feat(bomba): add mail

feat(fish): add some aliases

.gitignore

@@ -0,0 +1,2 @@
+result
+*.qcow2

.migrate

@@ -0,0 +1,37 @@
+{
+  "lastRun": "1763873600000-backfill-files-owner.js",
+  "migrations": [
+    {
+      "title": "1694360000000-create-folders.js",
+      "timestamp": 1783750350595
+    },
+    {
+      "title": "1694360479680-create-account-db.js",
+      "timestamp": 1783750350654
+    },
+    {
+      "title": "1694362247011-create-secret-table.js",
+      "timestamp": 1783750350670
+    },
+    {
+      "title": "1702667624000-rename-nordigen-secrets.js",
+      "timestamp": 1783750350671
+    },
+    {
+      "title": "1718889148000-openid.js",
+      "timestamp": 1783750350688
+    },
+    {
+      "title": "1719409568000-multiuser.js",
+      "timestamp": 1783750350708
+    },
+    {
+      "title": "1763873568237-server-global-prefs.js",
+      "timestamp": 1783750350724
+    },
+    {
+      "title": "1763873600000-backfill-files-owner.js",
+      "timestamp": 1783750350726
+    }
+  ]
+}

.sops.yaml

@@ -1,9 +1,15 @@
 keys:
   - &katana age18ujjw92tm6vpcpgqqky7dzg3yvzm9nytgzeptkfhtz5jhdskcdpsgmv0vs
   - &bomba age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx
+  - &frog age1xfr76wj2hzz9mkxxce5qxgr2n72zsypatzhgl2fxgsh408wdzsaq39wt9z
 creation_rules:
-  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/default.sops.yaml
     key_groups:
-    - age:
+      - age:
-      - *katana
+        - *katana
-      - *bomba
+        - *bomba
+        - *frog
+  - path_regex: secrets/bomba.sops.yaml
+    key_groups:
+      - age:
+        - *bomba

README.md

@@ -2,16 +2,20 @@
 
 My own NixOS configuration, made for myself so probably won't suit you well.
 
-![Screenshot](assets/gnome.png)
+![Screenshot](assets/niri.png)
 
 ## How to install 
 1) Clone the repo
 ```bash
 git clone git@github.com:Superredstone/nixos.git ~/.nixos && cd .nixos
 ```
-2) Choose an hostname 
+2) Choose a hostname 
 3) Copy your current configuration inside of `machines/$HOSTNAME`
-4) Create a file named `machines/$HOSTNAME/default.nix` with the following contents 
+4) Load basic utils to your current environment
+```bash
+nix-shell -p git neovim just
+```
+5) Create a file named `machines/$HOSTNAME/default.nix` with the following contents 
 ```nix
 { ... }: 
 {
@@ -20,11 +24,11 @@ git clone git@github.com:Superredstone/nixos.git ~/.nixos && cd .nixos
 	];
 }
 ```
-5) Follow `secrets/README.md`
 6) Switch to the new configuration
 ```bash
-HOSTNAME=HOSTNAME just switch
+HOSTNAME=HOSTNAME just new-machine
 ```
+7) Follow `secrets/README.md`
 
 ## Contributing 
 After commit [bd788c3](https://github.com/Superredstone/nixos/commit/bd788c366af4b94e1fab8251cabc08fc10f5b037) this repository will follow the [conventional commits specification](https://www.conventionalcommits.org/en/v1.0.0/#specification)

assets/niri.kdl

@@ -0,0 +1,327 @@
+// This config is in the KDL format: https://kdl.dev
+// "/-" comments out the following node.
+// Check the wiki for a full description of the configuration:
+// https://yalter.github.io/niri/Configuration:-Introduction
+
+// Input device configuration.
+// Find the full list of options on the wiki:
+// https://yalter.github.io/niri/Configuration:-Input
+input {
+    keyboard {
+        xkb {
+            layout "us,it"
+        }
+    }
+    touchpad {
+        tap
+        natural-scroll
+        accel-profile "flat"
+    }
+
+    mouse {
+        accel-speed 0.01
+        accel-profile "flat"
+    }
+}
+
+// https://yalter.github.io/niri/Configuration:-Outputs
+output "eDP-1" {
+    mode "1920x1080@144.003"
+    transform "normal"
+    position x=0 y=0
+}
+
+output "Acer Technologies Acer KG241Q 0x93210922" {
+    mode "1920x1080@74.986"
+}
+
+output "Microstep MSI G255F BC0M275402311" {
+    mode "1920x1080@179.998"
+}
+
+output "HDMI-A-1" {
+    mode "1920x1080@60.000"
+}
+
+// https://yalter.github.io/niri/Configuration:-Layout
+layout {
+    // Set gaps around windows in logical pixels.
+    gaps 16
+
+    // When to center a column when changing focus, options are:
+    // - "never", default behavior, focusing an off-screen column will keep at the left
+    //   or right edge of the screen.
+    // - "always", the focused column will always be centered.
+    // - "on-overflow", focusing a column will center it if it doesn't fit
+    //   together with the previously focused column.
+    center-focused-column "never"
+
+    // You can customize the widths that "switch-preset-column-width" (Mod+R) toggles between.
+    preset-column-widths {
+        // Proportion sets the width as a fraction of the output width, taking gaps into account.
+        // For example, you can perfectly fit four windows sized "proportion 0.25" on an output.
+        // The default preset widths are 1/3, 1/2 and 2/3 of the output.
+        proportion 0.33333
+        proportion 0.5
+        proportion 0.66667
+
+        // Fixed sets the width in logical pixels exactly.
+        // fixed 1920
+    }
+
+    default-column-width { proportion 0.5; }
+    focus-ring {
+        // Uncomment this line to disable the focus ring.
+        // off
+
+        // How many logical pixels the ring extends out from the windows.
+        width 2
+
+        // Colors can be set in a variety of ways:
+        // - CSS named colors: "red"
+        // - RGB hex: "#rgb", "#rgba", "#rrggbb", "#rrggbbaa"
+        // - CSS-like notation: "rgb(255, 127, 0)", rgba(), hsl() and a few others.
+
+        // Color of the ring on the active monitor.
+        active-color "#7fc8ff"
+
+        // Color of the ring on inactive monitors.
+        //
+        // The focus ring only draws around the active window, so the only place
+        // where you can see its inactive-color is on other monitors.
+        inactive-color "#505050"
+
+        // You can also use gradients. They take precedence over solid colors.
+        // Gradients are rendered the same as CSS linear-gradient(angle, from, to).
+        // The angle is the same as in linear-gradient, and is optional,
+        // defaulting to 180 (top-to-bottom gradient).
+        // You can use any CSS linear-gradient tool on the web to set these up.
+        // Changing the color space is also supported, check the wiki for more info.
+        //
+        // active-gradient from="#80c8ff" to="#c7ff7f" angle=45
+
+        // You can also color the gradient relative to the entire view
+        // of the workspace, rather than relative to just the window itself.
+        // To do that, set relative-to="workspace-view".
+        //
+        // inactive-gradient from="#505050" to="#808080" angle=45 relative-to="workspace-view"
+    }
+
+    border {
+        off
+        width 4
+        active-color "#ffc87f"
+        inactive-color "#505050"
+        urgent-color "#9b0000"
+    }
+
+    shadow {
+        on
+        softness 30
+        spread 5
+        offset x=0 y=5
+        color "#0007"
+    }
+}
+
+// To run a shell command (with variables, pipes, etc.), use spawn-sh-at-startup:
+// spawn-sh-at-startup "qs -c ~/source/qs/MyAwesomeShell"
+
+hotkey-overlay {
+    skip-at-startup
+}
+
+screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png"
+
+// https://yalter.github.io/niri/Configuration:-Animations
+animations {
+}
+
+// https://yalter.github.io/niri/Configuration:-Window-Rules
+
+// Open the Firefox picture-in-picture player as floating by default.
+window-rule {
+    // This app-id regular expression will work for both:
+    // - host Firefox (app-id is "firefox")
+    // - Flatpak Firefox (app-id is "org.mozilla.firefox")
+    match app-id=r#"firefox$"# title="^Picture-in-Picture$"
+    open-floating true
+}
+
+window-rule {
+    match app-id="steam" title=r#"^notificationtoasts_\d+_desktop$"#
+    default-floating-position x=10 y=10 relative-to="bottom-right"
+}
+
+window-rule {
+    geometry-corner-radius 0 // Embrace rectangles, reject modernity
+    clip-to-geometry true
+}
+
+window-rule {
+    match title="Steam"
+    match title="Firefox"
+    match title="Discord"
+    
+    open-maximized true;
+}
+
+window-rule {
+  match app-id="dev.noctalia.Noctalia.Settings"
+  open-floating true
+  default-column-width { fixed 1080; }
+  default-window-height { fixed 920; }
+}
+
+debug {
+  honor-xdg-activation-with-invalid-serial
+}
+
+spawn-at-startup "noctalia"
+
+binds {
+    Mod+Shift+Slash { show-hotkey-overlay; }
+
+    Mod+Return hotkey-overlay-title="Run Kitty" { spawn "kitty"; }
+    Mod+B hotkey-overlay-title="Run Firefox" { spawn "firefox"; }
+    Super+Alt+L hotkey-overlay-title="Lock the Screen" { spawn "noctalia" "msg" "session" "lock"; }
+    Mod+Space hotkey-overlay-title="Run application launcher" { spawn "noctalia" "msg" "panel-toggle" "launcher"; }
+
+    XF86AudioRaiseVolume { spawn "noctalia" "msg" "volume-up"; }
+    XF86AudioLowerVolume { spawn "noctalia" "msg" "volume-down"; }
+    XF86AudioMute { spawn "noctalia" "msg" "volume-mute"; }
+    XF86AudioPause { spawn "noctalia" "msg" "media" "toggle"; }
+    XF86AudioPlay { spawn "noctalia" "msg" "media" "toggle"; }
+    XF86AudioStop { spawn "noctalia" "msg" "media" "stop"; }
+    XF86AudioPrev { spawn "noctalia" "msg" "media" "previous"; }
+    XF86AudioNext { spawn "noctalia" "msg" "media" "next"; }
+    XF86MonBrightnessUp { spawn "noctalia" "msg" "brightness-up"; }
+    XF86MonBrightnessDown { spawn "noctalia" "msg" "brightness-down"; }
+
+    Mod+Shift+Space { spawn "niri" "msg" "action" "switch-layout" "next"; }
+
+    Mod+O repeat=false { toggle-overview; }
+
+    Mod+Shift+Q repeat=false { close-window; }
+
+    Mod+Left  { focus-column-left; }
+    Mod+Down  { focus-window-down; }
+    Mod+Up    { focus-window-up; }
+    Mod+Right { focus-column-right; }
+    Mod+H     { focus-column-left; }
+    Mod+J     { focus-window-down; }
+    Mod+K     { focus-window-up; }
+    Mod+L     { focus-column-right; }
+
+    Mod+Ctrl+Left  { move-column-left; }
+    Mod+Ctrl+Down  { move-window-down; }
+    Mod+Ctrl+Up    { move-window-up; }
+    Mod+Ctrl+Right { move-column-right; }
+    Mod+Ctrl+H     { move-column-left; }
+    Mod+Ctrl+J     { move-window-down; }
+    Mod+Ctrl+K     { move-window-up; }
+    Mod+Ctrl+L     { move-column-right; }
+
+    Mod+Home { focus-column-first; }
+    Mod+End  { focus-column-last; }
+    Mod+Ctrl+Home { move-column-to-first; }
+    Mod+Ctrl+End  { move-column-to-last; }
+
+    Mod+Shift+Left  { focus-monitor-left; }
+    Mod+Shift+Down  { focus-monitor-down; }
+    Mod+Shift+Up    { focus-monitor-up; }
+    Mod+Shift+Right { focus-monitor-right; }
+    Mod+Shift+H     { focus-monitor-left; }
+    Mod+Shift+J     { focus-monitor-down; }
+    Mod+Shift+K     { focus-monitor-up; }
+    Mod+Shift+L     { focus-monitor-right; }
+
+    Mod+Shift+Ctrl+Left  { move-column-to-monitor-left; }
+    Mod+Shift+Ctrl+Down  { move-column-to-monitor-down; }
+    Mod+Shift+Ctrl+Up    { move-column-to-monitor-up; }
+    Mod+Shift+Ctrl+Right { move-column-to-monitor-right; }
+    Mod+Shift+Ctrl+H     { move-column-to-monitor-left; }
+    Mod+Shift+Ctrl+J     { move-column-to-monitor-down; }
+    Mod+Shift+Ctrl+K     { move-column-to-monitor-up; }
+    Mod+Shift+Ctrl+L     { move-column-to-monitor-right; }
+
+    Mod+Page_Down      { focus-workspace-down; }
+    Mod+Page_Up        { focus-workspace-up; }
+    Mod+U              { focus-workspace-down; }
+    Mod+I              { focus-workspace-up; }
+    Mod+Ctrl+Page_Down { move-column-to-workspace-down; }
+    Mod+Ctrl+Page_Up   { move-column-to-workspace-up; }
+    Mod+Ctrl+U         { move-column-to-workspace-down; }
+    Mod+Ctrl+I         { move-column-to-workspace-up; }
+
+    Mod+Shift+Page_Down { move-workspace-down; }
+    Mod+Shift+Page_Up   { move-workspace-up; }
+    Mod+Shift+U         { move-workspace-down; }
+    Mod+Shift+I         { move-workspace-up; }
+
+    Mod+WheelScrollDown      cooldown-ms=150 { focus-workspace-down; }
+    Mod+WheelScrollUp        cooldown-ms=150 { focus-workspace-up; }
+    Mod+Ctrl+WheelScrollDown cooldown-ms=150 { move-column-to-workspace-down; }
+    Mod+Ctrl+WheelScrollUp   cooldown-ms=150 { move-column-to-workspace-up; }
+
+    Mod+WheelScrollRight      { focus-column-right; }
+    Mod+WheelScrollLeft       { focus-column-left; }
+    Mod+Ctrl+WheelScrollRight { move-column-right; }
+    Mod+Ctrl+WheelScrollLeft  { move-column-left; }
+
+    Mod+Shift+WheelScrollDown      { focus-column-right; }
+    Mod+Shift+WheelScrollUp        { focus-column-left; }
+    Mod+Ctrl+Shift+WheelScrollDown { move-column-right; }
+    Mod+Ctrl+Shift+WheelScrollUp   { move-column-left; }
+
+    Mod+1 { focus-workspace 1; }
+    Mod+2 { focus-workspace 2; }
+    Mod+3 { focus-workspace 3; }
+    Mod+4 { focus-workspace 4; }
+    Mod+5 { focus-workspace 5; }
+    Mod+6 { focus-workspace 6; }
+    Mod+7 { focus-workspace 7; }
+    Mod+8 { focus-workspace 8; }
+    Mod+9 { focus-workspace 9; }
+    Mod+Ctrl+1 { move-column-to-workspace 1; }
+    Mod+Ctrl+2 { move-column-to-workspace 2; }
+    Mod+Ctrl+3 { move-column-to-workspace 3; }
+    Mod+Ctrl+4 { move-column-to-workspace 4; }
+    Mod+Ctrl+5 { move-column-to-workspace 5; }
+    Mod+Ctrl+6 { move-column-to-workspace 6; }
+    Mod+Ctrl+7 { move-column-to-workspace 7; }
+    Mod+Ctrl+8 { move-column-to-workspace 8; }
+    Mod+Ctrl+9 { move-column-to-workspace 9; }
+
+    Mod+BracketLeft  { consume-or-expel-window-left; }
+    Mod+BracketRight { consume-or-expel-window-right; }
+
+    Mod+Comma  { consume-window-into-column; }
+    Mod+Period { expel-window-from-column; }
+
+    Mod+R { switch-preset-column-width; }
+    Mod+Shift+R { switch-preset-window-height; }
+    Mod+Ctrl+R { reset-window-height; }
+    Mod+F { maximize-column; }
+    Mod+Shift+F { fullscreen-window; }
+    Mod+Ctrl+F { expand-column-to-available-width; }
+    Mod+C { center-column; }
+    Mod+Ctrl+C { center-visible-columns; }
+    Mod+Minus { set-column-width "-10%"; }
+    Mod+Equal { set-column-width "+10%"; }
+    Mod+Shift+Minus { set-window-height "-10%"; }
+    Mod+Shift+Equal { set-window-height "+10%"; }
+    Mod+V       { toggle-window-floating; }
+    Mod+Shift+V { switch-focus-between-floating-and-tiling; }
+    Mod+W { toggle-column-tabbed-display; }
+    Print { screenshot; }
+    Ctrl+Print { screenshot-screen; }
+    Alt+Print { screenshot-window; }
+    Mod+Escape allow-inhibiting=false { toggle-keyboard-shortcuts-inhibit; }
+    Mod+Shift+E { quit; }
+    Ctrl+Alt+Delete { quit; }
+    Mod+Shift+P { power-off-monitors; }
+}
+
+include "./noctalia.kdl"
+

