudo flatpak uninstall --delete-data <app-id> (> flatpak list --app) - flatpak uninstall --unused
                                             # List:
@@ -159,8 +170,6 @@
   nix = {                                   # Nix Package Manager settings
     settings ={
       auto-optimise-store = true;           # Optimise syslinks
-      substituters = ["https://hyprland.cachix.org"];
-      trusted-public-keys = ["hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="];
     };
     gc = {                                  # Automatic garbage collection
       automatic = true;
@@ -168,25 +177,24 @@
       options = "--delete-older-than 7d";
     };
     package = pkgs.nixVersions.stable;               # Enable nixFlakes on system
-    registry.nixpkgs.flake = inputs.nixpkgs;
     extraOptions = ''
       experimental-features = nix-command flakes
-      keep-outputs          = true
-      keep-derivations      = true
     '';
   };
   nixpkgs.config.allowUnfree = true;        # Allow proprietary software.
-  nixpkgs.config.packageOverrides = pkgs: {
-    nur = import (builtins.fetchTarball "https://github.com/nix-community/NUR/archive/master.tar.gz") {
-      inherit pkgs;
-    };
-  };
 
   system = {                                # NixOS settings
-#    autoUpgrade = {                         # Allow auto update
+    autoUpgrade = {                         # Allow auto update
-#      enable = true;
+      enable = true;
-#      channel = "https://nixos.org/channels/nixos-unstable";
+      flake = "git+https://git.kabtop.de/Kabbone/nixos-config";
-#    };
+      randomizedDelaySec = "5m";
-    stateVersion = "22.05";
+      allowReboot = true;
+      rebootWindow = {
+          lower = "02:00";
+          upper = "05:00";
+      };
+      #channel = "https://nixos.org/channels/nixos-unstable";
+    };
+    stateVersion = "23.05";
   };
 }

hosts/configuration_server.nix

@@ -13,6 +13,8 @@
 { config, lib, pkgs, inputs, user, location, agenix, ... }:
 
 {
+
+
   imports =                                 # Import window or display manager.
     [
      #../modules/editors/nvim              # ! Comment this out on first install !
@@ -52,11 +54,11 @@
       ./rootCA.pem
   ];
 
-  fonts.fonts = with pkgs; [                # Fonts
+  fonts.packages = with pkgs; [                # Fonts
     carlito                                 # NixOS
     vegur                                   # NixOS
     source-code-pro
-    jetbrains-mono
+    cascadia-code
     font-awesome                            # Icons
     hack-font
     corefonts                               # MS
@@ -92,6 +94,9 @@
       powerline-fonts
       powerline-symbols
       tree
+      btop
+      htop
+      direnv
     ];
   };
 
@@ -99,15 +104,12 @@
     openssh = {                             # SSH: secure shell (remote connection to shell of server)
       enable = true;                        # local: $ ssh <user>@<ip>
       settings = {
-        passwordAuthentication = false;
+        PasswordAuthentication = false;
-        permitRootLogin = "no";
+        PermitRootLogin = "no";
       };
       ports = [ 2220 ];
       openFirewall = true;
     };
-    fail2ban = {
-        enable = true;
-    };
 
     #flatpak.enable = true;                  # download flatpak file from website - sudo flatpak install <path> - reboot if not showing up
                                             # sudo flatpak uninstall --delete-data <app-id> (> flatpak list --app) - flatpak uninstall --unused
@@ -123,7 +125,6 @@
       options = "--delete-older-than 7d";
     };
     package = pkgs.nixVersions.stable;               # Enable nixFlakes on system
-    registry.nixpkgs.flake = inputs.nixpkgs;
     extraOptions = ''
       experimental-features = nix-command flakes
       keep-outputs          = true
@@ -131,17 +132,18 @@
     '';
   };
   nixpkgs.config.allowUnfree = true;        # Allow proprietary software.
-  nixpkgs.config.packageOverrides = pkgs: {
-    nur = import (builtins.fetchTarball "https://github.com/nix-community/NUR/archive/master.tar.gz") {
-      inherit pkgs;
-    };
-  };
 
   system = {                                # NixOS settings
-#    autoUpgrade = {                         # Allow auto update
+    autoUpgrade = {                         # Allow auto update
-#      enable = true;
+      enable = true;
-#      channel = "https://nixos.org/channels/nixos-unstable";
+      flake = "git+https://git.kabtop.de/Kabbone/nixos-config";
-#    };
+      randomizedDelaySec = "5m";
-    stateVersion = "22.05";
+      allowReboot = true;
+      rebootWindow = {
+          lower = "02:00";
+          upper = "05:00";
+      };
+    };
+    stateVersion = "23.05";
   };
 }

hosts/default.nix

@@ -11,7 +11,7 @@
 #            └─ ./home.nix 
 #
 
-{ lib, inputs, nixpkgs, nixos-hardware, home-manager, nur, user, location, hyprland, agenix, ... }:
+{ lib, inputs, nixpkgs, nixpkgs-unstable, nixos-hardware, home-manager, home-manager-unstable, user, userdmz, userserver, location, agenix, jovian-nixos, microvm, impermanence, lanzaboote, nixvim, ... }:
 
 let
   system = "x86_64-linux";                                  # System architecture
@@ -22,27 +22,27 @@ let
   };
 
   lib = nixpkgs.lib;
+  users.defaultShell = "pkgs.zsh";
 
 in
 {
   desktop = lib.nixosSystem {                                # Desktop profile
     inherit system;
-    specialArgs = { inherit inputs user location hyprland nixos-hardware nur agenix; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix microvm nixpkgs lanzaboote nixvim; };
     modules = [
       agenix.nixosModules.default
-      nur.nixosModules.nur
+      microvm.nixosModules.host
-      #hyprland.nixosModules.default
+      lanzaboote.nixosModules.lanzaboote
+      #nixvim.nixosModules.nixvim
       ./desktop
       ./configuration_desktop.nix
+      ../modules/hardware/remoteBuilder.nix
       nixos-hardware.nixosModules.common-cpu-amd
       nixos-hardware.nixosModules.common-gpu-amd
       nixos-hardware.nixosModules.common-pc-ssd
       
 
       home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
         home-manager.useGlobalPkgs = true;
         home-manager.useUserPackages = true;
         home-manager.extraSpecialArgs = { inherit user; };
@@ -55,21 +55,17 @@ in
 
   laptop = lib.nixosSystem {                                # Laptop profile
     inherit system;
-    specialArgs = { inherit inputs user location hyprland nixos-hardware nur agenix; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix; };
     modules = [
       agenix.nixosModules.default
-      nur.nixosModules.nur
-      #hyprland.nixosModules.default
       ./laptop
       ./configuration_desktop.nix
+      ../modules/hardware/remoteClient.nix
       nixos-hardware.nixosModules.common-cpu-intel
       nixos-hardware.nixosModules.common-gpu-intel
       nixos-hardware.nixosModules.common-pc-ssd
 
       home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
         home-manager.useGlobalPkgs = true;
         home-manager.useUserPackages = true;
         home-manager.extraSpecialArgs = { inherit user; };
@@ -80,22 +76,43 @@ in
     ];
   };
 
-  dmz = lib.nixosSystem {                                # Desktop profile
+  steamdeck = nixpkgs-unstable.lib.nixosSystem {            # steamdeck profile
     inherit system;
-    #user = "dmz-user";
+    specialArgs = { inherit inputs user location nixos-hardware agenix jovian-nixos lanzaboote; };
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix; };
     modules = [
       agenix.nixosModules.default
-      nur.nixosModules.nur
+      jovian-nixos.nixosModules.default
+      lanzaboote.nixosModules.lanzaboote
+      ./steamdeck
+      ./configuration_desktop.nix
+      ../modules/hardware/remoteClient.nix
+      nixos-hardware.nixosModules.common-cpu-amd
+      nixos-hardware.nixosModules.common-gpu-amd
+      nixos-hardware.nixosModules.common-pc-ssd
+
+      home-manager-unstable.nixosModules.home-manager {
+        home-manager.useGlobalPkgs = true;
+        home-manager.useUserPackages = true;
+        home-manager.extraSpecialArgs = { inherit user; };
+        home-manager.users.${user} = {
+        imports = [(import ./home.nix)] ++ [(import ./steamdeck/home.nix)];
+        };
+      }
+    ];
+  };
+
+  server = lib.nixosSystem {                                # Desktop profile
+    inherit system;
+    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
+    modules = [
+      agenix.nixosModules.default
+      microvm.nixosModules.host
       ./server
       ./configuration_server.nix
       nixos-hardware.nixosModules.common-cpu-amd
       nixos-hardware.nixosModules.common-pc-ssd
 
       home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
         home-manager.useGlobalPkgs = true;
         home-manager.useUserPackages = true;
         home-manager.extraSpecialArgs = { inherit user; };
@@ -106,67 +123,108 @@ in
     ];
   };
 
-  nas = lib.nixosSystem {                                # Desktop profile
+  kabtop = lib.nixosSystem {                                # Desktop profile
     inherit system;
-    #user = "dmz-user";
+    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
-    specialArgs = { inherit inputs user location nixos-hardware nur agenix; };
     modules = [
       agenix.nixosModules.default
-      nur.nixosModules.nur
+      microvm.nixosModules.host
-      ./nas
+      ./kabtop
+      ./configuration_server.nix
+      nixos-hardware.nixosModules.common-cpu-amd
+      nixos-hardware.nixosModules.common-pc-ssd
+
+      home-manager.nixosModules.home-manager {
+        home-manager.useGlobalPkgs = true;
+        home-manager.useUserPackages = true;
+        home-manager.extraSpecialArgs = { inherit user; };
+        home-manager.users.${user} = {
+        imports = [(import ./home_server.nix)] ++ [(import ./server/home.nix)];
+        };
+      }
+    ];
+  };
+
+  nasbak = lib.nixosSystem {                                # Desktop profile
+    inherit system;
+    specialArgs = { inherit inputs user location nixos-hardware agenix; };
+    modules = [
+      agenix.nixosModules.default
+      ./nasbackup
       ./configuration_desktop.nix
+      ../modules/hardware/remoteClient.nix
       nixos-hardware.nixosModules.common-cpu-intel
       nixos-hardware.nixosModules.common-pc-ssd
 
       home-manager.nixosModules.home-manager {
-          nixpkgs.overlays = [
-            nur.overlay
-          ];
         home-manager.useGlobalPkgs = true;
         home-manager.useUserPackages = true;
         home-manager.extraSpecialArgs = { inherit user; };
         home-manager.users.${user} = {
-        imports = [(import ./home_server.nix)] ++ [(import ./nas/home.nix)];
+        imports = [(import ./home_server.nix)] ++ [(import ./nasbackup/home.nix)];
         };
       }
     ];
   };
 
-
+  jupiter = lib.nixosSystem {                                # Desktop profile
-  q920 = lib.nixosSystem {                                # Laptop profile
     inherit system;
-    specialArgs = { inherit inputs user location hyprland; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix; };
     modules = [
-      hyprland.nixosModules.default
+      agenix.nixosModules.default
-      ./q920
+      ./jupiter
-      ./configuration.nix
+      ./configuration_desktop.nix
+      ../modules/hardware/remoteClient.nix
+      nixos-hardware.nixosModules.common-cpu-intel
+      nixos-hardware.nixosModules.common-pc-ssd
 
       home-manager.nixosModules.home-manager {
         home-manager.useGlobalPkgs = true;
         home-manager.useUserPackages = true;
         home-manager.extraSpecialArgs = { inherit user; };
         home-manager.users.${user} = {
-          imports = [(import ./home.nix)] ++ [(import ./q920/home.nix)];
+        imports = [(import ./home_server.nix)] ++ [(import ./jupiter/home.nix)];
         };
       }
     ];
   };
 
-  vm = lib.nixosSystem {                                    # VM profile
+  dmz = lib.nixosSystem {                                # Desktop profile
     inherit system;
-    specialArgs = { inherit inputs user location; };
+    specialArgs = { inherit inputs user location nixos-hardware agenix nixpkgs impermanence; };
     modules = [
-      ./vm
+      agenix.nixosModules.default
-      ./configuration.nix
+      microvm.nixosModules.host
+      ./dmz
+      ./configuration_server.nix
+      nixos-hardware.nixosModules.common-pc-ssd
 
       home-manager.nixosModules.home-manager {
         home-manager.useGlobalPkgs = true;
         home-manager.useUserPackages = true;
         home-manager.extraSpecialArgs = { inherit user; };
         home-manager.users.${user} = {
-          imports = [(import ./home.nix)] ++ [(import ./vm/home.nix)];
+        imports = [(import ./home_server.nix)] ++ [(import ./dmz/home.nix)];
         };
       }
     ];
   };
+
+#  vm = lib.nixosSystem {                                    # VM profile
+#    inherit system;
+#    specialArgs = { inherit inputs user location; };
+#    modules = [
+#      ./vm
+#      ./configuration.nix
+#
+#      home-manager.nixosModules.home-manager {
+#        home-manager.useGlobalPkgs = true;
+#        home-manager.useUserPackages = true;
+#        home-manager.extraSpecialArgs = { inherit user; }; 
+#        home-manager.users.${user} = {
+#          imports = [(import ./home.nix)] ++ [(import ./vm/home.nix)];
+#        };
+#      }
+#    ];
+#  };
 }

hosts/desktop/default.nix

@@ -17,36 +17,41 @@
 #           └─ default.nix
 #
 
-{ config, pkgs, user, ... }:
+{ config, nixpkgs, pkgs, user, lib, nixvim, ... }:
 
 {
   imports =                                                         # For now, if applying to other system, swap files
     [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    #[(import ../../modules/desktop/hyprland/default.nix)] ++        # Window Manager
+    [(import ../../modules/wm/sway/default.nix)] ++         # Window Manager
-    [(import ../../modules/desktop/sway/default.nix)] ++        # Window Manager
+    (import ../../modules/wm/virtualisation) ++             # libvirt + Docker
-    (import ../../modules/desktop/virtualisation) ++   # Docker
+    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++   # kvm module options
-    (import ../../modules/hardware);                                # Hardware devices
+    (import ../../modules/hardware);                             # Hardware devices
 
   boot = {                                  # Boot options
     kernelPackages = pkgs.linuxPackages_latest;
 
     loader = {                              # EFI Boot
-      systemd-boot.enable = true;
+      systemd-boot.enable = lib.mkForce false;
       efi = {
         canTouchEfiVariables = true;
         efiSysMountPoint = "/boot";
       };
       timeout = 1;                          # Grub auto select time
     };
+
+    lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+    };
   };
 
 #  hardware.sane = {                           # Used for scanning with Xsane
 #    enable = false;
 #    extraBackends = [ pkgs.sane-airscan ];
 #  };
-  hardware = {
+#  hardware = {
-    nitrokey.enable = true;
+#    nitrokey.enable = true;
-  };
+#  };
 
 #  environment = {
 #    systemPackages = with pkgs; [
@@ -59,7 +64,6 @@
   programs = {                              # No xbacklight, this is the alterantive
     zsh.enable = true;
     dconf.enable = true;
-    light.enable = true;
     ssh.startAgent = false;
     gnupg.agent = {
       enable = true;
@@ -75,14 +79,18 @@
       enable = true;
       drivers = [ pkgs.gutenprint ];
     };
-    avahi = {                               # Needed to find wireless printer
+    #avahi = {                               # Needed to find wireless printer
-      enable = true;
+    #  enable = true;
-      nssmdns = true;
+    #  nssmdns = true;
-      publish = {                           # Needed for detecting the scanner
+    #  publish = {                           # Needed for detecting the scanner
+    #    enable = true;
+    #    addresses = true;
+    #    userServices = true;
+    #  };
+    #};
+    hardware.openrgb = {
         enable = true;
-        addresses = true;
+        motherboard = "amd";
-        userServices = true;
-      };
     };
 
   };

hosts/desktop/hardware-configuration.nix

@@ -14,14 +14,15 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")] ++
-    ];
+      [( import ../../modules/hardware/backup.nix )];
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ "vfio_pci" "vfio" "vfio_iommu_type1" ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
-  boot.tmp.useTmpfs = true;
+  boot.tmp.useTmpfs = false;
+  boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
 
   services.btrfs.autoScrub = {
@@ -59,110 +60,82 @@
   };
 
   fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXROOT";
+    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
       fsType = "btrfs";
       options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
     };
 
   fileSystems."/home" =
-    { device = "/dev/disk/by-label/NIXROOT";
+    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
       fsType = "btrfs";
       options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
     };
 
   fileSystems."/srv" =
-    { device = "/dev/disk/by-label/NIXROOT";
+    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
       fsType = "btrfs";
       options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
     };
 
   fileSystems."/nix" =
-    { device = "/dev/disk/by-label/NIXROOT";
+    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
       fsType = "btrfs";
       options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
     };
 
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
   fileSystems."/mnt/snapshots/root" =
-    { device = "/dev/disk/by-label/NIXROOT";
+    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part2";
       fsType = "btrfs";
       options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-label/NIXBOOT";
+    { device = "/dev/disk/by-id/nvme-ADATA_SX8200PNP_2J3320119186-part1";
       fsType = "vfat";
     };
 
   fileSystems."/mnt/Pluto" =
-    { device = "nas:/Pluto";
+    { device = "jupiter:/Pluto";
       fsType = "nfs";
       options = [ "noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2" ];
     };
 
   fileSystems."/mnt/Mars" =
-    { device = "nas:/Mars";
+    { device = "jupiter:/Mars";
       fsType = "nfs";
       options = [ "noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2" ];
     };
 
