nixos/jackflix: copyparty: Move /pub to / and put stuff at /priv

The old build-n-parse seemed to output null sometimes.....

.gitea/workflows/ci.yaml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   check:
-    name: Check, build and cache Nix flake
+    name: Check, build and cache nixfiles
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -25,15 +25,23 @@ jobs:
             extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
 
       - name: Check flake
-        run: nix flake check
-      - name: Build the world
-        id: build
-        run: |
-          path=$(nix build --no-link .#ci.x86_64-linux --json | jq -r .[0].outputs.out)
-          echo "path=$path" >> "$GITHUB_OUTPUT"
+        run: nix flake check --no-build
 
-      - name: Push to cache
+      - name: Build (and cache) the world
+        id: build
         env:
           HARMONIA_SSH_KEY: ${{ secrets.HARMONIA_SSH_KEY }}
         run: |
-          ci/push-to-cache.sh "${{ steps.build.outputs.path }}"
+          nix eval --json --apply "builtins.attrNames" .#ci.x86_64-linux | jq -cr '.[]' | while read job; do
+            echo "::group::Build $job"
+            nix build --no-link .#ci.x86_64-linux."$job"
+            echo "::endgroup::"
+
+            echo "::group::Cache $job"
+            ci/push-to-cache.sh "$(nix eval --raw .#ci.x86_64-linux."$job")"
+            echo "::endgroup::"
+          done
+
+          echo "Building and caching CI derivation"
+          nix build --no-link .#ciDrv.x86_64-linux
+          UPDATE_PROFILE=1 ci/push-to-cache.sh "$(nix eval --raw .#ciDrv.x86_64-linux)"

.gitea/workflows/installer.yaml

@@ -24,6 +24,10 @@ jobs:
             extra-substituters = https://nix-cache.nul.ie
             extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
 
+      - name: Set up vars
+        id: setup
+        run: |
+          echo "short_rev=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
       - name: Build installer ISO
         run: |
           nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.iso

ci/push-to-cache.sh

@@ -22,8 +22,10 @@ path="$1"
 echo "Pushing $path to cache..."
 nix copy --no-check-sigs --to "$STORE_URI" "$path"
 
-echo "Updating profile..."
-remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
+if [ -n "$UPDATE_PROFILE" ]; then
+  echo "Updating profile..."
+  remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
 
-echo "Collecting garbage..."
-remote_cmd nix-collect-garbage --delete-older-than 30d
+  echo "Collecting garbage..."
+  remote_cmd nix-collect-garbage --delete-older-than 60d
+fi

devshell/commands.nix

@@ -77,7 +77,12 @@ in
       name = "build-n-switch";
       category = "tasks";
       help = "Shortcut to nixos-rebuild for this flake";
-      command = ''doas nixos-rebuild --flake . "$@"'';
+      command = ''
+        # HACK: Upstream changes in Git + Nix makes this necessary
+        # https://github.com/NixOS/nix/issues/10202
+        doas git config --global --add safe.directory "$PWD"
+        doas nixos-rebuild --flake . "$@"
+      '';
     }
     {
       name = "run-vm";
@@ -115,29 +120,17 @@ in
       help = "Build home-manager configuration";
       command = ''nix build "''${@:2}" ".#homeConfigurations.\"$1\".activationPackage"'';
     }
-    {
-      name = "update-inputs";
-      category = "tasks";
-      help = "Update flake inputs";
-      command = ''
-        args=()
-        for f in "$@"; do
-          args+=(--update-input "$f")
-        done
-        nix flake lock "''${args[@]}"
-      '';
-    }
     {
       name = "update-nixpkgs";
       category = "tasks";
       help = "Update nixpkgs flake inputs";
-      command = ''update-inputs nixpkgs-{unstable,stable,mine,mine-stable}'';
+      command = ''nix flake update nixpkgs-{unstable,stable,mine,mine-stable}'';
     }
     {
       name = "update-home-manager";
       category = "tasks";
       help = "Update home-manager flake inputs";
-      command = ''update-inputs home-manager-{unstable,stable}'';
+      command = ''nix flake update home-manager-{unstable,stable}'';
     }
     {
       name = "update-installer";
@@ -145,5 +138,15 @@ in
       help = "Update installer tag (to trigger new release)";
       command = ''git tag -f installer && git push -f origin installer'';
     }
+    {
+      name = "deploy-multi";
+      category = "tasks";
+      help = "Deploy multiple flakes at once";
+      command = ''
+        for f in $@; do
+          deploy "$O" $f
+        done
+      '';
+    }
   ];
 }

devshell/default.nix

@@ -11,7 +11,7 @@ in
 
     NIX_USER_CONF_FILES = toString (pkgs.writeText "nix.conf"
       ''
-        experimental-features = nix-command flakes ca-derivations repl-flake
+        experimental-features = nix-command flakes ca-derivations
         connect-timeout = 5
         fallback = true
         ${lib.my.c.nix.cache.conf}
@@ -24,6 +24,7 @@ in
     coreutils
     nixVersions.stable
     rage
+    wireguard-tools
     (pkgs.writeShellScriptBin "deploy" ''
       exec ${deploy-rs.deploy-rs}/bin/deploy --skip-checks "$@"
     '')

flake.lock

@@ -8,14 +8,14 @@
           "ragenix",
           "nixpkgs"
         ],
-        "systems": "systems_8"
+        "systems": "systems_6"
       },
       "locked": {
-        "lastModified": 1707830867,
-        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
+        "lastModified": 1723293904,
+        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
+        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
         "type": "github"
       },
       "original": {
@@ -24,69 +24,41 @@
         "type": "github"
       }
     },
-    "attic": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs-stable"
-        ]
-      },
-      "locked": {
-        "lastModified": 1720542474,
-        "narHash": "sha256-aKjJ/4l2I9+wNGTaOGRsuS3M1+IoTibqgEMPDikXm04=",
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "rev": "6139576a3ce6bb992e0f6c3022528ec233e45f00",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "type": "github"
-      }
-    },
     "boardie": {
       "inputs": {
         "devshell": "devshell",
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
-        "poetry2nix": "poetry2nix"
+        "pyproject-nix": "pyproject-nix"
       },
       "locked": {
-        "lastModified": 1718746012,
-        "narHash": "sha256-sp9vGl3vWXvD/C2JeMDi5nbW6CkKIC3Q2JMGKwexYEs=",
-        "ref": "refs/heads/master",
-        "rev": "ea24100bd4a914b9e044a2085a3785a6bd3a3833",
-        "revCount": 5,
-        "type": "git",
-        "url": "https://git.nul.ie/dev/boardie"
+        "lastModified": 1757170758,
+        "narHash": "sha256-FyO+Brz5eInmdAkG8B2rJAfrNGMCsDQ8BPflKV2+r5g=",
+        "owner": "devplayer0",
+        "repo": "boardie",
+        "rev": "ed5fd520d5bf122871b5508dd3c1eda28d6e515d",
+        "type": "github"
       },
       "original": {
-        "type": "git",
-        "url": "https://git.nul.ie/dev/boardie"
+        "owner": "devplayer0",
+        "repo": "boardie",
+        "type": "github"
       }
     },
     "borgthin": {
       "inputs": {
         "devshell": "devshell_2",
-        "flake-utils": "flake-utils_6",
-        "nixpkgs": [
-          "nixpkgs-mine"
-        ]
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1692446555,
-        "narHash": "sha256-Uzl8TiGKVBCjwYhkprSwbcu8xlcQwnDNIqsk9rM+P9w=",
+        "lastModified": 1732994213,
+        "narHash": "sha256-3v8cTsPB+TIdWmc1gmRNd0Mi0elpfi39CXRsA/2x/Oo=",
         "owner": "devplayer0",
         "repo": "borg",
-        "rev": "44a3dc19b014ebc8d33db0b3e145ed7bfc9a0cb7",
+        "rev": "795f5009445987d42f32de1b49fdeb2d88326a64",
         "type": "github"
       },
       "original": {
@@ -95,40 +67,34 @@
         "type": "github"
       }
     },
+    "copyparty": {
+      "inputs": {
+        "flake-utils": "flake-utils_5",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1757362872,
+        "narHash": "sha256-juUSWjxX8y2gueU34BpkQipUlhZRFJNLFccdprle0iM=",
+        "owner": "9001",
+        "repo": "copyparty",
+        "rev": "e09f3c9e2c3dccf8f3912539e04dd840b10b51ee",
+        "type": "github"
+      },
+      "original": {
+        "owner": "9001",
+        "repo": "copyparty",
+        "type": "github"
+      }
+    },
     "crane": {
-      "inputs": {
-        "nixpkgs": [
-          "attic",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1717025063,
-        "narHash": "sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8=",
+        "lastModified": 1725409566,
+        "narHash": "sha256-PrtLmqhM6UtJP7v7IGyzjBFhbG4eOAHT6LPYOFmYfbk=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "480dff0be03dac0e51a8dfc26e882b0d123a450e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "crane_2": {
-      "inputs": {
-        "nixpkgs": [
-          "ragenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1708794349,
-        "narHash": "sha256-jX+B1VGHT0ruHHL5RwS8L21R6miBn4B6s9iVyUJsJJY=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "2c94ff9a6fbeb9f3ea0107f28688edbe9c81deaa",
+        "rev": "7e4586bad4e3f8f97a9271def747cf58c4b68f3c",
         "type": "github"
       },
       "original": {
@@ -162,18 +128,18 @@
     },
     "deploy-rs": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1718194053,
-        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
+        "lastModified": 1756719547,
+        "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
+        "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
         "type": "github"
       },
       "original": {
@@ -184,7 +150,7 @@
     },
     "devshell": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       },
       "locked": {
@@ -203,7 +169,7 @@
     },
     "devshell-tools": {
       "inputs": {
-        "flake-utils": "flake-utils_11",
+        "flake-utils": "flake-utils_9",
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
@@ -222,8 +188,8 @@
     },
     "devshell_2": {
       "inputs": {
-        "flake-utils": "flake-utils_5",
-        "nixpkgs": "nixpkgs_3"
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1671489820,
@@ -241,17 +207,16 @@
     },
     "devshell_3": {
       "inputs": {
-        "flake-utils": "flake-utils_7",
         "nixpkgs": [
           "nixpkgs-unstable"
         ]
       },
       "locked": {
-        "lastModified": 1713532798,
-        "narHash": "sha256-wtBhsdMJA3Wa32Wtm1eeo84GejtI43pMrFrmwLXrsEc=",
+        "lastModified": 1741473158,
+        "narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "12e914740a25ea1891ec619bb53cf5e6ca922e40",
+        "rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
         "type": "github"
       },
       "original": {
@@ -263,27 +228,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
@@ -293,12 +242,15 @@
       }
     },
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {
@@ -326,42 +278,6 @@
       }
     },
     "flake-utils_11": {
-      "inputs": {
-        "systems": "systems_10"
-      },
-      "locked": {
-        "lastModified": 1709126324,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_12": {
-      "inputs": {
-        "systems": "systems_11"
-      },
-      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_13": {
       "locked": {
         "lastModified": 1667395993,
         "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
@@ -377,24 +293,6 @@
       }
     },
     "flake-utils_2": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_3": {
       "inputs": {
         "systems": "systems_2"
       },
@@ -412,25 +310,7 @@
         "type": "github"
       }
     },
-    "flake-utils_4": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_5": {
+    "flake-utils_3": {
       "locked": {
         "lastModified": 1642700792,
         "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
@@ -445,7 +325,7 @@
         "type": "github"
       }
     },
-    "flake-utils_6": {
+    "flake-utils_4": {
       "locked": {
         "lastModified": 1667395993,
         "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
@@ -460,16 +340,49 @@
         "type": "github"
       }
     },
-    "flake-utils_7": {
-      "inputs": {
-        "systems": "systems_6"
-      },
+    "flake-utils_5": {
       "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "lastModified": 1678901627,
+        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_6": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_7": {
+      "inputs": {
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -497,12 +410,15 @@
       }
     },
     "flake-utils_9": {
+      "inputs": {
+        "systems": "systems_8"
+      },
       "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
         "type": "github"
       },
       "original": {
@@ -540,16 +456,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1719827415,
-        "narHash": "sha256-pvh+1hStXXAZf0sZ1xIJbWGx4u+OGBC1rVx6Wsw0fBw=",
+        "lastModified": 1756679287,
+        "narHash": "sha256-Xd1vOeY9ccDf5VtVK12yM0FS6qqvfUop8UQlxEB+gTQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f2e3c19867262dbe84fdfab42467fc8dd83a2005",
+        "rev": "07fc025fe10487dd80f2ec694f1cd790e752d0e8",
         "type": "github"
       },
       "original": {
         "id": "home-manager",
-        "ref": "release-23.11",
+        "ref": "release-25.05",
         "type": "indirect"
       }
     },
@@ -560,11 +476,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720734513,
-        "narHash": "sha256-neWQ8eNtLTd+YMesb7WjKl1SVCbDyCm46LUgP/g/hdo=",
+        "lastModified": 1757075491,
+        "narHash": "sha256-a+NMGl5tcvm+hyfSG2DlVPa8nZLpsumuRj1FfcKb2mQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "90ae324e2c56af10f20549ab72014804a3064c7f",
+        "rev": "f56bf065f9abedc7bc15e1f2454aa5c8edabaacf",
         "type": "github"
       },
       "original": {
@@ -574,11 +490,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1719091691,
-        "narHash": "sha256-AxaLX5cBEcGtE02PeGsfscSb/fWMnyS7zMWBXQWDKbE=",
+        "lastModified": 1737831083,
+        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "23c1f06316b67cb5dabdfe2973da3785cfe9c34a",
+        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
         "type": "github"
       },
       "original": {
@@ -587,41 +503,35 @@
         "type": "github"
       }
     },
-    "nix-github-actions": {
-      "inputs": {
-        "nixpkgs": [
-          "boardie",
-          "poetry2nix",
-          "nixpkgs"
-        ]
-      },
+    "libnetRepo": {
+      "flake": false,
       "locked": {
-        "lastModified": 1703863825,
-        "narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
+        "lastModified": 1745053097,
+        "narHash": "sha256-BEW57utyWCqP4U+MzCXFqbvEC8LE3iZv5dsPMrmTJ9Q=",
+        "owner": "oddlama",
+        "repo": "nixos-extra-modules",
+        "rev": "7565d8554b0fc9d621851150e7939d34a3a8cd6c",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
+        "owner": "oddlama",
+        "repo": "nixos-extra-modules",
         "type": "github"
       }
     },
     "nixGL": {
       "inputs": {
-        "flake-utils": "flake-utils_9",
+        "flake-utils": "flake-utils_7",
         "nixpkgs": [
           "nixpkgs-unstable"
         ]
       },
       "locked": {
-        "lastModified": 1713543440,
-        "narHash": "sha256-lnzZQYG0+EXl/6NkGpyIz+FEOc/DSEG57AP1VsdeNrM=",
+        "lastModified": 1752054764,
+        "narHash": "sha256-Ob/HuUhANoDs+nvYqyTKrkcPXf4ZgXoqMTQoCK0RFgQ=",
         "owner": "nix-community",
         "repo": "nixGL",
-        "rev": "310f8e49a149e4c9ea52f1adf70cdc768ec53f8a",
+        "rev": "a8e1ce7d49a149ed70df676785b07f63288f53c5",
         "type": "github"
       },
       "original": {
@@ -648,11 +558,11 @@
     },
     "nixpkgs-mine": {
       "locked": {
-        "lastModified": 1721079763,
-        "narHash": "sha256-mlzukvwgiBm9Q8BedrZagnTcsDTXYKaFCf38KiSrsMc=",
+        "lastModified": 1757173087,
+        "narHash": "sha256-NYXuC8xUUbvtwbaC1aLdpQKHzQtQ2XB3VkK0hfYTPd8=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "b4cd56e5afee2cec3e1feca912680539cbb51403",
+        "rev": "06e4c8cd503ed73806744b39368393df38b36bb7",
         "type": "github"
       },
       "original": {
@@ -664,11 +574,11 @@
     },
     "nixpkgs-mine-stable": {
       "locked": {
-        "lastModified": 1720987393,
-        "narHash": "sha256-aq1reu43552gD+QRyxAMlimAX9+YbGpAIyw82jg0eWY=",
+        "lastModified": 1757173155,
+        "narHash": "sha256-aDNAiQQsrgS/coVOqLbtILpOUouE6jp/wqAsO8Dta/o=",
         "owner": "devplayer0",
         "repo": "nixpkgs",
-        "rev": "154ab603fb2b794b437f233853aeb3c75f101049",
+        "rev": "8a1a03f2d17918a6d51746371031a8fe4014c549",
         "type": "github"
       },
       "original": {
@@ -680,26 +590,26 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1720535198,
-        "narHash": "sha256-zwVvxrdIzralnSbcpghA92tWu2DV2lwv89xZc8MTrbg=",
+        "lastModified": 1757020766,
+        "narHash": "sha256-PLoSjHRa2bUbi1x9HoXgTx2AiuzNXs54c8omhadyvp0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "205fd4226592cc83fd4c0885a3e4c9c400efabb5",
+        "rev": "fe83bbdde2ccdc2cb9573aa846abe8363f79a97a",
         "type": "github"
       },
       "original": {
         "id": "nixpkgs",
-        "ref": "nixos-23.11",
+        "ref": "nixos-25.05",
         "type": "indirect"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1720768451,
-        "narHash": "sha256-EYekUHJE2gxeo2pM/zM9Wlqw1Uw2XTJXOSAO79ksc4Y=",
+        "lastModified": 1756787288,
+        "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7e7c39ea35c5cdd002cd4588b03a3fb9ece6fad9",
+        "rev": "d0fc30899600b9b3466ddb260fd83deb486c32f1",
         "type": "github"
       },
       "original": {
@@ -709,22 +619,6 @@
       }
     },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1718632497,
-        "narHash": "sha256-YtlyfqOdYMuu7gumZtK0Kg7jr4OKfHUhJkZfNUryw68=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c58b4a9118498c1055c5908a5bbe666e56abe949",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable-small",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
       "locked": {
         "lastModified": 1643381941,
         "narHash": "sha256-pHTwvnN4tTsEKkWlXQ8JMY423epos8wUOhthpwJjtpc=",
@@ -740,6 +634,20 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1673606088,
+        "narHash": "sha256-wdYD41UwNwPhTdMaG0AIe7fE1bAdyHe6bB4HLUqUvck=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "37b97ae3dd714de9a17923d004a2c5b5543dfa6d",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
     "nixpkgs_4": {
       "locked": {
         "lastModified": 1709309926,
@@ -772,63 +680,64 @@
         "type": "github"
       }
     },
-    "poetry2nix": {
+    "pyproject-nix": {
       "inputs": {
-        "flake-utils": "flake-utils_4",
-        "nix-github-actions": "nix-github-actions",
-        "nixpkgs": "nixpkgs_2",
-        "systems": "systems_4",
-        "treefmt-nix": "treefmt-nix"
+        "nixpkgs": [
+          "boardie",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1718726452,
-        "narHash": "sha256-w4hJSYvACz0i5XHtxc6XNyHwbxpisN13M2kA2Y7937o=",
-        "owner": "nix-community",
-        "repo": "poetry2nix",
-        "rev": "53e534a08c0cd2a9fa7587ed1c3e7f6aeb804a2c",
+        "lastModified": 1756395552,
+        "narHash": "sha256-5aJM14MpoLk2cdZAetu60OkLQrtFLWTICAyn1EP7ZpM=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "030dffc235dcf240d918c651c78dc5f158067b51",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
-        "repo": "poetry2nix",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
         "type": "github"
       }
     },
     "ragenix": {
       "inputs": {
         "agenix": "agenix",
-        "crane": "crane_2",
-        "flake-utils": "flake-utils_10",
+        "crane": "crane",
+        "flake-utils": "flake-utils_8",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1718869541,
-        "narHash": "sha256-smhpGh1x/8mNl+sFL8SbeWnx0bK4HWjmdRA3mIwGjPU=",
-        "owner": "yaxitech",
+        "lastModified": 1731774781,
+        "narHash": "sha256-vwsUUYOIs8J6weeSK1n1mbZf8fgvygGUMsadx0JmG70=",
+        "owner": "devplayer0",
         "repo": "ragenix",
-        "rev": "8a254bbaa93fbd38e16f70fa81af6782794e046e",
+        "rev": "ec4115da7b67c783b1091811e17dbcba50edd1c6",
         "type": "github"
       },
       "original": {
-        "owner": "yaxitech",
+        "owner": "devplayer0",
+        "ref": "add-rekey-one-flag",
         "repo": "ragenix",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "attic": "attic",
         "boardie": "boardie",
         "borgthin": "borgthin",
+        "copyparty": "copyparty",
         "deploy-rs": "deploy-rs",
         "devshell": "devshell_3",
-        "flake-utils": "flake-utils_8",
+        "flake-utils": "flake-utils_6",
         "home-manager-stable": "home-manager-stable",
         "home-manager-unstable": "home-manager-unstable",
         "impermanence": "impermanence",
+        "libnetRepo": "libnetRepo",
         "nixGL": "nixGL",
         "nixpkgs-mine": "nixpkgs-mine",
         "nixpkgs-mine-stable": "nixpkgs-mine-stable",
@@ -840,21 +749,17 @@
     },
     "rust-overlay": {
       "inputs": {
-        "flake-utils": [
-          "ragenix",
-          "flake-utils"
-        ],
         "nixpkgs": [
           "ragenix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1708740535,
-        "narHash": "sha256-NCTw235XwSDbeTAtAwg/hOeNOgwYhVq7JjDdbkOgBeA=",
+        "lastModified": 1725675754,
+        "narHash": "sha256-hXW3csqePOcF2e/PYnpXj72KEYyNj2HzTrVNmS/F7Ug=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "9b24383d77f598716fa0cbb8b48c97249f5ee1af",
+        "rev": "8cc45e678e914a16c8e224c3237fb07cf21e5e54",
         "type": "github"
       },
       "original": {
@@ -865,7 +770,7 @@
     },
     "sbt": {
       "inputs": {
-        "flake-utils": "flake-utils_13",
+        "flake-utils": "flake-utils_11",
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
@@ -885,18 +790,18 @@
     "sharry": {
       "inputs": {
         "devshell-tools": "devshell-tools",
-        "flake-utils": "flake-utils_12",
+        "flake-utils": "flake-utils_10",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
         "sbt": "sbt"
       },
       "locked": {
-        "lastModified": 1720592125,
-        "narHash": "sha256-vR89LefkY8mBPWxDTQ8SNg6Z7/J6Yga80T4kSb6MNdk=",
+        "lastModified": 1741328331,
+        "narHash": "sha256-OtsHm9ykxfAOMRcgFDsqFBBy5Wu0ag7eq1qmTIluVcw=",
         "owner": "eikek",
         "repo": "sharry",
-        "rev": "604b20517150599cb05dbe178cd35cd10659aa4c",
+        "rev": "6203b90f9a76357d75c108a27ad00f323d45c1d0",
         "type": "github"
       },
       "original": {
@@ -920,36 +825,6 @@
         "type": "github"
       }
     },
-    "systems_10": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_11": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "systems_2": {
       "locked": {
         "lastModified": 1681028828,
@@ -990,8 +865,9 @@
         "type": "github"
       },
       "original": {
-        "id": "systems",
-        "type": "indirect"
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
       }
     },
     "systems_5": {
@@ -1069,38 +945,16 @@
         "type": "github"
       }
     },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "boardie",
-          "poetry2nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1718522839,
-        "narHash": "sha256-ULzoKzEaBOiLRtjeY3YoGFJMwWSKRYOic6VNw2UyTls=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "68eb1dc333ce82d0ab0c0357363ea17c31ea1f81",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
     "utils": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {

flake.nix

@@ -3,28 +3,34 @@
 
   inputs = {
     flake-utils.url = "github:numtide/flake-utils";
+    # libnet.url = "github:reo101/nix-lib-net";
+    libnetRepo = {
+      url = "github:oddlama/nixos-extra-modules";
+      flake = false;
+    };
     devshell.url = "github:numtide/devshell";
     devshell.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
     nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "nixpkgs/nixos-23.11";
+    nixpkgs-stable.url = "nixpkgs/nixos-25.05";
     nixpkgs-mine.url = "github:devplayer0/nixpkgs/devplayer0";
     nixpkgs-mine-stable.url = "github:devplayer0/nixpkgs/devplayer0-stable";
 
     home-manager-unstable.url = "home-manager";
     home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    home-manager-stable.url = "home-manager/release-23.11";
+    home-manager-stable.url = "home-manager/release-25.05";
     home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";
 