assets/noctalia-config.toml

@@ -0,0 +1,246 @@
+[accessibility]
+ui_scale = 0.90000000596046448
+
+[bar.default]
+capsule_radius = 0
+center = [ "clock" ]
+end = [
+    "media",
+    "tray",
+    "notifications",
+    "clipboard",
+    "network",
+    "bluetooth",
+    "volume",
+    "brightness",
+    "battery",
+    "control-center"
+]
+margin_edge = 0
+margin_ends = 0
+radius = 0
+start = [ "launcher", "workspaces" ]
+
+[calendar]
+enabled = true
+
+    [calendar.account.personal_google]
+    name = "Calendar"
+    type = "google"
+
+[desktop_widgets]
+schema_version = 1
+widget_order = [
+    "desktop-widget-0000000000000001",
+    "desktop-widget-0000000000000002",
+    "desktop-widget-0000000000000003",
+    "desktop-widget-0000000000000005"
+]
+
+    [desktop_widgets.grid]
+    cell_size = 16
+    major_interval = 4
+    visible = true
+
+    [desktop_widgets.widget.desktop-widget-0000000000000001]
+    box_height = 0.0
+    box_width = 0.0
+    cx = 1762.0
+    cy = 133.70001220703125
+    output = "HDMI-A-1"
+    rotation = 0.0
+    type = "clock"
+
+        [desktop_widgets.widget.desktop-widget-0000000000000001.settings]
+        background_opacity = 0.0
+        background_padding = 11
+        background_radius = 0
+        center_text = false
+        clock_style = "digital"
+        shadow = false
+
+    [desktop_widgets.widget.desktop-widget-0000000000000002]
+    box_height = 0.0
+    box_width = 0.0
+    cx = 1114.0
+    cy = 995.4000244140625
+    output = "HDMI-A-1"
+    rotation = 0.0
+    type = "sysmon"
+
+        [desktop_widgets.widget.desktop-widget-0000000000000002.settings]
+        background_opacity = 0.0
+        display = "graph"
+        shadow = false
+        stat = "cpu_usage"
+        stat2 = "cpu_temp"
+
+    [desktop_widgets.widget.desktop-widget-0000000000000003]
+    box_height = 0.0
+    box_width = 0.0
+    cx = 154.0
+    cy = 130.60000610351562
+    output = "HDMI-A-1"
+    rotation = 0.0
+    type = "weather"
+
+        [desktop_widgets.widget.desktop-widget-0000000000000003.settings]
+        background_opacity = 0.0
+        background_padding = 19
+        background_radius = 0
+        shadow = false
+
+    [desktop_widgets.widget.desktop-widget-0000000000000005]
+    box_height = 0.0
+    box_width = 0.0
+    cx = 810.0
+    cy = 995.4000244140625
+    output = "HDMI-A-1"
+    rotation = 0.0
+    type = "sysmon"
+
+        [desktop_widgets.widget.desktop-widget-0000000000000005.settings]
+        background_opacity = 0.0
+        display = "graph"
+        shadow = false
+        show_label = true
+        stat = "ram_pct"
+        stat2 = "swap_pct"
+
+[dock]
+auto_hide = true
+enabled = true
+icon_size = 42
+magnification_scale = 1.3000000044703484
+padding = 4
+radius = 0
+reserve_space = false
+show_dots = true
+
+[location]
+address = "Bolzano"
+
+[lockscreen]
+blurred_desktop = true
+
+[lockscreen_widgets]
+enabled = false
+schema_version = 1
+widget_order = [ "lockscreen-login-box@winit", "lockscreen-login-box@HDMI-A-1", "lockscreen-login-box@eDP-1" ]
+
+    [lockscreen_widgets.grid]
+    cell_size = 16
+    major_interval = 4
+    visible = true
+
+    [lockscreen_widgets.widget."lockscreen-login-box@HDMI-A-1"]
+    box_height = 70.0
+    box_width = 400.0
+    cx = 960.0
+    cy = 957.0
+    output = "HDMI-A-1"
+    rotation = 0.0
+    scale = 1.0
+    type = "login_box"
+
+        [lockscreen_widgets.widget."lockscreen-login-box@HDMI-A-1".settings]
+        show_caps_lock = true
+        show_keyboard_layout = true
+        show_login_button = true
+
+    [lockscreen_widgets.widget."lockscreen-login-box@eDP-1"]
+    box_height = 70.0
+    box_width = 400.0
+    cx = 960.0
+    cy = 957.0
+    output = "eDP-1"
+    rotation = 0.0
+    scale = 1.0
+    type = "login_box"
+
+        [lockscreen_widgets.widget."lockscreen-login-box@eDP-1".settings]
+        show_caps_lock = true
+        show_keyboard_layout = true
+        show_login_button = true
+
+    [lockscreen_widgets.widget."lockscreen-login-box@winit"]
+    box_height = 70.0
+    box_width = 400.0
+    cx = 464.0
+    cy = 863.0
+    output = "winit"
+    rotation = 0.0
+    type = "login_box"
+
+        [lockscreen_widgets.widget."lockscreen-login-box@winit".settings]
+        background_color = "surface_variant"
+        background_opacity = 0.88
+        background_radius = 12.0
+        input_opacity = 1.0
+        input_radius = 6.0
+        show_caps_lock = true
+        show_keyboard_layout = true
+        show_login_button = true
+
+[osd.kinds]
+media = false
+
+[plugins]
+enabled = []
+
+[shell]
+avatar_path = "/home/r3ddy/.face"
+corner_radius_scale = 0.0
+font_family = "Monocraft"
+polkit_agent = true
+settings_show_advanced = true
+
+    [shell.screen_corners]
+    size = 1
+
+[theme]
+builtin = "Catppuccin"
+community_palette = "One Dark Two"
+custom_palette = "Tokyo Night Moon"
+mode = "dark"
+source = "builtin"
+wallpaper_scheme = "dysfunctional"
+
+    [theme.templates]
+    builtin_ids = [ "btop", "gtk3", "gtk4", "kcolorscheme", "kitty", "niri", "qt" ]
+    community_ids = [ "discord", "telegram", "vscode", "heroiclauncher", "steam", "obs", "lazygit" ]
+
+[wallpaper]
+directory = "/home/r3ddy/Pictures/Wallpapers"
+
+    [wallpaper.default]
+    path = "/home/r3ddy/Pictures/Wallpapers/wallpaper.jpg"
+
+    [wallpaper.last]
+    path = "/home/r3ddy/Pictures/Wallpapers/wallpaper.jpg"
+
+    [wallpaper.monitors.HDMI-A-1]
+    path = "/home/r3ddy/Pictures/Wallpapers/wallpaper.jpg"
+
+    [wallpaper.monitors.eDP-1]
+    path = "/home/r3ddy/Pictures/Wallpapers/wallpaper.jpg"
+
+[weather]
+address = "Bolzano"
+refresh_minutes = 60
+
+[widget.cat]
+audio_spectrum = true
+rave_mode = true
+tappy_mode = true
+type = "noctalia/bongocat:cat"
+use_mpris_filter = true
+
+[widget.clock]
+format = "{:%a %d %b %Y %H:%M}"
+
+[widget.control-center]
+glyph = "ghost-3-filled"
+
+[widget.network]
+show_label = false

flake.nix

@@ -1,33 +1,54 @@
 {
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-25-11.url = "github:nixos/nixpkgs/nixos-25.11";
+    nixpkgs-my-features.url = "github:Superredstone/nixpkgs/my-features";
+    nix-cachyos-kernel.url = "github:xddxdd/nix-cachyos-kernel/release";
+    simple-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixvim = {
       url = "github:Superredstone/nixvim";
-      inputs.nixpkgs.follows = "nixpkgs";
+      # inputs.nixpkgs.follows = "nixpkgs";
     };
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    hyprland.url = "github:hyprwm/Hyprland";
+    noctalia = {
-    spotiflac-cli.url = "github:Superredstone/spotiflac-cli";
+      url = "github:noctalia-dev/noctalia";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nixflix = {
+      url = "github:kiriwalawren/nixflix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    authentik-nix = {
+      url = "github:nix-community/authentik-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
     {
       nixpkgs,
+      nixpkgs-25-11,
+      nixpkgs-my-features,
       home-manager,
       nixvim,
-      spotiflac-cli,
       sops-nix,
+      nix-cachyos-kernel,
+      noctalia,
+      nixflix,
+      authentik-nix,
+      simple-mailserver,
       ...
     }@inputs:
     let
       overlays = [
+        nix-cachyos-kernel.overlays.pinned
       ];
       personalEmail = "patrickcanal3@gmail.com";
       username = "r3ddy";
@@ -35,10 +56,13 @@
         inherit
           overlays
           nixvim
-          spotiflac-cli
           sops-nix
+          noctalia
+          simple-mailserver
           inputs
           nixpkgs
+          nixpkgs-25-11
+          nixpkgs-my-features
           home-manager
           ;
       };
@@ -49,8 +73,8 @@
         user = username;
         email = personalEmail;
         gamingSystem = true;
-        # Currently supported: plasma, gnome, hyprland and none
+        # Currently supported: plasma, gnome, niri and none
-        desktopEnvironment = "gnome";
+        desktopEnvironment = "niri";
         enableZram = true;
         additionalModules = [
         ];
@@ -69,6 +93,19 @@
         user = username;
         desktopEnvironment = "none";
         enableZram = true;
+        additionalModules = [
+          nixflix.nixosModules.default
+          authentik-nix.nixosModules.default
+          simple-mailserver.nixosModules.default
+        ];
+      };
+      nixosConfigurations."frog" = mkSystem "frog" {
+        system = "x86_64-linux";
+        user = username;
+        email = personalEmail;
+        workSystem = true;
+        desktopEnvironment = "gnome";
+        enableZram = true;
       };
     };
 }

home/blackbox.nix

@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+let
+  catppuccinTheme = pkgs.stdenv.mkDerivation {
+    name = "catppuccin-theme";
+    src = pkgs.fetchFromGitHub {
+      owner = "catppuccin";
+      repo = "tilix";
+      rev = "f29239686d1309b9eaaf03447156ae16427a3ef7";
+      hash = "sha256-d/HOSQ4F06s2aMojS9lK8Vbx8AJXdlxuK88W9h9q0kw=";
+    };
+    installPhase = ''
+      	cp themes/catppuccin-mocha.json $out
+    '';
+  };
+in
+{
+  home.file."blackbox-catppuccin" = {
+    source = catppuccinTheme;
+    target = ".local/share/blackbox/schemes/catppuccin-mocha.json";
+  };
+}

home/default.nix

@@ -6,6 +6,7 @@
 }:
 {
   imports = [
+    ./blackbox.nix
     ./fish.nix
     ./git.nix
     ./kitty.nix
@@ -14,15 +15,15 @@
     ./vesktop.nix
     ./zoxide.nix
   ]
-  ++ (if currentSystemDe == "hyprland" then [ ./hyprland ] else [ ])
+  ++ (if currentSystemDe == "gnome" then [ ./gnome.nix ] else [ ])
-  ++ (if currentSystemDe == "gnome" then [ ./gnome.nix ] else [ ]);
+  ++ (if currentSystemDe == "niri" then [ ./niri.nix ] else [ ]);
 
   home = {
     username = "${currentSystemUser}";
     sessionVariables = {
       EDITOR = "nvim";
       BROWSER = "firefox";
-      TERMINAL = "gnome-boxes";
+      TERMINAL = "kitty";
     };
     packages = [
       pkgs.dconf
@@ -31,7 +32,7 @@
       "$HOME/.local/bin"
     ];
 