 
-  swapDevices = [ ];
+  swapDevices = [ { device = "/swap/swapfile"; } ];
   
   networking = {
-    vswitches = {
-        vs0 = {
-            interfaces = {
-                enp34s0 = {  };
-                lo1 = {
-                    type = "internal";
-                };
-                #enp34s0iot = {
-                #    type = "internal";
-                #    vlan = 100;
-                #};
-            };
-        };
-    };
     useDHCP = false;                        # Deprecated
     hostName = "hades";
-    domain = "home.opel-online.de";
     networkmanager = {
       enable = false;
     };
-    timeServers = [
-        "192.168.2.1"
-    ];
-    interfaces = {
-      #enp34s0 = {
-      #  useDHCP = true;                     # For versatility sake, manually edit IP on nm-applet.
-      #  #ipv4.addresses = [ {
-      #  #    address = "192.168.0.51";
-      #  #    prefixLength = 24;
-      #  #} ];
-      #};
-      #enp34s0iot.useDHCP = true;
-      lo1 = {
-          useDHCP = true;
-          macAddress = "1a:20:e9:ce:9c:1a";
-      };
-    };
-    #defaultGateway = "192.168.0.1";
-    defaultGateway6 = {
-      address = "fe80::1";
-      interface = "lo1";
-    };
-    #nameservers = [ "192.168.0.4" ];
-    #firewall = {
-    #  enable = false;
-    #  #allowedUDPPorts = [ 53 67 ];
-    #  #allowedTCPPorts = [ 53 80 443 9443 ];
-    #};
   };
 
-  systemd.services = {
+  systemd.network = {
-    "ovsdb".partOf = [ "network-setup.service" ];
+      enable = true;
-    "ovs-vswitchd".partOf = [ "network-setup.service" ];
+      networks = {
-    "network-addresses-lo1".partOf = [ "network-setup.service" ];
+          "10-lan" = {
+              matchConfig.Name = "enp34s0";
+              ntp = [ "192.168.2.1" ];
+              domains = [ "home.opel-online.de" ];
+              networkConfig = {
+                DHCP = "yes";
+                IPv6AcceptRA = true;
+              };
+          };
+      };
   };
 
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

hosts/desktop/home.nix

@@ -16,15 +16,15 @@
 {
   imports =
     [
-      #../../modules/desktop/hyprland/home.nix # Window Manager
+      #../../modules/wm/hyprland/home.nix # Window Manager
-      ../../modules/desktop/sway/home.nix # Window Manager
+      ../../modules/wm/sway/home.nix # Window Manager
       ../../modules/home.nix # Window Manager
     ];
 
   home = {                                # Specific packages for laptop
     packages = with pkgs; [
       # Applications
-      freecad                         # Office packages
+      #freecad                         # Office packages
       #firefox
       chromium
       thunderbird
@@ -35,6 +35,8 @@
       pulsemixer
       #yubioath-flutter
       nitrokey-app
+      kicad
+      yuzu-mainline
 
       # Display
       #light                              # xorg.xbacklight not supported. Other option is just use xrandr.

hosts/dmz/default.nix

@@ -0,0 +1,60 @@
+#
+#  Specific system configuration settings for desktop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │        ├─ default.nix *
+#   │        └─ hardware-configuration.nix       
+#   └─ ./modules
+#       ├─ ./desktop
+#       │   └─ ./hyprland
+#       │       └─ hyprland.nix
+#       ├─ ./modules
+#       │   └─ ./programs
+#       │       └─ waybar.nix
+#       └─ ./hardware
+#           └─ default.nix
+#
+
+{ config, pkgs, user, agenix, impermanence, ... }:
+
+{
+  imports =                                                         # For now, if applying to other system, swap files
+    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
+    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/kvm-intel.nix)] ++   # Docker
+    (import ../../modules/services/dmz) ++                       # Server Services
+    (import ../../modules/hardware);                                # Hardware devices
+
+  boot = {                                  # Boot options
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    loader = {                              # EFI Boot
+      systemd-boot.enable = true;
+      efi = {
+        canTouchEfiVariables = true;
+        efiSysMountPoint = "/boot";
+      };
+      timeout = 1;                          # Grub auto select time
+    };
+  };
+
+  programs = {                              # No xbacklight, this is the alterantive
+    zsh.enable = true;
+  };
+
+  services = {
+    qemuGuest.enable = true;
+    avahi = {                               # Needed to find wireless printer
+      enable = true;
+      nssmdns = true;
+      publish = {                           # Needed for detecting the scanner
+        enable = true;
+        addresses = true;
+        userServices = true;
+      };
+    };
+  };
+
+}

hosts/dmz/hardware-configuration.nix

@@ -0,0 +1,104 @@
+#
+# Hardware settings for Teclast F5 10" Laptop
+# NixOS @ sda2
+#
+# flake.nix
+#  └─ ./hosts
+#      └─ ./laptop
+#          └─ hardware-configuration.nix *
+#
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ "vfio_pci" "vfio" "vfio_iommu_type1" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.tmp.useTmpfs = false;
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+
+  services.btrfs.autoScrub = {
+    enable = true;
+    interval = "monthly";
+    fileSystems = [
+      "/"
+    ];
+  };
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
+    };
+
+  fileSystems."/srv" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
+    };
+
+  fileSystems."/var" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@var,discard=async" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
+  fileSystems."/mnt/snapshots/root" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
+    };
+
+  swapDevices = [  ];
+  
+  systemd.network = {
+      enable = true;
+      networks = {
+          "10-lan" = {
+              matchConfig.Name = "enp6s18";
+              ntp = [ "192.168.101.1" ];
+              domains = [ "home.opel-online.de" ];
+              networkConfig = {
+                DHCP = "yes";
+                IPv6AcceptRA = true;
+              };
+          };
+      };
+  };
+  networking = {
+    useDHCP = false;                        # Deprecated
+    hostName = "dmz";
+    firewall = {
+      enable = true;
+      allowedUDPPorts = [  ];
+      allowedTCPPorts = [  ];
+    };
+  };
+
+}

hosts/dmz/home.nix

@@ -16,19 +16,18 @@
 {
   imports =
     [
-      ../../modules/desktop/hyprland/home.nix # Window Manager
+      ../../modules/home.nix # Window Manager
     ];
 
   home = {                                # Specific packages for laptop
     packages = with pkgs; [
       # Applications
-      libreoffice                         # Office packages
 
       # Display
       #light                              # xorg.xbacklight not supported. Other option is just use xrandr.
 
       # Power Management
-      auto-cpufreq                       # Power management
+      #auto-cpufreq                       # Power management
       #tlp                                # Power management
     ];
   };
@@ -37,14 +36,4 @@
     alacritty.settings.font.size = 11;
   };
 
-  services = {                            # Applets
-    blueman-applet.enable = true;         # Bluetooth
-    network-manager-applet.enable = true; # Network
-#   cbatticon = {
-#     enable = true;
-#     criticalLevelPercent = 10;
-#     lowLevelPercent = 20;
-#     iconType = null;
-#   };
-  };
 }

hosts/home.nix

@@ -30,15 +30,16 @@
     homeDirectory = "/home/${user}";
 
     packages = with pkgs; [
-      # Terminal
+# Terminal
-      btop              # Resource Manager
       pfetch            # Minimal fetch
       ranger            # File Manager
       gnupg             # sign and authorize 2nd Fac
 
       xdg-utils
+      steam
+      wakelan
 
-      # dev tools
+# dev ols
       gcc
       gnumake
       gnupatch
@@ -49,18 +50,11 @@
       tailscale
       wireguard-tools
 
-      # Video/Audio
+# VideAudio
-      #feh               # Image Viewer
       mpv               # Media Player
       youtube-dl
-      #pavucontrol       # Audio control
-      #stremio           # Media Streamer
-      #libva-utils       # vainfo
 
-      # Apps
+# Apps
-      #firefox           # Browser
-      #google-chrome     # Browser
-      #remmina           # XRDP & VNC Client
       galculator
       tdesktop
       hdparm
@@ -69,90 +63,38 @@
       calibre
       mtpfs
       vimiv-qt
-      #freecad
+      freecad
 
-      # File Management
+# Fileanagement
       #okular            # PDF viewer
       #gnome.file-roller # Archive Manager
+      ark
       pcmanfm           # File Manager
       rsync             # Syncer $ rsync -r dir1/ dir2/
       unzip             # Zip files
       unrar             # Rar files
       papirus-icon-theme
 
-      # General configuration
+# Genel configuration
-      #git              # Repositories
-      #killall          # Stop Applications
-      #nano             # Text Editor
-      #pciutils         # Computer utility info
-      #pipewire         # Sound
-      #usbutils         # USB utility info
-      #wacomtablet      # Wacom Tablet
-      #wget             # Downloader
-      #zsh              # Shell
       keepassxc
       libreoffice
-      #
+
-      # General home-manager
-      #alacritty        # Terminal Emulator
-      #dunst            # Notifications
-      #doom emacs       # Text Editor
-      #flameshot        # Screenshot
-      #libnotify        # Dep for Dunst
-      #neovim           # Text Editor
-      #rofi             # Menu
-      #udiskie          # Auto Mounting
-      #vim              # Text Editor
-      #
-      # Xorg configuration
-      #xclip            # Console Clipboard
-      #xorg.xev         # Input viewer
-      #xorg.xkill       # Kill Applications
-      #xorg.xrandr      # Screen settings
-      #xterm            # Terminal
-      #
-      # Xorg home-manager
-      #picom            # Compositer
-      #polybar          # Bar
-      #sxhkd            # Shortcuts
-      #
-      # Wayland configuration
-      #autotiling       # Tiling Script
-      #swayidle         # Idle Management Daemon
-      #wev              # Input viewer
-      #wl-clipboard     # Console Clipboard
-      #
-      # Wayland home-manager
-      #pamixer          # Pulse Audio Mixer
-      #swaylock-fancy   # Screen Locker
-      #waybar           # Bar
-      #
-      # Desktop
-      #blueman          # Bluetooth
-      #deluge           # Torrents
-      #discord          # Chat
-      #ffmpeg           # Video Support (dslr)
-      #gmtp             # Mount MTP (GoPro)
-      #gphoto2          # Digital Photography
-      #handbrake        # Encoder
-      #heroic           # Game Launcher
-      #hugo             # Static Website Builder
-      #lutris           # Game Launcher
-      #mkvtoolnix       # Matroska Tool
-      #new-lg4ff        # Logitech Drivers
-      #plex-media-player# Media Player
-      #polymc           # MC Launcher
-      #steam            # Games
-      #simple-scan      # Scanning
-      # 
-      # Laptop
-      #blueman          # Bluetooth
-      #light            # Display Brightness
-      #libreoffice      # Office Tools
-      #simple-scan      # Scanning
-      #
       # Flatpak
-      #obs-studio       # Recording/Live Streaming
+      prusa-slicer
+      #vscodium
+      (vscode-with-extensions.override {
+          vscode = vscodium;
+          vscodeExtensions = with vscode-extensions; [
+            vscodevim.vim
+            github.copilot
+            #ms-python.python
+            ms-vscode.cpptools
+            dracula-theme.theme-dracula
+            catppuccin.catppuccin-vsc
+            catppuccin.catppuccin-vsc-icons
+
+          ];
+      })
     ];
     file.".config/wall".source = ../modules/themes/wall.jpg;
     file.".config/lockwall".source = ../modules/themes/lockwall.jpg;
@@ -162,7 +104,7 @@
       size = 16;
       gtk.enable = true;
     };
-    stateVersion = "22.05";
+    stateVersion = "23.05";
   };
 
   programs = {
@@ -170,20 +112,20 @@
   };
 
 
-  gtk = {                                     # Theming
+#  gtk = {                                     # Theming
-    enable = true;
+#    enable = true;
-    theme = {
+#    theme = {
-      name = "Dracula";
+#      name = "Dracula";
-      package = pkgs.dracula-theme;
+#      package = pkgs.dracula-theme;
-    };
+#    };
-    iconTheme = {
+#    iconTheme = {
-      name = "Papirus-Dark";
+#      name = "Papirus-Dark";
-      package = pkgs.papirus-icon-theme;
+#      package = pkgs.papirus-icon-theme;
-    };
+#    };
-    font = {
+#    font = {
-      name = "JetBrains Mono Medium";         # or FiraCode Nerd Font Mono Medium
+#      name = "Cascadia Code";         # or FiraCode Nerd Font Mono Medium
-    };                                        # Cursor is declared under home.pointerCursor
+#    };                                        # Cursor is declared under home.pointerCursor
-  };
+#  };
   systemd.user.services.mpris-proxy = {
     Unit.Description = "Mpris proxy";
     Unit.After = [ "network.target" "sound.target" ];

hosts/home_server.nix

@@ -31,7 +31,6 @@
 
     packages = with pkgs; [
       # Terminal
-      btop              # Resource Manager
       pfetch            # Minimal fetch
       ranger            # File Manager
       gnupg             # sign and authorize 2nd Fac
@@ -51,7 +50,7 @@
       #unrar             # Rar files
 
     ];
-    stateVersion = "22.05";
+    stateVersion = "23.11";
   };
 
   programs = {

hosts/jupiter/default.nix

@@ -0,0 +1,74 @@
+#
+#  Specific system configuration settings for desktop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │        ├─ default.nix *
+#   │        └─ hardware-configuration.nix       
+#   └─ ./modules
+#       ├─ ./desktop
+#       │   └─ ./hyprland
+#       │       └─ hyprland.nix
+#       ├─ ./modules
+#       │   └─ ./programs
+#       │       └─ waybar.nix
+#       └─ ./hardware
+#           └─ default.nix
+#
+
+{ config, pkgs, user, ... }:
+
+{
+  imports =                                                         # For now, if applying to other ssystem, swap files
+    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
+    #(import ../../modules/wm/virtualisation) ++   # Docker
+    (import ../../modules/services/nas) ++                       # Server Services
+    (import ../../modules/hardware);                                # Hardware devices
+
+  boot = {                                  # Boot options
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    loader = {                              # EFI Boot
+      systemd-boot.enable = true;
+      efi = {
+        canTouchEfiVariables = true;
+        efiSysMountPoint = "/boot";
+      };
+      timeout = 1;                          # Grub auto select time
+    };
+  };
+
+#  environment = {
+#    systemPackages = with pkgs; [
+##      simple-scan
+##       intel-media-driver
+##       alacritty
+#    ];
+#  };
+
+  programs = {                              # No xbacklight, this is the alterantive
+    zsh.enable = true;
+    ssh.startAgent = false;
+    gnupg.agent = {
+      enable = false;
+      enableSSHSupport = true;
+      pinentryFlavor = "curses";
+    };
+  };
+
+  services = {
+    qemuGuest.enable = true;
+    avahi = {                               # Needed to find wireless printer
+      enable = true;
+      nssmdns = true;
+      publish = {                           # Needed for detecting the scanner
+        enable = true;
+        addresses = true;
+        userServices = true;
+      };
+    };
+
+  };
+
+}