     # Stuff used by the flake for build / deployment
-    ragenix.url = "github:yaxitech/ragenix";
+    # ragenix.url = "github:yaxitech/ragenix";
+    ragenix.url = "github:devplayer0/ragenix/add-rekey-one-flag";
     ragenix.inputs.nixpkgs.follows = "nixpkgs-unstable";
     deploy-rs.url = "github:serokell/deploy-rs";
     deploy-rs.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
     # Stuff used by systems
     impermanence.url = "github:nix-community/impermanence";
-    boardie.url = "git+https://git.nul.ie/dev/boardie";
+    boardie.url = "github:devplayer0/boardie";
     boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
     nixGL.url = "github:nix-community/nixGL";
     nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -33,10 +39,10 @@
     sharry.url = "github:eikek/sharry";
     sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
     borgthin.url = "github:devplayer0/borg";
-    borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
-    attic.url = "github:zhaofengli/attic";
-    attic.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    attic.inputs.nixpkgs-stable.follows = "nixpkgs-stable";
+    # TODO: Update borgthin so this works
+    # borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
+    copyparty.url = "github:9001/copyparty";
+    copyparty.inputs.nixpkgs.follows = "nixpkgs-unstable";
   };
 
   outputs =
@@ -51,7 +57,7 @@
       ...
     }:
     let
-      inherit (builtins) mapAttrs replaceStrings;
+      inherit (builtins) mapAttrs replaceStrings elem;
       inherit (lib) mapAttrs' filterAttrs nameValuePair recurseIntoAttrs evalModules;
       inherit (lib.flake) flattenTree eachDefaultSystem;
       inherit (lib.my) mkDefaultSystemsPkgs flakePackageOverlay;
@@ -59,7 +65,7 @@
       # Extend a lib with extras that _must not_ internally reference private nixpkgs. flake-utils doesn't, but many
       # other flakes (e.g. home-manager) probably do internally.
       libOverlay = final: prev: {
-        my = import ./lib { lib = final; };
+        my = import ./lib { inherit inputs; lib = final; };
         flake = flake-utils.lib;
       };
       pkgsLibOverlay = final: prev: { lib = prev.lib.extend libOverlay; };
@@ -90,12 +96,12 @@
         (_: path: mkDefaultSystemsPkgs path (system: {
           overlays = [
             pkgsLibOverlay
+
             myPkgsOverlay
             inputs.devshell.overlays.default
             inputs.ragenix.overlays.default
-            inputs.deploy-rs.overlay
+            inputs.deploy-rs.overlays.default
             (flakePackageOverlay inputs.home-manager-unstable system)
-            inputs.attic.overlays.default
           ];
         }))
         pkgsFlakes;
@@ -105,8 +111,19 @@
         (_: path: mkDefaultSystemsPkgs path (_: {
           overlays = [
             pkgsLibOverlay
+
             myPkgsOverlay
           ];
+
+          config = {
+            # RMS forgive me...
+            # Normally this is set modularly, but sometimes we need to use other pkgs
+            allowUnfreePredicate = p: elem (lib.getName p) [
+              "widevine-cdm"
+              "chromium-unwrapped"
+              "chromium"
+            ];
+          };
         }))
         pkgsFlakes;
 
@@ -119,6 +136,7 @@
         nixos/boxes/home/palace
         nixos/boxes/home/castle
         nixos/boxes/britway
+        nixos/boxes/britnet.nix
         nixos/boxes/kelder
 
         # Homes
@@ -149,7 +167,7 @@
     # Platform independent stuff
     {
       nixpkgs = pkgs';
-      inherit lib nixfiles;
+      inherit inputs lib nixfiles;
 
       overlays.default = myPkgsOverlay;
 
@@ -197,8 +215,9 @@
         systems' = mapAttrs' (n: v: nameValuePair "system-${n}" v) systems;
         packages' = mapAttrs' (n: v: nameValuePair "package-${n}" v) packages;
       in
-        pkgs.linkFarm "ci" (homes' // systems' // packages' // {
+        homes' // systems' // packages' // {
           inherit shell;
-        });
+        };
+      ciDrv = pkgs.linkFarm "ci" ci;
     }));
 }

home-manager/modules/common.nix

@@ -66,7 +66,7 @@ in
 
         lsd = {
           enable = mkDefault true;
-          enableAliases = mkDefault true;
+          enableFishIntegration = mkDefault true;
         };
 
         starship = {
@@ -132,6 +132,8 @@ in
 
         ssh = {
           enable = mkDefault true;
+          # TODO: Set after 25.11 releases
+          # enableDefaultConfig = false;
           matchBlocks = {
             nix-dev-vm = {
               user = "dev";
@@ -226,6 +228,8 @@ in
       # Note: If globalPkgs mode is on, then these will be overridden by the NixOS equivalents of these options
       nixpkgs = {
         overlays = [
+          inputs.libnet.overlays.default
+
           inputs.deploy-rs.overlay
           inputs.boardie.overlays.default
           inputs.nixGL.overlays.default

home-manager/modules/gui/default.nix

@@ -1,7 +1,8 @@
-{ lib, pkgs, config, ... }:
+{ lib, pkgs', pkgs, config, ... }:
 let
-  inherit (lib) genAttrs mkIf mkMerge mkForce;
-  inherit (lib.my) mkBoolOpt';
+  inherit (lib) genAttrs mkIf mkMerge mkForce mapAttrs mkOptionDefault;
+  inherit (lib.my) mkOpt' mkBoolOpt';
+  inherit (lib.my.c) pubDomain;
 
   cfg = config.my.gui;
 
@@ -15,34 +16,53 @@ let
     url = "https://distro.ibiblio.org/slitaz/sources/packages/d/doom1.wad";
     hash = "sha256-HX1DvlAeZ9kn5BXguPPinDvzMHXoWXIYFvZSpSbKx3E=";
   };
+  subwaySurfers = pkgs.fetchurl {
+    url = "https://p.${pubDomain}/video/subway-surfers-smol.mkv";
+    hash = "sha256-fMe7TDRNTymRHIJOi7qG3trzu4GP8a3gCDz+FMkX1dY=";
+  };
+  minecraftParkour = pkgs.fetchurl {
+    url = "https://p.${pubDomain}/video/minecraft-parkour-smol.mkv";
+    hash = "sha256-723pRm4AsIjY/WFUyAHzTJp+JvH4Pn5hvzF9wHTnOPA=";
+  };
 
-  doomsaver = pkgs.runCommand "doomsaver" {
-    inherit (pkgs) windowtolayer;
+  genLipsum = pkgs.writeScript "lipsum" ''
+    #!${pkgs.python3.withPackages (ps: [ ps.python-lorem ])}/bin/python
+    import lorem
+    print(lorem.get_paragraph(count=5, sep='\n\n'))
+  '';
+  doomsaver' = brainrotTextCommand: pkgs.runCommand "doomsaver" {
+    inherit (pkgs) windowtolayer tmux terminaltexteffects;
     chocoDoom = pkgs.chocolate-doom2xx;
+    ffmpeg = pkgs.ffmpeg-full;
     python = pkgs.python3.withPackages (ps: [ ps.filelock ]);
+
     inherit doomWad;
     enojy = ./enojy.jpg;
+    inherit brainrotTextCommand subwaySurfers minecraftParkour;
   } ''
     mkdir -p "$out"/bin
     substituteAll ${./screensaver.py} "$out"/bin/doomsaver
     chmod +x "$out"/bin/doomsaver
   '';
+  doomsaver = doomsaver' cfg.screensaver.brainrotTextCommand;
 in
 {
-  options.my.gui = {
+  options.my.gui = with lib.types; {
     enable = mkBoolOpt' true "Enable settings and packages meant for graphical systems";
     manageGraphical = mkBoolOpt' false "Configure the graphical session";
     standalone = mkBoolOpt' false "Enable settings for fully Nix managed systems";
+    screensaver.brainrotTextCommand = mkOpt' (either path str) genLipsum "Command to generate brainrot text.";
   };
 
   config = mkIf cfg.enable (mkMerge [
       {
         home = {
           packages = with pkgs; [
+            xdg-utils
+
             font.package
-            (nerdfonts.override {
-              fonts = [ "DroidSansMono" "SourceCodePro" ];
-            })
+            nerd-fonts.sauce-code-pro
+            nerd-fonts.droid-sans-mono
             noto-fonts-emoji
 
             grim
@@ -62,6 +82,9 @@ in
             neofetch
             cmatrix
             doomsaver
+
+            ffmpeg-full
+            xournalpp
           ];
         };
 
@@ -76,7 +99,7 @@ in
           alacritty = {
             enable = true;
             settings = {
-              import = [ ./alacritty-xterm.toml ];
+              general.import = [ ./alacritty-xterm.toml ];
 
               font = {
                 size = font.size;
@@ -95,6 +118,7 @@ in
               background_opacity = "0.65";
               tab_bar_edge = "top";
               shell_integration = "no-sudo";
+              font_features = "${font.name} -liga";
             };
           };
 
@@ -160,6 +184,19 @@ in
               };
               Install.RequiredBy = [ "sway-session.target" ];
             };
+
+            activate-linux = {
+              Unit = {
+                Description = "Linux activation watermark";
+                After = "graphical-session.target";
+                PartOf = "graphical-session.target";
+              };
+              Service = {
+                Type = "simple";
+                ExecStart = "${pkgs.activate-linux}/bin/activate-linux";
+              };
+              Install.RequiredBy = [ "graphical-session.target" ];
+            };
           };
         };
 
@@ -169,6 +206,7 @@ in
             wl-clipboard
             wev
             wdisplays
+            swaysome
 
             pavucontrol
             libsecret
@@ -191,9 +229,36 @@ in
         xsession.preferStatusNotifierItems = true;
         wayland = {
           windowManager = {
-            sway = {
+            sway =
+            let
+              cfg = config.wayland.windowManager.sway.config;
+              mod = cfg.modifier;
+
+              renameWs = pkgs.writeShellScript "sway-rename-ws" ''
+                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
+                focused_num="$(jq -r ".num" <<< "$focused_ws")"
+                focused_name="$(jq -r ".name" <<< "$focused_ws")"
+                placeholder="$(sed -E 's/[0-9]+: //' <<< "$focused_name")"
+
+                name="$(rofi -dmenu -p "rename ws $focused_num" -theme+entry+placeholder "\"$placeholder\"")"
+                if [ -n "$name" ]; then
+                  swaymsg rename workspace "$focused_name" to "$focused_num: $name"
+                fi
+              '';
+              clearWsName = pkgs.writeShellScript "sway-clear-ws-name" ''
+                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
+                focused_num="$(jq -r ".num" <<< "$focused_ws")"
+                focused_name="$(jq -r ".name" <<< "$focused_ws")"
+
+                swaymsg rename workspace "$focused_name" to "$focused_num"
+              '';
+            in
+            {
               enable = true;
               xwayland = true;
+              extraConfigEarly = ''
+                set $mod ${mod}
+              '';
               config = {
                 input = {
                   "type:touchpad" = {
@@ -208,23 +273,87 @@ in
 
                 modifier = "Mod4";
                 terminal = "kitty";
-                keybindings =
-                  let
-                    cfg = config.wayland.windowManager.sway.config;
-                    mod = cfg.modifier;
-                  in
-                  lib.mkOptionDefault {
+                keybindings = mapAttrs (k: mkOptionDefault) {
+                  "${mod}+Left" = "focus left";
+                  "${mod}+Down" = "focus down";
+                  "${mod}+Up" = "focus up";
+                  "${mod}+Right" = "focus right";
+
+                  "${mod}+Shift+Left" = "move left";
+                  "${mod}+Shift+Down" = "move down";
+                  "${mod}+Shift+Up" = "move up";
+                  "${mod}+Shift+Right" = "move right";
+
+                  "${mod}+b" = "splith";
+                  "${mod}+v" = "splitv";
+                  "${mod}+f" = "fullscreen toggle";
+                  "${mod}+a" = "focus parent";
+
+                  "${mod}+s" = "layout stacking";
+                  "${mod}+w" = "layout tabbed";
+                  "${mod}+e" = "layout toggle split";
+
+                  "${mod}+Shift+space" = "floating toggle";
+                  "${mod}+space" = "focus mode_toggle";
+
+                  "${mod}+1" = "workspace number 1";
+                  "${mod}+2" = "workspace number 2";
+                  "${mod}+3" = "workspace number 3";
+                  "${mod}+4" = "workspace number 4";
+                  "${mod}+5" = "workspace number 5";
+                  "${mod}+6" = "workspace number 6";
+                  "${mod}+7" = "workspace number 7";
+                  "${mod}+8" = "workspace number 8";
+                  "${mod}+9" = "workspace number 9";
+                  "${mod}+0" = "workspace number 10";
+
+                  "${mod}+Shift+1" =
+                    "move container to workspace number 1";
+                  "${mod}+Shift+2" =
+                    "move container to workspace number 2";
+                  "${mod}+Shift+3" =
+                    "move container to workspace number 3";
+                  "${mod}+Shift+4" =
+                    "move container to workspace number 4";
+                  "${mod}+Shift+5" =
+                    "move container to workspace number 5";
+                  "${mod}+Shift+6" =
+                    "move container to workspace number 6";
+                  "${mod}+Shift+7" =
+                    "move container to workspace number 7";
+                  "${mod}+Shift+8" =
+                    "move container to workspace number 8";
+                  "${mod}+Shift+9" =
+                    "move container to workspace number 9";
+                  "${mod}+Shift+0" =
+                    "move container to workspace number 10";
+
+                  "${mod}+Shift+minus" = "move scratchpad";
+                  "${mod}+minus" = "scratchpad show";
+
+                  "${mod}+Return" = "exec ${cfg.terminal}";
+                  "${mod}+r" = "mode resize";
                   "${mod}+d" = null;
                   "${mod}+l" = "exec ${doomsaver}/bin/doomsaver";
+                  "${mod}+q" = "kill";
+                  "${mod}+Shift+c" = "reload";
+                  "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
+
+                  # rofi
                   "${mod}+x" = "exec ${cfg.menu}";
                   "${mod}+Shift+x" = "exec rofi -show drun";
-                    "${mod}+q" = "kill";
-                    "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
-                    "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
-                    "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
                   "${mod}+Shift+e" = "exec rofi -show emoji";
                   # Config for this doesn't seem to work :/
                   "${mod}+c" = ''exec rofi -show calc -calc-command "echo -n '{result}' | ${pkgs.wl-clipboard}/bin/wl-copy"'';
+                  "${mod}+Shift+r" = "exec ${renameWs}";
+                  "${mod}+Shift+n" = "exec ${clearWsName}";
+
+                  # Screenshots
+                  "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
+                  "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
+
+                  "XF86MonBrightnessDown" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
+                  "XF86MonBrightnessUp" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set +5%";
 
                   "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
                   "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
@@ -241,6 +370,9 @@ in
                 menu = "rofi -show run";
                 bars = mkForce [ ];
               };
+              extraConfig = ''
+                include ${./swaysome.conf}
+              '';
 
               swaynag = {
                 enable = true;
@@ -291,6 +423,7 @@ in
             diff-so-fancy.enable = true;
             userEmail = "jackos1998@gmail.com";
             userName = "Jack O'Sullivan";
+            lfs.enable = true;
             extraConfig = {
               pull.rebase = true;
             };
@@ -298,11 +431,13 @@ in
 
           waybar = import ./waybar.nix { inherit lib pkgs config font; };
           rofi = {
+            package = pkgs.rofi-wayland;
             enable = true;
             font = "${font.name} ${toString font.size}";
-            plugins = with pkgs; [
+            plugins = with pkgs; (map (p: p.override { rofi-unwrapped = rofi-wayland-unwrapped; }) [
               rofi-calc
-              rofi-emoji
+            ]) ++ [
+              rofi-emoji-wayland
             ];
             extraConfig = {
               modes = "window,run,ssh,filebrowser,calc,emoji";
@@ -317,7 +452,7 @@ in
 
           chromium = {
             enable = true;
-            package = (pkgs.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
+            package = (pkgs'.unstable.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
               buildCommand = ''
                 ${old.buildCommand}
 

home-manager/modules/gui/screensaver.py

@@ -73,7 +73,7 @@ class TTESaver(Screensaver):
 
     def wait(self):
         while self.running:
-            effect_cmd = ['tte', random.choice(self.effects)]
+            effect_cmd = ['@terminaltexteffects@/bin/tte', random.choice(self.effects)]
             print(f"$ {self.cmd} | {' '.join(effect_cmd)}")
             content = subprocess.check_output(self.cmd, shell=True, env=self.env, stderr=subprocess.DEVNULL)
 
@@ -86,6 +86,51 @@ class TTESaver(Screensaver):
         self.running = False
         self.proc.terminate()
 
+class FFmpegCACASaver(Screensaver):
+    @staticmethod
+    def command(video, size):
+        return ['@ffmpeg@/bin/ffmpeg', '-hide_banner', '-loglevel', 'error',
+                '-stream_loop', '-1', '-i', video,
+                '-pix_fmt', 'rgb24', '-window_size', f'{size}x{size}',
+                '-f', 'caca', '-']
+
+    def __init__(self, video, weight=2):
+        cols, lines = os.get_terminal_size()
+        # IDK if it's reasonable to do this as "1:1"
+        size = lines - 4
+        super().__init__(
+            self.command(video, size),
+            env={'CACA_DRIVER': 'ncurses'},
+            weight=weight,
+        )
+
+    def stop(self):
+        super().stop(kill=True)
+
+class BrainrotStorySaver(Screensaver):
+    def __init__(self, video, text_command, weight=2):
+        cols, lines = os.get_terminal_size()
+        video_size = lines - 1
+        video_command = ' '.join(FFmpegCACASaver.command(video, video_size))
+        text_command = (
+            f'while true; do {text_command} | '
+            f'@terminaltexteffects@/bin/tte --wrap-text --canvas-width=80 --canvas-height={video_size//2} --anchor-canvas=c '
+            'print --final-gradient-stops=ffffff; clear; done' )
+        self.tmux_session = f'screensaver-{os.urandom(4).hex()}'
+        super().__init__(
+            ['@tmux@/bin/tmux', 'new-session', '-s', self.tmux_session, '-n', 'brainrot',
+             text_command, ';', 'split-window', '-hbl', str(lines), video_command],
+            # ['sh', '-c', text_command],
+            env={
+                'CACA_DRIVER': 'ncurses',
+                'SHELL': '/bin/sh',
+            },
+            weight=weight,
+        )
+
+    def stop(self):
+        subprocess.check_call(['@tmux@/bin/tmux', 'kill-session', '-t', self.tmux_session])
+
 class MultiSaver:
     savers = [
         DoomSaver(0),
@@ -100,6 +145,9 @@ class MultiSaver:
         TTESaver('ss -nltu'),
         TTESaver('ss -ntu'),
         TTESaver('jp2a --width=100 @enojy@'),
+
+        BrainrotStorySaver('@subwaySurfers@', '@brainrotTextCommand@'),
+        BrainrotStorySaver('@minecraftParkour@', '@brainrotTextCommand@'),
     ]
     state_filename = 'screensaver.json'
 

home-manager/modules/gui/swaysome.conf

@@ -0,0 +1,66 @@
+# Use (un)bindcode or (un)bindsym, depending on what you used in your main sway config file.
+# The `--no-warn` setting is only added to shortcuts that exist in the default config. You may want to add or remove
+# that flag on some bindings depending on your config.
+
+
+# Change focus between workspaces
+bindsym $mod+Alt+1 exec "swaysome focus 1"
+bindsym $mod+Alt+2 exec "swaysome focus 2"
+bindsym $mod+Alt+3 exec "swaysome focus 3"
+bindsym $mod+Alt+4 exec "swaysome focus 4"
+bindsym $mod+Alt+5 exec "swaysome focus 5"
+bindsym $mod+Alt+6 exec "swaysome focus 6"
+bindsym $mod+Alt+7 exec "swaysome focus 7"
+bindsym $mod+Alt+8 exec "swaysome focus 8"
+bindsym $mod+Alt+9 exec "swaysome focus 9"
+bindsym $mod+Alt+0 exec "swaysome focus 0"
+
+# Focus workspace groups
+bindsym --no-warn $mod+1 exec "swaysome focus-group 1"
+bindsym --no-warn $mod+2 exec "swaysome focus-group 2"
+bindsym --no-warn $mod+3 exec "swaysome focus-group 3"
+bindsym --no-warn $mod+4 exec "swaysome focus-group 4"
+bindsym --no-warn $mod+5 exec "swaysome focus-group 5"
+bindsym --no-warn $mod+6 exec "swaysome focus-group 6"
+bindsym --no-warn $mod+7 exec "swaysome focus-group 7"
+bindsym --no-warn $mod+8 exec "swaysome focus-group 8"
+bindsym --no-warn $mod+9 exec "swaysome focus-group 9"
+bindsym --no-warn $mod+0 exec "swaysome focus-group 0"
+
+# Move containers between workspaces
+bindsym $mod+Alt+Shift+1 exec "swaysome move 1"
+bindsym $mod+Alt+Shift+2 exec "swaysome move 2"
+bindsym $mod+Alt+Shift+3 exec "swaysome move 3"
+bindsym $mod+Alt+Shift+4 exec "swaysome move 4"
+bindsym $mod+Alt+Shift+5 exec "swaysome move 5"
+bindsym $mod+Alt+Shift+6 exec "swaysome move 6"
+bindsym $mod+Alt+Shift+7 exec "swaysome move 7"
+bindsym $mod+Alt+Shift+8 exec "swaysome move 8"
+bindsym $mod+Alt+Shift+9 exec "swaysome move 9"
+bindsym $mod+Alt+Shift+0 exec "swaysome move 0"
+
+# Move containers to other workspace groups
+bindsym --no-warn $mod+Shift+1 exec "swaysome move-to-group 1"
+bindsym --no-warn $mod+Shift+2 exec "swaysome move-to-group 2"
+bindsym --no-warn $mod+Shift+3 exec "swaysome move-to-group 3"
+bindsym --no-warn $mod+Shift+4 exec "swaysome move-to-group 4"
+bindsym --no-warn $mod+Shift+5 exec "swaysome move-to-group 5"
+bindsym --no-warn $mod+Shift+6 exec "swaysome move-to-group 6"
+bindsym --no-warn $mod+Shift+7 exec "swaysome move-to-group 7"
+bindsym --no-warn $mod+Shift+8 exec "swaysome move-to-group 8"
+bindsym --no-warn $mod+Shift+9 exec "swaysome move-to-group 9"
+bindsym --no-warn $mod+Shift+0 exec "swaysome move-to-group 0"
+
+# Move focused container to next output
+bindsym $mod+Alt+Right exec "swaysome next-output"
+# Move focused container to previous output
+bindsym $mod+Alt+Left exec "swaysome prev-output"
+
+# Move focused workspace group to next output
+bindsym $mod+Shift+Alt+Right exec "swaysome workspace-group-next-output"
+# Move focused workspace group to previous output
+bindsym $mod+Shift+Alt+Left exec "swaysome workspace-group-prev-output"
+
+# Init workspaces for every screen
+exec "swaysome init 1"
+

lib/constants.nix

@@ -13,6 +13,7 @@ rec {
       kea = 404;
       keepalived_script = 405;
       photoprism = 406;
+      copyparty = 408;
     };
     gids = {
       matrix-syncv3 = 400;
@@ -22,12 +23,14 @@ rec {
       kea = 404;
       keepalived_script = 405;
       photoprism = 406;
+      adbusers = 407;
+      copyparty = 408;
     };
   };
 
   kernel = {
-    lts = pkgs: pkgs.linuxKernel.packages.linux_6_6;
-    latest = pkgs: pkgs.linuxKernel.packages.linux_6_9;
+    lts = pkgs: pkgs.linuxKernel.packages.linux_6_12;
+    latest = pkgs: pkgs.linuxKernel.packages.linux_6_16;
   };
 
   nginx = rec {
@@ -135,6 +138,9 @@ rec {
         v4 = subnet 8 3 all.v4;
         v6 = subnet 4 3 all.v6;
       };
+      qclk = {
+        v4 = subnet 8 4 all.v4;
+      };
 
       cust = {
         v4 = subnet 8 100 all.v4; # single ip for routing only
@@ -170,6 +176,10 @@ rec {
       jam-ctr = host 3 prefixes.cust.v4;
     };
 