-    stateVersion = "24.11";
+    stateVersion = "26.05";
   };
 
   dconf.enable = true;

home/fish.nix

@@ -2,22 +2,25 @@
 {
   programs.fish = {
     enable = true;
+    shellAliases = {
+      "please" = "sudo $history[1]";
+      "amend" = "git commit --amend";
+      "commit" = "git commit";
+      "add" = "git add .";
+      "ssh" = "kitten ssh";
+      "dev" = "nix develop --command 'fish'";
+    };
     interactiveShellInit = ''
-      			# This is commented until a good way of installing themes is found
+      # This is commented until a good way of installing themes is found
-      			# fish_config theme choose Catppuccin\ Mocha
+      # fish_config theme choose Catppuccin\ Mocha
 
-      			function fish_greeting 
+      function fish_greeting 
-      				krabby random --no-title --padding-left 2
+        # Check if not inside of a distrobox 
-      			end
+        if not test -n "$CONTAINER_ID" 
-       
+          krabby random --no-title --padding-left 2
-      			function weather
+        end
-      				curl "wttr.in/Bolzano?0?Q?" 
+      end
-      			end
+    '';
-
-      			function dev
-      				nix develop --command "fish"
-      			end
-      		'';
     plugins = with pkgs.fishPlugins; [
       {
         name = "fzf.fish";

home/git.nix

@@ -2,6 +2,7 @@
 {
   programs.git = {
     enable = true;
+    signing.format = "openpgp";
     settings = {
       user = {
         name = "Superredstone";
@@ -11,6 +12,7 @@
       init.defaultBranch = "main";
       pull.rebase = true;
       commit.gpgsign = true;
+      push.autoSetupRemote = true;
     };
   };
 }

home/gnome.nix

@@ -14,10 +14,8 @@
 
   gtk = {
     enable = true;
-    iconTheme = {
+    colorScheme = "dark";
-      name = "Papirus";
+    gtk4.theme = null;
-      package = pkgs.papirus-icon-theme;
-    };
     cursorTheme = {
       name = "Bibata-Modern-Classic";
       package = pkgs.bibata-cursors;

home/hyprland/default.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./hyprland.nix
-    ./hyprlock.nix
-    ./waybar.nix
-    ./wofi.nix
-  ];
-}

home/hyprland/hyprland.nix

@@ -1,86 +0,0 @@
-{ currentSystemUser, ... }:
-{
-  dconf.settings = {
-    "org/gnome/desktop/interface" = {
-      color-scheme = "prefer-dark";
-    };
-  };
-
-  wayland.windowManager.hyprland = {
-    enable = true;
-    settings = {
-      "$mod" = "SUPER";
-      bind = [
-        "$mod, Return, exec, kitty"
-        "$mod, SPACE, exec, wofi --show run"
-        "$mod SHIFT, L, exec, hyprlock"
-
-        "$mod SHIFT, Q, killactive"
-        "$mod, F, fullscreen"
-        "$mod, H, movefocus, l"
-        "$mod, L, movefocus, r"
-        "$mod, K, movefocus, u"
-        "$mod, J, movefocus, d"
-        "$mod SHIFT, H, movewindow, l"
-        "$mod SHIFT, L, movewindow, r"
-        "$mod SHIFT, K, movewindow, u"
-        "$mod SHIFT, J, movewindow, d"
-        "$mod SHIFT, right, resizeactive, 30 0"
-        "$mod SHIFT, left, resizeactive, -30 0"
-        "$mod SHIFT, up, resizeactive, 0 -30"
-        "$mod SHIFT, down, resizeactive, 0 30"
-        "$mod SHIFT, U, togglefloating"
-
-        ",XF86MonBrightnessDown, exec, brightnessctl set 2%-"
-        ",XF86MonBrightnessUp, exec, brightnessctl set +2%"
-        ",XF86AudioLowerVolume, exec, pamixer -d 2"
-        ",XF86AudioRaiseVolume, exec, pamixer -i 2"
-
-        "$mod, delete, exit"
-      ]
-      ++ (builtins.concatLists (
-        builtins.genList (
-          i:
-          let
-            ws = i + 1;
-          in
-          [
-            "$mod, code:1${toString i}, workspace, ${toString ws}"
-            "$mod SHIFT, code:1${toString i}, movetoworkspace, ${toString ws}"
-          ]
-        ) 9
-      ));
-      bindm = [
-        "$mod, mouse:272, movewindow"
-        "$mod, mouse:273, resizewindow"
-      ];
-
-      monitor = ", preferred, auto, 1";
-
-      input = {
-        touchpad = {
-          natural_scroll = "yes";
-        };
-
-        sensitivity = "0";
-        accel_profile = "flat";
-      };
-
-      exec-once = [
-        "waybar"
-        "hyprpaper"
-      ];
-
-      exec = [
-      ];
-    };
-  };
-
-  services.hyprpaper = {
-    enable = true;
-    settings = {
-      preload = [ "/home/${currentSystemUser}/Pictures/wallpaper.jpg" ];
-      wallpaper = [ ",/home/${currentSystemUser}/Pictures/wallpaper.jpg" ];
-    };
-  };
-}

home/hyprland/hyprlock.nix

@@ -1,6 +0,0 @@
-{ ... }:
-{
-  programs.hyprlock = {
-    enable = true;
-  };
-}

home/hyprland/waybar.nix

@@ -1,377 +0,0 @@
-{ ... }:
-{
-  programs.waybar = {
-    enable = true;
-
-    settings = {
-      mainBar = {
-        height = 30;
-        spacing = 1;
-        modules-left = [
-          "hyprland/workspaces"
-        ];
-        modules-center = [
-          "hyprland/window"
-        ];
-        modules-right = [
-          "tray"
-          "pulseaudio"
-          "network"
-          "power-profiles-daemon"
-          "backlight"
-          "battery"
-          "clock"
-        ];
-
-        "hyprland/workspaces" = {
-          format = "{name} {icon}";
-          format-icons = {
-            "1" = "";
-            "2" = "";
-            "3" = "";
-            "4" = "";
-            "5" = "";
-          };
-        };
-        "tray" = {
-          spacing = 10;
-        };
-        "pulseaudio" = {
-          format = "{volume}% {icon}";
-          format-icons = {
-            headphones = "";
-            bluetooth = "󰥰";
-            handsfree = "";
-            headset = "󱡬";
-            phone = "";
-            portable = "";
-            car = "";
-            default = [
-              "🕨"
-              "🕩"
-              "🕪"
-            ];
-          };
-          on-click = "pavucontrol";
-        };
-        "hyprland/window" = {
-          format = "{class}";
-        };
-        "battery" = {
-          "interval" = 1;
-          states = {
-            good = 80;
-            warning = 30;
-            critical = 20;
-          };
-          format = "{capacity}% {icon}";
-          format-charging = "{capacity}% 󰂄";
-          format-plugged = "{capacity}% ";
-          format-alt = "{time} {icon}";
-          format-icons = [
-            "󰁻"
-            "󰁼"
-            "󰁾"
-            "󰂀"
-            "󰂂"
-            "󰁹"
-          ];
-        };
-        # Currently not enabled because i don't want to add some external tools to manage brightness
-        # backlight = {
-        # 	format = "{percent}% {icon}";
-        # 	format-icons = [
-        # 		""
-        # 		""
-        # 		""
-        # 		""
-        # 		""
-        # 		""
-        # 		""
-        # 		""
-        # 		""
-        # 		""
-        # 	];
-        #   	on-scroll-down = "light -A 10";
-        # 			on-scroll-up = "light -U 10";
-        # 			smooth-scrolling-threshold = 1;
-        # };
-        "network" = {
-          format-wifi = "{ipaddr} Wi-Fi";
-          format-ethernet = "{ipaddr} Eth";
-        };
-        "power-profiles-daemon" = {
-          "format" = "{icon}";
-          "tooltip-format" = "Power profile: {profile}\nDriver: {driver}";
-          "tooltip" = true;
-          "format-icons" = {
-            "default" = "";
-            "performance" = "";
-            "balanced" = "";
-            "power-saver" = "";
-          };
-        };
-      };
-    };
-
-    style = ''
-      @define-color rosewater #f5e0dc;
-      @define-color flamingo #f2cdcd;
-      @define-color pink #f5c2e7;
-      @define-color mauve #cba6f7;
-      @define-color red #f38ba8;
-      @define-color maroon #eba0ac;
-      @define-color peach #fab387;
-      @define-color yellow #f9e2af;
-      @define-color green #a6e3a1;
-      @define-color teal #94e2d5;
-      @define-color sky #89dceb;
-      @define-color sapphire #74c7ec;
-      @define-color blue #89b4fa;
-      @define-color lavender #b4befe;
-      @define-color text #cdd6f4;
-      @define-color subtext1 #bac2de;
-      @define-color subtext0 #a6adc8;
-      @define-color overlay2 #9399b2;
-      @define-color overlay1 #7f849c;
-      @define-color overlay0 #6c7086;
-      @define-color surface2 #585b70;
-      @define-color surface1 #45475a;
-      @define-color surface0 #313244;
-      @define-color base #1e1e2e;
-      @define-color mantle #181825;
-      @define-color crust #11111b;
-
-      * {
-          border: none;
-          border-radius: 1px;
-          font-family: JetBrainsMono Nerd Font;
-          font-size: 13px;
-          min-height: 0;
-      }
-
-      window#waybar {
-          background-color: @mantle;
-          color: @text;
-      }
-
-      window#waybar.hidden {
-          opacity: 0.2;
-      }
-
-      tooltip {
-          background-color: @base;
-          border: 1px solid @surface1;
-      }
-
-      tooltip label {
-          color: @text;
-      }
-
-      button {
-          box-shadow: inset 0 -3px transparent;
-          border: none;
-          border-radius: 1px;
-      }
-
-      button:hover {
-          background: inherit;
-          box-shadow: inset 0 -3px @text;
-      }
-
-      #workspaces button {
-          padding: 0 0;
-          background-color: @mantle;
-          color: @text;
-      }
-
-      #workspaces button:hover {
-          box-shadow: inherit;
-          text-shadow: inherit;
-          background-image: linear-gradient(0deg, @surface1, @mantle);
-      }
-
-      #workspaces button.focused {
-          background-image: linear-gradient(0deg, @mauve, @surface1);
-          box-shadow: inset 0 -3px @text;
-      }
-
-      #workspaces button.urgent {
-          background-image: linear-gradient(0deg, @red, @mantle);
-      }
-
-      #taskbar button.active {
-          background-image: linear-gradient(0deg, @surface1, @mantle);
-      }
-
-      #mode {
-          background-color: @base;
-          box-shadow: inset 0 -2px @text;
-      }
-
-      #mpris,
-      #custom-weather,
-      #clock,
-      #language,
-      #pulseaudio,
-      #bluetooth,
-      #network,
-      #memory,
-      #cpu,
-      #temperature,
-      #disk,
-      #custom-kernel,
-      #idle_inhibitor,
-      #scratchpad,
-      #mode,
-      #power-profiles-daemon,
-      #backlight,
-      #battery,
-      #tray {
-          padding: 0 10px;
-          margin: 5px 1px;
-          color: @text;
-      }
-
-      #window,
-      #workspaces {
-          margin: 0 4px;
-      }
-
-      #power-profiles-daemon {
-      	background-color: @red;
-      	color: @base;
-      }
-
-      #custom-weather {
-          background-color: @teal;
-          color: @mantle;
-          margin-right: 5px;
-      }
-
-      #custom-kernel {
-          background-color: @rosewater;
-          color: @mantle;
-      }
-
-      #clock {
-          background-color: @green;
-          color: @mantle;
-      }
-
-      @keyframes blink {
-          to {
-              background-color: @mantle;
-              color: @text;
-          }
-      }
-
-      label:focus {
-          background-color: @mantle;
-      }
-
-      #cpu {
-          background-color: @mauve;
-          color: @mantle;
-          min-width: 45px;
-      }
-
-      #memory {
-          background-color: @red;
-          color: @mantle;
-      }
-
-      #disk {
-          background-color: @flamingo;
-          color: @mantle;
-      }
-
-      #battery {
-      	background-color: @mauve;
-      	color: @base;
-      }
-
-      #backlight {
-      	background-color: @sky;
-      	color: @base;
-      }
-
-      #network {
-          background-color: @peach;
-          color: @mantle;
-      }
-
-      #network.disconnected {
-          background-color: red;
-          color: @mantle;
-      }
-
-      #bluetooth {
-          background-color: @maroon;
-          color: @mantle;
-          min-width: 40px;
-      }
-
-      #pulseaudio {
-          background-color: @yellow;
-          color: @mantle;
-      }
-
-      #pulseaudio.muted {
-          background-color: red;
-          color: @mantle;
-      }
-
-      #temperature {
-          background-color: @pink;
-          color: @mantle;
-          min-width: 37px;
-      }
-
-      #temperature.critical {
-          background-color: red;
-          color: @mantle;
-          min-width: 37px;
-      }
-
-      #mpris {
-          background-color: @base;
-          color: @text;
-      }
-
-      #tray {
-          background-color: @overlay0;
-          color: @text;
-      }
-
-      #tray > .passive {
-          -gtk-icon-effect: dim;
-      }
-
-      #tray > .needs-attention {
-          -gtk-icon-effect: highlight;
-          background-color: @mantle;
-      }
-
-      #idle_inhibitor {
-          background-color: @base;
-          color: @text;
-          font-family: Inter;
-      }
-
-      #idle_inhibitor.activated {
-          background-color: @text;
-          color: @base;
-      }
-
-      #scratchpad {
-          background-color: @base;
-          color: @text;
-      }
-
-      #scratchpad.empty {
-          background-color: transparent;
-      }
-      		'';
-  };
-}