hosts/jupiter/hardware-configuration.nix

@@ -0,0 +1,237 @@
+#
+# Hardware settings for Teclast F5 10" Laptop
+# NixOS @ sda2
+#
+# flake.nix
+#  └─ ./hosts
+#      └─ ./laptop
+#          └─ hardware-configuration.nix *
+#
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [(modulesPath + "/profiles/qemu-guest.nix")] ++
+    [( import ../../modules/hardware/backup.nix )];
+
+  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [  ];
+  boot.initrd.secrets = {
+    "/root/NASKeyfile" =
+        /root/NASKeyfile;
+  };
+  boot.initrd.luks.devices = {
+    NAS-RAID1 = {
+      device = "/dev/disk/by-uuid/78c74410-c840-49b0-8a29-456d60c38217";
+      keyFile = "/root/NASKeyfile";
+    };
+    NAS-RAID1_2 = {
+      device = "/dev/disk/by-uuid/dda6e698-4f0a-4d71-a06c-656b87374ed7";
+      keyFile = "/root/NASKeyfile";
+    };
+  };
+  boot.kernelModules = [  ];
+  boot.extraModulePackages = [ ];
+  boot.tmp.useTmpfs = false;
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+
+  services.btrfs.autoScrub = {
+    enable = true;
+    interval = "monthly";
+    fileSystems = [
+      "/"
+      "/mnt/Mars"
+      "/mnt/Pluto"
+    ];
+  };
+
+  services.btrbk = {
+      instances = {
+          hf = {
+              onCalendar = "hourly";
+              settings = {
+                  incremental = "yes";
+                  snapshot_create = "ondemand";
+                  snapshot_dir = "@snapshots";
+                  timestamp_format = "long";
+
+                  snapshot_preserve = "2m 2w 5d 5h";
+                  snapshot_preserve_min = "latest";
+                
+                  volume =  {
+                      "/mnt/snapshots/root" = {
+                          snapshot_create = "always";
+                          subvolume = {
+                              "@" = {};
+                              "@home" = {};
+                          };
+                      };
+                  };
+                  volume =  {
+                      "/mnt/snapshots/Mars" = {
+                          snapshot_create = "always";
+                          subvolume = {
+                              "@nas" = {};
+                          };
+                      };
+                  };
+              };
+          };
+          lf = {
+              onCalendar = "daily";
+              settings = {
+                  incremental = "yes";
+                  snapshot_create = "ondemand";
+                  snapshot_dir = "@snapshots";
+                  timestamp_format = "long";
+
+                  snapshot_preserve = "2m 2w 5d";
+                  snapshot_preserve_min = "latest";
+                
+                  volume =  {
+                      "/mnt/snapshots/Pluto" = {
+                          snapshot_create = "always";
+                          subvolume = {
+                            "@" = {};
+                            "@/Backups" = {};
+                            "@/Games" = {};
+                            "@/IT" = {};
+                            "@/Media" = {};
+                            "@/Pictures" = {};
+                            "@/Rest" = {};
+                          };
+                      };
+                  };
+              };
+          };
+      };
+  };
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
+    };
+
+  fileSystems."/srv" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
+    fileSystems."/mnt/snapshots/root" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
+    };
+
+    fileSystems."/mnt/snapshots/Mars" =
+    { device = "/dev/disk/by-label/MARS";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
+    };
+
+  fileSystems."/mnt/snapshots/Pluto" =
+    { device = "/dev/disk/by-label/NAS-RAID";
+      fsType = "btrfs";
+      options = [ "compress=zstd:8,noatime,subvolid=5" ];
+    };
+
+  fileSystems."/mnt/Pluto" =
+    { device = "/dev/disk/by-label/NAS-RAID";
+      fsType = "btrfs";
+      options = [ "compress=zstd:8,noatime,subvol=@" ];
+    };
+
+  fileSystems."/mnt/Mars" =
+    { device = "/dev/disk/by-label/MARS";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nas,discard=async" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+    };
+
+  fileSystems."/export/Pluto" =
+    { device = "/mnt/Pluto";
+      options = [ "bind" ];
+    };
+ 
+  fileSystems."/export/Mars" =
+    { device = "/mnt/Mars";
+      options = [ "bind" ];
+    };
+ 
+  swapDevices = [ { device = "/swap/swapfile"; } ];
+  
+  networking = {
+    hostName = "jupiter";
+    domain = "home.opel-online.de";
+    networkmanager = {
+      enable = false;
+    };
+    timeServers = [
+        "192.168.2.1"
+    ];
+    interfaces = {
+      enp6s18 = {
+        useDHCP = true;                     # For versatility sake, manually edit IP on nm-applet.
+#        ipv4.addresses = [ {
+#            address = "45.142.114.153";
+#            prefixLength = 24;
+#        } ];
+#        ipv6.addresses = [ {
+#            address = "2a00:ccc1:101:19D::2";
+#            prefixLength = 64;
+#        } ];
+#      };
+      };
+    };
+#    defaultGateway = "45.142.114.1";
+    defaultGateway6 = {
+      address = "fe80::1";
+      interface = "enp6s18";
+    };
+#    nameservers = [ "9.9.9.9" "2620:fe::fe" ];
+    #firewall = {
+    #  enable = false;
+    #  #allowedUDPPorts = [ 53 67 ];
+    #  #allowedTCPPorts = [ 53 80 443 9443 ];
+    #};
+  };
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  powerManagement = {
+    cpuFreqGovernor = lib.mkDefault "powersave";
+    powertop.enable = true;
+    scsiLinkPolicy = "med_power_with_dipm";
+    powerUpCommands = ''
+      ${pkgs.hdparm}/sbin/hdparm -S 150 /dev/disk/by-uuid/57e6446d-faca-4b67-9063-e8d9afb80088
+    '';
+  };
+  
+}

hosts/jupiter/home.nix

@@ -0,0 +1,39 @@
+#
+#  Home-manager configuration for laptop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │       └─ home.nix *
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./hyprland
+#              └─ hyprland.nix
+#
+
+{ pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/home.nix # Window Manager
+    ];
+
+  home = {                                # Specific packages for laptop
+    packages = with pkgs; [
+      # Applications
+
+      # Display
+      #light                              # xorg.xbacklight not supported. Other option is just use xrandr.
+
+      # Power Management
+      #auto-cpufreq                       # Power management
+      #tlp                                # Power management
+    ];
+  };
+
+  programs = {
+    alacritty.settings.font.size = 11;
+  };
+
+}

hosts/kabtop/default.nix

@@ -0,0 +1,112 @@
+#
+#  Specific system configuration settings for desktop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │        ├─ default.nix *
+#   │        └─ hardware-configuration.nix       
+#   └─ ./modules
+#       ├─ ./desktop
+#       │   └─ ./hyprland
+#       │       └─ hyprland.nix
+#       ├─ ./modules
+#       │   └─ ./programs
+#       │       └─ waybar.nix
+#       └─ ./hardware
+#           └─ default.nix
+#
+
+{ config, pkgs, user, agenix, impermanence, ... }:
+
+{
+  imports =                                                         # For now, if applying to other system, swap files
+    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
+    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++  # kvm module options
+    (import ../../modules/services/server) ++                       # Server Services
+    (import ../../modules/hardware);                                # Hardware devices
+
+  boot = {                                  # Boot options
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    loader = {                              # EFI Boot
+    grub = {
+        enable = true;
+        device = "/dev/sda";
+    };
+      timeout = 1;                          # Grub auto select time
+    };
+  };
+
+  environment = {
+    etc = {
+      "fail2ban/filter.d/open-webui.conf" = {
+        source = ../../modules/services/server/fail2ban/filter/open-webui.conf;
+        mode = "0444";
+      };
+      "fail2ban/filter.d/gitea.conf" = {
+        source = ../../modules/services/server/fail2ban/filter/gitea.conf;
+        mode = "0444";
+      };
+      "fail2ban/filter.d/nextcloud.conf" = {
+        source = ../../modules/services/server/fail2ban/filter/nextcloud.conf;
+        mode = "0444";
+      };
+    };
+  };
+
+  programs = {                              # No xbacklight, this is the alterantive
+    zsh.enable = true;
+    ssh.startAgent = false;
+    gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+      pinentryFlavor = "curses";
+    };
+  };
+
+  services = {
+    #auto-cpufreq.enable = true;
+    qemuGuest.enable = true;
+    avahi = {                               # Needed to find wireless printer
+      enable = true;
+      nssmdns = true;
+      publish = {                           # Needed for detecting the scanner
+        enable = true;
+        addresses = true;
+        userServices = true;
+      };
+    };
+    fail2ban = {
+        enable = true;
+        maxretry = 5;
+        jails.DEFAULT.settings = {
+           findtime = "15m";
+        };
+        jails = {
+            open-webui = ''
+              enabled = true
+              filter = open-webui
+              backend = systemd
+              action = iptables-allports
+            '';
+            gitea = ''
+              enabled = true
+              filter = gitea
+              backend = systemd
+              action = iptables-allports
+            '';
+            nextcloud = ''
+              backend = auto
+              enabled = true
+              filter = nextcloud
+              logpath = /var/lib/nextcloud/data/nextcloud.log
+              action = iptables-allports
+            '';
+          };
+    };
+
+  };
+
+}

hosts/kabtop/hardware-configuration.nix

@@ -0,0 +1,144 @@
+#
+# Hardware settings for Teclast F5 10" Laptop
+# NixOS @ sda2
+#
+# flake.nix
+#  └─ ./hosts
+#      └─ ./laptop
+#          └─ hardware-configuration.nix *
+#
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [  "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "ahci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ "vfio_pci" "vfio" "vfio_iommu_type1" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+  boot.tmp.useTmpfs = false;
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+
+  services.btrfs.autoScrub = {
+    enable = true;
+    interval = "monthly";
+    fileSystems = [
+      "/"
+    ];
+  };
+
+  services.btrbk = {
+      instances = {
+          hf = {
+              onCalendar = "hourly";
+              settings = {
+                  incremental = "yes";
+                  snapshot_create = "ondemand";
+                  snapshot_dir = "@snapshots";
+                  timestamp_format = "long";
+
+                  snapshot_preserve = "2m 2w 5d 5h";
+                  snapshot_preserve_min = "latest";
+                
+                  volume =  {
+                      "/mnt/snapshots/root" = {
+                          snapshot_create = "always";
+                          subvolume = {
+                              "@" = {};
+                              "@home" = {};
+                          };
+                      };
+                  };
+              };
+          };
+      };
+  };
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
+    };
+
+  fileSystems."/srv" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
+    };
+
+  fileSystems."/var" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "space_cache=v2,ssd,noatime,subvol=@var,discard=async" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
+  fileSystems."/mnt/snapshots/root" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
+    };
+
+
+  #swapDevices = [ { device = "/swap/swapfile"; } ];
+  swapDevices = [  ];
+  
+  networking = {
+    useDHCP = false;                        # Deprecated
+    hostName = "kabtop";
+    domain = "kabtop.de";
+    networkmanager = {
+      enable = false;
+    };
+    interfaces = {
+      ens18 = {
+        useDHCP = false;                     # For versatility sake, manually edit IP on nm-applet.
+        ipv4.addresses = [ {
+            address = "37.44.215.182";
+            prefixLength = 24;
+        } ];
+        ipv6.addresses = [ {
+            address = "2a13:7e80:0:ef::2";
+            prefixLength = 64;
+        } ];
+      };
+    };
+    defaultGateway = "37.44.215.1";
+    defaultGateway6 = {
+      address = "fe80::1";
+      interface = "ens18";
+    };
+
+    nameservers = [ "9.9.9.9" "2620:fe::fe" ];
+    firewall = {
+      enable = true;
+      allowedUDPPorts = [  ];
+      allowedTCPPorts = [ 80 443 ];
+    };
+  };
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/kabtop/home.nix

@@ -0,0 +1,39 @@
+#
+#  Home-manager configuration for laptop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │       └─ home.nix *
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./hyprland
+#              └─ hyprland.nix
+#
+
+{ pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/home.nix # Window Manager
+    ];
+
+  home = {                                # Specific packages for laptop
+    packages = with pkgs; [
+      # Applications
+
+      # Display
+      #light                              # xorg.xbacklight not supported. Other option is just use xrandr.
+
+      # Power Management
+      #auto-cpufreq                       # Power management
+      #tlp                                # Power management
+    ];
+  };
+
+  programs = {
+    alacritty.settings.font.size = 11;
+  };
+
+}

hosts/laptop/default.nix

@@ -22,9 +22,10 @@
 {
   imports =                                                         # For now, if applying to other system, swap files
     [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    #[(import ../../modules/desktop/hyprland/default.nix)] ++        # Window Manager
+    #[(import ../../modules/wm/hyprland/default.nix)] ++        # Window Manager
-    [(import ../../modules/desktop/sway/default.nix)] ++        # Window Manager
+    [(import ../../modules/wm/sway/default.nix)] ++        # Window Manager
-    [(import ../../modules/desktop/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/kvm-intel.nix)] ++   # kvm module options
     (import ../../modules/hardware);                                # Hardware devices
 
   boot = {                                  # Boot options
@@ -57,6 +58,7 @@
   };
 
   programs = {                              # No xbacklight, this is the alterantive
+    zsh.enable = true;
     dconf.enable = true;
     light.enable = true;
     ssh.startAgent = false;

hosts/laptop/hardware-configuration.nix

@@ -17,24 +17,29 @@
     [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" "rtsx_usb_sdmmc" ];
+  boot = {
-  boot.initrd.kernelModules = [ "i915" "kvm_intel" ];
+	  initrd = {
-  boot.kernelModules = [ "kvm-intel" ];
+		  availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" "rtsx_usb_sdmmc" ];
-  boot.extraModprobeConfig = ''
+		  kernelModules = [ "i915" "kvm_intel" ];
-      options i915 enable_guc=3 enable_fbc=1 fastboot=1
+		  systemd.enable = true;
-      '';
+		  luks = {
-  boot.kernelParams = [ "mitigations=off" "luks.options=fido2-device=auto" ];
+			  devices."root" = {
-  boot.tmp.useTmpfs = true;
+				  device = "/dev/disk/by-uuid/75eccc7f-30b0-4fe8-8f82-90edaf284cd5";
-  zramSwap.enable = true;
+				  allowDiscards = true;
+			  };
+		  };
+	  };
 
-  boot.initrd.luks = {
+	  kernelModules = [ "kvm-intel" ];
-    fido2Support = true;
+	  extraModprobeConfig = ''
-    devices."root" = {
+		  options i915 enable_guc=3 enable_fbc=1 fastboot=1
-      device = "/dev/disk/by-uuid/75eccc7f-30b0-4fe8-8f82-90edaf284cd5";
+		  '';
-      allowDiscards = true;
+	  kernelParams = [ "mitigations=off" "luks.options=fido2-device=auto" ];
-    };
+	  tmp.useTmpfs = true;
   };
 
+  zramSwap.enable = true;
+
   services.btrfs.autoScrub = {
     enable = true;
     interval = "monthly";
@@ -111,13 +116,13 @@
     };
 
   fileSystems."/mnt/Pluto" =
-    { device = "nas:/Pluto";
+    { device = "jupiter:/Pluto";
       fsType = "nfs";
       options = [ "noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2" ];
     };
 
   fileSystems."/mnt/Mars" =
-    { device = "nas:/Mars";
+    { device = "jupiter:/Mars";
       fsType = "nfs";
       options = [ "noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2" ];
     };

hosts/laptop/home.nix

@@ -16,8 +16,8 @@
 {
   imports =
     [
-      #../../modules/desktop/hyprland/home.nix # Window Manager
+      #../../modules/wm/hyprland/home.nix # Window Manager
-      ../../modules/desktop/sway/home.nix # Window Manager
+      ../../modules/wm/sway/home.nix # Window Manager
       ../../modules/home.nix # Window Manager
     ];
 

hosts/nas/default.nix

@@ -22,7 +22,7 @@
 {
   imports =                                                         # For now, if applying to other system, swap files
     [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    (import ../../modules/desktop/virtualisation) ++   # Docker
+    (import ../../modules/wm/virtualisation) ++   # Docker
     (import ../../modules/services/nas) ++                       # Server Services
     (import ../../modules/hardware);                                # Hardware devices
 

hosts/nas/hardware-configuration.nix

@@ -35,7 +35,8 @@
   };
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
-  boot.tmp.useTmpfs = true;
+  boot.tmp.useTmpfs = false;
+  boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
 
   services.btrfs.autoScrub = {
@@ -66,7 +67,7 @@
                           subvolume = {
                               "@" = {};
                               "@home" = {};
-                              "@nas/home" = {};
+                              "@nas/Home" = {};
                           };
                       };
                   };
@@ -126,6 +127,12 @@
       options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
     };
 
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
     fileSystems."/mnt/snapshots/root" =
     { device = "/dev/disk/by-label/NIXROOT";
       fsType = "btrfs";
@@ -171,7 +178,7 @@
       options = [ "bind" ];
     };
  