+    qclk = {
+      wgPort = 51821;
+    };
+
     firewallForwards = aa: [
       {
         port = "http";
@@ -192,11 +202,20 @@ rec {
         port = 25566;
         dst = aa.simpcraft-staging-oci.internal.ipv4.address;
       }
-
       {
-        port = 25575;
-        dst = aa.simpcraft-oci.internal.ipv4.address;
+        port = 25567;
+        dst = aa.kevcraft-oci.internal.ipv4.address;
       }
+      {
+        port = 25568;
+        dst = aa.kinkcraft-oci.internal.ipv4.address;
+      }
+
+      # RCON... unsafe?
+      # {
+      #   port = 25575;
+      #   dst = aa.simpcraft-oci.internal.ipv4.address;
+      # }
 
       {
         port = 2456;
@@ -220,6 +239,33 @@ rec {
         dst = aa.simpcraft-oci.internal.ipv4.address;
         proto = "udp";
       }
+      {
+        port = 25567;
+        dst = aa.kevcraft-oci.internal.ipv4.address;
+        proto = "udp";
+      }
+      {
+        port = 25568;
+        dst = aa.kinkcraft-oci.internal.ipv4.address;
+        proto = "udp";
+      }
+
+      {
+        port = 15636;
+        dst = aa.enshrouded-oci.internal.ipv4.address;
+        proto = "udp";
+      }
+      {
+        port = 15637;
+        dst = aa.enshrouded-oci.internal.ipv4.address;
+        proto = "udp";
+      }
+
+      {
+        port = qclk.wgPort;
+        dst = aa.qclk.internal.ipv4.address;
+        proto = "udp";
+      }
     ];
 
     fstrimConfig = {
@@ -243,8 +289,8 @@ rec {
       "stream"
     ];
     routersPubV4 = [
-      "80.111.122.16"
-      "109.255.252.63"
+      "109.255.108.88"
+      "109.255.108.121"
     ];
 
     prefixes = with lib.my.net.cidr; rec {
@@ -310,6 +356,20 @@ rec {
     assignedV6 = "2001:19f0:7402:128b:5400:04ff:feac:6e06";
   };
 
+  britnet = {
+    domain = "bhx1.int.${pubDomain}";
+    pubV4 = "77.74.199.67";
+    vpn = {
+      port = 51820;
+    };
+    prefixes = with lib.my.net.cidr; rec {
+      vpn = {
+        v4 = "10.200.0.0/24";
+        v6 = "fdfb:5ebf:6e84::/64";
+      };
+    };
+  };
+
   tailscale = {
     prefix = {
       v4 = "100.64.0.0/10";

lib/default.nix

@@ -1,11 +1,11 @@
-{ lib }:
+{ inputs, lib }:
 let
   inherit (builtins) length match elemAt filter replaceStrings substring;
   inherit (lib)
     genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
     mkOption mkOverride mkForce mkIf mergeEqualOption optional
     showWarnings concatStringsSep flatten unique optionalAttrs
-    mkBefore toLower;
+    mkBefore toLower splitString last;
   inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -23,7 +23,7 @@ rec {
 
   attrsToNVList = mapAttrsToList nameValuePair;
 
-  inherit (import ./net.nix { inherit lib; }) net;
+  inherit ((import "${inputs.libnetRepo}/lib/netu.nix" { inherit lib; }).lib) net;
   dns = import ./dns.nix { inherit lib; };
   c = import ./constants.nix { inherit lib; };
 
@@ -53,7 +53,7 @@ rec {
     in mkApp "${app}/bin/${app.meta.mainProgram}";
   flakePackageOverlay' = flake: pkg: system: (final: prev:
     let
-      pkg' = if pkg != null then flake.packages.${system}.${pkg} else flake.defaultPackage.${system};
+      pkg' = if pkg != null then flake.packages.${system}.${pkg} else flake.packages.${system}.default;
       name = if pkg != null then pkg else pkg'.name;
     in
     {
@@ -248,12 +248,13 @@ rec {
   in
   {
     trivial = prev.trivial // {
-      release = "24.07:u-${prev.trivial.release}";
-      codeName = "Diffed";
+      release = "25.09:u-${prev.trivial.release}";
+      codeName = "Giving";
       revisionWithDefault = default: self.rev or default;
       versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
     };
   };
+  upstreamRelease = last (splitString "-" lib.trivial.release);
 
   netbootKeaClientClasses = { tftpIP, hostname, systems }:
   let

nixos/boxes/britnet.nix

@@ -0,0 +1,191 @@
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c) pubDomain;
+  inherit (lib.my.c.britnet) domain pubV4 prefixes;
+in
+{
+  nixos.systems.britnet = {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+
+    assignments = {
+      allhost = {
+        inherit domain;
+        ipv4 = {
+          address = pubV4;
+          mask = 24;
+          gateway = "77.74.199.1";
+        };
+        ipv6 = {
+          address = "2a12:ab46:5344:99::a";
+          gateway = "2a12:ab46:5344::1";
+        };
+      };
+      vpn = {
+        ipv4 = {
+          address = net.cidr.host 1 prefixes.vpn.v4;
+          gateway = null;
+        };
+        ipv6.address = net.cidr.host 1 prefixes.vpn.v6;
+      };
+    };
+
+    configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
+      let
+        inherit (lib) mkMerge mkForce;
+        inherit (lib.my) networkdAssignment;
+      in
+      {
+        imports = [
+          "${modulesPath}/profiles/qemu-guest.nix"
+        ];
+
+        config = mkMerge [
+          {
+            boot = {
+              initrd.availableKernelModules = [
+                "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "ahci" "sr_mod" "virtio_blk"
+              ];
+              loader = {
+                systemd-boot.enable = false;
+                grub = {
+                  enable = true;
+                  device = "/dev/vda";
+                };
+              };
+            };
+
+            fileSystems = {
+              "/boot" = {
+                device = "/dev/disk/by-uuid/457444a1-81dd-4934-960c-650ad16c92b5";
+                fsType = "ext4";
+              };
+              "/nix" = {
+                device = "/dev/disk/by-uuid/992c0c79-5be6-45b6-bc30-dc82e3ec082a";
+                fsType = "ext4";
+              };
+              "/persist" = {
+                device = "/dev/disk/by-uuid/f020a955-54d5-4098-98ba-d3615781d96a";
+                fsType = "ext4";
+                neededForBoot = true;
+              };
+            };
+
+            environment = {
+              systemPackages = with pkgs; [
+                wireguard-tools
+              ];
+            };
+
+            services = {
+              iperf3 = {
+                enable = true;
+                openFirewall = true;
+              };
+
+              tailscale = {
+                enable = true;
+                authKeyFile = config.age.secrets."tailscale-auth.key".path;
+                openFirewall = true;
+                interfaceName = "tailscale0";
+                extraUpFlags = [
+                  "--operator=${config.my.user.config.name}"
+                  "--login-server=https://hs.nul.ie"
+                  "--netfilter-mode=off"
+                  "--advertise-exit-node"
+                  "--accept-routes=false"
+                ];
+              };
+            };
+
+            networking = { inherit domain; };
+
+            systemd.network = {
+              netdevs = {
+                "30-wg0" = {
+                  netdevConfig = {
+                    Name = "wg0";
+                    Kind = "wireguard";
+                  };
+                  wireguardConfig = {
+                    PrivateKeyFile = config.age.secrets."britnet/wg.key".path;
+                    ListenPort = lib.my.c.britnet.vpn.port;
+                  };
+                  wireguardPeers = [
+                    {
+                      PublicKey = "EfPwREfZ/q3ogHXBIqFZh4k/1NRJRyq4gBkBXtegNkE=";
+                      AllowedIPs = [
+                        (net.cidr.host 10 prefixes.vpn.v4)
+                        (net.cidr.host 10 prefixes.vpn.v6)
+                      ];
+                    }
+                  ];
+                };
+              };
+
+              links = {
+                "10-veth0" = {
+                  matchConfig.PermanentMACAddress = "00:db:d9:62:68:1a";
+                  linkConfig.Name = "veth0";
+                };
+              };
+
+              networks = {
+                "20-veth0" = mkMerge [
+                  (networkdAssignment "veth0" assignments.allhost)
+                  {
+                    dns = [ "1.1.1.1" "1.0.0.1" ];
+                    routes = [
+                      {
+                        # Gateway is on a different network for some reason...
+                        Destination = "2a12:ab46:5344::1";
+                        Scope = "link";
+                      }
+                    ];
+                  }
+                ];
+                "30-wg0" = mkMerge [
+                  (networkdAssignment "wg0" assignments.vpn)
+                  {
+                    networkConfig.IPv6AcceptRA = mkForce false;
+                  }
+                ];
+              };
+            };
+
+            my = {
+              server.enable = true;
+              secrets = {
+                key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIEx+1EC/lN6WKIaOB+O5LJgVHRK962YpZEPQg/m78O";
+                files = {
+                  "tailscale-auth.key" = {};
+                  "britnet/wg.key" = {
+                    owner = "systemd-network";
+                  };
+                };
+              };
+
+              firewall = {
+                udp.allowed = [ lib.my.c.britnet.vpn.port ];
+                trustedInterfaces = [ "tailscale0" ];
+                extraRules = ''
+                  table inet filter {
+                    chain forward {
+                      iifname wg0 oifname veth0 accept
+                    }
+                  }
+                  table inet nat {
+                    chain postrouting {
+                      iifname { tailscale0, wg0 } oifname veth0 snat ip to ${assignments.allhost.ipv4.address}
+                      iifname { tailscale0, wg0 } oifname veth0 snat ip6 to ${assignments.allhost.ipv6.address}
+                    }
+                  }
+                '';
+              };
+            };
+          }
+        ];
+      };
+  };
+}

nixos/boxes/britway/bgp.nix

@@ -11,23 +11,24 @@ in
   config = {
     my = {
       secrets.files."britway/bgp-password-vultr.conf" = {
-        owner = "bird2";
-        group = "bird2";
+        owner = "bird";
+        group = "bird";
       };
     };
 
     environment.etc."bird/vultr-password.conf".source = config.age.secrets."britway/bgp-password-vultr.conf".path;
 
     systemd = {
-      services.bird2.after = [ "systemd-networkd-wait-online@veth0.service" ];
+      services.bird.after = [ "systemd-networkd-wait-online@veth0.service" ];
       network = {
         config.networkConfig.ManageForeignRoutes = false;
       };
     };
 
     services = {
-      bird2 = {
+      bird = {
         enable = true;
+        package = pkgs.bird2;
         preCheckConfig = ''
           echo '"dummy"' > vultr-password.conf
         '';

nixos/boxes/britway/default.nix

@@ -106,7 +106,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
+                    routes = [
                       {
                         Destination = lib.my.c.colony.prefixes.all.v4;
                         Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -123,7 +123,7 @@ in
                         Table = "ts-extra";
                       }
                     ];
-                    routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+                    routingPolicyRules = [
                       {
                         IncomingInterface = "tailscale0";
                         To = lib.my.c.colony.prefixes.all.v6;

nixos/boxes/britway/nginx.nix

@@ -80,7 +80,7 @@ in
               };
             };
 
-            "ts.${pubDomain}" = {
+            "hs.${pubDomain}" = {
               locations."/" = {
                 proxyPass = "http://localhost:${toString config.services.headscale.port}";
                 proxyWebsockets = true;

nixos/boxes/britway/tailscale.nix

@@ -4,22 +4,6 @@ let
   inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.britway) prefixes domain;
 
-  # Can't use overrideAttrs because we need to override `vendorHash` within `buildGoModule`
-  headscale = (pkgs.headscale.override {
-    buildGoModule = args: pkgs.buildGoModule (args // rec {
-      version = "0.23.0-alpha12";
-      src = pkgs.fetchFromGitHub {
-        owner = "juanfont";
-        repo = "headscale";
-        rev = "v${version}";
-        hash = "sha256-kZZK0cXnFARxblSMz01TDcBbTorkHGAwGpR+a4/mYfU=";
-      };
-      patches = [];
-      vendorHash = "sha256-EorT2AVwA3usly/LcNor6r5UIhLCdj3L4O4ilgTIC2o=";
-      doCheck = false;
-    });
-  });
-
   advRoutes = concatStringsSep "," [
     lib.my.c.home.prefixes.all.v4
     lib.my.c.home.prefixes.all.v6
@@ -41,21 +25,21 @@ in
     services = {
       headscale = {
         enable = true;
-        package = headscale;
         settings = {
           disable_check_updates = true;
           unix_socket_permission = "0770";
-          server_url = "https://ts.${pubDomain}";
+          server_url = "https://hs.${pubDomain}";
           database = {
             type = "sqlite3";
             sqlite.path = "/var/lib/headscale/db.sqlite3";
           };
           noise.private_key_path = "/var/lib/headscale/noise_private.key";
           prefixes = with lib.my.c.tailscale.prefix; { inherit v4 v6; };
-          dns_config = {
+          dns = {
+            override_local_dns = false;
             # Use IPs that will route inside the VPN to prevent interception
             # (e.g. DNS rebinding filtering)
-            restricted_nameservers = {
+            nameservers.split = {
               "${domain}" = pubNameservers;
               "${lib.my.c.colony.domain}" = with allAssignments.estuary.base; [
                 ipv4.address ipv6.address
@@ -69,7 +53,6 @@ in
             };
             magic_dns = true;
             base_domain = "ts.${pubDomain}";
-            override_local_dns = false;
           };
           oidc = {
             only_start_if_oidc_is_available = true;
@@ -89,7 +72,7 @@ in
         interfaceName = "tailscale0";
         extraUpFlags = [
           "--operator=${config.my.user.config.name}"
-          "--login-server=https://ts.nul.ie"
+          "--login-server=https://hs.nul.ie"
           "--netfilter-mode=off"
           "--advertise-exit-node"
           "--advertise-routes=${advRoutes}"

nixos/boxes/colony/default.nix

@@ -252,10 +252,10 @@ in
                   };
                   ipv6Prefixes = [
                     {
-                      ipv6PrefixConfig.Prefix = prefixes.vms.v6;
+                      Prefix = prefixes.vms.v6;
                     }
                   ];
-                  routes = map (r: { routeConfig = r; }) [
+                  routes = [
                     {
                       Destination = prefixes.ctrs.v4;
                       Gateway = allAssignments.shill.routing.ipv4.address;
@@ -264,10 +264,12 @@ in
                       Destination = prefixes.ctrs.v6;
                       Gateway = allAssignments.shill.internal.ipv6.address;
                     }
+
                     {
                       Destination = allAssignments.shill.internal.ipv4.address;
                       Gateway = allAssignments.shill.routing.ipv4.address;
                     }
+
                     {
                       Destination = lib.my.c.tailscale.prefix.v4;
                       Gateway = allAssignments.shill.routing.ipv4.address;
@@ -276,6 +278,11 @@ in
                       Destination = lib.my.c.tailscale.prefix.v6;
                       Gateway = allAssignments.shill.internal.ipv6.address;
                     }
+                    {
+                      Destination = prefixes.qclk.v4;
+                      Gateway = allAssignments.shill.routing.ipv4.address;
+                    }
+
                     {
                       Destination = prefixes.jam.v6;
                       Gateway = allAssignments.shill.internal.ipv6.address;
@@ -320,10 +327,10 @@ in
                 };
                 ipv6Prefixes = [
                   {
-                    ipv6PrefixConfig.Prefix = prefixes.mail.v6;
+                    Prefix = prefixes.mail.v6;
                   }
                 ];
-                routes = map (r: { routeConfig = r; }) [
+                routes = [
                   {
                     Destination = prefixes.mail.v4;
                     Scope = "link";
@@ -343,10 +350,10 @@ in
                 };
                 ipv6Prefixes = [
                   {
-                    ipv6PrefixConfig.Prefix = prefixes.darts.v6;
+                    Prefix = prefixes.darts.v6;
                   }
                 ];
-                routes = map (r: { routeConfig = r; }) [
+                routes = [
                   {
                     Destination = prefixes.darts.v4;
                     Scope = "link";

nixos/boxes/colony/vms/default.nix

@@ -133,7 +133,7 @@
 
               (vm.lvmDisk "media")
               (vm.lvmDisk "minio")
-              (vm.lvmDisk "nix-atticd")
+              (vm.lvmDisk "nix-cache")
               (vm.lvmDisk "jam")
             ]);
           };

nixos/boxes/colony/vms/estuary/bgp.nix

@@ -8,8 +8,9 @@ in
 {
   config = {
     services = {
-      bird2 = {
+      bird = {
         enable = true;
+        package = pkgs.bird2;
         # TODO: Clean up and modularise
         config = ''
           define OWNAS = 211024;
@@ -250,42 +251,88 @@ in
             neighbor 2001:7f8:10f::dc49:254 as 56393;
           }
 
+          protocol bgp ixp4_frysix_rs3 from ixp_bgp4 {
+            description "Frys-IX route server 3 (IPv4)";
+            neighbor 185.1.160.255 as 56393;
+          }
+          protocol bgp ixp6_frysix_rs3 from ixp_bgp6 {
+            description "Frys-IX route server 3 (IPv6)";
+            neighbor 2001:7f8:10f::dc49:1 as 56393;
+          }
+
+          protocol bgp ixp4_frysix_rs4 from ixp_bgp4 {
+            description "Frys-IX route server 4 (IPv4)";
+            neighbor 185.1.161.0 as 56393;
+          }
+          protocol bgp ixp6_frysix_rs4 from ixp_bgp6 {
+            description "Frys-IX route server 4 (IPv6)";
+            neighbor 2001:7f8:10f::dc49:2 as 56393;
+          }
+
           protocol bgp peer4_frysix_luje from peer_bgp4 {
             description "LUJE.net (on Frys-IX, IPv4)";
-            neighbor 185.1.203.152 as 212855;
+            neighbor 185.1.160.152 as 212855;
           }
           protocol bgp peer6_frysix_luje from peer_bgp6 {
             description "LUJE.net (on Frys-IX, IPv6)";
             neighbor 2001:7f8:10f::3:3f95:152 as 212855;
           }
+
           protocol bgp peer4_frysix_he from peer_bgp4 {
             description "Hurricane Electric (on Frys-IX, IPv4)";
-            neighbor 185.1.203.154 as 6939;
+            neighbor 185.1.160.154 as 6939;
           }
-          protocol bgp peer4_frysix_cloudflare from peer_bgp4 {
-            description "Cloudflare (on Frys-IX, IPv4)";
+
+          protocol bgp peer4_frysix_cloudflare1_old from peer_bgp4 {
+            description "Cloudflare 1 (on Frys-IX, IPv4)";
             neighbor 185.1.203.217 as 13335;
           }
-          protocol bgp peer6_frysix_cloudflare from peer_bgp6 {
-            description "Cloudflare (on Frys-IX, IPv6)";
+          protocol bgp peer4_frysix_cloudflare2_old from peer_bgp4 {
+            description "Cloudflare 2 (on Frys-IX, IPv4)";
+            neighbor 185.1.203.109 as 13335;
+          }
+          protocol bgp peer4_frysix_cloudflare1 from peer_bgp4 {
+            description "Cloudflare 1 (on Frys-IX, IPv4)";
+            neighbor 185.1.160.217 as 13335;
+          }
+          protocol bgp peer4_frysix_cloudflare2 from peer_bgp4 {
+            description "Cloudflare 2 (on Frys-IX, IPv4)";
+            neighbor 185.1.160.109 as 13335;
+          }
+          protocol bgp peer6_frysix_cloudflare1 from peer_bgp6 {
+            description "Cloudflare 1 (on Frys-IX, IPv6)";
             neighbor 2001:7f8:10f::3417:217 as 13335;
           }
+          protocol bgp peer6_frysix_cloudflare2 from peer_bgp6 {
+            description "Cloudflare 2 (on Frys-IX, IPv6)";
+            neighbor 2001:7f8:10f::3417:109 as 13335;
+          }
+
           protocol bgp peer4_frysix_jurrian from peer_bgp4 {
             description "AS212635 aka jurrian (on Frys-IX, IPv4)";
-            neighbor 185.1.203.134 as 212635;
+            neighbor 185.1.160.134 as 212635;
           }
           protocol bgp peer6_frysix_jurrian from peer_bgp6 {
             description "AS212635 aka jurrian (on Frys-IX, IPv6)";
             neighbor 2001:7f8:10f::3:3e9b:134 as 212635;
           }
-          protocol bgp peer4_frysix_meta1 from peer_bgp4 {
+
+          protocol bgp peer4_frysix_meta1_old from peer_bgp4 {
             description "Meta 1 (on Frys-IX, IPv4)";
             neighbor 185.1.203.225 as 32934;
           }
-          protocol bgp peer4_frysix_meta2 from peer_bgp4 {
+          protocol bgp peer4_frysix_meta2_old from peer_bgp4 {
             description "Meta 2 (on Frys-IX, IPv4)";
             neighbor 185.1.203.226 as 32934;
           }
+          protocol bgp peer4_frysix_meta1 from peer_bgp4 {
+            description "Meta 1 (on Frys-IX, IPv4)";
+            neighbor 185.1.160.225 as 32934;
+          }
+          protocol bgp peer4_frysix_meta2 from peer_bgp4 {
+            description "Meta 2 (on Frys-IX, IPv4)";
+            neighbor 185.1.160.226 as 32934;
+          }
           protocol bgp peer6_frysix_meta1 from peer_bgp6 {
             description "Meta 1 (on Frys-IX, IPv6)";
             neighbor 2001:7f8:10f::80a6:225 as 32934;
@@ -317,36 +364,36 @@ in
             ipv6 { preference (PREFIXP-1); };
           }
 