home/hyprland/wofi.nix

@@ -1,6 +0,0 @@
-{ ... }:
-{
-  programs.wofi = {
-    enable = true;
-  };
-}

home/kitty.nix

@@ -1,17 +1,19 @@
-{ pkgs, ... }:
+{ pkgs, currentSystemDe, ... }:
 {
   programs.kitty = {
-    enable = false;
+    enable = currentSystemDe != "none";
+    themeFile = "Catppuccin-Mocha";
+    extraConfig = "		";
+    enableGitIntegration = true;
     settings = {
       enable_audio_bell = false;
-      linux_display_server = "x11"; # This is how you get borders in gnome!
+      hide_window_decorations = true;
+      # linux_display_server = "x11"; # This is how you get borders in gnome!
     };
     font = {
       package = pkgs.nerd-fonts.jetbrains-mono;
       name = "JetBrainsMono Nerd Font";
-      size = 16;
+      size = 12;
     };
-    themeFile = "Catppuccin-Mocha";
-    extraConfig = "		";
   };
 }

home/mangohud.nix

@@ -1,9 +1,9 @@
-{ ... }:
+{ gamingSystem, ... }:
 {
   programs.mangohud = {
-    enable = true;
+    enable = gamingSystem;
     settings = {
-      fps_limit = 75;
+      fps_limit = 180;
     };
   };
 }

home/niri.nix

@@ -0,0 +1,42 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [
+    inputs.noctalia.homeModules.default
+  ];
+
+  programs.noctalia = {
+    enable = true;
+    settings = ../assets/noctalia-config.toml;
+  };
+
+  gtk = {
+    enable = true;
+    colorScheme = "dark";
+    gtk4.theme = null;
+    iconTheme = {
+      name = "Adwaita";
+      package = pkgs.adwaita-icon-theme;
+    };
+    cursorTheme = {
+      name = "Bibata-Modern-Classic";
+      package = pkgs.bibata-cursors;
+    };
+  };
+
+  home.file = {
+    # Fix for steam cursor
+    ".local/share/icons/default" = {
+      source = "${pkgs.bibata-cursors}/share/icons/Bibata-Modern-Classic/";
+      recursive = true;
+    };
+    "niri-config" = {
+      source = ../assets/niri.kdl;
+      target = ".config/niri/config.kdl";
+    };
+  };
+
+  services.udiskie = {
+    enable = true;
+    settings.program_options.file_manager = "${pkgs.nautilus}/bin/nautilus";
+  };
+}

lib/libde.nix

@@ -1,27 +0,0 @@
-{ currentSystemDe, ... }:
-let
-  ifDesktop = de: content: {
-    _type = "if";
-    condition = currentSystemDe == de;
-    inherit content;
-  };
-  ifNotDesktop = de: content: {
-    _type = "if";
-    condition = currentSystemDe != de;
-    inherit content;
-  };
-  ifGnome = ifDesktop "gnome";
-  ifPlasma = ifDesktop "plasma";
-  ifNone = ifDesktop "none";
-  ifNotNone = ifNotDesktop "none";
-in
-{
-  inherit
-    ifDesktop
-    ifNotDesktop
-    ifGnome
-    ifPlasma
-    ifNone
-    ifNotNone
-    ;
-}

lib/mksystem.nix

@@ -2,10 +2,13 @@
 {
   overlays,
   nixvim,
-  spotiflac-cli,
   sops-nix,
+  noctalia,
+  simple-mailserver,
   inputs,
   nixpkgs,
+  nixpkgs-25-11,
+  nixpkgs-my-features,
   home-manager,
 }:
 name:
@@ -25,23 +28,28 @@ let
   HMConfig = ../home;
   systemPackages = ../modules/packages.nix;
   specialArgs = {
-    pkgs-stable = import nixpkgs {
+    inherit
+      gamingSystem
+      workSystem
+      enableZram
+      nixvim
+      simple-mailserver
+      sops-nix
+      noctalia
+      inputs
+      additionalModules
+      ;
+    pkgs-unstable = import nixpkgs {
       inherit system;
       config.allowUnfree = true;
     };
+    pkgs-25-11 = nixpkgs-25-11.legacyPackages.${system};
+    pkgs-my-features = nixpkgs-my-features.legacyPackages.${system};
     currentSystem = system;
     currentSystemName = name;
     currentSystemUser = user;
     currentSystemEmail = email;
     currentSystemDe = desktopEnvironment;
-    gamingSystem = gamingSystem;
-    workSystem = workSystem;
-    enableZram = enableZram;
-    nixvim = nixvim;
-    spotiflac-cli = spotiflac-cli;
-    sops-nix = sops-nix;
-    inputs = inputs;
-    additionalModules = additionalModules;
   };
 in
 nixpkgs.lib.nixosSystem {

machines/bomba/default.nix

@@ -4,9 +4,9 @@
     ./configuration.nix
     ./hardware.nix
     ./networking.nix
-    ./services.nix
+    ./secrets.nix
-    ./virtualisation.nix
     ./services
+    ./virtualisation.nix
   ];
 
   networking.hostName = "bomba";
@@ -14,5 +14,5 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  system.stateVersion = "25.05"; # Did you read the comment?
+  system.stateVersion = "26.05"; # Did you read the comment?
 }

machines/bomba/networking.nix

@@ -2,14 +2,28 @@
 {
   networking = {
     networkmanager.enable = true;
+    nftables.enable = true;
     firewall = {
+      enable = true;
       allowedTCPPorts = [
         22
-        5900
+        25
-        8001
+        53
+        80
+        143
+        443
+        465
+        587
+        993
+        25565
+        27015
+      ];
+      allowedUDPPorts = [
+        53
+        80
+        443
+        34197
       ];
-      allowedUDPPorts = [ ];
-      enable = true;
     };
   };
 }

machines/bomba/secrets.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  sops =
+    let
+      default = {
+        sopsFile = ../../secrets/bomba.sops.yaml;
+      };
+    in
+    {
+      secrets = {
+        nextcloud_password = default // {
+          owner = "nextcloud";
+        };
+        nixflix_password = default;
+        jellyfin_api_key = default;
+        qbittorrent_api_key = default;
+        qbittorrent_password = default;
+        radarr_api_key = default;
+        sonarr_api_key = default;
+        lidarr_api_key = default;
+        prowlarr_api_key = default;
+        seerr_api_key = default;
+        indexers_ilcorsaroblu_password = default;
+        gitea_registration_token = default;
+        navidrome_env = default;
+        yamtrack_env = default;
+        authentik_env = default;
+        vaultwarden_env = default;
+        vikunja_env = default;
+        mail_password = default;
+      };
+    };
+}

machines/bomba/services.nix

@@ -1,6 +0,0 @@
-{ ... }:
-{
-  services = {
-    openssh.enable = true;
-  };
-}

machines/bomba/services/actual.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  services.actual = {
+    enable = true;
+    settings = {
+      port = 8015;
+    };
+  };
+}

machines/bomba/services/adguard.nix

@@ -0,0 +1,18 @@
+{ ... }:
+{
+  services.adguardhome = {
+    enable = true;
+    port = 8017;
+    mutableSettings = true;
+    settings = {
+      dns = {
+        upstream_dns = [
+          "1.1.1.1"
+          "9.9.9.9"
+        ];
+        bind_hosts = [ "192.168.1.223" ];
+        port = 53;
+      };
+    };
+  };
+}

machines/bomba/services/authentik.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  services.authentik = {
+    enable = true;
+    environmentFile = config.sops.secrets.authentik_env.path;
+    settings = {
+      disable_startup_analytics = true;
+      avatars = "initials";
+    };
+  };
+}

machines/bomba/services/caddy.nix

@@ -0,0 +1,90 @@
+{
+  config,
+  ...
+}:
+{
+  services.caddy =
+    let
+      authentikAuth = ''
+        reverse_proxy /outpost.goauthentik.io/* http://127.0.0.1:9000
+
+        forward_auth http://127.0.0.1:9000 {
+          uri /outpost.goauthentik.io/auth/caddy
+          copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
+          trusted_proxies private_ranges
+        }
+      '';
+    in
+    {
+      enable = true;
+      virtualHosts = {
+        "patrickcanal.it".extraConfig = ''
+          root /var/www/patrickcanal.it/public
+          file_server
+        '';
+        "mail.patrickcanal.it".extraConfig = ''
+          root /var/www/patrickcanal.it/public
+          file_server
+        '';
+        "vaultwarden.patrickcanal.it".extraConfig = ''
+          encode zstd gzip
+          reverse_proxy :8003 {
+            header_up X-Real-IP {remote_host}
+          }
+        '';
+        "gitea.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.gitea.settings.server.HTTP_PORT}
+        '';
+        "nextcloud.patrickcanal.it".extraConfig = ''
+          reverse_proxy :8004
+        '';
+        "octoprint.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.octoprint.port}
+        '';
+        "vikunja.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.vikunja.port}
+        '';
+        "jellyfin.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.jellyfin.network.internalHttpPort}
+        '';
+        "qbittorrent.patrickcanal.it".extraConfig = ''
+          ${authentikAuth}
+          reverse_proxy :${toString config.nixflix.downloadarr.qbittorrent.port}
+        '';
+        "radarr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.radarr.settings.server.port}
+        '';
+        "sonarr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.sonarr.settings.server.port}
+        '';
+        "lidarr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.lidarr.settings.server.port}
+        '';
+        "prowlarr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.prowlarr.settings.server.port}
+        '';
+        "seerr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.seerr.port}
+        '';
+        "navidrome.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.navidrome.settings.Port}
+        '';
+        "yamtrack.patrickcanal.it".extraConfig = ''
+          reverse_proxy :8014
+        '';
+        "actual.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.actual.settings.port}
+        '';
+        "inventory.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.homebox.settings.HBOX_WEB_PORT}
+        '';
+        "adguard.patrickcanal.it".extraConfig = ''
+          ${authentikAuth}
+          reverse_proxy :${toString config.services.adguardhome.port}
+        '';
+        "auth.patrickcanal.it".extraConfig = ''
+          reverse_proxy :9000
+        '';
+      };
+    };
+}

machines/bomba/services/default.nix

@@ -1,6 +1,23 @@
 { ... }:
 {
   imports = [
+    ./actual.nix
+    ./adguard.nix
+    ./authentik.nix
+    ./caddy.nix
+    ./fail2ban.nix
     ./gitea.nix
+    ./homebox.nix
+    ./mail.nix
+    ./navidrome.nix
+    ./nextcloud.nix
+    ./nixflix.nix
+    ./octoprint.nix
+    ./teamspeak.nix
+    ./vaultwarden.nix
+    ./vikunja.nix
+    ./yamtrack.nix
   ];
+
+  services.openssh.enable = true;
 }

machines/bomba/services/fail2ban.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    ignoreIP = [ "192.168.1.0/24" ];
+    bantime = "4h";
+    bantime-increment = {
+      enable = true; 
+      multipliers = "1 2 4 8 16 32 64";
+      overalljails = true;
+    };
+  };
+}