-  swapDevices = [ ];
+  swapDevices = [ { device = "/swap/swapfile"; } ];
   
   networking = {
     vswitches = {

hosts/nasbackup/default.nix

@@ -0,0 +1,66 @@
+#
+#  Specific system configuration settings for desktop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │        ├─ default.nix *
+#   │        └─ hardware-configuration.nix       
+#   └─ ./modules
+#       ├─ ./desktop
+#       │   └─ ./hyprland
+#       │       └─ hyprland.nix
+#       ├─ ./modules
+#       │   └─ ./programs
+#       │       └─ waybar.nix
+#       └─ ./hardware
+#           └─ default.nix
+#
+
+{ config, pkgs, user, ... }:
+
+{
+  imports =                                                         # For now, if applying to other system, swap files
+    [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
+    #[(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
+    (import ../../modules/services/nasbackup) ++                       # Server Services
+    (import ../../modules/hardware);                                # Hardware devices
+
+  boot = {                                  # Boot options
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    loader = {                              # EFI Boot
+      systemd-boot.enable = true;
+      efi = {
+        canTouchEfiVariables = true;
+        efiSysMountPoint = "/boot";
+      };
+      timeout = 1;                          # Grub auto select time
+    };
+  };
+
+  programs = {                              # No xbacklight, this is the alterantive
+    zsh.enable = true;
+    ssh.startAgent = false;
+    gnupg.agent = {
+      enable = false;
+      enableSSHSupport = true;
+      pinentryFlavor = "curses";
+    };
+  };
+
+  services = {
+    qemuGuest.enable = true;
+    avahi = {                               # Needed to find wireless printer
+      enable = true;
+      nssmdns = true;
+      publish = {                           # Needed for detecting the scanner
+        enable = true;
+        addresses = true;
+        userServices = true;
+      };
+    };
+
+  };
+
+}

hosts/nasbackup/hardware-configuration.nix

@@ -0,0 +1,247 @@
+
+# Hardware settings for Teclast F5 10" Laptop
+# NixOS @ sda2
+#
+# flake.nix
+#  └─ ./hosts
+#      └─ ./laptop
+#          └─ hardware-configuration.nix *
+#
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ "vfio_pci" "vfio" "vfio_iommu_type1" ];
+  boot.initrd.secrets = {
+    "/root/NASKeyfile" =
+        /root/NASKeyfile;
+  };
+  boot.initrd.luks.devices = {
+    NAS-RAID1 = {
+      device = "/dev/disk/by-uuid/57e6446d-faca-4b67-9063-e8d9afb80088";
+      keyFile = "/root/NASKeyfile";
+      bypassWorkqueues = true;
+    };
+    NAS-RAID2 = {
+      device = "/dev/disk/by-uuid/b9edc489-ac37-4b28-981d-442722df7ae2";
+      keyFile = "/root/NASKeyfile";
+      bypassWorkqueues = true;
+    };
+  };
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.tmp.useTmpfs = false;
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+
+  services.btrfs.autoScrub = {
+    enable = true;
+    interval = "monthly";
+    fileSystems = [
+      "/"
+      "/mnt/nas"
+    ];
+  };
+
+  services.btrbk = {
+      extraPackages = [ pkgs.lz4 ];
+      instances = {
+          hf = {
+              onCalendar = "hourly";
+              settings = {
+                  incremental = "yes";
+                  snapshot_create = "ondemand";
+                  snapshot_dir = "@snapshots";
+                  timestamp_format = "long";
+
+                  snapshot_preserve = "2m 2w 5d 5h";
+                  snapshot_preserve_min = "latest";
+                
+                  volume =  {
+                      "/mnt/snapshots/root" = {
+                          snapshot_create = "always";
+                          subvolume = {
+                              "@" = {};
+                              "@home" = {};
+                          };
+                      };
+                  };
+              };
+          };
+          bak = {
+              onCalendar = "weekly";
+              settings = {
+                  stream_compress = "lz4";
+                  incremental = "yes";
+                  snapshot_create = "no";
+                  snapshot_dir = "@snapshots";
+                  timestamp_format = "long";
+
+                  snapshot_preserve_min = "all";
+                  target_preserve_min = "no";
+                  target_preserve = "4w 2m";
+
+                  ssh_identity = "/etc/btrbk/ssh/id_ed25519_btrbk";
+                  ssh_user = "btrbk";
+                
+                  volume =  {
+                      "ssh://jupiter.home.opel-online.de/mnt/snapshots/Mars" = {
+                          target = "/mnt/nas/Backups/Mars";
+                          subvolume = {
+                              "@nas" = {};
+                          };
+                      };
+                  };
+                  volume =  {
+                      "ssh://jupiter.home.opel-online.de/mnt/snapshots/Pluto" = {
+                          target = "/mnt/nas/Backups/Pluto";
+                          subvolume = {
+                              "@/Games" = {};
+                              "@/IT" = {};
+                              "@/Media" = {};
+                              "@/Pictures" = {};
+                              "@/Rest" = {};
+                          };
+                      };
+                  };
+              };
+          };
+#          lf = {
+#              onCalendar = "daily";
+#              settings = {
+#                  incremental = "yes";
+#                  snapshot_create = "ondemand";
+#                  snapshot_dir = "@snapshots";
+#                  timestamp_format = "long";
+#
+#                  snapshot_preserve = "2m 2w 5d";
+#                  snapshot_preserve_min = "latest";
+#                
+#                  volume =  {
+#                      "/mnt/snapshots/Pluto" = {
+#                          snapshot_create = "always";
+#                          subvolume = {
+#                            "@" = {};
+#                            "@/Backups" = {};
+#                            "@/Games" = {};
+#                            "@/IT" = {};
+#                            "@/Media" = {};
+#                            "@/Pictures" = {};
+#                            "@/Rest" = {};
+#                          };
+#                      };
+#                  };
+#              };
+#          };
+      };
+  };
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
+    };
+
+  fileSystems."/srv" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
+  fileSystems."/mnt/snapshots/root" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
+  };
+
+#  fileSystems."/mnt/snapshots/Pluto" =
+#    { device = "/dev/disk/by-label/NAS-RAID";
+#      fsType = "btrfs";
+#      options = [ "compress=zstd,space_cache=v2,noatime,subvolid=5" ];
+#    };
+#
+  fileSystems."/mnt/nas" =
+    { device = "/dev/disk/by-uuid/70523c79-ef5c-40f2-8782-60fc86bb445b";
+      fsType = "btrfs";
+      options = [ "compress=zstd:9,space_cache=v2,noatime,subvol=@nasbak" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ { device = "/swap/swapfile"; } ];
+  
+  networking = {
+    hostName = "nasbak";
+    domain = "home.opel-online.de";
+    networkmanager = {
+      enable = false;
+    };
+    timeServers = [
+        "192.168.2.1"
+    ];
+    interfaces = {
+      enp6s18 = {
+        useDHCP = true;                     # For versatility sake, manually edit IP on nm-applet.
+#        ipv4.addresses = [ {
+#            address = "45.142.114.153";
+#            prefixLength = 24;
+#        } ];
+#        ipv6.addresses = [ {
+#            address = "2a00:ccc1:101:19D::2";
+#            prefixLength = 64;
+#        } ];
+#      };
+      };
+    };
+#    defaultGateway = "45.142.114.1";
+    defaultGateway6 = {
+      address = "fe80::1";
+      interface = "enp6s18";
+    };
+#    nameservers = [ "9.9.9.9" "2620:fe::fe" ];
+    #firewall = {
+    #  enable = false;
+    #  #allowedUDPPorts = [ 53 67 ];
+    #  #allowedTCPPorts = [ 53 80 443 9443 ];
+    #};
+  };
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  powerManagement = {
+    cpuFreqGovernor = lib.mkDefault "powersave";
+    powertop.enable = true;
+#    powerUpCommands = ''
+#      ${pkgs.hdparm}/sbin/hdparm -S 150 /dev/disk/by-uuid/57e6446d-faca-4b67-9063-e8d9afb80088
+#      ${pkgs.hdparm}/sbin/hdparm -S 150 /dev/disk/by-uuid/b9edc489-ac37-4b28-981d-442722df7ae2
+#    '';
+  };
+  
+}

hosts/nasbackup/home.nix

@@ -0,0 +1,39 @@
+#
+#  Home-manager configuration for laptop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │       └─ home.nix *
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./hyprland
+#              └─ hyprland.nix
+#
+
+{ pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/home.nix # Window Manager
+    ];
+
+  home = {                                # Specific packages for laptop
+    packages = with pkgs; [
+      # Applications
+
+      # Display
+      #light                              # xorg.xbacklight not supported. Other option is just use xrandr.
+
+      # Power Management
+      #auto-cpufreq                       # Power management
+      #tlp                                # Power management
+    ];
+  };
+
+  programs = {
+    alacritty.settings.font.size = 11;
+  };
+
+}

hosts/q920/hardware-configuration.nix

@@ -1,82 +0,0 @@
-#
-# Hardware settings for Teclast F5 10" Laptop
-# NixOS @ sda2
-#
-# flake.nix
-#  └─ ./hosts
-#      └─ ./laptop
-#          └─ hardware-configuration.nix *
-#
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_usb_sdmmc" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-label/ROOT";
-      fsType = "btrfs";
-      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@" ];
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/ROOT";
-      fsType = "btrfs";
-      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home" ];
-    };
-
-  fileSystems."/srv" =
-    { device = "/dev/disk/by-label/ROOT";
-      fsType = "btrfs";
-      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/BOOT";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-  
-  networking = {
-    useDHCP = false;                        # Deprecated
-    hostName = "q920";
-    networkmanager.enable = true;
-    interfaces = {
-      enp0s25 = {
-        useDHCP = true;                     # For versatility sake, manually edit IP on nm-applet.
-        #ipv4.addresses = [ {
-        #    address = "192.168.0.51";
-        #    prefixLength = 24;
-        #} ];
-      };
-#      wlo1 = {
-#        useDHCP = true;
-#        #ipv4.addresses = [ {
-#        #  address = "192.168.0.51";
-#        #  prefixLength = 24;
-#        #} ];  
-#      };
-    };
-    #defaultGateway = "192.168.0.1";
-    #nameservers = [ "192.168.0.4" ];
-    #firewall = {
-    #  enable = false;
-    #  #allowedUDPPorts = [ 53 67 ];
-    #  #allowedTCPPorts = [ 53 80 443 9443 ];
-    #};
-  };
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  # high-resolution display
-  hardware.video.hidpi.enable = lib.mkDefault true;
-}

hosts/server/default.nix

@@ -17,12 +17,12 @@
 #           └─ default.nix
 #
 
-{ config, pkgs, user, ... }:
+{ config, pkgs, user, agenix, impermanence, ... }:
 
 {
   imports =                                                         # For now, if applying to other system, swap files
     [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/desktop/virtualisation/docker.nix)] ++   # Docker
+    [(import ../../modules/wm/virtualisation/docker.nix)] ++   # Docker
     (import ../../modules/services/server) ++                       # Server Services
     (import ../../modules/hardware);                                # Hardware devices
 
@@ -32,20 +32,24 @@
     loader = {                              # EFI Boot
     grub = {
         enable = true;
-        version = 2;
         device = "/dev/sda";
     };
       timeout = 1;                          # Grub auto select time
     };
   };
 
-#  environment = {
+  environment = {
-#    systemPackages = with pkgs; [
+    etc = {
-##      simple-scan
+      "fail2ban/filter.d/gitea.conf" = {
-##       intel-media-driver
+        source = ../../modules/services/server/fail2ban/filter/gitea.conf;
-##       alacritty
+        mode = "0444";
-#    ];
+      };
-#  };
+      "fail2ban/filter.d/nextcloud.conf" = {
+        source = ../../modules/services/server/fail2ban/filter/nextcloud.conf;
+        mode = "0444";
+      };
+    };
+  };
 
   programs = {                              # No xbacklight, this is the alterantive
     zsh.enable = true;
@@ -59,6 +63,7 @@
 
   services = {
     #auto-cpufreq.enable = true;
+    qemuGuest.enable = true;
     avahi = {                               # Needed to find wireless printer
       enable = true;
       nssmdns = true;
@@ -68,6 +73,28 @@
         userServices = true;
       };
     };
+    fail2ban = {
+        enable = true;
+        maxretry = 5;
+        jails.DEFAULT.settings = {
+           findtime = "15m";
+        };
+        jails = {
+            gitea = ''
+              enabled = true
+              filter = gitea
+              backend = systemd
+              action = iptables-allports
+            '';
+            nextcloud = ''
+              backend = auto
+              enabled = true
+              filter = nextcloud
+              logpath = /var/lib/nextcloud/data/nextcloud.log
+              action = iptables-allports
+            '';
+          };
+    };
 
   };
 

hosts/server/hardware-configuration.nix

@@ -21,7 +21,8 @@
   boot.initrd.kernelModules = [ "vfio_pci" "vfio" "vfio_iommu_type1" ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
-  boot.tmp.useTmpfs = true;
+  boot.tmp.useTmpfs = false;
+  boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
 
   services.btrfs.autoScrub = {
@@ -83,6 +84,12 @@
       options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
     };
 
+  fileSystems."/swap" =
+    { device = "/dev/disk/by-label/NIXROOT";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
   fileSystems."/mnt/snapshots/root" =
     { device = "/dev/disk/by-label/NIXROOT";
       fsType = "btrfs";
@@ -90,11 +97,12 @@
     };
 
 
-  swapDevices = [ ];
+  #swapDevices = [ { device = "/swap/swapfile"; } ];
+  swapDevices = [  ];
   
   networking = {
     useDHCP = false;                        # Deprecated
-    hostName = "dmz";
+    hostName = "kabtop";
     domain = "kabtop.de";
     networkmanager = {
       enable = false;
@@ -126,5 +134,5 @@
     };
   };
 
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  #hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/steamdeck/default.nix

@@ -17,95 +17,76 @@
 #           └─ default.nix
 #
 
-{ config, pkgs, user, ... }:
+{ config, pkgs, user, jovian-nixos, lib, ... }:
 
 {
   imports =                                                         # For now, if applying to other system, swap files
     [(import ./hardware-configuration.nix)] ++                      # Current system hardware config @ /etc/nixos/hardware-configuration.nix
-    [(import ../../modules/desktop/hyprland/default.nix)] ++        # Window Manager
+    [(import ../../modules/wm/steam/default.nix)] ++            # jovian steam
-    [(import ../../modules/desktop/virtualisation/docker.nix)]; # ++   # Docker
+    [(import ../../modules/wm/kde/default.nix)] ++              # Window Manager
-    #(import ../../modules/hardware);                                # Hardware devices
+    (import ../../modules/wm/virtualisation) ++                 # libvirt + Docker
+    [(import ../../modules/wm/virtualisation/kvm-amd.nix)] ++   # kvm module options
+    (import ../../modules/hardware);                                 # Hardware devices
 
   boot = {                                  # Boot options
-    kernelPackages = pkgs.linuxPackages_latest;
-
     loader = {                              # EFI Boot
-      systemd-boot.enable = true;
+      systemd-boot.enable = lib.mkForce false;
       efi = {
         canTouchEfiVariables = true;
         efiSysMountPoint = "/boot";
       };
       timeout = 1;                          # Grub auto select time
     };
+
+    lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+    };
   };
 
 #  hardware.sane = {                           # Used for scanning with Xsane
 #    enable = false;
 #    extraBackends = [ pkgs.sane-airscan ];
 #  };
+  hardware = {
+    nitrokey.enable = true;
+  };
 
 #  environment = {
 #    systemPackages = with pkgs; [
-#      simple-scan
+##       alacritty
 #    ];
 #  };
 
   programs = {                              # No xbacklight, this is the alterantive
-#    dconf.enable = true;
+    zsh.enable = true;
-#    light.enable = true;
+    dconf.enable = true;
+    light.enable = true;
     ssh.startAgent = false;
     gnupg.agent = {
       enable = true;
       enableSSHSupport = true;
-      pinentryFlavor = "curses";
+      #pinentryFlavor = "curses";
     };
   };
 
   services = {
-#    tlp.enable = true;                      # TLP and auto-cpufreq for power management
+ #   blueman.enable = true;
-    #logind.lidSwitch = "ignore";            # Laptop does not go to sleep when lid is closed
-    auto-cpufreq.enable = true;
-    blueman.enable = true;
-    pcscd.enable = true;
-    udev.packages = [ 
-        pkgs.nitrokey-udev-rules
-    ];
     printing = {                            # Printing and drivers for TS5300
       enable = true;
       drivers = [ pkgs.gutenprint ];
     };
     avahi = {                               # Needed to find wireless printer
       enable = true;
-      nssmdns = true;
+      nssmdns4 = true;
       publish = {                           # Needed for detecting the scanner
         enable = true;
         addresses = true;
         userServices = true;
       };
     };
+    tailscale.enable = true;
 
-    #xserver = {
-    #  libinput = {                          # Trackpad support & gestures
-    #    touchpad = {
-    #      tapping = true;
-    #      scrollMethod = "twofinger";
-    #      naturalScrolling = true;            # The correct way of scrolling
-    #      accelProfile = "adaptive";          # Speed settings
-    #      #accelSpeed = "-0.5";
-    #      disableWhileTyping = true;
-    #    };
-    #  };
-    #  resolutions = [
-    #    { x = 1600; y = 920; }
-    #    { x = 1280; y = 720; }
-    #    { x = 1920; y = 1080; }
-    #  ];
-    #};
   };
-
+  security.pam.sshAgentAuth.enable = true;
-  #temporary bluetooth fix
-#  systemd.tmpfiles.rules = [
-#    "d /var/lib/bluetooth 700 root root - -"
-#  ];
-#  systemd.targets."bluetooth".after = ["systemd-tmpfiles-setup.service"];
 }