-          protocol bgp peer4_nlix_cloudflare1 from peer_bgp4 {
-            description "Cloudflare NL-ix 1 (IPv4)";
-            neighbor 193.239.117.14 as 13335;
-            ipv4 { preference (PREFPEER-1); };
-          }
-          protocol bgp peer4_nlix_cloudflare2 from peer_bgp4 {
-            description "Cloudflare NL-ix 2 (IPv4)";
-            neighbor 193.239.117.114 as 13335;
-            ipv4 { preference (PREFPEER-1); };
-          }
-          protocol bgp peer4_nlix_cloudflare3 from peer_bgp4 {
-            description "Cloudflare NL-ix 3 (IPv4)";
-            neighbor 193.239.118.138 as 13335;
-            ipv4 { preference (PREFPEER-1); };
-          }
-          protocol bgp peer6_nlix_cloudflare1 from peer_bgp6 {
-            description "Cloudflare NL-ix 1 (IPv6)";
-            neighbor 2001:7f8:13::a501:3335:1 as 13335;
-            ipv6 { preference (PREFPEER-1); };
-          }
-          protocol bgp peer6_nlix_cloudflare2 from peer_bgp6 {
-            description "Cloudflare NL-ix 2 (IPv6)";
-            neighbor 2001:7f8:13::a501:3335:2 as 13335;
-            ipv6 { preference (PREFPEER-1); };
-          }
-          protocol bgp peer6_nlix_cloudflare3 from peer_bgp6 {
-            description "Cloudflare NL-ix 3 (IPv6)";
-            neighbor 2001:7f8:13::a501:3335:3 as 13335;
-            ipv6 { preference (PREFPEER-1); };
-          }
+          # protocol bgp peer4_nlix_cloudflare1 from peer_bgp4 {
+          #   description "Cloudflare NL-ix 1 (IPv4)";
+          #   neighbor 193.239.117.14 as 13335;
+          #   ipv4 { preference (PREFPEER-1); };
+          # }
+          # protocol bgp peer4_nlix_cloudflare2 from peer_bgp4 {
+          #   description "Cloudflare NL-ix 2 (IPv4)";
+          #   neighbor 193.239.117.114 as 13335;
+          #   ipv4 { preference (PREFPEER-1); };
+          # }
+          # protocol bgp peer4_nlix_cloudflare3 from peer_bgp4 {
+          #   description "Cloudflare NL-ix 3 (IPv4)";
+          #   neighbor 193.239.118.138 as 13335;
+          #   ipv4 { preference (PREFPEER-1); };
+          # }
+          # protocol bgp peer6_nlix_cloudflare1 from peer_bgp6 {
+          #   description "Cloudflare NL-ix 1 (IPv6)";
+          #   neighbor 2001:7f8:13::a501:3335:1 as 13335;
+          #   ipv6 { preference (PREFPEER-1); };
+          # }
+          # protocol bgp peer6_nlix_cloudflare2 from peer_bgp6 {
+          #   description "Cloudflare NL-ix 2 (IPv6)";
+          #   neighbor 2001:7f8:13::a501:3335:2 as 13335;
+          #   ipv6 { preference (PREFPEER-1); };
+          # }
+          # protocol bgp peer6_nlix_cloudflare3 from peer_bgp6 {
+          #   description "Cloudflare NL-ix 3 (IPv6)";
+          #   neighbor 2001:7f8:13::a501:3335:3 as 13335;
+          #   ipv6 { preference (PREFPEER-1); };
+          # }
           protocol bgp peer4_nlix_jurrian from peer_bgp4 {
             description "AS212635 aka jurrian (on NL-ix, IPv4)";
             neighbor 193.239.117.55 as 212635;

nixos/boxes/colony/vms/estuary/default.nix

@@ -164,11 +164,9 @@ in
                     };
                     wireguardPeers = [
                       {
-                        wireguardPeerConfig = {
                         PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
                         AllowedIPs = [ allAssignments.kelder.estuary.ipv4.address ];
                         PersistentKeepalive = 25;
-                        };
                       }
                     ];
                   };
@@ -221,6 +219,9 @@ in
               mkMerge
               [
                 (mkIXPConfig "frys-ix" "185.1.203.196/24" "2001:7f8:10f::3:3850:196/64")
+                # FrysIX is migrating to a /23
+                { "85-frys-ix".address = [ "185.1.160.196/23" ]; }
+
                 (mkIXPConfig "nl-ix" "193.239.116.145/22" "2001:7f8:13::a521:1024:1/64")
                 (mkIXPConfig "fogixp" "185.1.147.159/24" "2001:7f8:ca:1::159/64")
               {
@@ -278,11 +279,10 @@ in
                     };
                     ipv6Prefixes = [
                       {
-                        ipv6PrefixConfig.Prefix = prefixes.base.v6;
+                        Prefix = prefixes.base.v6;
                       }
                     ];
-                    routes = map (r: { routeConfig = r; }) (flatten
-                      ([
+                    routes = flatten ([
                       {
                         Destination = prefixes.vip1;
                         Gateway = allAssignments.colony.routing.ipv4.address;
@@ -308,6 +308,11 @@ in
                         Destination = lib.my.c.tailscale.prefix.v6;
                         Gateway = allAssignments.colony.internal.ipv6.address;
                       }
+
+                      {
+                        Destination = prefixes.qclk.v4;
+                        Gateway = allAssignments.colony.routing.ipv4.address;
+                      }
                     ] ++
                     (map (pName: [
                       {
@@ -318,7 +323,7 @@ in
                         Destination = prefixes."${pName}".v6;
                         Gateway = allAssignments.colony.internal.ipv6.address;
                       }
-                      ]) [ "vms" "ctrs" "oci" ])));
+                    ]) [ "vms" "ctrs" "oci" ]));
                   }
                 ];
 
@@ -327,7 +332,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
+                    routes = [
                       {
                         Destination = lib.my.c.home.prefixes.all.v4;
                         Gateway = lib.my.c.home.vips.as211024.v4;
@@ -339,10 +344,8 @@ in
                   matchConfig.Name = "kelder";
                   routes = [
                     {
-                      routeConfig = {
                       Destination = allAssignments.kelder.estuary.ipv4.address;
                       Scope = "link";
-                      };
                     }
                   ];
                 };
@@ -399,14 +402,19 @@ in
 
                       ip6 daddr ${aa.middleman.internal.ipv6.address} tcp dport { http, https, 8448 } accept
                       ${matchInet "tcp dport { http, https } accept" "git"}
-                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport { 25565, 25575 } accept
+                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport 25565 accept
                       ip6 daddr ${aa.simpcraft-staging-oci.internal.ipv6.address} tcp dport 25565 accept
+                      ip6 daddr ${aa.kevcraft-oci.internal.ipv6.address} tcp dport 25567 accept
+                      ip6 daddr ${aa.kinkcraft-oci.internal.ipv6.address} tcp dport 25568 accept
                       return
                     }
                     chain routing-udp {
                       ip6 daddr ${aa.valheim-oci.internal.ipv6.address} udp dport { 2456-2457 } accept
                       ip6 daddr ${aa.waffletail.internal.ipv6.address} udp dport 41641 accept
                       ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} udp dport 25565 accept
+                      ip6 daddr ${aa.enshrouded-oci.internal.ipv6.address} udp dport { 15636-15637 } accept
+                      ip6 daddr ${aa.kevcraft-oci.internal.ipv6.address} udp dport 25567 accept
+                      ip6 daddr ${aa.kinkcraft-oci.internal.ipv6.address} udp dport 25568 accept
                       return
                     }
                     chain filter-routing {

nixos/boxes/colony/vms/estuary/dns.nix

@@ -14,7 +14,7 @@ in
           owner = "pdns";
           group = "pdns";
         };
-        "estuary/pdns/recursor.conf" = {
+        "estuary/pdns/recursor.yml" = {
           owner = "pdns-recursor";
           group = "pdns-recursor";
         };
@@ -31,7 +31,7 @@ in
 
       pdns.recursor = {
         enable = true;
-        extraSettingsFile = config.age.secrets."estuary/pdns/recursor.conf".path;
+        extraSettingsFile = config.age.secrets."estuary/pdns/recursor.yml".path;
       };
     };
 
@@ -44,34 +44,37 @@ in
       };
 
       pdns-recursor = {
-        dns = {
-          address = [
+        yaml-settings = {
+          incoming = {
+            listen = [
               "127.0.0.1" "::1"
               assignments.base.ipv4.address assignments.base.ipv6.address
             ];
-          allowFrom = [
+            allow_from = [
               "127.0.0.0/8" "::1/128"
               prefixes.all.v4 prefixes.all.v6
             ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
+
+            # DNS NOTIFY messages override TTL
+            allow_notify_for = authZones;
+            allow_notify_from = [ "127.0.0.0/8" "::1/128" ];
           };
 
-        settings = {
-          query-local-address = [
+          outgoing = {
+            source_address = [
               assignments.internal.ipv4.address
               assignments.internal.ipv6.address
               assignments.base.ipv6.address
             ];
-          forward-zones = map (z: "${z}=127.0.0.1:5353") authZones;
+          };
 
-          # DNS NOTIFY messages override TTL
-          allow-notify-for = authZones;
-          allow-notify-from = [ "127.0.0.0/8" "::1/128" ];
+          recursor = {
+            forward_zones = map (z: {
+              zone = z;
+              forwarders = [ "127.0.0.1:5353" ];
+            }) authZones;
 
-          webserver = true;
-          webserver-address = "::";
-          webserver-allow-from = [ "127.0.0.1" "::1" ];
-
-          lua-dns-script = pkgs.writeText "pdns-script.lua" ''
+            lua_dns_script = pkgs.writeText "pdns-script.lua" ''
               function preresolve(dq)
                 if dq.qname:equal("nix-cache.nul.ie") then
                   dq:addAnswer(pdns.CNAME, "http.${config.networking.domain}.")
@@ -84,6 +87,13 @@ in
               end
             '';
           };
+
+          webservice = {
+            webserver = true;
+            address = "::";
+            allow_from = [ "127.0.0.1" "::1" ];
+          };
+        };
       };
     };
 
@@ -153,6 +163,11 @@ in
             simpcraft IN AAAA ${allAssignments.simpcraft-oci.internal.ipv6.address}
             simpcraft-staging IN A ${assignments.internal.ipv4.address}
             simpcraft-staging IN AAAA ${allAssignments.simpcraft-staging-oci.internal.ipv6.address}
+            enshrouded IN A ${assignments.internal.ipv4.address}
+            kevcraft IN A ${assignments.internal.ipv4.address}
+            kevcraft IN AAAA ${allAssignments.kevcraft-oci.internal.ipv6.address}
+            kinkcraft IN A ${assignments.internal.ipv4.address}
+            kinkcraft IN AAAA ${allAssignments.kinkcraft-oci.internal.ipv6.address}
 
             mail-vm IN A ${net.cidr.host 0 prefixes.mail.v4}
             mail-vm IN AAAA ${net.cidr.host 1 prefixes.mail.v6}

nixos/boxes/colony/vms/git/default.nix

@@ -4,7 +4,7 @@ let
   inherit (lib) mkMerge mkDefault;
   inherit (lib.my) net;
   inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.colony) domain prefixes;
+  inherit (lib.my.c.colony) domain prefixes firewallForwards;
   inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
 in
 {
@@ -197,6 +197,7 @@ in
 
               firewall = {
                 tcp.allowed = [ 19999 "http" "https" ];
+                nat.forwardPorts."${allAssignments.estuary.internal.ipv4.address}" = firewallForwards allAssignments;
                 extraRules = ''
                   table inet filter {
                     chain forward {

nixos/boxes/colony/vms/git/gitea-actions.nix

@@ -35,6 +35,11 @@ in
           ];
           url = "https://git.${pubDomain}";
           tokenFile = config.age.secrets."gitea/actions-runner.env".path;
+          settings = {
+            runner = {
+              timeout = "8h";
+            };
+          };
         };
       };
     };

nixos/boxes/colony/vms/shill/containers-ext.nix

@@ -47,10 +47,10 @@ in
         };
         ipv6Prefixes = [
           {
-            ipv6PrefixConfig.Prefix = prefixes.jam.v6;
+            Prefix = prefixes.jam.v6;
           }
         ];
-        routes = map (r: { routeConfig = r; }) [
+        routes = [
           {
             Destination = prefixes.jam.v4;
             Scope = "link";

nixos/boxes/colony/vms/shill/containers/chatterbox.nix

@@ -50,11 +50,6 @@ in
                   group = "matrix-synapse";
                 };
 
-                "chatterbox/syncv3.env" = {
-                  owner = "matrix-syncv3";
-                  group = "matrix-syncv3";
-                };
-
                 "chatterbox/mautrix-whatsapp.env" = {
                   owner = "mautrix-whatsapp";
                   group = "mautrix-whatsapp";
@@ -80,32 +75,21 @@ in
               matrix-synapse.extraGroups = [
                 "mautrix-whatsapp"
               ];
-              matrix-syncv3 = {
-                isSystemUser = true;
-                uid = uids.matrix-syncv3;
-                group = "matrix-syncv3";
-              };
-            };
-            groups = {
-              matrix-syncv3.gid = gids.matrix-syncv3;
             };
+            groups = { };
           };
 
           systemd = {
             network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
-            services = {
-              matrix-sliding-sync.serviceConfig = {
-                # Needs to be able to read its secrets
-                DynamicUser = mkForce false;
-                User = "matrix-syncv3";
-                Group = "matrix-syncv3";
-              };
-            } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
+            services = { } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
               # ffmpeg needed to convert GIFs to video
               path = with pkgs; [ ffmpeg ];
             }));
           };
 
+          # TODO/FIXME: https://github.com/NixOS/nixpkgs/issues/336052
+          nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
+
           services = {
             netdata.enable = true;
             matrix-synapse = {
@@ -193,20 +177,10 @@ in
                 app_service_config_files = [
                   "/var/lib/heisenbridge/registration.yml"
                   config.age.secrets."chatterbox/doublepuppet.yaml".path
-                  "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
                 ];
               };
 
             };
-            matrix-sliding-sync = {
-              enable = true;
-              createDatabase = false;
-              environmentFile = config.age.secrets."chatterbox/syncv3.env".path;
-              settings = {
-                SYNCV3_BINDADDR = "[::]:8009";
-                SYNCV3_SERVER = "http://localhost:8008";
-              };
-            };
 
             heisenbridge = {
               enable = true;
@@ -285,10 +259,12 @@ in
                       avatar = "mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak";
                     };
                   };
-                  meta.mode = "messenger";
+                  network = {
+                    mode = "messenger";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
+                  };
                   bridge = {
                     username_template = "fbm2_{{.}}";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
                     personal_filtering_spaces = true;
                     delivery_receipts = true;
                     management_room_text.welcome = "Hello, I'm a Messenger bridge bot.";
@@ -331,10 +307,12 @@ in
                       avatar = "mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv";
                     };
                   };
-                  meta.mode = "instagram";
+                  network = {
+                    mode = "instagram";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
+                  };
                   bridge = {
                     username_template = "ig_{{.}}";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
                     personal_filtering_spaces = true;
                     delivery_receipts = true;
                     management_room_text.welcome = "Hello, I'm an Instagram bridge bot.";
@@ -350,6 +328,7 @@ in
                     };
                     permissions = {
                       "@dev:nul.ie" = "admin";
+                      "@adzerq:nul.ie" = "user";
                     };
                   };
                 };

nixos/boxes/colony/vms/shill/containers/default.nix

@@ -8,5 +8,6 @@
     ./object.nix
     ./toot.nix
     ./waffletail.nix
+    ./qclk
   ];
 }

nixos/boxes/colony/vms/shill/containers/jackflix/default.nix

@@ -23,7 +23,7 @@ in
       };
     };
 
-    configuration = { lib, pkgs, config, ... }:
+    configuration = { lib, pkgs, config, allAssignments, ... }:
     let
       inherit (lib) mkForce;
     in
@@ -39,10 +39,20 @@ in
             key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPUv1ntVrZv5ripsKpcOAnyDQX2PHjowzyhqWK10Ml53";
             files = {
               "jackflix/photoprism-pass.txt" = {};
+              "jackflix/copyparty-pass.txt" = {
+                owner = "copyparty";
+                group = "copyparty";
               };
             };
           };
 
+          firewall = {
+            tcp.allowed = [
+              3923
+            ];
+          };
+        };
+
         users = with lib.my.c.ids; {
           users = {
             "${config.my.user.config.name}".extraGroups = [ "media" ];
@@ -60,11 +70,16 @@ in
               uid = uids.photoprism;
               group = "photoprism";
             };
+            copyparty = {
+              uid = uids.copyparty;
+              extraGroups = [ "media" ];
+            };
           };
           groups = {
             media.gid = 2000;
             jellyseerr.gid = gids.jellyseerr;
             photoprism.gid = gids.photoprism;
+            copyparty.gid = gids.copyparty;
           };
         };
 
@@ -123,6 +138,7 @@ in
             };
           };
 
+          flaresolverr.enable = true;
           jackett.enable = true;
           radarr.enable = true;
           sonarr.enable = true;
@@ -150,6 +166,50 @@ in
               PHOTOPRISM_DATABASE_DRIVER = "sqlite";
             };
           };
+
+          copyparty = {
+            enable = true;
+            package = pkgs.copyparty.override {
+              withMagic = true;
+            };
+            settings = {
+              name = "dev-stuff";
+              no-reload = true;
+              j = 8; # cores
+              http-only = true;
+              xff-src =
+                with allAssignments.middleman.internal;
+                [ "${ipv4.address}/32" prefixes.ctrs.v6 ];
+              rproxy = 1; # get if from x-forwarded-for
+              magic = true; # enable checking file magic on upload
+              hist = "/var/cache/copyparty";
+              shr = "/share"; # enable share creation
+              ed = true; # enable dotfiles
+              chmod-f = 664;
+              chmod-d = 775;
+              e2dsa = true; # file indexing
+              e2t = true; # metadata indexing
+              og-ua = "(Discord|Twitter|Slack)bot"; # embeds
+              theme = 6;
+            };
+            accounts.dev.passwordFile = config.age.secrets."jackflix/copyparty-pass.txt".path;
+            volumes = {
+              "/" = {
+                path = "/mnt/media/public";
+                access = {
+                  A = "dev";
+                  "r." = "*";
+                };
+                flags = {
+                  shr_who = "no"; # no reason to have shares here
+                };
+              };
+              "/priv" = {
+                path = "/mnt/media/stuff";
+                access.A = "dev"; # dev has admin access
+              };
+            };
+          };
         };
       };
     };

nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix

@@ -71,14 +71,12 @@ in
               RouteTable = routeTable;
             };
             wireguardPeers = [
-              {
               # AirVPN NL
-                wireguardPeerConfig = {
+              {
                 Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
                 PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
                 PresharedKeyFile = config.age.secrets."${pskFile}".path;
                 AllowedIPs = [ "0.0.0.0/0" "::/0" ];
-                };
               }
             ];
           };
@@ -94,7 +92,7 @@ in
               matchConfig.Name = "vpn";
               address = [ "10.182.97.37/32" "fd7d:76ee:e68f:a993:735d:ef5e:6907:b122/128" ];
               dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+              routingPolicyRules = [
                 {
                   Family = "both";
                   SuppressPrefixLength = 0;

nixos/boxes/colony/vms/shill/containers/middleman/default.nix

@@ -240,7 +240,8 @@ in
 
               recommendedTlsSettings = true;
               recommendedBrotliSettings = true;
-              recommendedZstdSettings = true;
+              # Uh so nginx is hanging with zstd enabled... maybe let's not for now
+              # recommendedZstdSettings = true;
               clientMaxBodySize = "0";
               serverTokens = true;
               resolver = {
@@ -250,6 +251,9 @@ in
               proxyResolveWhileRunning = true;
               sslDhparam = config.age.secrets."dhparams.pem".path;
 
+              appendConfig = ''
+                worker_processes auto;
+              '';
               # Based on recommended*Settings, but probably better to be explicit about these
               appendHttpConfig = ''
                 ${baseHttpConfig}

nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix

@@ -2,7 +2,7 @@
 let
   inherit (builtins) mapAttrs toJSON;
   inherit (lib) mkMerge mkDefault genAttrs flatten concatStringsSep;
-  inherit (lib.my.c) pubDomain;
+  inherit (lib.my.c) pubDomain home;
   inherit (lib.my.c.nginx) proxyHeaders;
   inherit (config.networking) domain;
 
@@ -35,7 +35,6 @@ let
       # For clients
       (mkWellKnown "matrix/client" (toJSON {
         "m.homeserver".base_url = "https://matrix.nul.ie";
-        "org.matrix.msc3575.proxy".url = "https://matrix-syncv3.nul.ie";
       }))
     ];
   };
@@ -50,6 +49,7 @@ let
     "/.well-known/webfinger".return = "301 https://toot.nul.ie$request_uri";
     "/.well-known/nodeinfo".return = "301 https://toot.nul.ie$request_uri";
     "/.well-known/host-meta".return = "301 https://toot.nul.ie$request_uri";
+    "/.well-known/atproto-did".return = "301 https://pds.nul.ie$request_uri";
   };
 in
 {
@@ -80,6 +80,10 @@ in
                   sha256 = "018wh6ps19n7323fi44njzj9yd4wqslc90dykbwfyscv7bgxhlar";
                 };
               }
+              {
+                name = "ssh.pub";
+                path = lib.my.c.sshKeyFiles.me;
+              }
             ];
           }
           wellKnown
@@ -182,10 +186,6 @@ in
         ];
         useACMEHost = pubDomain;
       };
-      "matrix-syncv3.${pubDomain}" = {
-        locations."/".proxyPass = "http://chatterbox-ctr.${domain}:8009";
-        useACMEHost = pubDomain;
-      };
 