machines/bomba/services/gitea.nix

@@ -1,6 +1,6 @@
-{ ... }:
+{ config, ... }:
 {
-  services.gitea = {
+  config.services.gitea = {
     enable = true;
     settings = {
       server = {

machines/bomba/services/homebox.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  services.homebox = {
+    enable = true;
+    settings = {
+      HBOX_WEB_PORT = "8016"; 
+      HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
+    };
+  };
+}

machines/bomba/services/mail.nix

@@ -0,0 +1,36 @@
+{ config, ... }:
+let
+  fqdn = "mail.patrickcanal.it";
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    certs."mail.patrickcanal.it" = {
+      webroot = "/var/www/patrickcanal.it/public/";
+    };
+  };
+
+  mailserver = {
+    enable = true;
+    stateVersion = 5;
+    fqdn = fqdn;
+    domains = [ "patrickcanal.it" ];
+
+    # Reference the existing ACME configuration created by nginx
+    x509.useACMEHost = fqdn;
+
+    # A list of all login accounts. To create the password hashes, use
+    # nix-shell -p mkpasswd --run 'mkpasswd -s'
+    accounts = {
+      "me@patrickcanal.it" = {
+        hashedPassword = "$y$j9T$zEKbsELY3HcPZq9CH6bSe0$T9syGTl9haNhjS5SNjDbrY5uoN5z/LCYEmbFowFcAP/";
+
+        # Additional addresses delivered to this mailbox
+        aliases = [
+          "postmaster@patrickcanal.it"
+          "io@patrickcanal.it"
+        ];
+      };
+    };
+  };
+}

machines/bomba/services/navidrome.nix

@@ -0,0 +1,15 @@
+{ config, ... }:
+{
+  services.navidrome = {
+    enable = true;
+    environmentFile = config.sops.secrets.navidrome_env.path;
+    settings = {
+      Port = 8013;
+      MusicFolder = "/var/lib/nixflix/media/music/";
+      EnableSharing = true;
+      ArtistArtPriority = "external, artist.*, album/artist.*";
+      CoverArtPriority = "external, cover.*, folder.*, front.*, embedded";
+      DiscArtPriority = "disc*.*, cd*.*, cover.*, folder.*, front.*, discsubtitle, embedded";
+    };
+  };
+}

machines/bomba/services/nextcloud.nix

@@ -0,0 +1,37 @@
+{
+  pkgs,
+  config,
+  currentSystemUser,
+  ...
+}:
+{
+  services = {
+    nextcloud = {
+      enable = true;
+      package = pkgs.nextcloud34;
+      hostName = "nextcloud.patrickcanal.it";
+      https = false;
+      config = {
+        adminpassFile = config.sops.secrets.nextcloud_password.path;
+        dbtype = "sqlite";
+        adminuser = currentSystemUser;
+      };
+      settings = {
+        default_phone_region = "IT";
+        overwriteprotocol = "https";
+        mail_domain = "patrickcanal.it";
+        log_type = "file";
+        trusted_domains = [
+          "nextcloud.patrickcanal.it"
+        ];
+      };
+    };
+    # Required to change nextcloud port
+    nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
+      {
+        addr = "127.0.0.1";
+        port = 8004;
+      }
+    ];
+  };
+}

machines/bomba/services/nixflix.nix

@@ -0,0 +1,158 @@
+{ config, ... }:
+let
+  user = "Patrick";
+  baseDir = "/var/lib/nixflix";
+  stateDir = "${baseDir}/state";
+  downloadsDir = "${baseDir}/downloads";
+  mediaDir = "${baseDir}/media";
+  jellyfinPort = 8005;
+  qbittorrentPort = 8006;
+  radarrPort = 8007;
+  prowlarrPort = 8008;
+  seerrPort = 8009;
+  sonarrPort = 8010;
+  lidarrPort = 8012;
+  hostConfig = {
+    username = user;
+    password._secret = config.sops.secrets.nixflix_password.path;
+  };
+in
+{
+  nixflix = {
+    inherit mediaDir downloadsDir stateDir;
+    enable = true;
+
+    caddy = {
+      enable = true;
+      domain = "patrickcanal.it";
+    };
+
+    flaresolverr.enable = true;
+
+    torrentClients.qbittorrent = {
+      enable = true;
+      webuiPort = qbittorrentPort;
+      password._secret = config.sops.secrets.nixflix_password.path;
+      serverConfig = {
+        LegalNotice.Accepted = true;
+        Preferences.WebUI = {
+          MaxAuthenticationFailCount = 0;
+          Username = user;
+          Password_PBKDF2 = "@ByteArray(8AhaCcVLo4H07+dv5uF7pQ==:m+wRuZuzus0N5mkOGXePQmDZfgTpRZiv2OSKbk1pnOA/QPa/JF4Ai1FwVbyZ1PF9odSOSI1UaRQwDMb3MxOKMg==)";
+          LocalHostAuth = false; # Disable auth because authentik is setup
+        };
+      };
+    };
+
+    recyclarr = {
+      enable = true;
+      radarrQuality = "1080p";
+      sonarrQuality = "1080p";
+      cleanupUnmanagedProfiles.enable = true;
+    };
+
+    radarr = {
+      enable = true;
+      settings.server.port = radarrPort;
+      config = {
+        apiKey._secret = config.sops.secrets.radarr_api_key.path;
+        hostConfig = hostConfig // {
+          port = radarrPort;
+        };
+      };
+    };
+
+    sonarr = {
+      enable = true;
+      settings.server.port = sonarrPort;
+      config = {
+        apiKey._secret = config.sops.secrets.sonarr_api_key.path;
+        hostConfig = hostConfig // {
+          port = sonarrPort;
+        };
+      };
+    };
+
+    lidarr = {
+      enable = true;
+      config = {
+        apiKey._secret = config.sops.secrets.lidarr_api_key.path;
+        hostConfig = hostConfig // {
+          port = lidarrPort;
+        };
+      };
+    };
+
+    prowlarr = {
+      enable = true;
+      settings.server.port = prowlarrPort;
+      config = {
+        apiKey._secret = config.sops.secrets.prowlarr_api_key.path;
+        hostConfig = hostConfig // {
+          port = prowlarrPort;
+        };
+        indexers = [
+          {
+            name = "Il Corsaro Blu";
+            username = "Petrich";
+            password._secret = config.sops.secrets.indexers_ilcorsaroblu_password.path;
+          }
+          {
+            name = "LimeTorrents";
+          }
+          {
+            name = "The Pirate Bay";
+          }
+        ];
+      };
+    };
+
+    seerr = {
+      enable = true;
+      port = seerrPort;
+      apiKey._secret = config.sops.secrets.seerr_api_key.path;
+    };
+
+    jellyfin = {
+      enable = true;
+      apiKey._secret = config.sops.secrets.jellyfin_api_key.path;
+      branding.loginDisclaimer = ''
+        <a href="/sso/OIDC/Start/authentik">
+          Sign in with Authentik
+        </a>
+      '';
+      network = {
+        knownProxies = [ "127.0.0.1" ];
+        internalHttpPort = jellyfinPort;
+      };
+      users."${user}" = {
+        mutable = false;
+        policy.isAdministrator = true;
+        password._secret = config.sops.secrets.nixflix_password.path;
+      };
+      libraries = {
+        Movies = {
+          collectionType = "movies";
+          paths = [
+            "${mediaDir}/movies"
+          ];
+        };
+
+        Shows = {
+          collectionType = "tvshows";
+          seasonZeroDisplayName = "Specials";
+          paths = [
+            "${mediaDir}/tv"
+          ];
+        };
+
+        Music = {
+          collectionType = "music";
+          paths = [
+            "${mediaDir}/music"
+          ];
+        };
+      };
+    };
+  };
+}

machines/bomba/services/octoprint.nix

@@ -0,0 +1,12 @@
+{ pkgs-my-features, ... }:
+{
+  services.octoprint = {
+    enable = true;
+    port = 8002;
+    package = pkgs-my-features.octoprint;
+    plugins =
+      plugins: with plugins; [
+        fanspeedslider
+      ];
+  };
+}

machines/bomba/services/teamspeak.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.teamspeak3 = {
+    enable = true;
+    openFirewall = true;
+  };
+}

machines/bomba/services/vaultwarden.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  services.vaultwarden = {
+    enable = true;
+    environmentFile = config.sops.secrets.vaultwarden_env.path;
+    # config = {
+    #   DOMAIN = "https://vaultwarden.patrickcanal.it";
+    #   ROCKET_ADDRESS = "127.0.0.1";
+    #   ROCKET_PORT = 8003;
+    #   SSO_ENABLED = true;
+    #   SSO_ONLY = false;
+    #   SSO_AUTHORITY = "https://auth.patrickcanal.it";
+    #   SSO_SCOPES = [
+    #     "profile"
+    #     "email"
+    #     "offline_access"
+    #     "vaultwarden"
+    #   ];
+    #   SSO_PKCE = true;
+    #   SSO_CLIENT_ID = "vaultwarden";
+    #   SSO_CLIENT_SECRET = config.sops.secrets.vaultwarden_sso_secret;
+    #   SSO_ROLES_ENABLED = true;
+    #   SSO_ROLES_DEFAULT_TO_USER = true;
+    # };
+  };
+}

machines/bomba/services/vikunja.nix

@@ -0,0 +1,12 @@
+{ config, ... }:
+{
+  services.vikunja = {
+    enable = true;
+    port = 8011;
+    frontendScheme = "http";
+    frontendHostname = "vikunja.patrickcanal.it";
+    environmentFiles = [
+      config.sops.secrets.vikunja_env.path
+    ];
+  };
+}

machines/bomba/services/yamtrack.nix

@@ -0,0 +1,121 @@
+  # Temporary solution until https://github.com/NixOS/nixpkgs/pull/501051 gets merged
+  # TODO: Once merged change also caddy.nix accordingly
+# Auto-generated by compose2nix.
+
+{ pkgs, lib, config, ... }:
+{
+  # Enable container name DNS for all Podman networks.
+  networking.firewall.interfaces = let
+    matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+  in {
+    "${matchAll}".allowedUDPPorts = [ 53 ];
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  # Containers
+  virtualisation.oci-containers.containers."yamtrack" = {
+    image = "ghcr.io/fuzzygrim/yamtrack";
+    environmentFiles = [ config.sops.secrets.yamtrack_env.path ];
+    volumes = [
+      "/var/lib/yamtrack:/yamtrack/db:rw"
+    ];
+    ports = [
+      "8014:8000/tcp"
+    ];
+    dependsOn = [
+      "yamtrack_redis"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=yamtrack"
+      "--network=yamtrack_default"
+    ];
+  };
+  systemd.services."podman-yamtrack" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-yamtrack_default.service"
+    ];
+    requires = [
+      "podman-network-yamtrack_default.service"
+    ];
+    partOf = [
+      "podman-compose-yamtrack-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-yamtrack-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."yamtrack_redis" = {
+    image = "redis:8-alpine";
+    volumes = [
+      "yamtrack_redis_data:/data:rw"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=yamtrack_redis"
+      "--network=yamtrack_default"
+    ];
+  };
+  systemd.services."podman-yamtrack_redis" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-yamtrack_default.service"
+      "podman-volume-yamtrack_redis_data.service"
+    ];
+    requires = [
+      "podman-network-yamtrack_default.service"
+      "podman-volume-yamtrack_redis_data.service"
+    ];
+    partOf = [
+      "podman-compose-yamtrack-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-yamtrack-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."podman-network-yamtrack_default" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "podman network rm -f yamtrack_default";
+    };
+    script = ''
+      podman network inspect yamtrack_default || podman network create yamtrack_default
+    '';
+    partOf = [ "podman-compose-yamtrack-root.target" ];
+    wantedBy = [ "podman-compose-yamtrack-root.target" ];
+  };
+
+  # Volumes
+  systemd.services."podman-volume-yamtrack_redis_data" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect yamtrack_redis_data || podman volume create yamtrack_redis_data
+    '';
+    partOf = [ "podman-compose-yamtrack-root.target" ];
+    wantedBy = [ "podman-compose-yamtrack-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-yamtrack-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

machines/bomba/virtualisation.nix

@@ -1,11 +1,16 @@
 { pkgs, ... }:
 {
   virtualisation = {
-    docker.enable = true;
     spiceUSBRedirection.enable = true;
     libvirtd = {
       enable = true;
       package = pkgs.qemu_kvm;
     };
+    podman = {
+      enable = true;
+      autoPrune.enable = true;
+      dockerCompat = true;
+    };
   };
+  environment.systemPackages = with pkgs; [ podman-compose ];
 }

machines/frog/configuration.nix

@@ -0,0 +1,59 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ pkgs, ... }:
+
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/vda";
+  boot.loader.grub.useOSProber = true;
+
+  networking.hostName = "frog"; # Define your hostname.
+
+  networking.networkmanager.enable = true;
+
+  time.timeZone = "Europe/Rome";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "it_IT.UTF-8";
+    LC_IDENTIFICATION = "it_IT.UTF-8";
+    LC_MEASUREMENT = "it_IT.UTF-8";
+    LC_MONETARY = "it_IT.UTF-8";
+    LC_NAME = "it_IT.UTF-8";
+    LC_NUMERIC = "it_IT.UTF-8";
+    LC_PAPER = "it_IT.UTF-8";
+    LC_TELEPHONE = "it_IT.UTF-8";
+    LC_TIME = "it_IT.UTF-8";
+  };
+
+  services.xserver.enable = true;
+
+  services.xserver.displayManager.gdm.enable = true;
+  services.xserver.desktopManager.gnome.enable = true;
+
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+  services.printing.enable = true;
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+  environment.systemPackages = with pkgs; [
+  ];
+  system.stateVersion = "25.11"; # Did you read the comment?
+
+}

machines/frog/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+  ];
+}

machines/frog/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ lib, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "sr_mod"
+    "virtio_blk"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/b3a05e5f-6394-4115-b206-8fb51c235067";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/c94fa719-f29a-41bb-8e85-e186fe96846c"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/katana/boot.nix

@@ -10,7 +10,8 @@
       verbose = false;
       systemd.enable = true;
     };
-    kernelPackages = pkgs.linuxPackages_zen; # pkgs.linuxPackages_latest;
+    # Do not remove cachy kernel, it fixes nvidia kernel panic on shutdown
+    kernelPackages = pkgs.cachyosKernels.linuxPackages-cachyos-lts-lto-x86_64-v3;
     consoleLogLevel = 3;
     kernelParams = [
       "quiet"

machines/katana/default.nix

@@ -11,5 +11,5 @@
 
   networking.hostName = "katana"; # Define your hostname.
 