hosts/steamdeck/hardware-configuration.nix

@@ -0,0 +1,185 @@
+#
+# Hardware settings for Teclast F5 10" Laptop
+# NixOS @ sda2
+#
+# flake.nix
+#  └─ ./hosts
+#      └─ ./laptop
+#          └─ hardware-configuration.nix *
+#
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot = {
+	  initrd = {
+                  availableKernelModules = [ "nvme" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
+		  kernelModules = [ ];
+		  systemd.enable = true;
+		  luks = {
+			  devices."crypted" = {
+				  device = "/dev/disk/by-partlabel/disk-nvme0n1-luks";
+				  allowDiscards = true;
+                  bypassWorkqueues = true;
+			  };
+		  };
+	  };
+
+	  kernelModules = [ "kvm-amd" "amdgpu" ];
+	  kernelParams = [ "luks.options=fido2-device=auto" ];
+	  tmp.useTmpfs = false;
+	  tmp.cleanOnBoot = true;
+  };
+
+  zramSwap.enable = true;
+
+  services = {
+      btrfs.autoScrub = {
+          enable = true;
+          interval = "monthly";
+          fileSystems = [
+              "/"
+          ];
+      };
+      udev.extraRules = ''
+          ACTION=="add", SUBSYSTEM=="block", KERNEL=="mmcblk[0-9]p[0-9]", ENV{ID_FS_USAGE}=="filesystem", RUN{program}+="${pkgs.systemd}/bin/systemd-mount -o noatime,compress-force=zstd:15,ssd_spread,commit=120 --no-block --automount=yes --collect $devnode /run/media/mmcblk0p1"
+          '';
+  };
+
+  services.btrbk = {
+      instances = {
+          hf = {
+              onCalendar = "hourly";
+              settings = {
+                  incremental = "yes";
+                  snapshot_create = "ondemand";
+                  snapshot_dir = "@snapshots";
+                  timestamp_format = "long";
+
+                  snapshot_preserve = "2m 2w 5d 5h";
+                  snapshot_preserve_min = "latest";
+                
+                  volume =  {
+                      "/mnt/snapshots/root" = {
+                          snapshot_create = "always";
+                          subvolume = {
+                              "@home" = {};
+                          };
+                      };
+                  };
+              };
+          };
+      };
+  };
+
+  fileSystems."/" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@,discard=async" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@home,discard=async" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@nix,discard=async" ];
+    };
+
+  fileSystems."/srv" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@srv,discard=async" ];
+    };
+
+  fileSystems."/swap" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@swap,discard=async" ];
+    };
+
+  fileSystems."/opt" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvol=@opt,discard=async" ];
+    };
+
+  fileSystems."/mnt/snapshots/root" =
+    { device = "/dev/mapper/crypted";
+      fsType = "btrfs";
+      options = [ "compress=zstd,space_cache=v2,ssd,noatime,subvolid=5,discard=async" ];
+    };
+
+#  fileSystems."/sdcard" =
+#    { device = "/dev/disk/by-label/sdcard";
+#      fsType = "ext4";
+#      options = [ "nofail,noauto,users,x-systemd.automount" ];
+#    };
+
+  fileSystems."/mnt/Pluto" =
+    { device = "jupiter:/Pluto";
+      fsType = "nfs";
+      options = [ "nofail,noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2" ];
+    };
+
+  fileSystems."/mnt/Mars" =
+    { device = "jupiter:/Mars";
+      fsType = "nfs";
+      options = [ "nofail,noauto,users,x-systemd.automount,x-systemd.device-timeout=10,soft,timeo=14,x-systemd.idle-timeout=1min,sec=sys,exec,nfsvers=4.2" ];
+    };
+
+
+  swapDevices = [ { device = "/swap/swapfile"; } ];
+  
+
+  networking = {
+    useDHCP = false;                        # Deprecated
+    hostName = "steamdeck";
+    wireless.iwd.enable = true;
+    networkmanager = {
+      enable = true;
+      wifi = {
+        backend = "iwd";
+        powersave = false;
+      };
+    };
+#    interfaces = {
+#      wlan0 = {
+#        useDHCP = true;                     # For versatility sake, manually edit IP on nm-applet.
+#        #ipv4.addresses = [ {
+#        #    address = "192.168.0.51";
+#        #    prefixLength = 24;
+#        #} ];
+#      };
+#    };
+    #defaultGateway = "192.168.0.1";
+    #nameservers = [ "192.168.0.4" ];
+    firewall = {
+      checkReversePath = "loose";
+    #  enable = false;
+    #  #allowedUDPPorts = [ 53 67 ];
+    #  #allowedTCPPorts = [ 53 80 443 9443 ];
+    };
+  };
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  #powerManagement.powertop.enable = true;
+  powerManagement = {
+    scsiLinkPolicy = "med_power_with_dipm";
+  };
+}

hosts/steamdeck/home.nix

@@ -0,0 +1,55 @@
+#
+#  Home-manager configuration for laptop
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │       └─ home.nix *
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./hyprland
+#              └─ hyprland.nix
+#
+
+{ pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../modules/wm/steam/home.nix # Window Manager
+      ../../modules/wm/kde/home.nix # Window Manager
+      ../../modules/home.nix # Window Manager
+    ];
+
+  home = {                                # Specific packages for laptop
+    packages = with pkgs; [
+      # Applications
+      libreoffice                         # Office packages
+      #firefox
+      chromium
+      thunderbird
+      streamlink
+      streamlink-twitch-gui-bin
+      element-desktop
+      pulsemixer
+      #yuzu-early-access
+      
+      # Display
+      light                              # xorg.xbacklight not supported. Other option is just use xrandr.
+
+      # Power Management
+      #auto-cpufreq                       # Power management
+      #tlp                                # Power management
+    ];
+  };
+
+  programs = {
+    alacritty.settings.font.size = 11;
+  };
+
+  services = {                            # Applets
+  };
+
+  xsession.preferStatusNotifierItems = true;
+
+}

modules/editors/nvim/config/bufferline.nix

@@ -0,0 +1,5 @@
+{
+  plugins.bufferline = {
+    enable = true;
+  };
+}

modules/editors/nvim/config/default.nix

@@ -0,0 +1,16 @@
+{ nvim, ... }:
+{
+  # Import all your configuration modules here
+  programs.nixvim = {
+      enable = true;
+      colorschemes.gruvbox.enable = true;
+
+      imports = [
+        ./bufferline.nix
+        ./plugins.nix
+        ./options.nix
+        ./keymaps.nix
+        ./highlight.nix
+      ];
+  };
+}

modules/editors/nvim/config/highlight.nix

@@ -0,0 +1,8 @@
+{
+  highlight = {
+    Comment.fg = "#ff00ff";
+    Comment.bg = "#000000";
+    Comment.underline = true;
+    Comment.bold = true;
+  };
+}

modules/editors/nvim/config/keymaps.nix

@@ -0,0 +1,8 @@
+{
+  keymaps = [
+    {
+      action = "<cmd>Telescope live_grep<CR>";
+      key = "<leader>g";
+    }
+  ];
+}

modules/editors/nvim/config/options.nix

@@ -0,0 +1,14 @@
+{
+    config = {
+        globals.mapleader = " ";
+        viAlias = true;
+        vimAlias = true;
+
+        opts = {
+            number = true;         # Show line numbers
+            relativenumber = true; # Show relative line numbers
+
+            shiftwidth = 2;        # Tab width should be 2
+        };
+    };
+}

modules/editors/nvim/config/plugins.nix

@@ -0,0 +1,51 @@
+{
+    plugins = {
+        lualine.enable = true;
+
+        cmp = {
+            enable = true;
+            autoEnableSources = true;
+            settings = {
+                sources = [
+                  {name = "nvim_lsp";}
+                  {name = "path";}
+                  {name = "buffer";}
+                  {name = "luasnip";}
+                ];
+
+                mapping = {
+                    "<C-d>" = "cmp.mapping.scroll_docs(-4)";
+                    "<C-f>" = "cmp.mapping.scroll_docs(4)";
+                    "<C-Space>" = "cmp.mapping.complete()";
+                    "<C-e>" = "cmp.mapping.close()";
+                    "<CR>" = "cmp.mapping.confirm({ select = true })";
+                    "<Tab>" = "cmp.mapping(cmp.mapping.select_next_item(), {'i', 's'})";
+                    "<S-Tab>" = "cmp.mapping(cmp.mapping.select_prev_item(), {'i', 's'})";
+                };
+            };
+        };
+
+        lsp = {
+            enable = true;
+
+            servers = {
+                tsserver.enable = true;
+
+                lua-ls = {
+                    enable = true;
+                    settings.telemetry.enable = false;
+                };
+#                rust-analyzer = {
+#                    enable = true;
+#                    installCargo = true;
+#                };
+            };
+        };
+
+        telescope.enable = true;
+
+        treesitter.enable = true;
+
+        luasnip.enable = true;
+    };
+}

modules/editors/nvim/default.nix

@@ -5,51 +5,157 @@
 { pkgs, ... }:
 
 {
+
+  home = {
+      packages = [ pkgs.gnvim ];
+  };
+
   programs = {
     neovim = {
       enable = true;
       viAlias = true;
       vimAlias = true;
       vimdiffAlias = true;
+      withNodeJs = true;
 
-      plugins = with pkgs.vimPlugins; [
+#      plugins = with pkgs.vimPlugins; [
+#
+#        # Syntax
+#        #vim-nix
+#        #vim-markdown
+#
+#        # Quality of life
+#        vim-lastplace         # Opens document where you left it
+#        auto-pairs            # Print double quotes/brackets/etc.
+#        vim-gitgutter         # See uncommitted changes of file :GitGutterEnable
+#
+#        # File Tree
+#        nerdtree              # File Manager - set in extraConfig to F6
+#	
+#        # Customization 
+#        wombat256-vim         # Color scheme for lightline
+#        srcery-vim            # Color scheme for text
+#
+#        lightline-vim         # Info bar at bottom
+#        indent-blankline-nvim # Indentation lines
+#
+#        # Syntax
+#        nvim-treesitter.withAllGrammars
+#        # finder
+#        telescope-nvim
+#        # completion
+#        nvim-cmp
+#        # status line
+#        lualine-nvim
+#        # indent
+#        indent-blankline-nvim
+#      ];
 
-        # Syntax
+      extraPackages = with pkgs; [
-        vim-nix
+        ripgrep
-        vim-markdown
+        fd
-
+        nodejs
-        # Quality of life
+        nodePackages.npm
-        vim-lastplace         # Opens document where you left it
-        auto-pairs            # Print double quotes/brackets/etc.
-        vim-gitgutter         # See uncommitted changes of file :GitGutterEnable
-
-        # File Tree
-        nerdtree              # File Manager - set in extraConfig to F6
-	
-        # Customization 
-        wombat256-vim         # Color scheme for lightline
-        srcery-vim            # Color scheme for text
-
-        lightline-vim         # Info bar at bottom
-        indent-blankline-nvim # Indentation lines
       ];
 
-      extraConfig = ''
+#      extraConfig = ''
-          set number relativenumber
+#        set expandtab
-          syntax enable                             " Syntax highlighting
+#        set shiftwidth=4
-          colorscheme srcery                        " Color scheme text
+#        set tabstop=4
-          let g:lightline = {
+#      '';
-            \ 'colorscheme': 'wombat',
-            \ }                                     " Color scheme lightline
-          highlight Comment cterm=italic gui=italic " Comments become italic
-          hi Normal guibg=NONE ctermbg=NONE         " Remove background, better for personal theme
 
-          set number                                " Set numbers
+#      extraLuaConfig = ''
-          nmap <F6> :NERDTreeToggle<CR>             " F6 opens NERDTree
+#          vim.g.mapleader = ' '
-          set expandtab
+#          vim.g.maplocalleader = ' '
-          set shiftwidth=4
+#
-          set tabstop=4
+#          -- Set highlight on search
-      '';
+#          vim.o.hlsearch = false
+#          
+#          -- Make line numbers default
+#          vim.wo.number = true
+#          
+#          -- Enable mouse mode
+#          vim.o.mouse = 'a'
+#          
+#          -- Sync clipboard between OS and Neovim.
+#          --  Remove this option if you want your OS clipboard to remain independent.
+#          --  See `:help 'clipboard'`
+#          vim.o.clipboard = 'unnamedplus'
+#          
+#          -- Enable break indent
+#          vim.o.breakindent = true
+#          
+#          -- Save undo history
+#          vim.o.undofile = true
+#          
+#          -- Case insensitive searching UNLESS /C or capital in search
+#          vim.o.ignorecase = true
+#          vim.o.smartcase = true
+#          
+#          -- Keep signcolumn on by default
+#          vim.wo.signcolumn = 'yes'
+#          
+#          -- Decrease update time
+#          vim.o.updatetime = 250
+#          vim.o.timeout = true
+#          vim.o.timeoutlen = 300
+#          
+#          -- Set completeopt to have a better completion experience
+#          vim.o.completeopt = 'menuone,noselect'
+#          
+#          -- NOTE: You should make sure your terminal supports this
+#          vim.o.termguicolors = true
+#
+#          -- [[ Highlight on yank ]]
+#          -- See `:help vim.highlight.on_yank()`
+#          local highlight_group = vim.api.nvim_create_augroup('YankHighlight', { clear = true })
+#          vim.api.nvim_create_autocmd('TextYankPost', {
+#            callback = function()
+#              vim.highlight.on_yank()
+#            end,
+#            group = highlight_group,
+#            pattern = '*',
+#          })
+#          
+#          -- [[ Configure Telescope ]]
+#          -- See `:help telescope` and `:help telescope.setup()`
+#          require('telescope').setup {
+#            defaults = {
+#              mappings = {
+#                i = {
+#                  ['<C-u>'] = false,
+#                  ['<C-d>'] = false,
+#                },
+#              },
+#            },
+#          }
+#          
+#          -- Enable telescope fzf native, if installed
+#          pcall(require('telescope').load_extension, 'fzf')
+#          
+#          -- See `:help telescope.builtin`
+#          vim.keymap.set('n', '<leader>?', require('telescope.builtin').oldfiles, { desc = '[?] Find recently opened files' })
+#          vim.keymap.set('n', '<leader><space>', require('telescope.builtin').buffers, { desc = '[ ] Find existing buffers' })
+#          vim.keymap.set('n', '<leader>/', function()
+#            -- You can pass additional configuration to telescope to change theme, layout, etc.
+#            require('telescope.builtin').current_buffer_fuzzy_find(require('telescope.themes').get_dropdown {
+#              winblend = 10,
+#              previewer = false,
+#            })
+#          end, { desc = '[/] Fuzzily search in current buffer' })
+#          
+#          vim.keymap.set('n', '<leader>gf', require('telescope.builtin').git_files, { desc = 'Search [G]it [F]iles' })
+#          vim.keymap.set('n', '<leader>sf', require('telescope.builtin').find_files, { desc = '[S]earch [F]iles' })
+#          vim.keymap.set('n', '<leader>sh', require('telescope.builtin').help_tags, { desc = '[S]earch [H]elp' })
+#          vim.keymap.set('n', '<leader>sw', require('telescope.builtin').grep_string, { desc = '[S]earch current [W]ord' })
+#          vim.keymap.set('n', '<leader>sg', require('telescope.builtin').live_grep, { desc = '[S]earch by [G]rep' })
+#          vim.keymap.set('n', '<leader>sd', require('telescope.builtin').diagnostics, { desc = '[S]earch [D]iagnostics' })
+#          require("indent_blankline").setup {
+#              -- for example, context is off by default, use this to turn it on
+#              show_current_context = true,
+#              show_current_context_start = true,
+#          }
+#      '';
     };
   };
 }

modules/hardware/backup.nix

@@ -0,0 +1,15 @@
+
+
+{ config, lib, pkgs, ... }:
+
+{
+  services.btrbk = {
+    sshAccess = [
+      {
+        key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDU2NJ9xwYnp6/frIOv96ih8psiFcC2eOQeT+ZEMW5rq";
+        roles = [ "source" "info" "send" ];
+      }
+    ];
+    extraPackages = [ pkgs.lz4 ];
+  };
+}

modules/hardware/remoteBuilder.nix

@@ -0,0 +1,25 @@
+{ pkgs, config, ... }:
+
+{
+  users.users.nixremote = {                   # System User
+    isNormalUser = true;
+    extraGroups = [ "kvm" ];
+    shell = pkgs.zsh;                       # Default shell
+    uid = 1001;
+#    initialPassword = "password95";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILczsj4W1kFQaalFwaY+RJ4LEzNeFKD+itXB40Q2O59M nixremote@hades"
+    ];
+  };
+
+  nix.settings.trusted-users = [
+    "nixremote"
+  ];
+
+  services.nix-serve.secretKeyFile = config.age.secrets."keys/nixservepriv".path;
+
+  age.secrets."keys/nixservepriv" = {
+    file = ../../secrets/keys/nixservepriv.age;
+    owner = "nixremote";
+  };
+}

modules/hardware/remoteClient.nix

@@ -0,0 +1,32 @@
+
+{ config, lib, pkgs, ... }:
+
+{
+  nix = {
+    distributedBuilds = false;
+    buildMachines = [ {
+      hostName = "hades";
+      system = "x86_64-linux";
+      supportedFeatures = [ "kvm" "big-parallel" ];
+      sshUser = "nixremote";
+      sshKey = config.age.secrets."keys/nixremote".path;
+      maxJobs = 1;
+      speedFactor = 4;
+      publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUVnbld5UVVVYSt2Y0hBS3g2ZWRiVGdxVzhwaCtNQ2lTNmZVd1lqWWNTK28gcm9vdEBoYWRlcwo=%";
+      protocol = "ssh-ng";
+    } ];
+    settings = {
+      extra-trusted-public-keys = [
+        "hades-builder:AFdPgi6Qq/yKqc2V2imgzMikEkVEFCrDaHyAmOJ3MII="
+      ];
+      trusted-users = [
+        "kabbone"
+      ];
+    };
+  };
+  
+  age.secrets."keys/nixremote" = {
+    file = ../../secrets/keys/nixremote.age;
+    owner = "root";
+  };
+}

modules/home.nix

@@ -5,7 +5,7 @@
     cmds = {
       shell = mkOption { type = types.str; default = "zsh"; };
       fetch = mkOption { type = types.str; default = "hyfetch"; };
-      editor = mkOption { type = types.str; default = "hx"; };
+      editor = mkOption { type = types.str; default = "nvim"; };
 
       wm = mkOption { type = types.str; default = "sway"; };
 