       "element.${pubDomain}" =
       let
@@ -327,6 +327,15 @@ in
         useACMEHost = pubDomain;
       };
 
+      "pds.nul.ie" = {
+        locations."/" = {
+          proxyPass = "http://toot-ctr.${domain}:3000";
+          proxyWebsockets = true;
+          extraConfig = proxyHeaders;
+        };
+        useACMEHost = pubDomain;
+      };
+
       "share.${pubDomain}" = {
         locations."/" = {
           proxyPass = "http://object-ctr.${domain}:9090";
@@ -338,16 +347,13 @@ in
 
       "stuff.${pubDomain}" = {
         locations."/" = {
-          basicAuthFile = config.age.secrets."middleman/htpasswd".path;
-          root = "/mnt/media/stuff";
-          extraConfig = ''
-            fancyindex on;
-            fancyindex_show_dotfiles on;
-          '';
+          proxyPass = "http://jackflix-ctr.${domain}:3923";
         };
         useACMEHost = pubDomain;
       };
       "public.${pubDomain}" = {
+        onlySSL = false;
+        addSSL = true;
         serverAliases = [ "p.${pubDomain}" ];
         locations."/" = {
           root = "/mnt/media/public";
@@ -368,6 +374,11 @@ in
         useACMEHost = pubDomain;
       };
 
+      "mc-map-kink.${pubDomain}" = {
+        locations."/".proxyPass = "http://kinkcraft-oci.${domain}:8100";
+        useACMEHost = pubDomain;
+      };
+
       "librespeed.${domain}" = {
         locations."/".proxyPass = "http://localhost:8989";
       };
@@ -396,6 +407,36 @@ in
         };
         useACMEHost = pubDomain;
       };
+
+      "pront.${pubDomain}" = mkMerge [
+        {
+          locations."/" = mkMerge [
+            {
+              proxyPass = "http://stream-hi.${home.domain}:5000";
+              proxyWebsockets = true;
+              extraConfig = proxyHeaders;
+            }
+            (ssoLoc "generic")
+          ];
+          locations."~* ^/webcam/(.*)" = mkMerge [
+            {
+              proxyPass = "http://stream-hi.${home.domain}:5050/$1$is_args$args";
+              extraConfig = proxyHeaders;
+            }
+            (ssoLoc "generic")
+          ];
+          useACMEHost = pubDomain;
+        }
+        (ssoServer "generic")
+      ];
+      "hass.${pubDomain}" = {
+        locations."/" = {
+          proxyPass = "http://hass-ctr.${home.domain}:8123";
+          proxyWebsockets = true;
+          extraConfig = proxyHeaders;
+        };
+        useACMEHost = pubDomain;
+      };
     };
 
     minio =

nixos/boxes/colony/vms/shill/containers/object.nix

@@ -33,7 +33,7 @@ in
         {
           fileSystems = {
             "/var/lib/harmonia" = {
-              device = "/mnt/atticd/harmonia";
+              device = "/mnt/nix-cache";
               options = [ "bind" ];
             };
           };
@@ -216,7 +216,7 @@ in
 
             atticd = {
               enable = false;
-              credentialsFile = config.age.secrets."object/atticd.env".path;
+              environmentFile = config.age.secrets."object/atticd.env".path;
               settings = {
                 listen = "[::]:8069";
                 allowed-hosts = [ "nix-cache.${pubDomain}" ];
@@ -237,7 +237,7 @@ in
 
             harmonia = {
               enable = true;
-              signKeyPath = config.age.secrets."nix-cache.key".path;
+              signKeyPaths = [ config.age.secrets."nix-cache.key".path ];
               settings = {
                 priority = 30;
               };

nixos/boxes/colony/vms/shill/containers/qclk/default.nix

@@ -0,0 +1,115 @@
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c.colony) domain prefixes qclk;
+in
+{
+  nixos.systems.qclk = { config, ... }: {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+    rendered = config.configuration.config.my.asContainer;
+
+    assignments = {
+      internal = {
+        name = "qclk-ctr";
+        inherit domain;
+        ipv4.address = net.cidr.host 10 prefixes.ctrs.v4;
+        ipv6 = {
+          iid = "::a";
+          address = net.cidr.host 10 prefixes.ctrs.v6;
+        };
+      };
+      qclk = {
+        ipv4 = {
+          address = net.cidr.host 1 prefixes.qclk.v4;
+          gateway = null;
+        };
+      };
+    };
+
+    configuration = { lib, pkgs, config, assignments, ... }:
+    let
+      inherit (lib) concatStringsSep mkMerge mkIf mkForce;
+      inherit (lib.my) networkdAssignment;
+
+      apiPort = 8080;
+
+      instances = [
+        {
+          host = 2;
+          wgKey = "D7z1FhcdxpnrGCE0wBW5PZb5BKuhCu6tcZ/5ZaYxdwQ=";
+        }
+      ];
+      ipFor = i: net.cidr.host i.host prefixes.qclk.v4;
+    in
+    {
+      config = {
+        environment = {
+          systemPackages = with pkgs; [
+            wireguard-tools
+          ];
+        };
+
+        my = {
+          deploy.enable = false;
+          server.enable = true;
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC1kcfvahYmSk8IJKaUIcGkhxf/8Yse2XnU7Qqgcglyq";
+            files = {
+              "qclk/wg.key" = {
+                group = "systemd-network";
+                mode = "440";
+              };
+            };
+          };
+
+          firewall = {
+            udp.allowed = [ qclk.wgPort ];
+            extraRules = ''
+              table inet filter {
+                chain input {
+                  iifname management tcp dport ${toString apiPort} accept
+                }
+                chain forward {
+                  iifname host0 oifname management ip saddr { ${concatStringsSep ", " lib.my.c.as211024.trusted.v4} } accept
+                }
+              }
+              table inet nat {
+                chain postrouting {
+                  iifname host0 oifname management snat ip to ${assignments.qclk.ipv4.address}
+                }
+              }
+            '';
+          };
+        };
+
+        systemd = {
+          network = {
+            netdevs."30-management" = {
+              netdevConfig = {
+                Name = "management";
+                Kind = "wireguard";
+              };
+              wireguardConfig = {
+                PrivateKeyFile = config.age.secrets."qclk/wg.key".path;
+                ListenPort = qclk.wgPort;
+              };
+              wireguardPeers = map (i: {
+                PublicKey = i.wgKey;
+                AllowedIPs = [ (ipFor i) ];
+              }) instances;
+            };
+            networks = {
+              "30-container-host0" = networkdAssignment "host0" assignments.internal;
+
+              "30-management" = networkdAssignment "management" assignments.qclk;
+            };
+          };
+        };
+
+        services = { };
+      };
+    };
+  };
+}

nixos/boxes/colony/vms/shill/containers/toot.nix

@@ -26,6 +26,8 @@ in
     let
       inherit (lib) mkMerge mkIf genAttrs;
       inherit (lib.my) networkdAssignment systemdAwaitPostgres;
+
+      pdsPort = 3000;
     in
     {
       config = mkMerge [
@@ -36,7 +38,7 @@ in
 
             secrets = {
               key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSslLkDe54AKYzxdtKD70zcU72W0EpYsfbdJ6UFq0QK";
-              files = genAttrs
+              files = (genAttrs
                 (map (f: "toot/${f}") [
                   "postgres-password.txt"
                   "secret-key.txt"
@@ -48,7 +50,12 @@ in
                 (_: with config.services.mastodon; {
                   owner = user;
                   inherit group;
-                });
+                })) // {
+                  "toot/pds.env" = {
+                    owner = "pds";
+                    group = "pds";
+                  };
+                };
             };
 
             firewall = {
@@ -56,6 +63,7 @@ in
                 19999
 
                 "http"
+                pdsPort
               ];
             };
           };
@@ -79,7 +87,7 @@ in
             netdata.enable = true;
             mastodon = mkMerge [
               rec {
-                enable = true;
+                enable = false;
                 localDomain = extraConfig.WEB_DOMAIN; # for nginx config
                 extraConfig = {
                   LOCAL_DOMAIN = "nul.ie";
@@ -87,7 +95,9 @@ in
                 };
 
                 secretKeyBaseFile = config.age.secrets."toot/secret-key.txt".path;
-                otpSecretFile = config.age.secrets."toot/otp-secret.txt".path;
+                # TODO: This was removed at some point.
+                # If we want to bring Mastodon back, this will probably need to be addressd.
+                # otpSecretFile = config.age.secrets."toot/otp-secret.txt".path;
                 vapidPrivateKeyFile = config.age.secrets."toot/vapid-key.txt".path;
                 vapidPublicKeyFile = toString (pkgs.writeText
                   "vapid-pubkey.txt"
@@ -155,6 +165,32 @@ in
                 };
               };
             };
+
+            bluesky-pds = {
+              enable = true;
+              environmentFiles = [ config.age.secrets."toot/pds.env".path ];
+              settings = {
+                PDS_HOSTNAME = "pds.nul.ie";
+                PDS_PORT = pdsPort;
+
+                PDS_BLOBSTORE_DISK_LOCATION = null;
+                PDS_BLOBSTORE_S3_BUCKET = "pds";
+                PDS_BLOBSTORE_S3_ENDPOINT = "https://s3.nul.ie/";
+                PDS_BLOBSTORE_S3_REGION = "eu-central-1";
+                PDS_BLOBSTORE_S3_ACCESS_KEY_ID = "pds";
+                PDS_BLOB_UPLOAD_LIMIT = "52428800";
+
+                PDS_EMAIL_FROM_ADDRESS = "pds@nul.ie";
+
+                PDS_DID_PLC_URL = "https://plc.directory";
+                PDS_INVITE_REQUIRED = 1;
+                PDS_BSKY_APP_VIEW_URL = "https://api.bsky.app";
+                PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";
+                PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";
+                PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";
+                PDS_CRAWLERS = "https://bsky.network";
+              };
+            };
           };
         }
         (mkIf config.my.build.isDevVM {

nixos/boxes/colony/vms/shill/containers/vaultwarden.nix

@@ -99,6 +99,8 @@ in
             };
 
             borgbackup.jobs.vaultwarden = {
+              readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];
+
               paths = [ vwData ];
               repo = "zh2855@zh2855.rsync.net:borg/vaultwarden2";
               doInit = true;

nixos/boxes/colony/vms/shill/containers/waffletail.nix

@@ -86,7 +86,7 @@ in
             interfaceName = "tailscale0";
             extraUpFlags = [
               "--operator=${config.my.user.config.name}"
-              "--login-server=https://ts.nul.ie"
+              "--login-server=https://hs.nul.ie"
               "--netfilter-mode=off"
               "--advertise-exit-node"
               "--advertise-routes=${advRoutes}"

nixos/boxes/colony/vms/shill/default.nix

@@ -94,8 +94,8 @@ in
                 device = "/dev/disk/by-label/minio";
                 fsType = "xfs";
               };
-              "/mnt/atticd" = {
-                device = "/dev/disk/by-label/atticd";
+              "/mnt/nix-cache" = {
+                device = "/dev/disk/by-label/nix-cache";
                 fsType = "ext4";
               };
             };
@@ -140,10 +140,10 @@ in
                     };
                     ipv6Prefixes = [
                       {
-                        ipv6PrefixConfig.Prefix = prefixes.ctrs.v6;
+                        Prefix = prefixes.ctrs.v6;
                       }
                     ];
-                    routes = map (r: { routeConfig = r; }) [
+                    routes = [
                       {
                         Destination = lib.my.c.tailscale.prefix.v4;
                         Gateway = allAssignments.waffletail.internal.ipv4.address;
@@ -152,6 +152,11 @@ in
                         Destination = lib.my.c.tailscale.prefix.v6;
                         Gateway = allAssignments.waffletail.internal.ipv6.address;
                       }
+
+                      {
+                        Destination = prefixes.qclk.v4;
+                        Gateway = allAssignments.qclk.internal.ipv4.address;
+                      }
                     ];
                   }
                 ];
@@ -206,11 +211,12 @@ in
                   object = {
                     bindMounts = {
                       "/mnt/minio".readOnly = false;
-                      "/mnt/atticd".readOnly = false;
+                      "/mnt/nix-cache".readOnly = false;
                     };
                   };
                   toot = {};
                   waffletail = {};
+                  qclk = {};
                 };
               in
               mkMerge [

nixos/boxes/colony/vms/whale2/default.nix

@@ -52,6 +52,9 @@ in
       valheim-oci = 2;
       simpcraft-oci = 3;
       simpcraft-staging-oci = 4;
+      enshrouded-oci = 5;
+      kevcraft-oci = 6;
+      kinkcraft-oci = 7;
     };
 
     configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -66,6 +69,7 @@ in
 
           ./valheim.nix
           ./minecraft
+          # ./enshrouded.nix
         ];
 
         config = mkMerge [

nixos/boxes/colony/vms/whale2/enshrouded.nix

@@ -0,0 +1,35 @@
+{ lib, config, allAssignments, ... }:
+let
+  inherit (lib) concatStringsSep;
+  inherit (lib.my) dockerNetAssignment;
+in
+{
+  config = {
+    virtualisation.oci-containers.containers = {
+      enshrouded = {
+        image = "sknnr/enshrouded-dedicated-server@sha256:f163e8ba9caa2115d8a0a7b16c3696968242fb6fba82706d9a77a882df083497";
+
+        environment = {
+          SERVER_NAME = "UWUshrouded";
+          # SERVER_IP = "::"; # no IPv6?? :(
+          TZ = "Europe/Dublin";
+        };
+        environmentFiles = [ config.age.secrets."whale2/enshrouded.env".path ];
+
+        volumes = [
+          "enshrouded:/home/steam/enshrouded/savegame"
+        ];
+
+        extraOptions = [
+          ''--network=colony:${dockerNetAssignment allAssignments "enshrouded-oci"}''
+        ];
+      };
+    };
+
+    my = {
+      secrets.files = {
+        "whale2/enshrouded.env" = {};
+      };
+    };
+  };
+}

nixos/boxes/colony/vms/whale2/minecraft/default.nix

@@ -5,12 +5,13 @@ let
 
   # devplayer0
   op = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
+  kev = "703b378a-09f9-4c1d-9876-1c9305728c49";
   whitelist = concatStringsSep "," [
     op
     "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56" # Elderlypug
     "fcb26db2-c3ce-41aa-b588-efec79d37a8a" # Jesthral_
     "1d366062-12c0-4e29-aba7-6ab5d8c6bb05" # shr3kas0ras
-    "703b378a-09f9-4c1d-9876-1c9305728c49" # OROURKEIRE
+    kev
     "f105bbe6-eda6-4a13-a8cf-894e77cab77b" # Adzerq
     "1fc94979-41fb-497a-81e9-34ae24ca537a" # johnnyscrims
     "d53c91df-b6e6-4463-b106-e8427d7a8d01" # BossLonus
@@ -104,6 +105,87 @@ in
       #     ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
       #   ];
       # };
+
+      kevcraft = {
+        # 2025.2.1-java21-alpine
+        image = "itzg/minecraft-server@sha256:57e319c15e9fee63f61029a65a33acc3de85118b21a2b4bb29f351cf4a915027";
+
+        environment = {
+          TYPE = "VANILLA";
+          VERSION = "1.20.1";
+          SERVER_PORT = "25567";
+          QUERY_PORT = "25567";
+
+          EULA = "true";
+          ENABLE_QUERY = "true";
+          ENABLE_RCON = "true";
+          MOTD = "§4§k----- §9K§ae§bv§cc§dr§ea§ff§6t §4§k-----";
+          ICON = "/ext/icon.png";
+
+          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
+          WHITELIST = whitelist;
+          EXISTING_OPS_FILE = "SYNCHRONIZE";
+          OPS = concatStringsSep "," [ op kev ];
+          DIFFICULTY = "normal";
+          SPAWN_PROTECTION = "0";
+          # VIEW_DISTANCE = "20";
+
+          MAX_MEMORY = "4G";
+
+          TZ = "Europe/Dublin";
+        };
+        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
+
+        volumes = [
+          "kevcraft_data:/data"
+          "${./kev.png}:/ext/icon.png:ro"
+        ];
+
+        extraOptions = [
+          ''--network=colony:${dockerNetAssignment allAssignments "kevcraft-oci"}''
+        ];
+      };
+
+      kinkcraft = {
+        # 2025.5.1-java21-alpine
+        image = "itzg/minecraft-server@sha256:de26c7128e3935f3be48fd30283f0b5a6da1b3d9f1a10c9f92502ee1ba072f7b";
+
+        environment = {
+          TYPE = "MODRINTH";
+          SERVER_PORT = "25568";
+          QUERY_PORT = "25568";
+
+          EULA = "true";
+          ENABLE_QUERY = "true";
+          ENABLE_RCON = "true";
+          MOTD = "§4§k----- §9K§ai§bn§ck§dc§er§fa§6f§5t §4§k-----";
+          ICON = "/ext/icon.png";
+
+          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
+          WHITELIST = whitelist;
+          EXISTING_OPS_FILE = "SYNCHRONIZE";
+          OPS = op;
+          DIFFICULTY = "normal";
+          SPAWN_PROTECTION = "0";
+          VIEW_DISTANCE = "20";
+
+          MAX_MEMORY = "6G";
+          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/NGutsQSd/Simpcraft-0.2.1.mrpack";
+
+          TZ = "Europe/Dublin";
+        };
+        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
+
+        volumes = [
+          "kinkcraft_data:/data"
+          "${./icon.png}:/ext/icon.png:ro"
+        ];
+
+        extraOptions = [
+          ''--network=colony:${dockerNetAssignment allAssignments "kinkcraft-oci"}''
+        ];
+      };
+
     };
 
     services = {
@@ -123,6 +205,7 @@ in
           within = "12H";
           hourly = 48;
         };
+        readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];
 
         # Avoid Minecraft poking the files while we back up
         preHook = rconCommand "save-off";

nixos/boxes/home/castle/default.nix

@@ -36,7 +36,7 @@ in
           cpu = {
             amd.updateMicrocode = true;
           };
-          opengl.extraPackages = with pkgs; [
+          graphics.extraPackages = with pkgs; [
             intel-media-driver
           ];
           bluetooth.enable = true;
@@ -75,6 +75,8 @@ in
               };
             };
           };
+
+          binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
         };
 
         fileSystems = {
@@ -148,10 +150,15 @@ in
           mstflint
           qperf
           ethtool
+          android-tools
         ];
 
         nix = {
           gc.automatic = false;
+          settings = {
+            experimental-features = [ "recursive-nix" ];
+            system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" "recursive-nix" ];
+          };
         };
 
         systemd = {

nixos/boxes/home/palace/vms/default.nix

@@ -188,6 +188,13 @@
                 hostBDF = "44:00.4";
               };
             };
+            qemuFlags = [
+              "device qemu-xhci,id=xhci"
+              # Front-right port?
+              "device usb-host,hostbus=1,hostport=4"
+              # Front-left port
+              "device usb-host,hostbus=1,hostport=3"
+            ];
           };
         };
       };

nixos/boxes/home/palace/vms/sfh/containers/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
     ./unifi.nix
+    ./hass.nix
   ];
 }

nixos/boxes/home/palace/vms/sfh/containers/hass.nix

@@ -0,0 +1,262 @@
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.c) pubDomain;
+  inherit (lib.my.c.home) domain prefixes vips hiMTU;
+in
+{
+  nixos.systems.hass = { config, ... }: {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+    rendered = config.configuration.config.my.asContainer;
+
+    assignments = {
+      hi = {
+        name = "hass-ctr";
+        altNames = [ "frigate" ];
+        inherit domain;
+        mtu = hiMTU;
+        ipv4 = {
+          address = net.cidr.host 103 prefixes.hi.v4;
+          mask = 22;
+          gateway = vips.hi.v4;
+        };
+        ipv6 = {
+          iid = "::5:3";
+          address = net.cidr.host (65536*5+3) prefixes.hi.v6;
+        };
+      };
+      lo = {
+        name = "hass-ctr-lo";
+        inherit domain;
+        mtu = 1500;
+        ipv4 = {
+          address = net.cidr.host 103 prefixes.lo.v4;
+          mask = 21;
+          gateway = null;
+        };
+        ipv6 = {
+          iid = "::5:3";
+          address = net.cidr.host (65536*5+3) prefixes.lo.v6;
+        };
+      };
+    };
+
+    configuration = { lib, config, pkgs, assignments, allAssignments, ... }:
+    let
+      inherit (lib) mkMerge mkIf mkForce;
+      inherit (lib.my) networkdAssignment;
+
+      hassCli = pkgs.writeShellScriptBin "hass-cli" ''
+        export HASS_SERVER="http://localhost:${toString config.services.home-assistant.config.http.server_port}"
+        export HASS_TOKEN="$(< ${config.age.secrets."hass/cli-token.txt".path})"
+        exec ${pkgs.home-assistant-cli}/bin/hass-cli "$@"
+      '';
+    in
+    {
+      config = {
+        my = {
+          deploy.enable = false;
+          server.enable = true;
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpYX2WbYwUqHp8bFFf0eHFrqrR8xp8IheguA054F8V4";
+            files = {
+              "hass/cli-token.txt" = {
+                owner = config.my.user.config.name;
+              };
+            };
+          };
+
+          firewall = {
+            tcp.allowed = [ "http" 1883 ];
+          };
+        };
+
+        environment = {
+          systemPackages = with pkgs; [
+            usbutils
+            hassCli
+          ];
+        };
+
+        systemd = {
+          network.networks = {
+            "80-container-host0" = networkdAssignment "host0" assignments.hi;
+            "80-container-lan-lo" = networkdAssignment "lan-lo" assignments.lo;
+          };
+        };
+
+        services = {
+          mosquitto = {
+            enable = true;
+            listeners = [
+              {
+                omitPasswordAuth = true;
+                settings = {
+                  allow_anonymous = true;
+                };
+              }
+            ];
+          };
+
+          go2rtc = {
+            enable = true;
+            settings = {
+              streams = {
+                reolink_living_room = [
+                  # "http://reolink-living-room.${domain}/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=admin#video=copy#audio=copy#audio=opus"
+                  "rtsp://admin:@reolink-living-room:554/h264Preview_01_main"
+                ];
+                webcam_office = [
+                  "ffmpeg:device?video=/dev/video0&video_size=1024x576#video=h264"
+                ];
+              };
+            };
+          };
+
+          frigate = {
+            enable = true;
+            hostname = "frigate.${domain}";
+            settings = {
+              mqtt = {
+                enabled = true;
+                host = "localhost";
+                topic_prefix = "frigate";
+              };
+
+              cameras = {
+                reolink_living_room = {
+                  ffmpeg.inputs = [
+                    {
+                      path = "rtsp://127.0.0.1:8554/reolink_living_room";
+                      input_args = "preset-rtsp-restream";
+                      roles = [ "record" "detect" ];
+                    }
+                  ];
+                  detect = {
+                    enabled = false;
+                  };
+                  record = {
+                    enabled = true;
+                    retain.days = 1;
+                  };
+                };
+
+                webcam_office = {
+                  ffmpeg.inputs = [
+                    {
+                      path = "rtsp://127.0.0.1:8554/webcam_office";
+                      input_args = "preset-rtsp-restream";
+                      roles = [ "record" "detect" ];
+                    }
+                  ];
+                  detect.enabled = false;
+                  record = {
+                    enabled = true;
+                    retain.days = 1;
+                  };
+                };
+              };
+            };
+          };
+
+          home-assistant =
+          let
+            cfg = config.services.home-assistant;
+
+            pyirishrail = ps: ps.buildPythonPackage rec {
+              pname = "pyirishrail";
+              version = "0.0.2";
+              src = pkgs.fetchFromGitHub {
+                owner = "ttroy50";
+                repo = "pyirishrail";
+                tag = version;
+                hash = "sha256-NgARqhcXP0lgGpgBRiNtQaSn9JcRNtCcZPljcL7t3Xc=";
+              };
+
+              dependencies = with ps; [
+                requests
+              ];
+
+              pyproject = true;
+              build-system = [ ps.setuptools ];
+            };
+          in
+          {
+            enable = true;
+
+            extraComponents = [
+              "default_config"
+              "esphome"
+              "google_translate"
+
+              "met"
+              "zha"
+              "denonavr"
+              "webostv"
+              "androidtv_remote"
+              "heos"
+              "mqtt"
+              "wled"
+            ];
+            extraPackages = python3Packages: with python3Packages; [
+              zlib-ng
+              isal
+
+              gtts
+              (pyirishrail python3Packages)
+            ];
+            customComponents = with pkgs.home-assistant-custom-components; [
+              alarmo
+              frigate
+            ];
+
+            configWritable = false;
+            openFirewall = true;
+            config = {
+              default_config = {};
+              homeassistant = {
+                name = "Home";
+                unit_system = "metric";
+                currency = "EUR";
+                country = "IE";
+                time_zone = "Europe/Dublin";
+                external_url = "https://hass.${pubDomain}";
+                internal_url = "http://hass-ctr.${domain}:${toString cfg.config.http.server_port}";
+              };
+              http = {
+                use_x_forwarded_for = true;
+                trusted_proxies = with allAssignments.middleman.internal; [
+                  ipv4.address
+                  ipv6.address
+                ];
+                ip_ban_enabled = false;
+              };
+              automation = "!include automations.yaml";
+              script = "!include scripts.yaml";
+              scene = "!include scenes.yaml";
+
+              sensor = [
+                {
+                  platform = "irish_rail_transport";
+                  name = "To Work from Home";
+                  station = "Glenageary";
+                  stops_at = "Dublin Connolly";
+                  direction = "Northbound";
+                }
+                {
+                  platform = "irish_rail_transport";
+                  name = "To Home from Work";
+                  station = "Dublin Connolly";
+                  stops_at = "Glenageary";
+                  direction = "Southbound";
+                }
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