-  system.stateVersion = "25.11"; # Did you read the comment?
+  system.stateVersion = "26.05";
 }

machines/katana/networking.nix

@@ -3,7 +3,6 @@
   networking = {
     networkmanager.enable = true;
     wireguard.enable = true;
-    nftables.enable = true;
     firewall = {
       checkReversePath = false;
       allowedUDPPorts = [ 25565 ];

machines/katana/virtualisation.nix

@@ -3,8 +3,7 @@
   programs.virt-manager.enable = true;
   virtualisation = {
     docker.enable = true;
-    # libvirtd.enable = true; disable temorarly because of https://github.com/NixOS/nixpkgs/issues/496836
+    libvirtd.enable = true;
     spiceUSBRedirection.enable = true;
-    waydroid.enable = true;
   };
 }

modules/nix-config/caches.nix

@@ -4,12 +4,16 @@
     substituters = [
       "https://cache.nixos.org"
       "https://nixvim-superredstone.cachix.org"
-      "https://spotiflac-cli.cachix.org"
+      "https://noctalia.cachix.org"
+      "https://attic.xuyh0120.win/lantian"
+      "https://nix-community.cachix.org"
     ];
     trusted-public-keys = [
       "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
       "nixvim-superredstone.cachix.org-1:mEXHVxEv5dKka3FOxTMFDfdk/DJ0baydsahi+zZIcQE="
-      "spotiflac-cli.cachix.org-1:UgpE8P0TO8NuF03vF117r/vgTkjq13Z3JqGzaQdC7xE="
+      "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="
+      "lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
     ];
     trusted-users = [
       "root"

modules/nix-config/de.nix

@@ -1,89 +0,0 @@
-{
-  pkgs,
-  lib,
-  currentSystemDe,
-  ...
-}:
-let
-  libDe = import ../../lib/libde.nix {
-    inherit currentSystemDe lib;
-  };
-in
-{
-  services = {
-    xserver.enable = true;
-    xserver.excludePackages = with pkgs; [
-      xterm
-    ];
-
-    # Display managers
-    displayManager = {
-      sddm = libDe.ifPlasma {
-        enable = true;
-        wayland.enable = true;
-      };
-      gdm.enable = libDe.ifGnome true;
-    };
-
-    # Desktop environments
-    desktopManager = {
-      plasma6.enable = libDe.ifPlasma true;
-      gnome.enable = libDe.ifGnome true;
-    };
-
-    gnome.gnome-keyring.enable = libDe.ifGnome true;
-  };
-  environment.plasma6.excludePackages = with pkgs.kdePackages; [
-    elisa
-    konsole
-  ];
-  environment.gnome.excludePackages = with pkgs; [
-    epiphany
-    geary
-    gedit
-    gnome-characters
-    gnome-console
-    gnome-contacts
-    gnome-maps
-    gnome-music
-    gnome-software
-    gnome-tour
-    seahorse
-    simple-scan
-    xterm
-    yelp
-  ];
-
-  xdg = {
-    autostart.enable = true;
-    portal.enable = true;
-  };
-
-  programs.kdeconnect = libDe.ifNotNone {
-    enable = true;
-    package =
-      if (currentSystemDe == "gnome") then
-        pkgs.gnomeExtensions.gsconnect
-      else
-        pkgs.kdePackages.kdeconnect-kde;
-  };
-
-  programs.thunar.plugins =
-    with pkgs.xfce;
-    libDe.ifGnome [ ]
-    ++ [
-      thunar-archive-plugin
-      thunar-media-tags-plugin
-      thunar-vcs-plugin
-      tumbler
-    ];
-
-  # Hack to fix "Your GStreamer installation is missing a plug-in." inside of Nautilus
-  environment.sessionVariables.GST_PLUGIN_SYSTEM_PATH_1_0 =
-    lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0"
-      [
-        pkgs.gst_all_1.gst-plugins-good
-        pkgs.gst_all_1.gst-plugins-bad
-        pkgs.gst_all_1.gst-plugins-ugly
-      ];
-}

modules/nix-config/default.nix

@@ -2,6 +2,7 @@
   pkgs,
   currentSystemUser,
   currentSystemDe,
+  config,
   ...
 }:
 {
@@ -15,14 +16,12 @@
   ++ (
     if (currentSystemDe != "none") then
       [
-        ./de.nix
         ./fonts.nix
         ./sound.nix
       ]
     else
       [ ]
   );
-
   time.timeZone = "Europe/Rome";
 
   # Select internationalisation properties.
@@ -51,13 +50,14 @@
   users.users.${currentSystemUser} = {
     isNormalUser = true;
     description = "Patrick Canal";
+    shell = pkgs.fish;
+    hashedPasswordFile = config.sops.secrets.user_password.path;
     extraGroups = [
       "networkmanager"
       "wheel"
       "docker"
       "libvirtd"
     ];
-    shell = pkgs.fish;
   };
 
   nix.settings = {
@@ -72,4 +72,5 @@
   };
 
   documentation.man.cache.enable = false;
+  boot.tmp.cleanOnBoot = true;
 }

modules/nix-config/fonts.nix

@@ -1,6 +1,67 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
+  system.fsPackages = [ pkgs.bindfs ];
+  fileSystems =
+    let
+      mkRoSymBind = path: {
+        device = path;
+        fsType = "fuse.bindfs";
+        options = [
+          "ro"
+          "resolve-symlinks"
+          "x-gvfs-hide"
+        ];
+      };
+      fontsPkgs =
+        config.fonts.packages
+        ++ (with pkgs; [
+          bibata-cursors
+        ]);
+      x11Fonts =
+        pkgs.runCommand "X11-fonts"
+          {
+            preferLocalBuild = true;
+            nativeBuildInputs = with pkgs; [
+              gzip
+              mkfontscale
+              mkfontdir
+            ];
+          }
+          (
+            ''
+              mkdir -p "$out/share/fonts"
+              font_regexp='.*\.\(ttf\|ttc\|otb\|otf\|pcf\|pfa\|pfb\|bdf\)\(\.gz\)?'
+            ''
+            + (builtins.concatStringsSep "\n" (
+              builtins.map (pkg: ''
+                find ${toString pkg} -regex "$font_regexp" \
+                  -exec ln -sf -t "$out/share/fonts" '{}' \;
+              '') fontsPkgs
+            ))
+            + ''
+              cd "$out/share/fonts"
+              mkfontscale
+              mkfontdir
+              cat $(find ${pkgs.fontalias}/ -name fonts.alias) >fonts.alias
+            ''
+          );
+      aggregatedIcons = pkgs.buildEnv {
+        name = "system-icons";
+        paths = fontsPkgs;
+        pathsToLink = [
+          "/share/icons"
+        ];
+      };
+    in
+    {
+      "/usr/share/icons" = mkRoSymBind (aggregatedIcons + "/share/icons");
+      "/usr/share/fonts" = mkRoSymBind (x11Fonts + "/share/fonts");
+    };
+
   fonts.packages = with pkgs; [
+    vista-fonts
+    monocraft
+    miracode
     nerd-fonts.jetbrains-mono
     noto-fonts
   ];

modules/nix-config/security.nix

@@ -1,9 +1,42 @@
 { currentSystemUser, ... }:
+let
+  swBin = "/run/current-system/sw/bin";
+  wrappersBin = "/run/wrappers/bin";
+in
 {
-  security.sudo.extraConfig = ''
+  security.sudo = {
-    		Defaults pwfeedback
+    extraConfig = ''
-        		Defaults timestamp_timeout=120
+      Defaults pwfeedback
-    	'';
+      Defaults timestamp_timeout=120
+    '';
+    extraRules = [
+      {
+        groups = [ "wheel" ];
+        commands = [
+          {
+            command = "${swBin}/shutdown";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${swBin}/reboot";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${swBin}/poweroff";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${wrappersBin}/mount";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${wrappersBin}/umount";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+  };
   sops = {
     age.sshKeyPaths = [
       "/etc/ssh/ssh_host_ed25519_key"
@@ -13,6 +46,9 @@
       "wifi_password" = {
         owner = currentSystemUser;
       };
+      "user_password" = {
+        neededForUsers = true;
+      };
     };
   };
 }

modules/nix-config/services.nix

@@ -1,7 +1,11 @@
-{ ... }:
+{ pkgs, currentSystemDe, ... }:
 {
   services = {
     pcscd.enable = true;
+    xserver.enable = currentSystemDe != "none";
+    xserver.excludePackages = with pkgs; [
+      xterm
+    ];
     openssh = {
       enable = true;
       hostKeys = [

modules/nix-config/sound.nix

@@ -7,6 +7,7 @@
       alsa.enable = true;
       alsa.support32Bit = true;
       pulse.enable = true;
+      wireplumber.enable = true;
     };
     pulseaudio.enable = false;
   };

modules/packages.nix

@@ -1,5 +1,8 @@
 {
   pkgs,
+  # pkgs-25-11,
+  pkgs-my-features,
+  lib,
   gamingSystem,
   workSystem,
   currentSystemDe,
@@ -14,138 +17,129 @@
 
   environment.systemPackages =
     with pkgs;
-    [
+    let
-      # CLI utils
+      hostSystem = pkgs.stdenv.hostPlatform.system;
-      appimage-run
+      basePackages = [
-      bat
+        # CLI utils
-      btop
+        appimage-run
-      bun
+        bat
-      busybox
+        bintools
-      distrobox
+        btop
-      docker
+        bun
-      dua
+        busybox
-      fd
+        devenv
-      fish
+        dig
-      fzf
+        distrobox
-      gh
+        docker
-      git
+        dua
-      gitlab-ci-local
+        fd
-      gnumake
+        file
-      htop
+        fish
-      jq
+        fzf
-      just
+        gh
-      killall
+        git
-      krabby
+        gitlab-ci-local
-      lazygit
+        gnumake
-      nmap
+        htop
-      nodejs
+        jq
-      openssl
+        just
-      openvpn
+        killall
-      pinentry-tty
+        krabby
-      python3
+        lazygit
-      ripgrep
+        nixpkgs-review
-      sops
+        nmap
-      tree
+        nodejs
-      unzip
+        openssl
-      wget
+        openvpn
-      wl-clipboard
+        pinentry-tty
-      zip
+        python3
-      zoxide
+        ripgrep
-      zulu
+        rsync
+        sops
+        tree
+        unzip
+        wget
+        wl-clipboard
+        xwayland-satellite
+        zip
+        zoxide
+        zulu
 
-      # Man pages
+        # Man pages
-      man-pages
+        man-pages
 
-      vim # The only and one great editor
+        vim # The only and one great editor
-      inputs.nixvim.packages.${stdenv.hostPlatform.system}.default # The only and one great editor improved even further
+        inputs.nixvim.packages.${stdenv.hostPlatform.system}.default # The only and one great editor improved even further
+      ];
 
-      inputs.spotiflac-cli.packages.${stdenv.hostPlatform.system}.default
+      guiPackages = lib.optionals (currentSystemDe != "none") [
-    ]
+        android-studio
-    ++ (
+        baobab
-      if currentSystemDe != "none" then
+        bazaar
-        [
+        brave
-          # Video card
+        cinny-desktop
-          vulkan-tools
+        firefox
+        fladder
+        gapless
+        gimp
+        mpv
+        nautilus
+        nextcloud-client
+        obs-studio
+        qbittorrent
+        rustdesk
+        seahorse
+        telegram-desktop
+        thunderbird
+        tor-browser
+        vesktop
+        vlc
+        vulkan-tools
+        libreoffice
+      ];
 
-          # GUI applications
+      gamingPackages = lib.optionals gamingSystem [
-          baobab
+        arrpc
-          bazaar
+        cura-appimage
-          blackbox-terminal
+        heroic
-          delfin
+        obs-studio
-          discord
+        openrgb
-          firefox
+        prismlauncher
-          gapless
+        satisfactorymodmanager
-          gnome-boxes
+      ];
-          mpv
-          nextcloud-client
-          obs-studio
-          piper
-          seahorse
-          telegram-desktop
-          thunderbird
-        ]
-      else
-        [ ]
-    )
-    ++ (
-      if gamingSystem then
-        [
-          cura-appimage
-          heroic
-          mangohud
-          openrgb
-          prismlauncher
-          protonplus
-          satisfactorymodmanager
 