@@ -24,7 +24,7 @@
     theme = {
       theme = mkOption { type = types.str; default = "catppuccin-mocha"; };
       icon-theme = mkOption { type = types.str; default = "Papirus-Dark"; };
-      font = mkOption { type = types.str; default = "FiraCode Nerd Font Mono 11"; };
+      font = mkOption { type = types.str; default = "Cascadia Code 11"; };
       wallpaper = mkOption { type = types.str; default = ""; };
     };
   };

modules/programs/alacritty.nix

@@ -16,8 +16,10 @@
       package = pkgs.alacritty;
       settings = {
         font = rec {                          # Font - Laptop has size manually changed at home.nix
-          normal.family = "Source Code Pro";
+          #normal.family = "FiraCode Nerd Font";
-          bold = { style = "Bold"; };
+          normal.family = "Cascadia Code";
+          #normal.family = "Intel One Mono";
+          #bold = { style = "Bold"; };
 #         size = 8;
         };
         offset = {                            # Positioning

modules/programs/default.nix

@@ -17,5 +17,5 @@
    #./waybar.nix
    #./games.nix
 ]
-# Waybar.nix is pulled from modules/desktop/..
+# Waybar.nix is pulled from modules/wm/..
 # Games.nix is pulled from desktop/default.nix

modules/services/dmz/default.nix

@@ -0,0 +1,19 @@
+#
+#  Services
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ home.nix
+#   └─ ./modules
+#       └─ ./services
+#           └─ default.nix *
+#               └─ ...
+#
+
+[
+  ./microvm.nix
+  ./hydra.nix
+]
+
+# picom, polybar and sxhkd are pulled from desktop module
+# redshift temporarely disables

modules/services/dmz/gitea_runner.nix

@@ -0,0 +1,60 @@
+{ lib, config, pkgs, ... }:
+
+{
+    virtualisation = {
+      podman ={
+        enable = true;
+        autoPrune.enable = true;
+        dockerCompat = true;
+      };
+      containers.containersConf.settings = {
+        # podman seems to not work with systemd-resolved
+        containers.dns_servers = [ "192.168.101.1" ];
+        #containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
+      };
+    };
+
+    services.gitea-actions-runner.instances = {
+        homerunner = {
+            enable = true;
+            url = "https://git.kabtop.de";
+            name = "Homerunner";
+            tokenFile = config.age.secrets."services/gitea/homerunner-token".path;
+            labels = [ 
+              "home"
+              "debian-latest:docker://node:18-bullseye"
+              "ubuntu-latest:docker://node:16-bullseye"
+              "ubuntu-22.04:docker://node:16-bullseye"
+              "ubuntu-20.04:docker://node:16-bullseye"
+              "ubuntu-18.04:docker://node:16-buster"
+              "native:host"
+            ];
+            hostPackages = with pkgs; [
+              bash
+              coreutils
+              curl
+              gawk
+              gitMinimal
+              gnused
+              nodejs
+              wget
+            ];
+            settings = {
+             # container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
+               # the default network that also respects our dns server settings
+              container.network = "host";
+              container.privileged = false;
+             # container.valid_volumes = [
+             #   "/nix"
+             #   "${storeDeps}/bin"
+             #   "${storeDeps}/etc/ssl"
+             # ];
+            };
+        };
+    };
+
+    age.secrets."services/gitea/homerunner-token" = {
+      file = ../../../secrets/services/gitea/homerunner-token.age;
+      owner = "gitea-runner";
+    };
+}

modules/services/dmz/hydra.nix

@@ -0,0 +1,11 @@
+{ lib, config, pkgs, ... }:
+
+{
+    services.hydra = {
+      enable = true;
+      hydraURL = "http://localhost:3000";
+      notificationSender = "hydra@localhost";
+      useSubstitutes = true;
+    };
+
+}

modules/services/dmz/microvm.nix

@@ -0,0 +1,131 @@
+{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
+let
+  name = "gitea-runner";
+in
+{
+  microvm = {
+    autostart = [
+      name
+    ];
+    vms = {
+      ${name} = {
+
+        inherit pkgs;
+
+        config = {
+          imports = 
+            [ agenix.nixosModules.default ] ++
+            [ impermanence.nixosModules.impermanence ] ++
+            [( ./gitea_runner.nix )];
+
+          networking = {
+            hostName = "${name}";
+
+            firewall = {
+              enable = true;
+                allowedUDPPorts = [  ];
+                allowedTCPPorts = [  ];
+            };
+          };
+          systemd.network = {
+              enable = true;
+              networks = {
+                  "10-lan" = {
+                      matchConfig.Name = "*";
+                      networkConfig = {
+                        DHCP = "yes";
+                        IPv6AcceptRA = true;
+                      };
+                  };
+              };
+          };
+
+          users.users.${user} = {                   # System User
+            isNormalUser = true;
+            extraGroups = [ "wheel" ];
+            uid = 2000;
+            openssh.authorizedKeys.keys = [
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo= kabbone@kabc"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo= kabbone@hades.home.opel-online.de"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
+            ];
+          };
+          services = {
+            openssh = {
+              enable = true;
+              settings.PasswordAuthentication = false;
+              hostKeys = [
+              {
+                  path = "/persist/etc/ssh/ssh_host_ed25519_key";
+                  type = "ed25519";
+              }
+              {
+                  path = "/persist/etc/ssh/ssh_host_rsa_key";
+                  type = "rsa";
+                  bits = 4096;
+              }];
+            };
+          };
+
+          fileSystems."/persist".neededForBoot = lib.mkForce true;
+
+          environment = {
+            systemPackages = with pkgs; [           # Default packages install system-wide
+               bash
+               coreutils
+               curl
+               gawk
+               gitMinimal
+               gnused
+               nodejs
+               wget
+            ];
+            persistence."/persist" = {
+              directories = [
+                "/var/log"
+                "/var/lib/private"
+              ];
+
+              files = [
+                "/etc/machine-id"
+              ];
+            };
+          };
+
+          microvm = {
+            hypervisor = "cloud-hypervisor";
+            vcpu = 4;
+            mem = 4096;
+            interfaces = [
+            {
+              type = "macvtap";
+              id = "vm-${name}";
+              mac = "04:00:00:00:00:01";
+              macvtap = {
+                  link = "enp6s18";
+                  mode = "bridge";
+              };
+            } ];
+             shares = [{
+              source = "/nix/store";
+              mountPoint = "/nix/.ro-store";
+              tag = "ro-store";
+              proto = "virtiofs";
+            }
+            {
+              source = "/etc/vm-persist/${name}";
+              mountPoint = "/persist";
+              tag = "persist";
+              proto = "virtiofs";
+            }];
+            #writableStoreOverlay = "/nix/.rw-store";
+            #storeOnDisk = true;
+          };
+
+          system.stateVersion = "23.05";
+        };
+      };
+    };
+  };
+}

modules/services/nas/nfs.nix

@@ -11,7 +11,7 @@
   };
   # open the firewall
   networking.firewall = {
-    interfaces.lo1 = {
+    interfaces.enp6s18 = {
       allowedTCPPorts = [ 2049 ];
     };
   };

modules/services/nasbackup/default.nix

@@ -0,0 +1,18 @@
+#
+#  Services
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ home.nix
+#   └─ ./modules
+#       └─ ./services
+#           └─ default.nix *
+#               └─ ...
+#
+
+[
+#  ./nfs.nix
+]
+
+# picom, polybar and sxhkd are pulled from desktop module
+# redshift temporarely disables

modules/services/server/coturn.nix

@@ -14,7 +14,7 @@
     pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
     extraConfig = ''
       # for debugging
-      verbose
+      #verbose
       # ban private IP ranges
       no-multicast-peers
       denied-peer-ip=0.0.0.0-0.255.255.255

modules/services/server/default.nix

@@ -13,11 +13,12 @@
 [
   ./postgresql.nix
   ./gitea.nix
-  ./woodpecker.nix
+  ./microvm.nix
   ./nextcloud.nix
   ./matrix.nix
   ./coturn.nix
   ./jitsi.nix
+  ./ollama.nix
 ]
 
 # picom, polybar and sxhkd are pulled from desktop module

modules/services/server/fail2ban/filter/gitea.conf

@@ -0,0 +1,4 @@
+[Definition]
+failregex =  .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
+ignoreregex =
+journalmatch = _SYSTEMD_UNIT=gitea.service + _COMM=gitea

modules/services/server/fail2ban/filter/nextcloud.conf

@@ -0,0 +1,6 @@
+[Definition]
+_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
+failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
+datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
+journalmatch = 

modules/services/server/fail2ban/filter/open-webui.conf

@@ -0,0 +1,4 @@
+[Definition]
+failregex =  <HOST> - .*(401 Unauthorized|invalid credentials|Attempted access of unknown user).*
+ignoreregex =
+journalmatch = _SYSTEMD_UNIT=podman-open-webui.service + _COMM=podman-open-webui

modules/services/server/gitea.nix

@@ -7,7 +7,7 @@
 {
   services.gitea = {
     enable = true;
-    dump.enable = true;
+    dump.enable = false;
     lfs.enable = true;
     dump.type = "tar.xz";
     database.type = "postgres";
@@ -61,6 +61,9 @@
             REGISTER_EMAIL_CONFIRM = true;
             DISABLE_REGISTRATION = true;
         };
+        actions = {
+            ENABLED = true;
+        };
     };
   };
 

modules/services/server/gitea_runner.nix

@@ -0,0 +1,59 @@
+{ lib, config, pkgs, ... }:
+
+{
+    virtualisation = {
+      podman ={
+        enable = true;
+        autoPrune.enable = true;
+        dockerCompat = true;
+      };
+      containers.containersConf.settings = {
+        # podman seems to not work with systemd-resolved
+        containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
+      };
+    };
+
+    services.gitea-actions-runner.instances = {
+        serverrunner = {
+            enable = true;
+            url = "https://git.kabtop.de";
+            name = "Server runner";
+            tokenFile = config.age.secrets."services/gitea/serverrunner-token".path;
+            labels = [ 
+              "server"
+              "debian-latest:docker://node:18-bullseye"
+              "ubuntu-latest:docker://node:16-bullseye"
+              "ubuntu-22.04:docker://node:16-bullseye"
+              "ubuntu-20.04:docker://node:16-bullseye"
+              "ubuntu-18.04:docker://node:16-buster"
+              "native:host"
+            ];
+            hostPackages = with pkgs; [
+              bash
+              coreutils
+              curl
+              gawk
+              gitMinimal
+              gnused
+              nodejs
+              wget
+            ];
+            settings = {
+             # container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
+               # the default network that also respects our dns server settings
+              container.network = "host";
+              container.privileged = false;
+             # container.valid_volumes = [
+             #   "/nix"
+             #   "${storeDeps}/bin"
+             #   "${storeDeps}/etc/ssl"
+             # ];
+            };
+        };
+    };
+
+    age.secrets."services/gitea/serverrunner-token" = {
+      file = ../../../secrets/services/gitea/serverrunner-token.age;
+      owner = "gitea-runner";
+    };
+}

modules/services/server/matrix.nix

@@ -40,6 +40,7 @@ in {
       "${fqdn}" = {
         enableACME = true;
         forceSSL = true;
+        locations."/health".proxyPass = "http://localhost:8008"; 
         locations."/_matrix".proxyPass = "http://localhost:8008"; 
         locations."/_synapse/client".proxyPass = "http://localhost:8008"; 
         locations."/".extraConfig = '' 

modules/services/server/microvm.nix

@@ -0,0 +1,129 @@
+{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
+let
+  name = "gitea-runner";
+in
+{
+  microvm = {
+    autostart = [
+      name
+    ];
+    vms = {
+      ${name} = {
+
+        inherit pkgs;
+
+        config = {
+          imports = 
+            [ agenix.nixosModules.default ] ++
+            [ impermanence.nixosModules.impermanence ] ++
+            [( ./gitea_runner.nix )];
+
+          networking = {
+            hostName = "${name}";
+
+            firewall = {
+              enable = true;
+                allowedUDPPorts = [  ];
+                allowedTCPPorts = [  ];
+            };
+          };
+          systemd.network = {
+              enable = true;
+              networks = {
+                  "10-lan" = {
+                      matchConfig.Name = "*";
+                      networkConfig = {
+                        DHCP = "yes";
+                        IPv6AcceptRA = true;
+                      };
+                  };
+              };
+          };
+
+          users.users.${user} = {                   # System User
+            isNormalUser = true;
+            extraGroups = [ "wheel" ];
+            uid = 2000;
+            openssh.authorizedKeys.keys = [
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo= kabbone@kabc"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo= kabbone@hades.home.opel-online.de"
+              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
+            ];
+          };
+          services = {
+            openssh = {
+              enable = true;
+              settings.PasswordAuthentication = false;
+              hostKeys = [
+              {
+                  path = "/persist/etc/ssh/ssh_host_ed25519_key";
+                  type = "ed25519";
+              }
+              {
+                  path = "/persist/etc/ssh/ssh_host_rsa_key";
+                  type = "rsa";
+                  bits = 4096;
+              }];
+            };
+          };
+
+          fileSystems."/persist".neededForBoot = lib.mkForce true;
+
+          environment = {
+            systemPackages = with pkgs; [           # Default packages install system-wide
+               bash
+               coreutils
+               curl
+               gawk
+               gitMinimal
+               gnused
+               nodejs
+               wget
+            ];
+            persistence."/persist" = {
+              directories = [
+                "/var/log"
+                "/var/lib/private"
+              ];
+
+              files = [
+                "/etc/machine-id"
+              ];
+            };
+          };
+
+          microvm = {
+            hypervisor = "qemu";
+            vcpu = 4;
+            mem = 4096;
+            balloonMem = 4096;
+            #kernel = pkgs.linuxKernel.packages.linux_latest;
+            interfaces = [
+            {
+              type = "user";
+              id = "vm-${name}";
+              mac = "04:00:00:00:00:01";
+            } ];
+             shares = [{
+              source = "/nix/store";
+              mountPoint = "/nix/.ro-store";
+              tag = "ro-store";
+              proto = "virtiofs";
+            }
+            {
+              source = "/etc/vm-persist/${name}";
+              mountPoint = "/persist";
+              tag = "persist";
+              proto = "virtiofs";
+            }];
+            #writableStoreOverlay = "/nix/.rw-store";
+            #storeOnDisk = true;
+          };
+
+          system.stateVersion = "23.05";
+        };
+      };
+    };
+  };
+}

modules/services/server/nextcloud.nix

@@ -1,18 +1,23 @@
 
 { config, pkgs, ... }:
 {
+    environment.systemPackages = with pkgs; [           # Default packages install system-wide
+      appimage-run
+    ];
+
     services.nextcloud = {
         enable = true;
         hostName = "cloud.kabtop.de";
         https = true;
-        package = pkgs.nextcloud26;
+        package = pkgs.nextcloud27;
-        enableBrokenCiphersForSSE = false;
         database.createLocally = false;
+        logType = "file";
         caching = {
             redis = true;
             apcu = false;
         };
         extraOptions = {
+            logfile = "nextcloud.log";
             redis = {
                 host = "/run/redis-nextcloud/redis.sock";
                 port = 0;
@@ -38,10 +43,23 @@
     #autoUpdateApps.enable = true;
     };
 
-    services.redis.servers.nextcloud = {
+    services.onlyoffice = {
         enable = true;
-        user = "nextcloud";
+        hostname = "docs.cloud.kabtop.de";
-        port = 0;
+        postgresName = "onlyoffice";
+        postgresHost = "localhost";
+        postgresUser = "onlyoffice";
+        postgresPasswordFile = config.age.secrets."services/nextcloud/onlyofficedb".path;
+        jwtSecretFile = config.age.secrets."services/nextcloud/onlyofficejwt".path;
+    };
+
+    services.redis = {
+        vmOverCommit = true;
+        servers.nextcloud = {
+            enable = true;
+            user = "nextcloud";
+            port = 0;
+        };
     };
 
     services.nginx = {
@@ -51,6 +69,9 @@
           enableACME = true;
           forceSSL = true;
         };
+        "${config.services.onlyoffice.hostname}".listen = [ {
+            addr = "127.0.0.1"; port = 8080;
+        } ];
       };
     };
 