nixos/boxes/home/palace/vms/sfh/containers/unifi.nix

@@ -55,7 +55,8 @@ in
           unifi = {
             enable = true;
             openFirewall = true;
-            unifiPackage = pkgs.unifi8;
+            unifiPackage = pkgs.unifi;
+            mongodbPackage = pkgs.mongodb-7_0;
           };
         };
       };

nixos/boxes/home/palace/vms/sfh/default.nix

@@ -29,7 +29,7 @@ in
 
     configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
     let
-      inherit (lib) mapAttrs mkMerge;
+      inherit (lib) mapAttrs mkMerge mkForce;
       inherit (lib.my) networkdAssignment;
       inherit (lib.my.c) networkd;
       inherit (lib.my.c.home) domain;
@@ -83,6 +83,12 @@ in
           };
         };
 
+        environment = {
+          systemPackages = with pkgs; [
+            usbutils
+          ];
+        };
+
         systemd.network = {
           links = {
             "10-lan-hi" = {
@@ -105,6 +111,13 @@ in
                 MTUBytes = toString lib.my.c.home.hiMTU;
               };
             };
+            "10-lan-lo-ctrs" = {
+              matchConfig = {
+                Driver = "virtio_net";
+                PermanentMACAddress = "52:54:00:a5:7e:93";
+              };
+              linkConfig.Name = "lan-lo-ctrs";
+            };
           };
 
           networks = {
@@ -118,8 +131,28 @@ in
               linkConfig.RequiredForOnline = "no";
               networkConfig = networkd.noL3;
             };
+            "30-lan-lo-ctrs" = {
+              matchConfig.Name = "lan-lo-ctrs";
+              linkConfig.RequiredForOnline = "no";
+              networkConfig = networkd.noL3;
             };
           };
+        };
+
+        systemd.nspawn = {
+          hass = {
+            networkConfig = {
+              MACVLAN = mkForce "lan-hi-ctrs:host0 lan-lo-ctrs:lan-lo";
+            };
+          };
+        };
+
+        systemd.services = {
+          "systemd-nspawn@hass".serviceConfig.DeviceAllow = [
+            "char-ttyUSB rw"
+            "char-video4linux rw"
+          ];
+        };
 
         my = {
           secrets = {
@@ -141,7 +174,17 @@ in
           containers.instances =
           let
             instances = {
-              unifi = {};
+              # unifi = {};
+              hass = {
+                bindMounts = {
+                  "/dev/bus/usb/001/002".readOnly = false;
+                  "/dev/video0".readOnly = false;
+                  "/dev/serial/by-id/usb-Nabu_Casa_Home_Assistant_Connect_ZBT-1_ce549704fe38ef11a2c2e5d154516304-if00-port0" = {
+                    readOnly = false;
+                    mountPoint = "/dev/ttyUSB0";
+                  };
+                };
+              };
             };
           in
           mkMerge [

nixos/boxes/home/routing-common/default.nix

@@ -141,8 +141,8 @@ in
                   onState = [ "configured" ];
                   script = ''
                   #!${pkgs.runtimeShell}
-                  if [ $IFACE = "wan-ifb" ]; then
-                    ${pkgs.iproute2}/bin/tc filter add dev wan parent ffff: matchall action mirred egress redirect dev $IFACE
+                  if [ "$IFACE" = "wan-ifb" ]; then
+                    ${pkgs.iproute2}/bin/tc filter add dev wan parent ffff: matchall action mirred egress redirect dev "$IFACE"
                   fi
                   '';
                 };
@@ -227,7 +227,7 @@ in
                   networkConfig = networkd.noL3;
                   extraConfig = ''
                     [CAKE]
-                    Bandwidth=235M
+                    Bandwidth=490M
                     RTTSec=50ms
                     PriorityQueueingPreset=besteffort
                     # DOCSIS preset
@@ -251,7 +251,7 @@ in
                     extraConfig = ''
                       [CAKE]
                       Parent=root
-                      Bandwidth=24M
+                      Bandwidth=48M
                       RTTSec=50ms
                     '';
                   }
@@ -276,7 +276,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = map (r: { routeConfig = r; }) [
+                    routes = [
                       {
                         Destination = lib.my.c.colony.prefixes.all.v4;
                         Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -301,7 +301,7 @@ in
 
               {
                 "60-lan-hi" = {
-                  routes = map (r: { routeConfig = r; }) [
+                  routes = [
                     {
                       Destination = elemAt routersPubV4 otherIndex;
                       Gateway = net.cidr.host (otherIndex + 1) prefixes.hi.v4;

nixos/boxes/home/routing-common/dns-blocklist.txt

@@ -0,0 +1,74 @@
+# Blocklist for LG WebOS Services (US)
+ad.lgappstv.com
+ibis.lgappstv.com
+info.lgsmartad.com
+lgtvsdp.com
+ngfts.lge.com
+rdx2.lgtvsdp.com
+smartshare.lgtvsdp.com
+lgappstv.com
+us.ad.lgsmartad.com
+us.ibs.lgappstv.com
+us.info.lgsmartad.com
+us.lgtvsdp.com
+
+# Community Contributions
+lgad.cjpowercast.com
+edgesuite.net
+yumenetworks.com
+smartclip.net
+smartclip.com
+
+# Non-US Entries
+rdx2.lgtvsdp.com
+info.lgsmartad.com
+ibs.lgappstv.com
+lgtvsdp.com
+lgappstv.com
+smartshare.lgtvsdp.com
+
+# Full Block for Europe and Other Regions
+de.ad.lgsmartad.com
+de.emp.lgsmartplatform.com
+de.ibs.lgappstv.com
+de.info.lgsmartad.com
+de.lgeapi.com
+de.lgtvsdp.com
+de.rdx2.lgtvsdp.com
+eu.ad.lgsmartad.com
+eu.ibs.lgappstv.com
+eu.info.lgsmartad.com
+app-lgwebos.pluto.tv
+it.lgtvsdp.com
+it.lgeapi.com
+it.emp.lgsmartplatform.com
+
+# LG ThinQ Services
+eic.common.lgthinq.com
+eic.iotservice.lgthinq.com
+eic.service.lgthinq.com
+eic.ngfts.lge.com
+eic.svc-lgthinq-com.aws-thinq-prd.net
+eic.cdpsvc.lgtvcommon.com
+eic.cdpbeacon.lgtvcommon.com
+eic.cdplauncher.lgtvcommon.com
+eic.homeprv.lgtvcommon.com
+eic.lgtviot.com
+eic.nudge.lgtvcommon.com
+eic.rdl.lgtvcommon.com
+eic.recommend.lgtvcommon.com
+eic.service.lgtvcommon.com
+gb-lgeapi-com.esi-prd.net
+gb.lgeapi.com
+lgtvonline.lge.com
+lg-channelplus-de-beacons.xumo.com
+lg-channelplus-de-mds.xumo.com
+lg-channelplus-eu-beacons.xumo.com
+lg-channelplus-eu-mds.xumo.com
+kr-op-v2.lgthinqhome.com
+ngfts.lge.com
+noti.lgthinq.com
+objectcontent.lgthinq.com
+
+# Update Server Block
+#snu.lge.com

nixos/boxes/home/routing-common/dns.nix

@@ -19,7 +19,7 @@ in
           owner = "pdns";
           group = "pdns";
         };
-        "home/pdns/recursor.conf" = {
+        "home/pdns/recursor.yml" = {
           owner = "pdns-recursor";
           group = "pdns-recursor";
         };
@@ -28,53 +28,79 @@ in
 
       pdns.recursor = {
         enable = true;
-        extraSettingsFile = config.age.secrets."home/pdns/recursor.conf".path;
+        extraSettingsFile = config.age.secrets."home/pdns/recursor.yml".path;
       };
     };
 
     services = {
       pdns-recursor = {
-        dns = {
-          address = [
+        yaml-settings = {
+          incoming = {
+            listen = [
               "127.0.0.1" "::1"
               assignments.hi.ipv4.address assignments.hi.ipv6.address
               assignments.lo.ipv4.address assignments.lo.ipv6.address
             ];
-          allowFrom = [
+            allow_from = [
               "127.0.0.0/8" "::1/128"
               prefixes.hi.v4 prefixes.hi.v6
               prefixes.lo.v4 prefixes.lo.v6
             ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
-        };
-
-        settings = {
-          query-local-address = [
-            "0.0.0.0"
-            "::"
-          ];
-          forward-zones = map (z: "${z}=127.0.0.1:5353") authZones;
 
             # DNS NOTIFY messages override TTL
-          allow-notify-for = authZones;
-          allow-notify-from = [ "127.0.0.0/8" "::1/128" ];
+            allow_notify_for = authZones;
+            allow_notify_from = [ "127.0.0.0/8" "::1/128" ];
+          };
 
-          webserver = true;
-          webserver-address = "::";
-          webserver-allow-from = [ "127.0.0.1" "::1" ];
+          outgoing = {
+            source_address = [ "0.0.0.0" "::" ];
+          };
+
+          recursor = {
+            forward_zones = map (z: {
+              zone = z;
+              forwarders = [ "127.0.0.1:5353" ];
+            }) authZones;
+
+            lua_dns_script = pkgs.writeText "pdns-script.lua" ''
+              blocklist = newDS()
 
-          lua-dns-script = pkgs.writeText "pdns-script.lua" ''
-            -- Disney+ doesn't like our IP space...
               function preresolve(dq)
                 local name = dq.qname:toString()
+
+                -- Disney+ doesn't like our IP space...
                 if dq.qtype == pdns.AAAA and (string.find(name, "disneyplus") or string.find(name, "disney-plus") or string.find(name , "disney.api")) then
                   dq.rcode = 0
                   return true
                 end
 
+                if blocklist:check(dq.qname) then
+                  if dq.qtype == pdns.A then
+                    dq:addAnswer(dq.qtype, "127.0.0.1")
+                  elseif dq.qtype == pdns.AAAA then
+                    dq:addAnswer(dq.qtype, "::1")
+                  end
+                  return true
+                end
+
                 return false
               end
+
+              for line in io.lines("${./dns-blocklist.txt}") do
+                entry = line:gsub("%s+", "")
+                if entry ~= "" and string.sub(entry, 1, 1) ~= "#" then
+                  blocklist:add(entry)
+                end
+              end
             '';
           };
+
+          webservice = {
+            webserver = true;
+            address = "::";
+            allow_from = [ "127.0.0.1" "::1" ];
+          };
+        };
       };
     };
 
@@ -170,8 +196,8 @@ in
               hostname = "${otherName}.${config.networking.domain}";
               server = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
             }}
-            ${elemAt routers 0} IN AAAA ${net.cidr.host 1 prefixes.hi.v6}
-            ${elemAt routers 1} IN AAAA ${net.cidr.host 2 prefixes.hi.v6}
+            ${elemAt routers 0} IN AAAA ${allAssignments."${elemAt routers 0}".as211024.ipv6.address}
+            ${elemAt routers 1} IN AAAA ${allAssignments."${elemAt routers 1}".as211024.ipv6.address}
             boot IN CNAME river-hi.${config.networking.domain}.
 
             @ IN NS ns1
@@ -206,6 +232,9 @@ in
             ups IN A ${net.cidr.host 20 prefixes.lo.v4}
             palace-kvm IN A ${net.cidr.host 21 prefixes.lo.v4}
 
+            reolink-living-room IN A ${net.cidr.host 45 prefixes.lo.v4}
+            nixlight IN A ${net.cidr.host 46 prefixes.lo.v4}
+
             ${lib.my.dns.fwdRecords {
               inherit allAssignments names;
               domain = config.networking.domain;

nixos/boxes/home/routing-common/dns_update.py

@@ -2,7 +2,7 @@
 import argparse
 import subprocess
 
-import CloudFlare
+import cloudflare
 
 def main():
     parser = argparse.ArgumentParser(description='Cloudflare DNS update script')
@@ -19,17 +19,22 @@ def main():
     if args.api_token_file:
         with open(args.api_token_file) as f:
             cf_token = f.readline().strip()
+    cf = cloudflare.Cloudflare(api_token=cf_token)
 
-    cf = CloudFlare.CloudFlare(token=cf_token)
-    zones = cf.zones.get(params={'name': args.zone})
+    zones = list(cf.zones.list(name=args.zone))
     assert zones, f'Zone {args.zone} not found'
-    records = cf.zones.dns_records.get(zones[0]['id'], params={'name': args.record})
+    assert len(zones) == 1, f'More than one zone found for {args.zone}'
+    zone = zones[0]
+
+    records = list(cf.dns.records.list(zone_id=zone.id, name=args.record, type='A'))
     assert records, f'Record {args.record} not found in zone {args.zone}'
+    assert len(records) == 1, f'More than one record found for {args.record}'
+    record = records[0]
 
     print(f'Updating {args.record} -> {address}')
-    cf.zones.dns_records.patch(
-        zones[0]['id'], records[0]['id'],
-        data={'type': 'A', 'name': args.record, 'content': address})
+    cf.dns.records.edit(
+        zone_id=zone.id, dns_record_id=record.id,
+        type='A', content=address)
 
 if __name__ == '__main__':
     main()

nixos/boxes/home/routing-common/kea.nix

@@ -132,6 +132,37 @@ in
                   hw-address = "24:8a:07:a8:fe:3a";
                   ip-address = net.cidr.host 40 prefixes.lo.v4;
                 }
+
+                {
+                  # avr
+                  hw-address = "8c:a9:6f:30:03:6b";
+                  ip-address = net.cidr.host 41 prefixes.lo.v4;
+                }
+                {
+                  # tv
+                  hw-address = "00:a1:59:b8:4d:86";
+                  ip-address = net.cidr.host 42 prefixes.lo.v4;
+                }
+                {
+                  # android tv
+                  hw-address = "b8:7b:d4:95:c6:74";
+                  ip-address = net.cidr.host 43 prefixes.lo.v4;
+                }
+                {
+                  # hass-panel
+                  hw-address = "80:30:49:cd:d7:51";
+                  ip-address = net.cidr.host 44 prefixes.lo.v4;
+                }
+                {
+                  # reolink-living-room
+                  hw-address = "ec:71:db:30:69:a4";
+                  ip-address = net.cidr.host 45 prefixes.lo.v4;
+                }
+                {
+                  # nixlight
+                  hw-address = "00:4b:12:3b:d3:14";
+                  ip-address = net.cidr.host 46 prefixes.lo.v4;
+                }
               ];
             }
           ];

nixos/boxes/home/routing-common/mstpd.nix

@@ -24,8 +24,8 @@ in
         onState = [ "routable" ];
         script = ''
           #!${pkgs.runtimeShell}
-          if [ $IFACE = "lan" ]; then
-            ${mstpd}/sbin/mstpctl setforcevers $IFACE rstp
+          if [ "$IFACE" = "lan" ]; then
+            ${mstpd}/sbin/mstpctl setforcevers "$IFACE" rstp
           fi
         '';
       };

nixos/boxes/home/stream.nix

@@ -43,6 +43,38 @@
           };
         };
 
+        services = {
+          mjpg-streamer = {
+            enable = false;
+            inputPlugin = "input_uvc.so";
+            outputPlugin = "output_http.so -w @www@ -n -p 5050";
+          };
+          octoprint = {
+            enable = false;
+            host = "::";
+            extraConfig = {
+              plugins = {
+                classicwebcam = {
+                  snapshot = "/webcam/?action=snapshot";
+                  stream = "/webcam/?action=stream";
+                  streamRatio = "4:3";
+                };
+              };
+              serial = {
+                port = "/dev/ttyACM0";
+                baudrate = 115200;
+              };
+              temperature.profiles = [
+                {
+                  bed = 60;
+                  extruder = 215;
+                  name = "PLA";
+                }
+              ];
+            };
+          };
+        };
+
         systemd.network = {
           netdevs = {
             "25-lan" = {

nixos/boxes/kelder/containers/acquisition/default.nix

@@ -26,7 +26,7 @@ in
 
       config = {
         # Hardware acceleration for Jellyfin
-        hardware.opengl = {
+        hardware.graphics = {
           enable = true;
           extraPackages = with pkgs; [
             vaapiIntel
@@ -78,6 +78,14 @@ in
           };
         };
 
+        nixpkgs.config.permittedInsecurePackages = [
+          # FIXME: This is needed for Sonarr
+          "aspnetcore-runtime-wrapped-6.0.36"
+          "aspnetcore-runtime-6.0.36"
+          "dotnet-sdk-wrapped-6.0.428"
+          "dotnet-sdk-6.0.428"
+        ];
+
         services = {
           transmission = {
             enable = true;

nixos/boxes/kelder/containers/acquisition/networking.nix

@@ -73,14 +73,12 @@ in
               RouteTable = routeTable;
             };
             wireguardPeers = [
-              {
               # AirVPN IE
-                wireguardPeerConfig = {
+              {
                 Endpoint = "146.70.94.2:1637";
                 PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
                 PresharedKeyFile = config.age.secrets."${pskFile}".path;
                 AllowedIPs = [ "0.0.0.0/0" "::/0" ];
-                };
               }
             ];
           };
@@ -97,7 +95,7 @@ in
               matchConfig.Name = "vpn";
               address = [ "10.161.170.28/32" "fd7d:76ee:e68f:a993:b12d:6d15:c80a:9516/128" ];
               dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+              routingPolicyRules = [
                 {
                   Family = "both";
                   SuppressPrefixLength = 0;

nixos/boxes/kelder/containers/spoder/default.nix

@@ -92,12 +92,14 @@ in
 
           nextcloud = {
             enable = true;
-            package = pkgs.nextcloud29;
+            # TODO: Might need to do some bullshit to go from Nextcloud 28 (?) to 30
+            package = pkgs.nextcloud30;
             datadir = "/mnt/storage/nextcloud";
             hostName = "cloud.${domain}";
             https = true;
             config = {
               adminpassFile = config.age.secrets."kelder/nextcloud-root.txt".path;
+              dbtype = "sqlite";
             };
             settings = {
               updatechecker = false;

nixos/boxes/kelder/default.nix

@@ -121,8 +121,7 @@ in
 
             samba = {
               enable = true;
-              enableNmbd = true;
-              shares = {
+              settings = {
                 storage = {
                   path = "/mnt/storage";
                   browseable = "yes";
@@ -131,6 +130,8 @@ in
                   "directory mask" = "0775";
                 };
               };
+
+              nmbd.enable = true;
             };
             samba-wsdd.enable = true;
 
@@ -180,12 +181,10 @@ in
                   };
                   wireguardPeers = [
                     {
-                      wireguardPeerConfig = {
                       PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
                       Endpoint = "${allAssignments.estuary.internal.ipv4.address}:${toString lib.my.c.kelder.vpn.port}";
                       AllowedIPs = [ "0.0.0.0/0" ];
                       PersistentKeepalive = 25;
-                      };
                     }
                   ];
                 };
@@ -213,7 +212,7 @@ in
                   address = with assignments.estuary; [
                     (with ipv4; "${address}/${toString mask}")
                   ];
-                  routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+                  routingPolicyRules = [
                     {
                       Family = "both";
                       SuppressPrefixLength = 0;

nixos/boxes/tower/default.nix

@@ -14,7 +14,7 @@
           cpu = {
             intel.updateMicrocode = true;
           };
-          opengl.extraPackages = with pkgs; [
+          graphics.extraPackages = with pkgs; [
             intel-media-driver
           ];
           bluetooth.enable = true;
@@ -177,7 +177,7 @@
               programs = {
                 fish = {
                   shellAbbrs = {
-                    tsup = "doas tailscale up --login-server=https://ts.nul.ie --accept-routes";
+                    tsup = "doas tailscale up --login-server=https://hs.nul.ie --accept-routes";
                   };
                 };
               };

nixos/default.nix

@@ -23,7 +23,7 @@ let
       pkgs = pkgs'.${config'.nixpkgs}.${config'.system};
       allPkgs = mapAttrs (_: p: p.${config'.system}) pkgs';
 
-      modules' = [ hmFlakes.${config'.home-manager}.nixosModule ] ++ (attrValues cfg.modules);
+      modules' = [ hmFlakes.${config'.home-manager}.nixosModules.default ] ++ (attrValues cfg.modules);
     in
     # Import eval-config ourselves since the flake now force-sets lib
     import "${pkgsFlake}/nixos/lib/eval-config.nix" {
@@ -35,7 +35,7 @@ let
       system = null;
 
       # Put the inputs in specialArgs to avoid infinite recursion when modules try to do imports
-      specialArgs = { inherit inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
+      specialArgs = { inherit self inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
 