-          # Required for Discord RPC
+      workPackages = lib.optionals workSystem [
-          arrpc
+        ansible
-        ]
+        virt-manager
-      else
+      ];
-        [ ]
+
-    )
+      plasmaPackages = lib.optionals (currentSystemDe == "plasma") [
-    ++ (
+        kdePackages.wallpaper-engine-plugin
-      if workSystem then
+      ];
-        [
+
-          android-studio
+      gnomePackages = lib.optionals (currentSystemDe == "gnome") [
-          ansible
+        blackbox-terminal
-          virt-manager
+        gnome-tweaks
-        ]
+        gnomeExtensions.appindicator
-      else
+        gnomeExtensions.caffeine
-        [ ]
+        gnomeExtensions.dash-to-dock
-    )
+        gnomeExtensions.wallpaper-slideshow
-    ++ (
+      ];
-      if currentSystemDe == "plasma" then
+
-        [
+      niriPackages = lib.optionals (currentSystemDe == "niri") [
-          kdePackages.wallpaper-engine-plugin
+        gnome-keyring
-        ]
+        loupe
-      else
+        papers
-        [ ]
+
-    )
+        inputs.noctalia.packages.${hostSystem}.default
-    ++ (
+      ];
-      if currentSystemDe == "hyprland" then
+    in
-        [
+    basePackages
-          # Hyprland
+    ++ guiPackages
-          brightnessctl
+    ++ gamingPackages
-          hyprpaper
+    ++ workPackages
-          pamixer
+    ++ plasmaPackages
-          pavucontrol
+    ++ gnomePackages
-          kdePackages.dolphin
+    ++ niriPackages;
-        ]
-      else
-        [ ]
-    )
-    ++ (
-      if currentSystemDe == "gnome" then
-        [
-          gnome-tweaks
-          gnomeExtensions.appindicator
-          gnomeExtensions.caffeine
-          gnomeExtensions.dash-to-dock
-          gnomeExtensions.wallpaper-slideshow
-        ]
-      else
-        [ ]
-    );
 
 }

modules/programs/default.nix

@@ -5,6 +5,13 @@
   ...
 }:
 {
+  imports = [
+
+  ]
+  ++ (if currentSystemDe == "niri" then [ ./niri.nix ] else [ ])
+  ++ (if currentSystemDe == "gnome" then [ ./gnome.nix ] else [ ])
+  ++ (if currentSystemDe == "plasma" then [ ./plasma.nix ] else [ ]);
+
   programs = {
     gamescope = {
       enable = true;
@@ -15,6 +22,7 @@
         {
           enable = true;
           remotePlay.openFirewall = true;
+          extraCompatPackages = with pkgs; [ proton-ge-bin ];
         }
       else
         { };
@@ -26,6 +34,8 @@
     nh = {
       enable = true;
     };
-    hyprland.enable = if currentSystemDe == "hyprland" then true else false;
+    bash.shellAliases = {
+      dev = "nix develop --command 'fish'";
+    };
   };
 }

modules/programs/gnome.nix

@@ -0,0 +1,41 @@
+{ pkgs, lib, ... }:
+{
+  services = {
+    desktopManager.gnome.enable = true;
+    displayManager.gdm.enable = true;
+    gnome.gnome-keyring.enable = true;
+  };
+
+  environment.gnome.excludePackages = with pkgs; [
+    epiphany
+    geary
+    gedit
+    gnome-characters
+    gnome-console
+    gnome-contacts
+    gnome-maps
+    gnome-music
+    gnome-software
+    gnome-tour
+    seahorse
+    simple-scan
+    xterm
+    yelp
+  ];
+
+  programs.thunar.plugins = with pkgs.xfce; [
+    thunar-archive-plugin
+    thunar-media-tags-plugin
+    thunar-vcs-plugin
+    tumbler
+  ];
+
+  # Hack to fix "Your GStreamer installation is missing a plug-in." inside of Nautilus
+  environment.sessionVariables.GST_PLUGIN_SYSTEM_PATH_1_0 =
+    lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0"
+      [
+        pkgs.gst_all_1.gst-plugins-good
+        pkgs.gst_all_1.gst-plugins-bad
+        pkgs.gst_all_1.gst-plugins-ugly
+      ];
+}

modules/programs/niri.nix

@@ -0,0 +1,56 @@
+{ pkgs, lib, ... }:
+{
+  programs.niri.enable = true;
+
+  services = {
+    dbus.packages = [ pkgs.nautilus ];
+    dbus.implementation = "broker";
+    xserver.desktopManager.runXdgAutostartIfNone = true;
+    upower.enable = true;
+    power-profiles-daemon.enable = true;
+    udisks2.enable = true;
+    gvfs.enable = true;
+    gnome.gnome-keyring.enable = true;
+    displayManager.dms-greeter = {
+      enable = true;
+      compositor.name = "niri";
+    };
+  };
+
+  xdg = {
+    mime = {
+      enable = true;
+      defaultApplications = {
+        "application/pdf" = "firefox.desktop";
+        "audio/*" = [
+          "mpv.desktop"
+        ];
+        "video/*" = [
+          "mpv.desktop"
+        ];
+        "image/*" = [
+          "org.gnome.Loupe.desktop"
+        ];
+      };
+    };
+    # For god's sake, never touch this code again, so much pain has been released on the following lines.
+    portal = {
+      enable = true;
+      xdgOpenUsePortal = true;
+      extraPortals = lib.mkForce [
+        pkgs.xdg-desktop-portal-gnome
+        pkgs.xdg-desktop-portal-gtk
+      ];
+      config = {
+        niri = {
+          default = lib.mkForce [
+            "gnome"
+            "gtk"
+          ];
+          "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ];
+          "org.freedesktop.impl.portal.Screenshot" = [ "gnome" ];
+        };
+      };
+    };
+  };
+}

modules/programs/plasma.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+{
+  services = {
+    displayManager.sddm = {
+      enable = true;
+      wayland.enable = true;
+    };
+    desktopManager.plasma6.enable = true;
+  };
+
+  environment.plasma6.excludePackages = with pkgs.kdePackages; [
+    elisa
+    konsole
+  ];
+}