@@ -62,9 +83,22 @@
         file = ../../../secrets/services/nextcloud/adminpassFile.age;
         owner = "nextcloud";
     };
+    age.secrets."services/nextcloud/onlyofficedb" = {
+        file = ../../../secrets/services/nextcloud/onlyofficedb.age;
+        owner = "onlyoffice";
+    };
+    age.secrets."services/nextcloud/onlyofficejwt" = {
+        file = ../../../secrets/services/nextcloud/onlyofficejwt.age;
+        owner = "onlyoffice";
+    };
 
     systemd.services."nextcloud-setup" = {
         requires = ["postgresql.service"];
         after = ["postgresql.service"];
     };
+
+    security.acme.defaults.email = "webmaster@kabtop.de";
+    security.acme.defaults.webroot = "/var/lib/acme/acme-challenge";
+    security.acme.acceptTerms = true;
+
 }

modules/services/server/ollama.nix

@@ -0,0 +1,28 @@
+
+{ config, pkgs, ... }:
+let
+  ollamahostname = "llm.kabtop.de";
+in
+{
+  virtualisation.oci-containers.containers."open-webui" = {
+    autoStart = true;
+    image = "ghcr.io/open-webui/open-webui:ollama";
+    volumes = [
+      "/var/lib/open-webui:/app/backend/data"
+    ];
+    hostname = "open-webui";
+    ports = [ "8081:8080" ];
+  };
+
+  services = {
+    nginx = {
+      virtualHosts = {
+          ${ollamahostname} = {
+              enableACME = true;
+              forceSSL = true;
+              locations."/".proxyPass = "http://localhost:8081";
+          };
+      };
+    };
+  };
+}

modules/services/server/postgresql.nix

@@ -7,28 +7,28 @@
 {
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_14;
+    package = pkgs.postgresql_15;
     settings = {
         max_connections = 200;
         listen_addresses = "localhost";
         password_encryption = "scram-sha-256";
-        shared_buffers = "512MB";
+        shared_buffers = "4GB";
-        work_mem = "8MB";
+        work_mem = "2GB";
+        maintenance_work_mem = "500MB";
         autovacuum_work_mem = -1;
-        min_wal_size = "1GB";
-        max_wal_size = "4GB";
         log_timezone = "Europe/Berlin";
         timezone = "Europe/Berlin";
     };
     authentication = pkgs.lib.mkOverride 14 ''
         local  all         postgres        peer
         host   giteadb     gitea          localhost scram-sha-256
-        host  woodpeckerdb woodpecker     localhost scram-sha-256
         host   nextclouddb nextcloud      localhost scram-sha-256
         host   synapsedb   synapse        localhost scram-sha-256
         host   whatsappdb  mautrixwa      localhost scram-sha-256
         host   telegramdb  mautrixtele    localhost scram-sha-256
         host   signaldb    mautrixsignal  localhost scram-sha-256
+        host   onlyoffice  onlyoffice     localhost scram-sha-256
+        local  onlyoffice  onlyoffice      peer
     '';
     initialScript = config.age.secrets."services/postgresql/initScript.sql".path;
   };

modules/shell/tmux.nix

@@ -8,7 +8,8 @@
   programs = {
     tmux = {
       enable = true;
-      terminal = "xterm-256color";
+      terminal = "screen-256color";
+      escapeTime = 300;
       newSession = false;
       keyMode = "vi";
       historyLimit = 10000;
@@ -19,16 +20,25 @@
           yank
           sidebar
           {
-              plugin = dracula;
+          #    plugin = dracula;
-              extraConfig = "
+          #    extraConfig = "
-                set -g @dracula-show-powerline true
+          #      set -g @dracula-show-powerline true
-                set -g @dracula-plugins 'git cpu-usage ram-usage battery time'
+          #      set -g @dracula-plugins 'git cpu-usage ram-usage battery time'
-                set -g @dracula-border-contrast true
+          #      set -g @dracula-border-contrast true
-              ";
+          #    ";
+            plugin = catppuccin;
+            extraConfig = "
+              set -g @catppuccin_flavour 'macchiato'
+              set -g @catppuccin_window_tabs_enabled 'on'
+              set -g @catppuccin_host 'on'
+              set -g @catppuccin_user 'on'
+              set -g @catppuccin_date_time '%Y-%m-%d %H:%M'
+            ";
           }
       ];
       extraConfig = ''
         set -g mouse on
+        set-option -sa terminal-features ',alacritty:RGB'
 
         # More friendly split pane
         bind-key s split-window -h -c "#{pane_current_path}"

modules/shell/zsh.nix

@@ -10,7 +10,7 @@
       enable = true;
       dotDir = ".config/zsh_nix";
       enableAutosuggestions = true;             # Auto suggest options and highlights syntact, searches in history for options
-      enableSyntaxHighlighting = true;
+      syntaxHighlighting.enable = true;
       history.size = 10000;
 
       oh-my-zsh = {                             # Extra plugins for zsh
@@ -27,10 +27,10 @@
       '';
 
       initExtra = ''                            # Zsh theme
-        #export GPG_TTY=$(tty)
+        export GPG_TTY=$(tty)
-        #gpg-connect-agent updatestartuptty /bye >/dev/null
+        gpg-connect-agent updatestartuptty /bye >/dev/null
-        #unset SSH_AGENT_PID
+        unset SSH_AGENT_PID
-        #export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
+        export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
         # Spaceship
         source ${pkgs.spaceship-prompt}/share/zsh/site-functions/prompt_spaceship_setup
         autoload -U promptinit; promptinit
@@ -39,6 +39,7 @@
 #       emulate zsh -c "$(direnv hook zsh)"
         # Swag
         pfetch                                  # Show fetch logo on terminal start
+        eval "$(direnv hook zsh)"
       '';
     };
   };

modules/wm/default.nix

@@ -0,0 +1,16 @@
+{ pkgs, lib, config, ... }:
+
+{
+    options = {
+        desktop = {
+            wm = lib.mkOption { type = types.str; default = "sway"; };
+            taskbar = lib.mkOption { type = types.str; default = "waybar"; };
+            launcher = lib.mkOption { type = types.str; default = "bemenu"; };
+        };
+    };
+
+    config = {
+        imports =
+          (import ./ + (desktop.wm)) ++
+    };
+}

modules/wm/gnome/default.nix

@@ -0,0 +1,49 @@
+#
+#  Gnome configuration
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │       └─ default.nix
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./gnome
+#               └─ default.nix *
+#
+{ config, lib, user, pkgs, ... }:
+
+{
+    hardware.pulseaudio.enable = lib.mkForce false;
+
+    environment.systemPackages = with pkgs; [
+      gnome.gnome-terminal
+      gnomeExtensions.dash-to-dock
+      gnomeExtensions.appindicator
+      flatpak
+      rocmPackages.clr.icd
+      rocmPackages.clr
+      clinfo
+    ];
+
+    services = {
+      xserver = {
+        enable = true;
+        desktopManager.gnome.enable = true;
+        displayManager = {
+          gdm.wayland = true;
+          gdm.enable = true;
+          gdm.autoLogin.delay = 5;
+          gdm.settings = {
+              security = {
+                  DisallowTCP=true;
+              };
+          };
+          defaultSession = "steam-wayland";
+          autoLogin.enable = true;
+          autoLogin.user = "kabbone";
+        };
+      };
+      flatpak.enable = true;
+      udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
+    };
+}

modules/wm/gnome/home.nix

@@ -0,0 +1,53 @@
+#
+#  Gnome NixOS & Home manager configuration
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./steamdeck
+#   │       └─ home.nix
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./gnome
+#               └─ home.nix *
+#
+
+{ config, lib, pkgs, ... }:
+{
+  dconf.settings = {
+    # Enable on-screen keyboard
+    "org/gnome/desktop/a11y/applications" = {
+      screen-keyboard-enabled = true;
+    };
+    "org/gnome/shell" = {
+      enabled-extensions = [
+        "dash-to-dock@micxgx.gmail.com"
+      ];
+      favorite-apps = [
+        "firefox.desktop"
+        "thunderbird.desktop"
+        "element-desktop.desktop"
+        "keepassxc"
+        "yubioath-flutter.desktop"
+        "alacritty.desktop"
+      ];
+    };
+  # Dash to Dock settings for a better touch screen experience
+    "org/gnome/shell/extensions/dash-to-dock" = {
+      background-opacity = 0.80000000000000004;
+      custom-theme-shrink = true;
+      dash-max-icon-size = 48;
+      dock-fixed = true;
+      dock-position = "LEFT";
+      extend-height = true;
+      height-fraction = 0.60999999999999999;
+      hot-keys = false;
+      preferred-monitor = -2;
+      preferred-monitor-by-connector = "eDP-1";
+      scroll-to-focused-application = true;
+      show-apps-at-top = true;
+      show-mounts = true;
+      show-show-apps-button = true;
+      show-trash = false;
+    };
+  };
+}

modules/wm/kde/default.nix

@@ -0,0 +1,48 @@
+#
+#  Gnome configuration
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │       └─ default.nix
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./gnome
+#               └─ default.nix *
+#
+{ config, lib, user, pkgs, ... }:
+
+{
+
+    environment.systemPackages = with pkgs; [
+      flatpak
+      rocmPackages.clr.icd
+      rocmPackages.clr
+      clinfo
+      libsForQt5.discover
+      maliit-keyboard
+    ];
+
+    services = {
+      packagekit.enable = true;
+      xserver = {
+        enable = true;
+        desktopManager.plasma5.enable = true;
+#        displayManager = {
+#          gdm.wayland = true;
+#          gdm.enable = true;
+#          gdm.autoLogin.delay = 5;
+#          gdm.settings = {
+#              security = {
+#                  DisallowTCP=true;
+#              };
+#          };
+#          defaultSession = "steam-wayland";
+#          autoLogin.enable = true;
+#          autoLogin.user = "kabbone";
+#        };
+      };
+      flatpak.enable = true;
+      udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
+    };
+}

modules/wm/kde/home.nix

@@ -0,0 +1,16 @@
+#
+#  Gnome NixOS & Home manager configuration
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./steamdeck
+#   │       └─ home.nix
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./gnome
+#               └─ home.nix *
+#
+
+{ config, lib, pkgs, ... }:
+{
+}

modules/wm/steam/default.nix

@@ -0,0 +1,43 @@
+#
+#  Gnome configuration
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./laptop
+#   │       └─ default.nix
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./gnome
+#               └─ default.nix *
+#
+{ config, lib, user, pkgs, jovian-nixos, ... }:
+
+{
+    imports = [ 
+      (jovian-nixos + "/modules")
+    ];
+
+    jovian = {
+        steam = {
+          enable = true;
+          user = "kabbone";
+          autoStart = true;
+          desktopSession = "plasmawayland";
+        };
+        devices.steamdeck = {
+            enable = true;
+        };
+        decky-loader.enable = true;
+    };
+
+    hardware.opengl = {
+      enable = true;
+      driSupport = true;
+      driSupport32Bit = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      steamdeck-firmware
+    ];
+
+}

modules/wm/steam/home.nix

@@ -0,0 +1,26 @@
+#
+#  Gnome NixOS & Home manager configuration
+#
+#  flake.nix
+#   ├─ ./hosts
+#   │   └─ ./steamdeck
+#   │       └─ home.nix
+#   └─ ./modules
+#       └─ ./desktop
+#           └─ ./steam
+#               └─ home.nix *
+#
+
+{ config, lib, pkgs, ... }:
+{
+  home = {
+    packages = with pkgs; [
+      steam
+      jq
+      appimage-run
+      gnome.zenity
+      unzip
+      fuse
+    ];
+  };
+}

modules/wm/sway/default.nix

@@ -11,13 +11,15 @@
 #               └─ hyprland.nix *
 #
 
-{ config, lib, user, pkgs, ... }:
+{ config, lib, user, pkgs, desktop, ... }:
 
 {
-  imports = [ ../../programs/waybar.nix ];
+  imports = [ ../waybar.nix ];
 
   hardware.opengl = {
     enable = true;
+    driSupport = true;
+    driSupport32Bit = true;
   };
 
   environment = {
@@ -35,6 +37,10 @@
       grim
       bemenu
       lxqt.lxqt-openssh-askpass
+      rocmPackages.clr.icd
+      rocmPackages.clr
+      clinfo
+      waybar
     ];
   };
 

modules/wm/sway/home.nix

@@ -48,13 +48,18 @@
             "*" = { 
                 bg = "$HOME/.config/wall fill";
             };
-            "HDMI-A-1" = {
+            #"HDMI-A-1" = {
-                mode = "1920x1080";
+            #    mode = "2560x1440";
+            #    pos = "0,0";
+            #    #scale = "1.1";
+            #};
+            "DP-2" = {
+                mode = "2560x1440";
                 pos = "0,0";
             };
-            "DP-1" = {
+            "DP-3" = {
-                mode = "2560x1080";
+                mode = "1920x1200";
-                pos = "1920,0";
+                pos = "2560,120";
             };
             #"eDP-1" = { 
             #    mode = "1920x1080";
@@ -68,7 +73,7 @@
         terminal = "${pkgs.alacritty}/bin/alacritty";
     
         fonts = {
-            names = [ "Source Code Pro" ];
+            names = [ "Cascadia Code" ];
             size = 10.0;
         };
         
@@ -207,6 +212,9 @@
             "${mod}+Shift+9" = "move container to workspace number 9";
             "${mod}+Shift+0" = "move container to workspace number 10";
   
+            "${mod}+Tab" = "workspace next";
+            "${mod}+Alt+Tab" = "workspace prev";
+
             "${mod}+k" = "splith";
             "${mod}+v" = "splitv";
   
@@ -223,7 +231,7 @@
             "${mod}+minus" = "scratchpad show";
         };
      };
-    systemdIntegration = true;
+    systemd.enable = true;
     wrapperFeatures.gtk = true;
     extraSessionCommands = ''
       export MOZ_ENABLE_WAYLAND="1";
@@ -244,8 +252,8 @@
     '';
 
     extraConfig = ''
-        set $output-primary DP-1
+        set $output-primary DP-2
-        set $output-secondary HDMI-A-1
+        set $output-secondary DP-3
 
         workspace 1 output $output-secondary
         workspace 2 output $output-primary
@@ -253,11 +261,14 @@
     '';
   };
 
-  programs.swaylock.settings = {
+  programs.swaylock = {
-    color = "000000";
+      enable = true;
-    image = "$HOME/.config/lockwall"; 
+      settings = {
-    indicator-caps-lock = true;
+          color = "000000";
-    show-keyboard-layout = true;
+          image = "$HOME/.config/lockwall"; 
+          indicator-caps-lock = true;
+          show-keyboard-layout = true;
+      };
   };
 
   services.swayidle = {

modules/wm/virtualisation/docker.nix

@@ -6,7 +6,11 @@
 
 {
   virtualisation = {
-    docker.enable = true;
+    podman = {
+        enable = true;
+        autoPrune.enable = true;
+        dockerCompat = true;
+    };
   };
 
   users.groups.docker.members = [ "${user}" ];
@@ -17,9 +21,9 @@
   #  '';                                                           # Alias to easily start container
   #};
 
-  environment.systemPackages = with pkgs; [
+#  environment.systemPackages = with pkgs; [
-    docker-compose
+#    docker-compose
-  ];
+#  ];
 }
 
 # USAGE:

modules/wm/virtualisation/kvm-amd.nix

@@ -0,0 +1,12 @@
+#
+# KVM module options amd
+#
+
+{ config, pkgs, user, ... }:
+
+{                                             # Add libvirtd and kvm to userGroups
+  boot.extraModprobeConfig = ''
+    options kvm_amd nested=0 avic=1 npt=1
+  '';                                         # Needed to run OSX-KVM 
+}
+

modules/wm/virtualisation/kvm-intel.nix

@@ -0,0 +1,13 @@
+#
+# KVM module options intel 
+#
+
+{ config, pkgs, user, ... }:
+
+{                                             # Add libvirtd and kvm to userGroups
+  boot.extraModprobeConfig = ''
+    options kvm_intel nested=1
+    options kvm_intel emulate_invalid_guest_state=0
+    options kvm ignore_nsrs=1
+  '';                                         # Needed to run OSX-KVM 
+}

modules/wm/virtualisation/qemu.nix

@@ -5,16 +5,9 @@
 { config, pkgs, user, ... }:
 
 {                                             # Add libvirtd and kvm to userGroups
-  boot.extraModprobeConfig = ''
-    options kvm_intel nested=1
-    options kvm_intel emulate_invalid_guest_state=0
-    options kvm ignore_nsrs=1
-  '';                                         # Needed to run OSX-KVM 
-
   users.groups.libvirtd.members = [ "root" "${user}" ];
 
   virtualisation = {
-    vswitch.enable = true;
     libvirtd = {
       enable = true;                          # Virtual drivers
       onShutdown = "shutdown";

modules/wm/waybar.nix

@@ -9,14 +9,6 @@
     waybar
   ];
 
-#  nixpkgs.overlays = [                                      # Waybar needs to be compiled with the experimental flag for wlr/workspaces to work
-#    (self: super: {
-#      waybar = super.waybar.overrideAttrs (oldAttrs: {
-#        mesonFlags = oldAttrs.mesonFlags ++ [ "-Dexperimental=true" ];
-#      });
-#    })
-#  ];
-
   home-manager.users.${user} = {                           # Home-manager waybar config
     programs.waybar = {
       enable = true;

secrets/nixremote

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACC3M7I+FtZBUGmpRcGmPkSeCxMzXhSg/orVweNENjufTAAAAJAgCaSVIAmk
+lQAAAAtzc2gtZWQyNTUxOQAAACC3M7I+FtZBUGmpRcGmPkSeCxMzXhSg/orVweNENjufTA
+AAAEAJPJDPptl9Ljj80G3MNyiAfMBKn6MOfBOT+vF0aBenTLczsj4W1kFQaalFwaY+RJ4L
+EzNeFKD+itXB40Q2O59MAAAADWthYmJvbmVAaGFkZXM=
+-----END OPENSSH PRIVATE KEY-----

secrets/nixremote.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILczsj4W1kFQaalFwaY+RJ4LEzNeFKD+itXB40Q2O59M kabbone@hades

secrets/secrets.nix

@@ -18,16 +18,46 @@ let
       yubia
   ];
 