       # `baseModules` informs the manual which modules to document
       baseModules =

nixos/installer.nix

@@ -31,8 +31,10 @@
             server.enable = true;
           };
 
+          image = {
+            baseName = "jackos-installer";
+          };
           isoImage = {
-            isoBaseName = "jackos-installer";
             volumeID = "jackos-${config.system.nixos.release}-${pkgs.stdenv.hostPlatform.uname.processor}";
             edition = "devplayer0";
             appendToMenuLabel = " /dev/player0 Installer";
@@ -61,8 +63,8 @@
           };
 
           networking = {
-            # Will be set dynamically
-            hostName = "";
+            # Will be set dynamically, but need something to satisfy `/etc/os-release` stuff
+            hostName = "installer";
             useNetworkd = false;
           };
 

nixos/modules/_list.nix

@@ -14,7 +14,7 @@
     network = ./network.nix;
     pdns = ./pdns.nix;
     nginx-sso = ./nginx-sso.nix;
-    gui = ./gui.nix;
+    gui = ./gui;
     l2mesh = ./l2mesh.nix;
     borgthin = ./borgthin.nix;
     nvme = ./nvme;

nixos/modules/borgthin.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, config, ... }:
+{ inputs, lib, pkgs, config, ... }:
 let
   inherit (builtins) substring match;
   inherit (lib)
@@ -127,7 +127,9 @@ in
     enable = mkBoolOpt' false "Whether to enable borgthin jobs";
     lvmPackage = mkOpt' package pkgs.lvm2 "Packge containing LVM tools";
     thinToolsPackage = mkOpt' package pkgs.thin-provisioning-tools "Package containing thin-provisioning-tools";
-    package = mkOpt' package pkgs.borgthin "borgthin package";
+    # Really we should use the version from the overlay, but the package is quite far behind...
+    # Not bothering to update until Borg 2.0 releases
+    package = mkOpt' package inputs.borgthin.packages.${config.nixpkgs.system}.borgthin "borgthin package";
     jobs = mkOpt' (attrsOf jobType) { } "borgthin jobs";
   };
 

nixos/modules/build.nix

@@ -221,8 +221,8 @@ in
       memorySize = dummyOption;
       qemu.options = dummyOption;
     };
+    image.baseName = dummyOption;
     isoImage = {
-      isoBaseName = dummyOption;
       volumeID = dummyOption;
       edition = dummyOption;
       appendToMenuLabel = dummyOption;

nixos/modules/common.nix

@@ -1,4 +1,4 @@
-{ lib, pkgsFlake, pkgs, pkgs', inputs, config, ... }:
+{ lib, pkgsFlake, pkgs, pkgs', self, inputs, config, ... }:
 let
   inherit (lib) mkIf mkDefault mkMerge;
   inherit (lib.my) mkDefault';
@@ -12,7 +12,7 @@ in
     inputs.impermanence.nixosModule
     inputs.ragenix.nixosModules.age
     inputs.sharry.nixosModules.default
-    inputs.attic.nixosModules.atticd
+    inputs.copyparty.nixosModules.default
   ];
 
   config = mkMerge [
@@ -41,6 +41,7 @@ in
 
       nix = {
         package = pkgs'.mine.nix;
+        channel.enable = false;
         settings = with lib.my.c.nix; {
           trusted-users = [ "@wheel" ];
           experimental-features = [ "nix-command" "flakes" "ca-derivations" ];
@@ -65,10 +66,12 @@ in
       };
       nixpkgs = {
         overlays = [
-          inputs.deploy-rs.overlay
+          inputs.deploy-rs.overlays.default
           inputs.sharry.overlays.default
-          inputs.borgthin.overlays.default
+          # TODO: Re-enable when borgthin is updated
+          # inputs.borgthin.overlays.default
           inputs.boardie.overlays.default
+          inputs.copyparty.overlays.default
         ];
         config = {
           allowUnfree = true;
@@ -127,6 +130,9 @@ in
         };
       };
 
+      environment.etc = {
+        "nixos/flake.nix".source = "/run/nixfiles/flake.nix";
+      };
       environment.systemPackages = with pkgs; mkMerge [
         [
           bash-completion
@@ -142,7 +148,10 @@ in
         fish.enable = mkDefault true;
         # TODO: This is expecting to look up the channel for the database...
         command-not-found.enable = mkDefault false;
-        vim.defaultEditor = true;
+        vim = {
+          enable = true;
+          defaultEditor = true;
+        };
       };
 
       services = {
@@ -209,14 +218,35 @@ in
             # python.d plugin script does #!/usr/bin/env bash
             path = with pkgs; [ bash ];
           };
+
+          nixfiles-mutable = {
+            description = "Mutable nixfiles";
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+            };
+
+            path = with pkgs; [ util-linux ];
+            script = ''
+              nixfilesDir="${self}"
+
+              mkdir -p /run/nixfiles{,/.rw,/.work}
+              mount -t overlay overlay -o lowerdir="$nixfilesDir",upperdir=/run/nixfiles/.rw,workdir=/run/nixfiles/.work /run/nixfiles
+              chmod -R u+w /run/nixfiles
+            '';
+            preStop = ''
+              umount /run/nixfiles
+              rm -rf /run/nixfiles
+            '';
+
+            wantedBy = [ "multi-user.target" ];
+          };
         };
       };
     }
     (mkIf config.services.kmscon.enable {
       fonts.fonts = with pkgs; [
-        (nerdfonts.override {
-          fonts = [ "SourceCodePro" ];
-        })
+        nerd-fonts.sauce-code-pro
       ];
     })
   ];

nixos/modules/containers.nix

@@ -15,6 +15,7 @@ let
     passAsFile = [ "code" ];
     code = ''
       #include <stdio.h>
+      #include <stdlib.h>
       #include <signal.h>
       #include <unistd.h>
       #include <systemd/sd-daemon.h>

nixos/modules/gui/default.nix

@@ -4,6 +4,12 @@ let
   inherit (lib.my) mkBoolOpt';
 
   cfg = config.my.gui;
+
+  androidUdevRules = pkgs.runCommand "udev-rules-android" {
+    rulesFile = ./android-udev.rules;
+  } ''
+    install -D "$rulesFile" "$out"/lib/udev/rules.d/51-android.rules
+  '';
 in
 {
   options.my.gui = with lib.types; {
@@ -12,7 +18,7 @@ in
 
   config = mkIf cfg.enable {
     hardware = {
-      opengl.enable = mkDefault true;
+      graphics.enable = mkDefault true;
     };
 
     systemd = {
@@ -26,6 +32,12 @@ in
       pam.services.swaylock-plugin = {};
     };
 
+    users = {
+      groups = {
+        adbusers.gid = lib.my.c.ids.gids.adbusers;
+      };
+    };
+
     environment.systemPackages = with pkgs; [
       # for pw-jack
       pipewire.jack
@@ -44,8 +56,12 @@ in
       gnome = {
         gnome-keyring.enable = true;
       };
+      udisks2.enable = true;
 
       udev = {
+        packages = [
+          androidUdevRules
+        ];
         extraRules = ''
           # Nvidia
           SUBSYSTEM=="usb", ATTR{idVendor}=="0955", MODE="0664", GROUP="wheel"
@@ -53,6 +69,8 @@ in
           SUBSYSTEM=="usb", ATTR{idVendor}=="057e", MODE="0664", GROUP="wheel"
           # FT
           SUBSYSTEM=="usb", ATTR{idVendor}=="0403", MODE="0664", GROUP="wheel"
+          # /dev/player0
+          SUBSYSTEM=="usb", ATTR{idVendor}=="6969", MODE="0664", GROUP="wheel"
         '';
       };
     };
@@ -86,5 +104,13 @@ in
         ];
       };
     };
+
+    my = {
+      user = {
+        config = {
+          extraGroups = [ "adbusers" ];
+        };
+      };
+    };
   };
 }

nixos/modules/l2mesh.nix

@@ -44,10 +44,8 @@ let
       toString (mesh.baseMTU - overhead);
 
       bridgeFDBs = mapAttrsToList (n: peer: {
-        bridgeFDBConfig = {
         MACAddress = "00:00:00:00:00:00";
         Destination = peer.addr;
-        };
       }) otherPeers;
     };
   };

nixos/modules/netboot/default.nix

@@ -5,10 +5,23 @@ let
 
   cfg = config.my.netboot;
 
+  # Newer releases don't boot on desktop?
+  ipxe = pkgs.ipxe.overrideAttrs (o: rec {
+    version = "1.21.1-unstable-2024-06-27";
+    src = pkgs.fetchFromGitHub {
+      owner = "ipxe";
+      repo = "ipxe";
+      rev = "b66e27d9b29a172a097c737ab4d378d60fe01b05";
+      hash = "sha256-TKZ4WjNV2oZIYNefch7E7m1JpeoC/d7O1kofoNv8G40=";
+    };
+
+    # This upstream patch (in newer versions) is needed for newer GCC
+    patches = (if (o ? patches) then o.patches else []) ++ [ ./fix-uninitialised-var.patch ];
+  });
   tftpRoot = pkgs.linkFarm "tftp-root" [
     {
       name = "ipxe-x86_64.efi";
-      path = "${pkgs.ipxe}/ipxe.efi";
+      path = "${ipxe}/ipxe.efi";
     }
   ];
   menuFile = pkgs.runCommand "menu.ipxe" {
@@ -17,10 +30,11 @@ let
     substituteAll ${./menu.ipxe} "$out"
   '';
 
-  bootBuilder = pkgs.substituteAll {
+  bootBuilder = pkgs.replaceVarsWith {
     src = ./netboot-loader-builder.py;
     isExecutable = true;
 
+    replacements = {
       inherit (pkgs) python3;
       bootspecTools = pkgs.bootspec;
       nix = config.nix.package.out;
@@ -35,6 +49,7 @@ let
         fi
       '';
     };
+  };
 in
 {
   options.my.netboot = with lib.types; {

nixos/modules/netboot/fix-uninitialised-var.patch

@@ -0,0 +1,48 @@
+From 7f75d320f6d8ac7ec5185b2145da87f698aec273 Mon Sep 17 00:00:00 2001
+From: Michael Brown <mcb30@ipxe.org>
+Date: Mon, 2 Sep 2024 12:24:57 +0100
+Subject: [PATCH] [etherfabric] Fix use of uninitialised variable in
+ falcon_xaui_link_ok()
+
+The link status check in falcon_xaui_link_ok() reads from the
+FCN_XX_CORE_STAT_REG_MAC register only on production hardware (where
+the FPGA version reads as zero), but modifies the value and writes
+back to this register unconditionally.  This triggers an uninitialised
+variable warning on newer versions of gcc.
+
+Fix by assuming that the register exists only on production hardware,
+and so moving the "modify-write" portion of the "read-modify-write"
+operation to also be covered by the same conditional check.
+
+Signed-off-by: Michael Brown <mcb30@ipxe.org>
+---
+ src/drivers/net/etherfabric.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/src/drivers/net/etherfabric.c b/src/drivers/net/etherfabric.c
+index b40596beae7..be30b71f79f 100644
+--- a/src/drivers/net/etherfabric.c
++++ b/src/drivers/net/etherfabric.c
+@@ -2225,13 +2225,16 @@ falcon_xaui_link_ok ( struct efab_nic *efab )
+ 		sync = ( sync == FCN_XX_SYNC_STAT_DECODE_SYNCED );
+ 		
+ 		link_ok = align_done && sync;
+-	}
+ 
+-	/* Clear link status ready for next read */
+-	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_COMMA_DET, FCN_XX_COMMA_DET_RESET );
+-	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_CHARERR, FCN_XX_CHARERR_RESET);
+-	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_DISPERR, FCN_XX_DISPERR_RESET);
+-	falcon_xmac_writel ( efab, &reg, FCN_XX_CORE_STAT_REG_MAC );
++		/* Clear link status ready for next read */
++		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_COMMA_DET,
++				       FCN_XX_COMMA_DET_RESET );
++		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_CHARERR,
++				       FCN_XX_CHARERR_RESET );
++		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_DISPERR,
++				       FCN_XX_DISPERR_RESET );
++		falcon_xmac_writel ( efab, &reg, FCN_XX_CORE_STAT_REG_MAC );
++	}
+ 
+ 	has_phyxs = ( efab->phy_op->mmds & ( 1 << MDIO_MMD_PHYXS ) );
+ 	if ( link_ok && has_phyxs ) {

nixos/modules/network.nix

@@ -1,6 +1,6 @@
 { lib, pkgs, config, ... }:
 let
-  inherit (lib) flatten optional mkIf mkDefault mkMerge;
+  inherit (lib) flatten optional mkIf mkDefault mkMerge versionAtLeast;
 in
 {
   config = mkMerge [
@@ -12,14 +12,6 @@ in
         useNetworkd = mkDefault true;
       };
 
-      systemd = {
-        additionalUpstreamSystemUnits = [
-          # TODO: NixOS has its own version of this, but with `network` instead of `networkd`. Is this just a typo? It
-          # hasn't been updated in 2 years...
-          "systemd-networkd-wait-online@.service"
-        ];
-      };
-
       services.resolved = {
         domains = [ config.networking.domain ];
         # Explicitly unset fallback DNS (Nix module will not allow for a blank config)

nixos/modules/nvme/default.nix

@@ -4,11 +4,6 @@ let
   inherit (lib.my) mkOpt';
 
   cfg = config.my.nvme;
-  nvme-cli = pkgs.nvme-cli.override {
-    libnvme = pkgs.libnvme.overrideAttrs (o: {
-      patches = (if (o ? patches) then o.patches else [ ]) ++ [ ./libnvme-hostconf.patch ];
-    });
-  };
 
   hostNQN = "nqn.2014-08.org.nvmexpress:uuid:${cfg.uuid}";
   etc = prefix: {
@@ -28,7 +23,7 @@ in
   config = mkIf (cfg.uuid != null) {
     environment = {
       systemPackages = [
-        nvme-cli
+        pkgs.nvme-cli
       ];
       etc = etc "";
     };
@@ -44,10 +39,6 @@ in
             ip = "${iproute2}/bin/ip";
             nvme = "${nvme-cli}/bin/nvme";
           };
-          extraConfig = ''
-            DefaultTimeoutStartSec=20
-            DefaultDeviceTimeoutSec=20
-          '';
 
           network = {
             enable = true;
@@ -62,14 +53,25 @@ in
 
             serviceConfig = {
               Type = "oneshot";
-              ExecStart = "${nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn}";
+              ExecStart = "${pkgs.nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn} -q ${hostNQN}";
               Restart = "on-failure";
               RestartSec = 10;
             };
 
             wantedBy = [ "initrd-root-device.target" ];
           };
+        # TODO: Remove when 25.11 releases
+        } // (if (lib.versionAtLeast lib.my.upstreamRelease "25.11") then {
+          settings.Manager = {
+            DefaultTimeoutStartSec = 20;
+            DefaultDeviceTimeoutSec = 20;
           };
+        } else {
+          extraConfig = ''
+            DefaultTimeoutStartSec=20
+            DefaultDeviceTimeoutSec=20
+          '';
+        });
       };
     };
   };

nixos/modules/pdns.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, config, ... }:
 let
   inherit (builtins) isList;
-  inherit (lib) mkMerge mkIf mkDefault mapAttrsToList concatMapStringsSep concatStringsSep;
+  inherit (lib) mkMerge mkIf mkDefault mapAttrsToList concatMapStringsSep concatStringsSep getExe;
   inherit (lib.my) mkBoolOpt' mkOpt';
 
   # Yoinked from nixos/modules/services/networking/pdns-recursor.nix
@@ -165,7 +165,7 @@ let
 
   extraSettingsOpt = with lib.types; mkOpt' (nullOr str) null "Path to extra settings (e.g. for secrets).";
   baseAuthSettings = pkgs.writeText "pdns.conf" (settingsToLines cfg.auth.settings);
-  baseRecursorSettings = pkgs.writeText "pdns-recursor.conf" (settingsToLines config.services.pdns-recursor.settings);
+  baseRecursorSettings = (pkgs.formats.yaml { }).generate "pdns-recursor.yaml" config.services.pdns-recursor.yaml-settings;
   generateSettings = type: base: dst: if (cfg."${type}".extraSettingsFile != null) then ''
     oldUmask="$(umask)"
     umask 006
@@ -174,6 +174,14 @@ let
   '' else ''
     cp "${base}" "${dst}"
   '';
+  generateYamlSettings = type: base: dst: if (cfg."${type}".extraSettingsFile != null) then ''
+    oldUmask="$(umask)"
+    umask 006
+    ${getExe pkgs.yaml-merge} "${base}" "${cfg."${type}".extraSettingsFile}" > "${dst}"
+    umask "$oldUmask"
+  '' else ''
+    cp "${base}" "${dst}"
+  '';
 
   namedConf = pkgs.writeText "pdns-named.conf" ''
     options {
@@ -315,9 +323,9 @@ in
     (mkIf cfg.recursor.enable {
       systemd.services.pdns-recursor = {
         preStart = ''
-          ${generateSettings "recursor" baseRecursorSettings "/run/pdns-recursor/recursor.conf"}
+          ${generateYamlSettings "recursor" baseRecursorSettings "/run/pdns-recursor/recursor.yml"}
         '';
-        serviceConfig.ExecStart = [ "" "${pkgs.pdns-recursor}/bin/pdns_recursor --config-dir=/run/pdns-recursor" ];
+        serviceConfig.ExecStart = [ "" "${pkgs.pdns-recursor}/bin/pdns_recursor --config-dir=/run/pdns-recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no" ];
       };
 
       services.pdns-recursor = {

nixos/modules/tmproot.nix

@@ -147,6 +147,15 @@ in
             "/var/lib/systemd"
 
             { directory = "/root/.cache/nix"; mode = "0700"; }
+            # Including these unconditionally due to infinite recursion problems...
+            {
+              directory = "/etc/lvm/archive";
+              mode = "0700";
+            }
+            {
+              directory = "/etc/lvm/backup";
+              mode = "0700";
+            }
           ];
           files = [
             "/etc/machine-id"
@@ -260,18 +269,6 @@ in
         my.tmproot.persistence.config.files =
           concatMap (k: [ k.path "${k.path}.pub" ]) config.services.openssh.hostKeys;
       })
-      (mkIf config.services.lvm.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/etc/lvm/archive";
-            mode = "0700";
-          }
-          {
-            directory = "/etc/lvm/backup";
-            mode = "0700";
-          }
-        ];
-      })
       (mkIf (config.security.acme.certs != { }) {
         my.tmproot.persistence.config.directories = [
           {
@@ -539,6 +536,73 @@ in
           }
         ];
       })
+      (persistSimpleSvc "octoprint")
+      (mkIf (config.services.borgbackup.jobs != { }) {
+        my.tmproot.persistence.config.directories = [
+          "/var/lib/borgbackup"
+          "/var/cache/borgbackup"
+        ];
+
+        services.borgbackup.package = pkgs.borgbackup.overrideAttrs (o: {
+          makeWrapperArgs = o.makeWrapperArgs ++ [
+            "--set-default BORG_BASE_DIR /var/lib/borgbackup"
+            "--set-default BORG_CONFIG_DIR /var/lib/borgbackup/config"
+            "--set-default BORG_CACHE_DIR /var/cache/borgbackup"
+          ];
+        });
+      })
+      (mkIf (config.services ? "bluesky-pds" && config.services.bluesky-pds.enable) {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/pds";
+            mode = "0750";
+            user = "pds";
+            group = "pds";
+          }
+        ];
+      })
+      (mkIf config.services.home-assistant.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = config.services.home-assistant.configDir;
+            mode = "0750";
+            user = "hass";
+            group = "hass";
+          }
+        ];
+      })
+      (mkIf config.services.frigate.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/frigate";
+            mode = "0755";
+            user = "frigate";
+            group = "frigate";
+          }
+          {
+            directory = "/var/cache/frigate";
+            mode = "0755";
+            user = "frigate";
+            group = "frigate";
+          }
+        ];
+      })
+      (mkIf config.services.copyparty.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/copyparty";
+            mode = "0755";
+            user = "copyparty";
+            group = "copyparty";
+          }
+          {
+            directory = "/var/cache/copyparty";
+            mode = "0755";
+            user = "copyparty";
+            group = "copyparty";
+          }
+        ];
+      })
     ]))
   ]);
 

nixos/modules/user.nix

@@ -82,6 +82,10 @@ in
       # NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
       # passed to it
       home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
+
+      systemd.services.nixfiles-mutable.script = ''
+        chown -R ${user'.name} /run/nixfiles
+      '';
     }
     (mkIf (cfg.passwordSecret != null) {
       my = {

pkgs/chocolate-doom2xx/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, autoreconfHook, pkg-config, SDL, SDL_mixer, SDL_net
+{ lib, stdenv, autoreconfHook, pkg-config, SDL1, SDL_mixer, SDL_net
 , fetchFromGitHub, fetchpatch, python3 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     # for documentation
     python3
   ];
-  buildInputs = [ (SDL.override { cacaSupport = true; }) SDL_mixer SDL_net ];
+  buildInputs = [ (SDL1.override { cacaSupport = true; }) SDL_mixer SDL_net ];
   enableParallelBuilding = true;
 
   meta = {

pkgs/default.nix

@@ -8,9 +8,7 @@ in
   vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
   librespeed-go = callPackage ./librespeed-go.nix { };
   # modrinth-app = callPackage ./modrinth-app { };
-  glfw-minecraft = callPackage ./glfw-minecraft { };
   chocolate-doom2xx = callPackage ./chocolate-doom2xx { };
   windowtolayer = callPackage ./windowtolayer.nix { };
   swaylock-plugin = callPackage ./swaylock-plugin.nix { };
-  terminaltexteffects = callPackage ./terminaltexteffects.nix { };
 }

pkgs/glfw-minecraft/default.nix

@@ -1,6 +0,0 @@
-{ lib, glfw-wayland-minecraft, ... }:
-glfw-wayland-minecraft.overrideAttrs (o: {
-  patches = [
-    ./suppress-wayland-errors.patch
-  ];
-})

pkgs/glfw-minecraft/suppress-wayland-errors.patch

@@ -1,43 +0,0 @@
-diff --git a/src/wl_window.c b/src/wl_window.c
-index 7c509896..db9a6451 100644
---- a/src/wl_window.c
-+++ b/src/wl_window.c
-@@ -2115,25 +2115,21 @@ void _glfwSetWindowTitleWayland(_GLFWwindow* window, const char* title)
- void _glfwSetWindowIconWayland(_GLFWwindow* window,
-                                int count, const GLFWimage* images)
- {
--    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
--                    "Wayland: The platform does not support setting the window icon");
-+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window icon\n");
- }
- 
- void _glfwGetWindowPosWayland(_GLFWwindow* window, int* xpos, int* ypos)
- {
-     // A Wayland client is not aware of its position, so just warn and leave it
-     // as (0, 0)
--
--    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
--                    "Wayland: The platform does not provide the window position");
-+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not provide the window position\n");
- }
- 
- void _glfwSetWindowPosWayland(_GLFWwindow* window, int xpos, int ypos)
- {
-     // A Wayland client can not set its position, so just warn
- 
--    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
--                    "Wayland: The platform does not support setting the window position");
-+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window position\n");
- }
- 
- void _glfwGetWindowSizeWayland(_GLFWwindow* window, int* width, int* height)
-@@ -2359,8 +2355,7 @@ void _glfwRequestWindowAttentionWayland(_GLFWwindow* window)
- 
- void _glfwFocusWindowWayland(_GLFWwindow* window)
- {
--    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
--                    "Wayland: The platform does not support setting the input focus");
-+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the input focus\n");
- }
- 
- void _glfwSetWindowMonitorWayland(_GLFWwindow* window,

pkgs/terminaltexteffects.nix

@@ -1,19 +0,0 @@
-{ lib
-, python3Packages
-, fetchPypi
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "terminaltexteffects";
-  version = "0.10.1";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-NyWPfdgLeXAxKPJOzB7j4aT+zjrURN59CGcv0Vt99y0=";
-  };
-
-  build-system = with python3Packages; [
-    poetry-core
-  ];
-}

pkgs/windowtolayer.nix

@@ -1,18 +1,25 @@
 { lib
 , fetchFromGitLab
 , rustPlatform
+, python3
+, rustfmt
 }:
 rustPlatform.buildRustPackage rec {
   pname = "windowtolayer";
-  version = "a5b89c3c";
+  version = "97ebd079";
+
+  nativeBuildInputs = [
+    python3
+    rustfmt
+  ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mstoeckl";
     repo = pname;
-    rev = "a5b89c3c047297fd574932860a6c89e9ea02ba5d";
-    hash = "sha256-rssL2XkbTqUvJqfUFhzULeE4/VBzjeBC5iZWSJ8MJ+M=";
+    rev = "97ebd0790b13bf00afb0c53a768397882fd2e831";
+    hash = "sha256-XjbhZEoE5NPBofyJe7OSsE7MWgzjyRjBqiEzaQEuRrU=";
   };
 