secrets/bomba.sops.yaml

@@ -0,0 +1,33 @@
+nextcloud_password: ENC[AES256_GCM,data:lMavQvl4grki9c5AgaKE8Q==,iv:jJ0/Wka5/2TBD4C739HBeiVzxujWC4WL6FDLqov6FVA=,tag:1skCLwSr6VSzZWthtzaxwg==,type:str]
+nixflix_password: ENC[AES256_GCM,data:g8S6Z925bLWDFjFKL3TqDQ==,iv:sFg8bCBL71yVUUJ7ibD/IH2O47gsxbH8Zrgu67lH3+A=,tag:J3Y8KQw8bSYzBrOCN23q2w==,type:str]
+jellyfin_api_key: ENC[AES256_GCM,data:Xhd3X3iy78kmPPmWQOngdF9jqPb6YBM9kgjhib6K1zw+wQ14VPJORqkVgKw/K0AwjF81zJXVGgkGHZbdjvKDPQ==,iv:2Y8c8iCcJ4MNlKZsDG/RyfQ4zO5686ExGQCCTkfcigw=,tag:/T/ms/SVL2EIyI+iMX7rVg==,type:str]
+qbittorrent_api_key: ENC[AES256_GCM,data:EJmLZr15745Fcwu6zO1GJ68ptrZjS3NgG2BTNC0bgxEuGR8rjo3UrUj6zo3wkMUu9j3A9uZD1mNH5HLL/nGKrg==,iv:B5riJE+jMy3u+nBV7jhnYdpxw8cIMmPwdVm6XCTgxEA=,tag:1IofM5ieuyHL3l6fOsaV8Q==,type:str]
+qbittorrent_password: ENC[AES256_GCM,data:qZNlHLMcihmfaP8t6Bd0vbt89A5nzgukJ0lO+n52R9lldNQiHKNCNI2LpitIsHGfjNMiluuo5r4fTwVjJsA1zA==,iv:InCWhFfWkmMo1R0wGNx7n09Wpq2RW1TYtuaQWJknkvM=,tag:Qp59jzDWEjD/s04DUV9u8A==,type:str]
+radarr_api_key: ENC[AES256_GCM,data:NxYoYFffrPFmI3cmtgi+qRBzH15imO3knq00GWcY+uJSvBL0hOs1Zem+n7Ij7L5V7PbZfWVnnuRJvjy2BnRzYA==,iv:+b5jm/Z8wHf3CidKV1L5a3vlSJvsi+eWhBBO6J48/8o=,tag:RiA0/dbcftCp79YqEwu7yA==,type:str]
+sonarr_api_key: ENC[AES256_GCM,data:nm9lcY9/3aMce7MIEK9E+su9o0f7RdOafx52a8vgG8hxiv4J6bktiK8EAfLIr0ae8Yi17gDiHtRgPw/9EUOdCw==,iv:elRPggP64PdaV1j6fCyZSilgwi41cmG9rDpXVKcX0PY=,tag:o0ZdHxh1NaJSfW7iNlV9eg==,type:str]
+lidarr_api_key: ENC[AES256_GCM,data:VDV3oJTjR5Tbf6bJeR9JgUr3ZjNIsAYEH7WqWGhUHU6WFa1Rld+jSNm4WKZMSN/+7sdQU9nPDHem9/i5lfVbIQ==,iv:z1nJosq9bJ1tXB3CQO2QTBssF/ZFCm3W/y4OTUs0SpM=,tag:tZ5FKkLnC5svLYxolZmtvw==,type:str]
+prowlarr_api_key: ENC[AES256_GCM,data:UDpnqIP64k8Qt9k/sjbESNostFiGHfLo3CEYfyWppHEwfkjVu1oirdtzDgAO056rxWaLwwcqJs0jDFau5VZi8Q==,iv:N9d9Sdbo/akFecQRYfbrkigq2Za3CXzsRJvNljm1MQM=,tag:Et1kIBHPX4bLlCgqpZf4CA==,type:str]
+seerr_api_key: ENC[AES256_GCM,data:KDQxxo2W4tz9UokscAUSz7pf7wY2AfsEQpZh2aXGjsQOBgSLt1DEe5LUxealBZju8gabhp4sNGFvp0+ioZpfkg==,iv:V/rbR6bZtVnDhLLVmygGyTf5Ujm8sb2xHy4JuvLiiV8=,tag:MxGzXHbZWgu3H+ICS2tSNQ==,type:str]
+indexers_ilcorsaroblu_password: ENC[AES256_GCM,data:w3CIGQqLxHEkUHvscZc=,iv:fjsB3zt4Z43MKRECjpa7+gNDzM8D+JK0sbKt2P+Hdiw=,tag:KvLawon+KfrhGmi1TWRHLw==,type:str]
+gitea_registration_token: ENC[AES256_GCM,data:aHoUBwPXtlme9RgGObwWt1V90JU5qeVBUtpINrb1hY6XjKi4+kLxAg==,iv:zkgDdx82Lku7/oNIoSoKUIrxvZuyPaGUI411V/rkW9c=,tag:0eBC0Kd71UwokH9scs/AKA==,type:str]
+mail_password: ENC[AES256_GCM,data:fznlr+Mzu+cpHsLN8EYx6g==,iv:s/DidEGNar4jGHGcbXsysZ2grpwVO1T2Zd+jksb90T8=,tag:LgJ7r+stG7QCpX9n/UZUsA==,type:str]
+navidrome_env: ENC[AES256_GCM,data:SjEg735zoiWNjp0+uYi5CyLadDd7mSXpG1LInLsaqESz0LNgMi+r46ohPjpEC3GD+WbE9D3XRwhB22oIey3K7p3GdB/bYjIR6wOa8MVjj3EDvzdBWbnhkXsGnIhLGuyZwDmMdA==,iv:gHv7lZzU09V3XVjs3nEOEm55xRwD23+sVWfgbuX18p4=,tag:8UAMIGXPGobQfBAao2nI6Q==,type:str]
+yamtrack_env: ENC[AES256_GCM,data:fUaM7prLhu7aJQbWimzjPWmSD7SiCFTiXaWz4Ep34EadofCXvrBKnUa8ZDOSX9mw1PUAdqbao8l1TbA6LieV1ywW4VqC7+fUyJsfOhjRqtg+ud286UilIrMTcU/bodcKxbzxIjG9HMJ4HVs+hNnrVm4SUaloueXZm6pT0iB4Pm3ygXb/NjyBR5PdGc3MiJ0kJ4OvrLzMXYipdFTVqGvgiKazQm37ug3JFw+UjpRanYLlGT+q/aC0Km+UK41CQjvB06N8jwfd3vFWIxKHtWTfMaiJAarwSh6320lQWj5bIkbK5p4TXgqy+UgBqwEt6eWDbeZ5L46covfUi2ZUCDMBYSslFK5cYqaOvfRb0VO1nb+06djBi1WvuVR4i6PkNpyb5PGZa9f2cZB8yqXaUGNJQaut+nu7G8t8YWFlTP78fXAHOyd4kfCFot68LYJ1Vjo08v6SnUuF8JA+tmBOddBPpyO15IP5Ln7mEfinAhYRI7MACO/uOcfRX4ydcyHdELwKwM1hY69c8Ph2++1pkzJOtnSco1iJD07JreMTlOSyT7Y5Q96jR6OZdbPQ0KgoCQNjeRfoQlo2cRBwrCyvNb/Ajy2eW8JgRnY/U+SV+JkmjqrUh740sNbD0CNfFCOvvyIn9pSqQBkezfrqDKUznF6jMMATTdG75XMynbvS3RKfv/pd6ZR+m0DMFuWvvmL5cfjYsAe+M46TtfpHipCB+rxt27gn8+WN3o1cIm5OCsWK3bY51+pFFNr8P/S2kXPyRmq7B7GjLxfMBBYpERSPgzy1vTdpx+n1bREoFPll2d3KWSceVd+2izdj2S14ONPP/Ov4ImpIQQche1/Avaem6A/Go+y8Lpmnjp8/9ATwz3/b3RkbupX0bQy6y4gDg/V5bByaTpmb8Uh8,iv:rHGqUoLl6iJ1+LDHSuDFuIsl/YLlb75lUwl8gaxV79c=,tag:GVet48AfHBX5IXa/u1wXFA==,type:str]
+authentik_env: ENC[AES256_GCM,data:kAva3C4pWZ4+BFhGbbq9j1rSXeldb+NAwU16aZUD7wiw8k7Sg0kVq/43rj1HtR2ZTQY6DxhPlsK5I7opVAg953GwN0kTErpuhKLRWaRGSb8rC8kkxnY=,iv:X61qSjH18KQRWNOtYq1o8IZmY6Dz4TrJzehJWxE7b2o=,tag:mifmD1C3A+XSQveLviLt2w==,type:str]
+vaultwarden_env: ENC[AES256_GCM,data:vlwywspQDMrevce4dMgJTAbV4Fv9l8COK/k3ZMCZN4w0oIm4rQ3RfFzbagnG7oY9GRrqQNKM3gyRtxZ/5tPHHyiSNDDJ9lRBZ2g6w+VcVAmPyJaI736LOWZNwaYsK8yymfOWJuE8nZy5z07L/YjM+oQf0t6aqGIrHrwD4mB8GLIUhaDDNtB7xAJaDVtGCOKPseQGBwEXzs9S6hOKOUb/YeWXj290qDd9jVLSsBRZt8/ePxKMKnqSCekhrrlnGKGUitQBlHJgtUWd6wUtzR5DdTmh5Dn32JaAri51vlI+UuN6DOHxhh03rKsF5nTGXr1oclNMCrpk+uCOQZfjJ1U6jdz+vLxxuwocz3KRW2vi/v/MC2uutAu8KEskdcLBk+k6hnHse2WQ9HfePvY9hPcVMnnp1OaDLmJ3UnJsSuj+fTT/iGVyiDC+UpZ7XdF47VwohnYHbmsq30ruSxS05irhFqQ6Yla938V+l3ASSzAh7DNXmpGzYiit0evyt2wm+an29ulaU6oIaoh9etpvLK1I4WC9WjTG24Cq/4/S9d+Kzp6GaUxX7zOa9wANEAvPDHwUjreH/iIqbrIrbYBIdWLZacPWVj60JMP6ioaz8HfIsKel3q+pAfuZZbKJobSPOut/7jhz0RtLK9BN5zKv1UcAYRgcBF1Wy8d7eB5/k8IjDF6StfgJ+l5nEflrTx48ZouveMarincrj/i7PFmK2y5Ss31Xc3fvafPenxE8zT4CNaSu5RsUYQCIqAFcQfqdJSSu7S8OjQmzKGEwgFOhkG4mMqtPacvyNl2rDmgYcj8vbIkX5uC6wWejOJlqfDZwKIbnevBYaaoDLZWmzpqn47vBI4kveGLqhp2EqHH/yqAhz5Q=,iv:ziOAFuLGSngOmS9cOr8LE+Qf0Wh6CSCmWNHWFahpMUk=,tag:Ssm/6hC6A3t90502qo4zng==,type:str]
+vikunja_env: ENC[AES256_GCM,data:dFh7Ev1HWL6AdjU3ZrWa7SzZicBRXdqUn53Mrguqh/EN/HrUHgk0pIa/SCM9kpt/xgEUkhDuxfMYWAXcJ8jX8yRgytN3ItF6aiivrV98lijGQR1rcAO7MR9T56Qp/FjXNEpleMJ6iv01JrpKTIFN47dC7Hal/AYrlXLqIyFG8uoje3b4xkTsNJeK+NfY4gNwddN454yNwADkJK+8QklM0Z73iGkVedPpOAi71JjsUIboJHGHUghxNIqalnTSZMs2jpI1HtPBAYdF/8WTwFGL7tAVwGUhctdQj+3LMuLBF5Z75ZDLJEbc16jf4ssfpnjAWQArb1oRsX5TCgceY7Qs5eso+hD1alWPVV0w/YygVTpWsSyBG0mN4Mm5r4mM7jW+B8y6aaQhtDb58laEZ1wDS1G+Fbnd/Y+ECJamKz8zi7xT0Qlh54hodFe4cXulOnt3/DQX8jPTttWawswBIq69k/j04T2oxpV33mR6MLrWvAU9vJKy+aYds0tbQS/j3DkeHtVo2Fsd6v5PHS/z8dP+vh1WYaFPg1NpYIQxr8ue0fB/S3Spme2EaiU9zdm6z0FYN1OJJlnQlt4YRbeUJMfCo+RoYkpR6VALtapKn40tXPiA22wCz5p3ErWblt0ZzOyWYkE3Q4d3DNhXUCbpnYw9WkS+GHYCXczfCc746+0tLpYTj3ncwtukblFjNY1glKJ7YV0v9fmDdm/zdfxrfZexTAeb8YSbKbCd5qxPyIzpwroLrwFleKmvBQ==,iv:y1XVaZV2Zt8d90CDoZXX5dAL3SBIZwTPNcopyGEr5SM=,tag:G+Yz18GWtyKRsXZsHWF5mg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOC9xeExzN2VzT2NmZS9I
+            TEVxamNYOWZDWUJvYnpjL2JpMHJRbTlOV1Y4CmFGaXhEd0pRWU1tRTBMdDVPU2Fr
+            RVRrNkpCa3VNUWd0dzFDR004M005d1kKLS0tIDUxSUYzTkJLK3Y0dVNkVGNqTmxT
+            YjVvSDV1TGExYUJGUk00MTF4bXNFVTQKG/GueSmnuA23L42X6AvAWZgBbJuCGLw1
+            ZQ17gIIOjhKHlGx8Lo5t/PekzFyQKCKdijS7caq74dVib1vO3tk+uQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx
+    lastmodified: "2026-08-16T15:41:59Z"
+    mac: ENC[AES256_GCM,data:JCmj1SmD62xYMckWkfereDLbWg5NnEGO53diijpFNtsJbHQqnoCRIekQNq53FOpHBUadl7Qjz2snjsd0a5NzFaV5jP4WXqFKpSuFE4BK16Xj15v/HSUSwYc0APKCMwFeX7Oeu39iQNgsQ/quOQy8LRQcX8ck99NCVBPV8xeqfIo=,iv:FGk3Y/GuFNPCZ4L04+ygvM+2LJQvn3f7uRvArhpbQ14=,tag:UTU2Fjj2gJl7Og2r45+jwQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

secrets/default.sops.yaml

@@ -1,25 +1,35 @@
 wifi_password: ENC[AES256_GCM,data:7plUlREKK8mNdWGhlTG5+3ICFqZq+hBp6aHz1mrLbOm9xZ5Uh2EF4RM4eXDXLw==,iv:nW8dyJHMuvKPJV9155DiAFynb+Q4hfxzyO8RYLKjgGg=,tag:c3hpltMYjtjah0ttnkQWiw==,type:str]
+user_password: ENC[AES256_GCM,data:oRb4aO3iby+cA5YU5cyCeyOeSzZqd58/WozcHrK00VSHG01OnUZqpWbBa6zIm43UqfoZUM7IScWQZcWPbVR6t4H/uErZbZi2dQ==,iv:UzoJS290MWP7E/A1todnmyiNV3C8f5lg5h1Tf81QSPA=,tag:rvGNdn2I2TxVX8xDpDe/Vw==,type:str]
 sops:
     age:
-        - recipient: age18ujjw92tm6vpcpgqqky7dzg3yvzm9nytgzeptkfhtz5jhdskcdpsgmv0vs
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvM3dublNrNkQ2dlpJQUVP
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2QjFrS0Zhbm9KRk1VUy9h
-            MVE4c1hwdksyN3BtL1pWRXBISS9yaDRkNmhnCm5EQW4wTXZNQWxIYkhNVjh5TWFO
+            MjNxMXU0UFB0MzZkeG1NV2hEN0lNcnBVczNvCitFWjk5ellheEpsUE16ZE8rbkZa
-            cGJGRHFBekwzMUJWZzc2NCtTNDV2ckEKLS0tIDJpN0UyK0sraExiOVk1UTN2dUEw
+            QmtZUm51bHpyOGFGcDdscENZckh2SGcKLS0tIEJKVHNPY0hvRStCdjl5bDNjWmxx
-            ZjVBVUpBekJOaTZraEtWdEx2QU9VSWsKql10qo6BZUPZw/oXDQV0AlEihQnOi9Qd
+            MlhmSFREVEdmaHhnb2lneWdPK0trK0UKyLnmxyb+1D4Rg40Vdt5j0ChSWDXc8Ft3
-            f4gtZWBFpy5EUXolgtbbJH0LPwKhi7hVvQk/PkOGq11jNnA6PQJ93w==
+            UCIXrOebQlaJjbO3B8I2HkuOUtwg/SrljTa6SFwMlY2gZOhneEn/8g==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx
+          recipient: age18ujjw92tm6vpcpgqqky7dzg3yvzm9nytgzeptkfhtz5jhdskcdpsgmv0vs
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPN2R4cFZpOFlLcG4zVmlm
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvQkJQZVgrcW05TEEyYmRV
-            ZGF3MW9sb1NHOEhZY0UxNzF0TVIxanZHSFhFCkZYR01lUGFZaW9tbXhFZjg3UFB4
+            VjFuVW9nVFIzcVc5ZnpPQm1rRThPQ3d1RTNNCnhmUjc2RkxSNU81dXUwbWM3RGpM
-            dUhZNEduNUt3elFwSFRGYVF0Z3BZVWcKLS0tIC9oOUhER0JxWjg2OUhmTTI1ellE
+            ZWZSNng0eDFoN0w0eDFia05mKzZqNGcKLS0tIGVIU2JMZXBIelFScWJGR2pCdWN4
-            NDN3c1J1dVcvY21uOUYrVFZMVXZXUTQK8GFPONewI3mzyG9Eh8PSjGVETsslyHiy
+            akYvWXFVbXl6a0syY2FNdGhpSExKbGMKRzJDY2JPQoLG2MutoqQKzDfTT06QbsQz
-            ud/QT1fJFbjZzbKHu2RsFNYukLuoEodQ5t9ccGfWCpSfgddNXjGtHg==
+            aukZRfGNouysaBvrXU7uasJ9KRvJQXjFRI/JRmkWicYR8oxXbkgSeQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-05T20:36:33Z"
+          recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx
-    mac: ENC[AES256_GCM,data:L1sYA4CxLJjHOEJpho0q8k4uNa6XazYBjzWsMmITYxZVlTcdxKdIrMC3v6Fpcwdh+cHGnwEGufZAIBmRUjkCmxRhbuTA5T660oZb3bCmYE/i8u3IIh7C9jNAv95n16F/2CL5BVNzQj4lNQj8UzuUrSd/mH2BRO01I29SWNwb6mQ=,iv:RZJsTPhXYv82k9661R80NOUAqGzFqv4YnVaK13vhAJ0=,tag:huf6cjSx46H4DnsWS8c7AQ==,type:str]
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzb2laTm13VTRBeUpaS0VK
+            ZEUzL1g0M1A2ZzJudytPUnU2czNzbWdDMkhNCjVjOHBzcE8wQXdWZmt1eVl6VzBJ
+            bkhHMUczdG9sbCtMNVNUbDcraWovV2MKLS0tIEtuQ29rQk9PY0ZVTytMVGRGNGVt
+            dytEdkxoS3NtOFR0bHd0dmFUbEJ5b3cKju79g7jKN+m11YKHqTK+sNzXaw9j/gCI
+            EFS3/WCaFB4VI4olS0uzDsnsBzBywzgj/RTVwXYagzDkIqH2CAXRsw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1xfr76wj2hzz9mkxxce5qxgr2n72zsypatzhgl2fxgsh408wdzsaq39wt9z
+    lastmodified: "2026-03-07T16:01:24Z"
+    mac: ENC[AES256_GCM,data:Ni5qtsBcjKj9R2g78rdzd7+4tBL20SsU6aD5YZII/jaxjFxwFeVzfXuJruLnq3bEUiZShzOBVCc7gUi/6DaaluhXfltwwywu0QjJkPxfpGtQ7gmmiSDQAItwmj+9bJ/BFjx6ViBI/Vi1hnSRsS/gr1K0QkAzCT0JRehWi2HwnE4=,iv:rHWCfNa2hR6kB7lGB/VhPlB7MexgSFyWl5xyteQC3sk=,tag:6vBjVUIJLKDkJ7hjbkQXKw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.1