-  dmz = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwN8p78OncPIRUfV64PLHOem4LtlQ3opOJwLEYqdGVx";
+  server = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwN8p78OncPIRUfV64PLHOem4LtlQ3opOJwLEYqdGVx";
+  server2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPm3epi3v+yuskxQZgmPdkVDET8IGeYA6LbTCqPWqkz+";
+  dmz = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmivVLbkJJ1anwQ8CeNT7rv0Qxinp1LIQIjVWZpnIE5";
   hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEgnWyQUUa+vcHAKx6edbTgqW8ph+MCiS6fUwYjYcS+o";
-  nbf5 = "";
+  nasbak = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdoxslkKn3ouadPOHmDN7e5AtoJmnllnUmhl1j9qfzz";
+  jupiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDBQr9/TIeAd25h0gfOPjoHs6JMeye4V04LuFufbe1S/";
+  steamdeck = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINcbvtlL9xFq6kcvE6x20/Es5PVWMhbBvra8HjGUm4NB";
+  laptop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICLDA3tmyCR4ogX7mgwaEhsceqALQvq9IqXhg8rF0OIi";
+  homerunner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5MASizLhydfxn0AWcG6LfeC4fghLTDVsLbEHDnIAhc";
+  serverrunner="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHfLhlJX2VlZE4myreojQ0hqCSL28kE9Y3F65uumgrSK";
   systems = [ 
-      hades
+      server
-      nbf5
+      server2
       dmz
+      hades
+      nasbak
+      jupiter
+      steamdeck
+      laptop
+      homerunner
+      serverrunner
   ];
   servers = [
-      dmz
+      server
+      server2
+  ];
+  homerunners = [
+    homerunner
+  ];
+  serverrunners = [
+    serverrunner
+  ];
+  buildClients = [
+      nasbak
+      jupiter
+      steamdeck
+      laptop
+  ];
+  buildServer = [
+      hades
   ];
 in
     {
@@ -42,7 +72,12 @@ in
         "services/matrix/signal-registration.age".publicKeys = servers ++ users;
         "services/nextcloud/adminpassFile.age".publicKeys = servers ++ users;
         "services/nextcloud/dbpassFile.age".publicKeys = servers ++ users;
+        "services/nextcloud/onlyofficedb.age".publicKeys = servers ++ users;
+        "services/nextcloud/onlyofficejwt.age".publicKeys = servers ++ users;
         "services/gitea/databasePassword.age".publicKeys = servers ++ users;
         "services/gitea/mailerPassword.age".publicKeys = servers ++ users;
-        "services/woodpecker/environment.age".publicKeys = servers ++ users;
+        "services/gitea/homerunner-token.age".publicKeys = homerunners ++ users;
+        "services/gitea/serverrunner-token.age".publicKeys = serverrunners ++ users;
+        "keys/nixremote.age".publicKeys = buildClients ++ users;
+        "keys/nixservepriv.age".publicKeys = buildServer ++ users;
     }

secrets/services/gitea/homerunner-token.age

@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 1fxDZw HPqtOnCf0xv43GQmB6iSSLGK6r/5pCFFZJC37ioMIw0
+VjvteDjUqqkBas9FzZKxlA1y5/TwIB44I7yNH3KBDYA
+-> ssh-rsa VtjGpQ
+Xx8tuS0ClpvIEn/diIhCInLuiNym22i0SQZCkFCz5V0FKNM0L9hzlqU2A2wLemgz
+iy1So0jNJWGt9ylUCyPI9ucyLUgoXFXiQjaMkI85yj+xuUDHkmereRMW3AQD+2LL
++NHsmQQchtmQg/gCZY0MS7gq++ULDwlakAkwMP0U6T19i299eBSBL4Zoj00rKNlx
+KLe0jbNlIe1uhVLYRfyz3S0I9z8gWDSQ8soFoqrJwKVHsO7wmH/3a0dCEWSHRRVm
+MRfU/Oy7A8U+iD37z9DxSN2O6hKRLMDu/NyTXUV95ImYwOcA7ya4nShwpB7vZLop
+Vu/BtX5HZ7JvBK3kApyR+Da5LYsBhqrDmqXqtykjn8TM0WG65jLKp5XolEcGEfUe
+KrqVMhVm+d2AijpRvsbOv13B7UmZkxBP9+6/o7uujv9nV5uSoGwv9tZn9ubeZyXo
+U7q3MaURqbgv6YV+h/aJ1X0URmPMyjUgkCLI3HbKJV+ZQH1jbNsn0aiVU0d0MXBb
+cE1NIZdfrQ/+Mp14KuiKoY/ycrJPQkg+Au8LANSk/pzH/lvGO1EP50eBRz4hIqEg
+RaNII+fQosyr10HPvlgMfEZQnDoG6H+Tvhgt4S6Ex9lyjKASnx/SQyRwhd9SPgDb
+bArbSq4lJ59rqw7TX2IrkjDgvv/FMqdcxjW+kIOTWDQ
+-> piv-p256 grR75w A1d8pk5Qfx1xq9vApCkKKj6gx1elqSYxLezwoChk3k7Z
+AeYO+rslswXdRJK/pwe9m3CNHIKsrRkt1lamyysDNQk
+-> piv-p256 RQguQQ AukcSmMTNQQZdr5zDOjMTnsOFZp5H5D5ohuVdIQUpUYM
+aJqrWcaXdpfS2vakEu5vi/AMHnoUUrUpm0bRRcCxiE8
+--- fNTWHdKIXpbJsZo2WnMAPXTNMtr0hKkgivCIi1qiQps
+X<1E><>R0j<30>ebMB7v6<76><04>Ȧ~
+몀<1E>8<=
+2i<1E><><EFBFBD>2<EFBFBD>J<EFBFBD>]L<><4C>p

secrets/services/gitea/mailerPassword.age

@@ -1,24 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 neExcQ S4SkrY0LLBlXsKIyKbJG/0xsdOTMXPRQwWmciJdCGFU
+-> ssh-ed25519 neExcQ Qx3NuIC3HnyhLAPB6NGLlO8073iIEXQ3VpVDvsPsLVk
-OugL59NZJ6fccEJtXbWA7wYoaFflA/wUOzkOSeuoLaM
+9Cz7AXaP/EorKrdLxMfaWJJsCIv5u6upJIaNbLiDleA
+-> ssh-ed25519 WiIaQQ AS+i8m6vO83lj5vZ1lr+FiM1SO1v7BU6OWertpdTXSU
+LIitIW7F/8idoKvgHmirFp1V9RlObyqOueDVIdBdRM0
 -> ssh-rsa VtjGpQ
-L4dHVMy1Ep/ai3y0cbOjJYcCgFcbzecOdjPow6OASNqBPUOfpcge4hmpWKbITLB4
+FdINMHPfPVgkQk0A5g6uDRQmZxI0h74QkJSdYUtHRfbqBP0R3f4TrqbtO4n6E7pR
-9FNsBxF0g+Z/gYtyiRmdZpB+61Ns5qsp66V9UDpQouAWnWGOtJhMVju0klXJWQLm
+5NYLkqyZND7ApC10hoQ2UJF22Ja06ZvWhhM7Zsl0X3u/58NhgXsXWy92I2sniBa4
-W8nL9dWdS3vcFhdD10YO7ErQZAADRn5msN3m79wsFpS8ehq7PSoyGmysvimvOGid
+DF6T3AD4bQOF4Px2A/+lnA++NIWHdroqghojWOAZazvLFaFa6HtIdrTiMb2bojuU
-d3H+NGfBJZOKuFtgPwx3OUel+QekGaCPJNgEMw5BB7BABvtOkSFsngbxSIzQDDgy
+qxepekbRwJBEm9/5bKHZlEmwx3rJsYxrNKEkxPrBvNdPbnwgxrvhOXxeQJghyGGw
-vFfcFWtvpLM/VNNZNkUBr+9esaCj6RJsn7wvktT69bjT12RoFrrMA1M3f/nwBPPW
+vnCRHKDbqvRIWfkmftRjNQMHUSMitDJHUOPsG9z5KBr4M7n7B1bV5ozsLsVyUUmE
-7VEe9DWmYU0KYO/z8oyqW0pv1Jn7CywSkeMhzhZflXrHgSJz8f0sc7RvUDrPe8nU
+6vBvrOPz9+RiE9H61PlAvPFMmKBTQgRf8+mjbU0RGxScqLcUoHCud2x3O+WqlLoP
-+hZtja23mp8iFLsqT1IDzCtx2AVQ/IEpBhK/e2VAA9x1dD1u8oO63Lqafx5bJj4o
+TMQtye8ayRPgG3PbwP4pO3olcA9ANEdd2Jfo+HG4izbJxdCTbOMfEFTJIEfyGMIo
-fVvqdfqS95Hoj6BYT4R+eaALjlQwo+ZbYkpMs48tMl3FMGB1yWFTf7lef//faRDd
+lo0Hh0EIijFAVfyAH6G/Rv1KggpINr8fTxbWz8i1PXTqzBsjfrqbHWWRrE/VJSYI
-O2qah2bc0B145eBQjSxu+qGV65h1uVVYbzyHztTDtD2VAH3vt3yhXxcrwIEbFmAD
+x9bjSHeWCOs+IlZ2YEB8dshJe5smrTnKpFYrj3kvLHOiC1jKUJdDZooQex4nkXpW
-RhdudA2i5N5R4WYvTSUlqu7W/1IReYLhJGPcAwUwviZMpsLAZXV0J4+kMfY2nlG7
+mMKIOb/VF6/QM3NkmJKLdnMJenIKL1Vqbrv/Lqu1/FaINqRsIGTXCsQs+JjxrcfX
-QIWAaOjNbCR9uUIzyRBiT8Z7evEhNJGfeoHfWI3YyxE
+zxpzs7Bk2eV/BaiJxJ7Cjfx1gO37GpL0kzCMuN1xnWs
--> piv-p256 grR75w A4JUNXeQebYxnpxuy/S0nZFuVefAsKoy9AgSqAmIgf+C
+-> piv-p256 grR75w Azu36XfRZ2Evj79zCs8RA5lwbMe2Je0oBI5JM+3MC/cO
-E6W2cZda5/zXAQiVXpuBwyq1vVjkc6oLPRZcxoquhSQ
+p8nO/p2M3pvEevZLLItNDSz64Ju8yBA2GPBnTWMN25I
--> piv-p256 RQguQQ AtTS4VS0D7XBHhqO4nAilRuUoaL8wN/CKqvsJBDkS2eV
+-> piv-p256 RQguQQ Av9ILPK7bsPNqgudLMq88MNSWrB+xrBVfxX3bjVCquvj
-DNQ7jGW5JaLyTj7s0pcjqYgB8TmSzKAc7uzY6KY/3K0
+0iwRR9htchLUk88RRooXsP0H39FfybCPMQC8AMxgu/0
--> dUR*@Go-grease sO
+--- puq9s7iYi1A0v+7Qhsqo05Yfxtg5kHJK66RM1TDLtNM
-kaM21qvzGtRDZOmKY3+RmLO7JNQ2qnbAy7Rhm2jrDwFMZapow7tHdoukwSPPtdqV
+<1E>![<5B><><EFBFBD>u_<75>(*<2A>0<03>Ŵ8<C5B4><38><EFBFBD><EFBFBD><EFBFBD>"<22><>Fsn<73>"T<><54>-<2D><><EFBFBD><EFBFBD><EFBFBD><05><>w<1B>w'<0C><><EFBFBD>4<EFBFBD><34><EFBFBD>sd_<64>!
-zbvcRqVh5eUp2GSpP9L5Md/Rb4zBrB3DQEQX+BDcBq2AoQLgznZu
---- 3gADr/DczM3F+Cvzio9AelnCMVuF9lKba8i82UlSmIs
-<EFBFBD>!O
~<7E><>a}<7D><>'i|A<><41>b<><62><EFBFBD>V<EFBFBD><56><EFBFBD>rq'N<><4E>_0<1A>L<EFBFBD>fBEnW<6E><0B>c<EFBFBD><63><EFBFBD>M<><4D><EFBFBD>I<>:Ybb

secrets/services/gitea/runner-token.age

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 1fxDZw TDpxzsr/x1p3WR7SKVetYVlKqdIxMI6w98tM5MIHC30
+HmWHgsw11pqILyvSl0FjeOokMuxlA9u128aAECK0Qvc
+-> ssh-rsa VtjGpQ
+XTL+rQuSTsY42cuFi2HKBo/6xRa+5Aw0NJafCDg4PBYbNvZf8Q4EFtrX3k3JzUcE
+fgzJI81h/ijl6FzvnAsfB0oMR/RIxHNdheIMxilsiaVGDS6ATnq8Mk7Ca67MtM5Y
+Uc9XQ6I4qtL3rdpvnp3BjR3d1KfmwsTBeYJrl03vltLBN8twgD7mBabtjcl38u1A
+emcgc8qAhz45n+07yVnqRqdMUY3VntqyL2DzasaPhpQHqV0jwWATNMGJilpvOSpn
+it5VGZWGVjjHiGtwEGvuWBRi2+4jt02WwrDmlrqoSZxiqXW42XCa9pPn/X+U1UYE
+dBJ1iPNc9EEQhr3sIewDAvjy2m4T/4wzY1gpgfiAY1FzgObZXOM3cv11yIAJU0ZX
+nnDTgJmRysxvp/at1dEDbza8krIGcBW0tWYvKQdm2kh3m+nTZWI2Btmm+hT60qYX
+4pLNkz0WR1nwdzzw0mSYXbPLlFAb8OrKP8fGJKvC6VM8C/Tofp+gWbfGnAFIq0um
+hBcCK3hlg/QDdBV3jrIQyX+Vk+W3xe5QMjI8Oem9Jzy/y4MmMjUV7x8X5hd6KiK9
+wc5Dt0VL1KgwomYLvrNnl32TAGK+tOVXPRLaFiR9jwsrJZ3GXlsxJO0W2hFjp3wk
+GGX/CFqRy228of9ujc+yPi6r9SO4BNT0eelwEbp0Kfs
+-> piv-p256 grR75w A4dwZqBbpqrb3KcacC1mupb7Nka8s7RlHfVcc07L1ApC
+5xM0zPEnRoA08LEdQDl3qcsOaNXPHgyDJxfRV3ar8cA
+-> piv-p256 RQguQQ AgC34mS9BXHs3UM7Xp7e66oMUKAJ7VASdxRCJuWnzZcz
+oOFQFWLUkQyGvHvmq2dZHDiE9J4J/wE3NBT1ASHtKRE
+--- fbj8iFIYKQvjNminxZ0TLt7S2RSdozKUhq2ARdI1L9s
+<EFBFBD>>H<><48><EFBFBD>&<26>3<>L<EFBFBD><4C><,Dv܍c<><63><EFBFBD><EFBFBD><EFBFBD>BI<42>dJ<64>i%<25>gK׳`<60><19><><EFBFBD>g<>9kN<6B>CP<43><50><EFBFBD><EFBFBD><EFBFBD><EFBFBD>b<EFBFBD><62>	<09><><EFBFBD><EFBFBD>a<1A><><EFBFBD>s=<1A><>"S

secrets/services/gitea/serverrunner-token.age

@@ -0,0 +1,23 @@
+age-encryption.org/v1
+-> ssh-ed25519 0qfOZA UTOzjwhqcVLmpf3P/nzO3aGKzKH0YKq04sUbFvMa/FE
+a2MMcZXucDEXmy/uU7JapMsboImCGsUiPA2Pr/wB5yQ
+-> ssh-rsa VtjGpQ
+Nr2g/ocV0oTbZydmcRnESyI4VOJdMGafozm80EMarbQfmeeRCfi76jxct/gpnL00
+P/2d/3pfvqbpuGZRg+Q/BCY0Vm2AujJ1P2UTxpnzC42iZu7qKWd5EY4z0Hok53kg
+McPh+pgNhugLr4Yh2KHpT27FfJpD/Pmjajg7G78Q9P5uel6SKXIW4uFO4Lp2yLC/
+vC52XMqxLrR9moCTr72dQPzd0IIhQ2vN9EtZkBnxUW6zt3ILAYJ06VLAGvVwXIWl
+0Wjs3G5g5v+H2e+Em5vIy1hdub/3orEL4racHO0m0binK/IVRJY7sjZDVDrrerFS
+SqPORQ3a7jmuHFeHxwAlRcmh/O1gEgAnCZTZRfQzgXI+nfPEzuL0yENd/ksUPBdm
+q2zQSv1rrj/tLMtxk4vpG8FkPp5UctaYignvHAp95xC+TR14aDUdT4x4MGboHIxu
+l6Q3evVJzblwIl3JbzpP3yOA2k25Y1KI+nVDrTqAdi+Yy4jtIOA+XancIHrpLzAO
+21JO1wwGtAsjUDCdhnYSyMcOiRLRHzPoK7o/BGx6b1Uqk2WmWhZnZft9MHPp2RtX
+Gv3PBMVjz2CO+f3d8B4akPSApgQ9fw1Vje5fY0CDWdORV7tHDCKb6fmTua2d73Iz
+ANrKYonqWhjf3F9u7zzM8/xd593AH/Y+aJo+z0S+Z6I
+-> piv-p256 grR75w Ap4du3RBcNdRvbwjQTpP5PPXtNCRuoQePt6ULYEpNM1r
+4Qe4c6j7df/TajuxM5Q1qnC/TCBNNI5K9WCDqD4VM1M
+-> piv-p256 RQguQQ AoR+aGTAQ6VELef54cGpukkWjeKz37tDbW93ncGWFsrI
+KbF1N14PYEQ28a/MePeq7hW9LAgUaNriFo6UO0eBvt4
+--- F8GiyUf87+vhg22ldWuC2j5K8WGAK3y5lRDG6yrzBPQ
+a<18>$<24>-<2D><>|<7C>h.cr38<33><38><EFBFBD><EFBFBD>Pw<50>3<EFBFBD><19>Nh<4E><68><EFBFBD>B<EFBFBD>j	!z^<5E><> b<>8c<38><63><EFBFBD>m<EFBFBD>s<EFBFBD><03><>
+<EFBFBD>\<5C>3<EFBFBD><18><><EFBFBD>f<>x3|<7C>Ne<4E>
+=:<3A>