-  cargoHash = "sha256-XHmLsx9qdjlBz4xJFFiO24bR9CMw1o5368K+YMpMIBA=";
+  cargoHash = "sha256-M0BVSUEFGvjgX+vSpwzvaEGs0i80XOTCzvbV4SzYpLc=";
 }

secrets/britnet/wg.key.age

@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHNqUFR5ZyBVVkI0
+dE5YN1pJWExzLzltcmhna2tJUmdRNjZ1Y1hwbzdtRE0wa2hReTNBCk4ydmNFK0FF
+b0RUdVl3a3d4amhKSEVhZWZPeHZDenBiTXpkVVFiNXFXNGsKLT4gWDI1NTE5IG9i
+K0ZrNEc5SVlyWU1EbXdlbWppRG1DdjFRbTBCREY2OUxrMmVqNHhSazQKVnRaVmVn
+MFBRL1dWeFNOaEwyU2szb1lOVzF1enQwdmVZZWRJcHd5MHdFbwotPiB2Wy1gUV8/
+LWdyZWFzZSBdSDFebHsgKkBkVzl+KnggJTEKdlhrdzVpMHYxUUliQnhaYXNaVWNR
+S3NxbjhFMEFGamZkRU1RNURhcmwzOGxFbGxXelhOdDBWTHBSY1hBcGFtUwpkampi
+WnhzMDcxTk1seWZ6VURZb1l1QU1GdwotLS0gRFNpcXpDUFZLTXFJN3Z0bEJQd280
+WGROWUVvdSt3ZUdBbmRNcGFhRE9BWQoDDlPEY/t2eapa4Xbv8FcW6gdLzQn7Y2cH
+5UwD+0CTF3JdUpxWUIx9RWFleHekkt8j1+2/oO+m7+24yCg5mdqTJ3ZIwu9uk1eI
+0As8IA==
+-----END AGE ENCRYPTED FILE-----

secrets/chatterbox/syncv3.env.age

@@ -1,16 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBQMEJB
-VVhIL2ViVUx1Ym9IbFV1UW52NjZYMmJlYmpjY0RuMzhiclJVS0ZnCkY5dEZHTHlC
-K29uamorWWNJSVV0VlVJNG1VNm9GQ3VPdldJRDNSODVoOVUKLT4gWDI1NTE5IEM0
-UVQvLzFYRTRRMldWSnNnd3V3aXJTeS8vZ1hkdENYVHk1QVVaQVEyQnMKVmN4OUFH
-WCtVSW9tREV5RExycnFJejk5UW91dzd5Rm8vcFBTT0ZCdytFWQotPiBCPC0lLTJW
-LS1ncmVhc2UgRSBjOlg5a0pdQSBSb2YKN0pkalY4VlFDMm8vZzJpQUV4TmdSRHA2
-dnB4UzJaWTRXeDdmKzFrUGVMSEFlbFhlNFFycFRQU005d1I2Si9VUQpHbDVxcGxn
-SVdjZzduSGluYlZnY3lmZmtnOWJYKzkydDhKU0VCNmNvV0EKLS0tIGdaUkpGNy9P
-Y3BGVGVJenJkTG51c3Z3WFU0eTFXT09pSVFseGRLMmxJVU0KhH9EjbL0zv821Yox
-FXc54SXGEkq97qPi3xIoPydWd3FbIuftAhe0xPFGfUOO5/zDni4h+PoNJs2hnkOK
-kHhxtaOj1S6RulI/eYLK/fJjl2aRrTaRFN0TGhFwz5X8HOQe2+Qrq/9wT7pyzOFU
-LsMwe71OhTjA5XrBTawU9QkWjPx2LZyb/WEkzlLOCGoHTUm4X03xY/1UeHVYZt2k
-wbLses0JHK1h2ttWnO5y68LovZWJqFdIjoCCkgfo0nNUD5i+e51xEju9OBJMngj+
-LnPb6YCqFh4Fxy09WORD0A==
------END AGE ENCRYPTED FILE-----

secrets/estuary/pdns/recursor.conf.age

@@ -1,12 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA4bGQr
-dzJZbU4reWI1Sk45QTR3UkRoc0NvaDBFcUwrVWlCYWUrcWtYZGpNCm1PWjVzRVlt
-UDFKY2ZSZTg4S2pVZ0pDNzR1WklYQ3pEclJZLy9kKzdGTGsKLT4gWDI1NTE5IHFO
-TXVRK2d3azg2cHpRanhUNXp6YnRsZW1MUDJqc3l1bnNYNUhHaTIzMVkKWXp1M09H
-TnJIazRmb0tOSnE1Q0E1dERiaHZCQkh2YzE1cS9zRUhwaEovMAotPiBzPj5nLWdy
-ZWFzZQozSThRWnJCcVFFRHpoSi9tZnZMdnJoRlFud2VISHBHSThMem9qZVVWdS9C
-VFBDVEVzbUVCdFU2Qy9PaGdyc0FaCmk3UFZma2ZiR3hmWG1sa053bDBnY04yZ1VZ
-TW9jZwotLS0gMDVSaE5aakxHenFPVXpXa1JxczlWQ2x2VGNuQzdwaWZFTTFTaUp6
-cnRmZwoomylfwjD5A3N21/mk1Wtt8f4bsK747iZz7KT34kqmoX597rbGYxyip5lg
-VLZV6CY4LLRjnnSKoC2hIXU0dgudAmvxhztuaQ42fOc=
------END AGE ENCRYPTED FILE-----

secrets/estuary/pdns/recursor.yml.age

@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyB0RnVq
+RUpSZy9qZ29DemdnWjdscHMvelRYUGF0YVZlNDFtdzFRdVljbGpZCjdWcE50ck44
+NVBsbVk3SmR6cHhHdkJ0TWI2S2ppOUtnK3pMK28xeTc0KzgKLT4gWDI1NTE5IHIy
+SEUxOCtjK3VFMEozblB1T00yRTE3c3dRSXIydmJHdmEvL25yMStOUVEKbE1XdU4z
+L1lLcEJWY2w2WXRWbmVIN0ZBRVl1R1dhNk10MWtheTRCYjloZwotPiBXXXRKcS1n
+cmVhc2UgRUBEWyBwamZsOVQKZ09pVGdWUG02WmxUcGNBN3RnbE42V05xRDE2azMr
+WHd3VEt0NmwvZnI1dXdiSjNvaStsNTZmUEhwbUp5cVlieQpSYmhUVm1GbEJVdXo3
+ZwotLS0gSkFZMFdiRHBjWFJsR3pqcytYZkEza3dsZ0ZyaDkxdmliZ3RUOFErUXlt
+cwq9gj+Fg4p2D1548J+bhvJ0re9uVm9TZ9lJSqmj5tMxWRS9aN1j9BlhmK/RnEG9
+KcodvBiyqibzauS4KC18xLLu986hK2gn3857waXn/AIp+p8BIA2J9M2M
+-----END AGE ENCRYPTED FILE-----

secrets/hass/cli-token.txt.age

@@ -0,0 +1,16 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFQrc2JHQSBmTlVp
+RnlKNE9ySGo4L2h3VXBXRzIyZGdqU0RtUWk4ZmJVcGNKZ3BqTmpjCjJtQjUyTmJN
+dkpsbVI3M01mQlNPSEI0U1lVeUJTMVlXUlpheGxVblhUbUkKLT4gWDI1NTE5IG5K
+K0F3QWxJaW5CbW5TZElEVklIeUJxS0JCc2IxaFI5dVZrbDc3NDZGV2MKOVR6M0k5
+eW5HWDQrT3Rtb0tIM1EyajI1V0dKbHBLb0tVNU9nb21OUjcxYwotPiA5anw6bk56
+dC1ncmVhc2UgPCVeLiZyIH4KTGFRWHBGZFBJUElONUZLb3pJeXNZeXhoakYwT3BM
+TW9kUXBhOGhNbHh1Q1RPRTlCRnhSckg5NEUxWk5MVHJucQp4YlFDcVRzK2V5bWVT
+V0xLQjN1SjVTaWNJajJaTjRrQTd2VHlMRy82TExXbAotLS0gVE5YZVhTWXl4VUN2
+WUpidkJLV1JDU0R2QkdHZE5ZbCt2K2FlbGNjK0ZlNApzDh+kgAy4SBqC51mJi+VX
+ON8wbwLVTQRs1H30eyWNzt/3MO++eS4AoZUKQZUxURwXfhV0t0zd5/MlByBsqaHR
++W6O/9Dp8e/8GYSX3D892r1LKN0AYHgcKeKwEtJojt5CTNJS2IgU6UxZhTliqAEc
+NkfxvcoAEHhGhPOudEIX2SgjrgVGJA8MYm6/46zAolZws3TWim3NEgJpb9tWXpvi
+1f/MXuxiowplF+PqCsd1EGzpXKsvADq6Rwyxpo6CbJzrq+GhFrTHF+LRkzjWx6JE
+LUsZwDqOZUY=
+-----END AGE ENCRYPTED FILE-----

secrets/home/pdns/recursor.conf.age

@@ -1,14 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBlODZr
-RHpJcFdFaVNYM0x1d3QxVmhKTFBkMndrakFYS3FxWk00YWxXejNzCkFqWFlCWUt2
-cGluRGtxODQzbElhRWt1TGFVeTE1UU5SSkdZejJzNVdhZ3cKLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIFRpeVNsT2Jqc2I4dzB3cEFWK2ZEZlpJQklWSnhJM3o0Ukhsc1lz
-REZ0VFkKWWJPckVSNlZHREJIVVgwNVNBSkpSbHRPcUxIWVo4ZTlyVkovTGRpZThL
-MAotPiBYMjU1MTkgUGxhR2d3TVh1dnJwQjNoY0pjV09halZKZFhybVk3Vjk3Tmwr
-bDd5ckp6MApBcW8zbUl1SnhmOXZwOFRNUG1EZUNacDlXdXJSbWFUeG5GNjM3eXJo
-RmR3Ci0+IDstZ3JlYXNlICRoICVbfmU2fQpFYzNyZXBxVU5jT3JSY1NFMGEzUnVF
-WFQ2MmR2SGQ0Vnd6V0VxQlp5bE5LZ2NML2hyd09LOEVPL2lGREdLR3FMCmVGN09J
-OUNscVh1d0VSdwotLS0gbTB1NnZ4Q3B6WE1KVzJjbmVwL2dEVjc4WnRXZTlYbFBG
-T3htUHBWang2awr0OgkUO6XPZji5ZBNpqGwOlwpa605t38QCmFSXvPQhvT4Gj/0+
-rUvg7zWf5Yb4c86EDD05CsqGEUQTOKEz08z0lewN5kuFfZmrYQY=
------END AGE ENCRYPTED FILE-----

secrets/home/pdns/recursor.yml.age

@@ -0,0 +1,14 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBJSU1V
+M1QyaWcvcFJlUlJEcDVvblJGcXJDWk11RDhCZzBkY2Qyc2lDQW5jCjJVRVBWMTZy
+SHNTZG9ZSnZ3RjRqUE9Ub3JKZERkcTZpeEhSUlppTmVsZm8KLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIFFsbm1oNk1jNndoU0J3SkdFSkNhSGNVRjdQb2JSUFBnczVwdlF0
+bDVhaVUKaFBzSHF3THNiL09Ib2ZhOFlyNVY0Q1ZwOUMwczZiQW9jVlNwanRYek1P
+WQotPiBYMjU1MTkgcEppMVBpbmRGS1h5RUgwNkZPZ0dXWVpkdXlZcFc5S3dQaDA4
+THdhUm9oTQpLbUpTaVVuQ29Zc3FuQ2MyaFcvTkxVK1l1T3V0L3FZSXZBS2dlY2hM
+VUNVCi0+IENcLWdyZWFzZSAnNGJjfiB1IHB3QDpUIHsoQi57Ilw9CnkxdFRqWVZi
+ZFdHQXJwNGZuNDg2Q3cKLS0tIDJSNmthczc1U2xxSlVKZDBLc1BHNnFMV3MwK3Qr
+ckJDL204d210NW1Pb2sKCC+sa8uPupC3Rv+o12XT/wTmLsKhtaE/bbshPCDIHUFn
+cpTwpY96JsCShAjSb6n7Xt6FgTKTFt2iDsGQ6+sLp0AJ2quxRaoxmqaFVsz4p8BL
+gF0On7LgZg==
+-----END AGE ENCRYPTED FILE-----

secrets/jackflix/copyparty-pass.txt.age

@@ -0,0 +1,11 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyA4Qk8z
+SkhFWWMyaGM1c2luVzZzbWNvT0ZsS09yN0w1N01oY0tldWFXZnhVCkM0YzBVZUM1
+MmRzdFlCL1o5ZTdkTjkxQ1YyQ0kwbnJ0eVRuYUpQNWw2c0EKLT4gWDI1NTE5IGli
+dkp5RjZRSmROMEtQeWJiVkt2UktxdTAwUzZBRW9XajFDblFqZ3ZVR0EKYzFubnp0
+UHo5WlViYTNwbXFBd01qM0R4Wk82MTV1TzJsVVczdGRNSFRBQQotPiAnLWdyZWFz
+ZSAuPzVDCm1SZkdDMHRjT2NBVXI5ektKZ1R3dXhMUEVRblhBdC9mclFZSitSODI0
+OHZzZThEQnlBY25lVnFTQXRaV2FIYTIKeHkrY1NRCi0tLSBhUFgvd1BUbFlJeEFO
+RWRBQzcrT0ZFMG5SZVliNlZnK2N2VDJVV05UTkhBCrZM7RtMrOVIGIpod8aU4GLn
+0KBGTSq6kE01+f1kmTZDAKHx/LhiWgHYKLxTLW4VpYnUCg==
+-----END AGE ENCRYPTED FILE-----

secrets/middleman/htpasswd.age

@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyB1YlJt
-UDI5MStrbTBGNzZhMTdvTm5wczBRdXd1dlFSYitOTmpMcytXdHlBCkR5aHpSSWRJ
-OWp2RzlNZFRFUkxoOTZzcTQ1VDVuYmxKbTQrS29pR1gyb28KLT4gWDI1NTE5IDVz
-aEJyU3R0Z0Njd283QjVJK1gvRUxFVllYdStEbElPSG9yNmc2TnZaemsKaVFNOEd5
-L3hNVlFSUGhoMUxPSE5tK0JUU1FnMGtRNXkvODl0bmNiY0F5RQotPiBwdiR3UD8t
-Z3JlYXNlIGpBbSNeVSBMYVogdFxFZicgTiNDOgpJQnNyMFEKLS0tIEdDZ3oxbDZ0
-VkxETUVnSHRuTDFjTGVYSE9jcWhWT2RCOExDeitKcmZ4TXMKyClXNLb/8j0JtKrc
-OQ2Fd4Ej16Pe8aEfHmwd1VT/XKyE9bOYE4tY5wAhGYLbO6A3SxzeKlZPvfKA4/el
-dCh8mOBvBMV9m/RYvjux7mCQNzXiq38IVYE+BqD9fJIXw2iGMDwpYOmz2J+41CMd
-EiuA1Ms2OlELFw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBRQlp2
+ajRjbFlJcnYxY1ViYmxLS0hWcTIzdTM4aXpzRkNER3NDVEp1UkdnCkNkQUkzWlZh
+Qy9RdmIrdEtRZk5aNDI2ajVCNDZvQ3VCcGpha1QwUHMxamcKLT4gWDI1NTE5IHc5
+bzhCNVFvalpaa3Frc0U3UE5GT0V3Y0MySGdBeHNTdzBNMWJtTnNmeDAKOS9KTSs1
+eitCUHNlSnBMSWVkOEdaSEt4MFRoTTVsVldnNnoyNk5hRStORQotPiBzZzNrSyVj
+LWdyZWFzZSBgTiBxXlosJTYlYiBBYyZVIy03Cm96UFpTSGR1S25UVzExTnZNRFdB
+L0UzR1FKSzA5VXYva1EKLS0tIEM1QXFXcFJPUEJRTmJVK25jNFM2eUkzd3VSaVpJ
+MW0wTTlDZGFmMFhBMVEKRHzl+MWwD1N16bywVC9LFKmLTJeTVLww0pa20th9HEhE
+AePSzNsp2xUhESxBDmQDjS3E+s88oCd0D8y3pFmV4Nmf2yPNxbMu8gPVvNmhLAFA
+UR6aTjnfUFJpIXQgPgTncT99kF1YPgF0/X5hqe1DjZneRRTLgPp83me2cF43RDqf
+C4QhJWaqKf8ofqNKfqxvmcKmXNhJG1KEokMyKqPzaw==
 -----END AGE ENCRYPTED FILE-----

secrets/qclk/wg.key.age

@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpiTEpXQSBPQjFB
+R3p6OGZYOTlZcHV0djlnY2tPTVk2SDNaazM2Nm0vMytSTWJ0THo4CnNSUW4zR2Vo
+V3hsVVFIOEhRM1ZpSnVmcmd6WFhKdGVNQk9IYlRoZFBGUjgKLT4gWDI1NTE5IDJs
+NzlrMXQ5Ty9sdTkwNFpUVnp5MWlucUJLZWtWbGpMd1NTZm1UendPa0EKeWVTa2p6
+ejROR29UYU5GcWlxb1hjWnV6V1BOK29pL2pZRFVUZkU5NU9EUQotPiBfPk5oe0Fq
+LWdyZWFzZSA2Jy1xCnhpYThsOVlMWTZEWVFYemlvQ1lKZlVnc0xnT29WVEtXUHF1
+SDJ1TmJ0Qmg0R1o2UTBFanAwcXVpbGtKR21UbXoKYVNUTXVweDhQUmU2TzFOc1M4
+Z3d6YjdIT29meHVUU0tTV2NnSkljcgotLS0gRFRZNlc3cmRVS25wU0ZZeEpKNmZS
+Q1YxQkcyOGRDQ0VMSC9Ec2xka2NMOAppbDQ9/xJxLUc0OuOFq4b6r+fYCB4hm4ZB
+aEF8B3csbjrIHoboxCNaYGNh1DibseZaaWygsDfMbAmbRw2xvBNgI/oq2/RjSda9
+dZm+1A==
+-----END AGE ENCRYPTED FILE-----

secrets/tailscale-auth.key.age

@@ -1,16 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyB4Y2th
-ZnZhNE42ZjJSWGx2OWQyY3lxeGc4eDdReHl1bDFXSGVnR2Q4TFhFCnRGLzJpWDVT
-NmN3bElxZmpYMEhPQnBtODYyTHJPTmFpaVppL1JkODFRVVEKLT4gc3NoLWVkMjU1
-MTkgT0VxTXNnIGlyMmlTV1Fvd3lXNFI1ZHdGNnk0R0RCN2ZOV3ExZHFLd2k3QnUr
-T2hyUTgKMzhlZEZ2alVnM1RHWW1xUE1FQXJlQjc0S0EyYmxscURKQWtybEFWdTA4
-TQotPiBYMjU1MTkgVDVkYmwzQTg0TDNnNVloeEtuS2R6OW42MFBNSys3bzVuSHY3
-OHpIMi9UNAplbmE3MTZCQ3U2VHVLL1ZQSkd4YnM4a0xnSmpuRnFxcUlnT1lESDMr
-MDU0Ci0+ICZUZShrPi1ncmVhc2UgSjIxRCA/U34Kd1ZFb1ZPTFJVeWs2bk1Tbktn
-aW1mUXRIWkthb0JFcnlCdHRmRFZ6Zm9CbnNtWmNZUytoR2w5M28xMUViamNtQQpO
-b2poelZ6cjY5ZUZjSnBJem1zeGlSQmUrQ1dUNyt6Mm5aZzNiSkt4S2tuT0JTdWRx
-ZGJvQ1gwR0h5QWtpRUlPClRCSQotLS0gT1BLSmFaRS84V1BKNVMrSG9rMUZMZWZY
-SlUvWnozb21JZmtPQkJVc1VTQQpuOl0YXqAckAY7DmUrZGjzFg1m6zmNKE2KBcin
-sd/Dn+pZpkPk/OID6XwCRTDJB6saD5mLMPooKAYYz0oEy1UA9z+S/Xn1E4X1yktV
-FQDy0wQ=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHNqUFR5ZyArUnBS
+MCtjZERmK2IwTm16eGcrZFF5QlpYZU9VbUNzbHZ2VDBoZkJkam0wCndDdmhHc2pu
+TFFiT3MzcU13YklrdFpiRW1ZSU4zUGFQbXF3ellUU3U3bUkKLT4gc3NoLWVkMjU1
+MTkgRExNZUZnIE9EbUtYRFg0Z0xuVGNRM2pad3FFVGRDVTA3ZE50SHlvT1ZrU1NW
+b3VYREkKL0dPV3RGMHYyUW9jSlJhTU5yTnR3L0pHVjZTNWpoaGJiSmlPVWlDYlFv
+RQotPiBzc2gtZWQyNTUxOSBPRXFNc2cgRkwrZEY4RjAxYzhpbEE2eU0ya2N4emE5
+T0NlUnJwUi8vdVlJWlVOWEZESQo0OFdldUdML0hoR0NENHp2UktCTFhOYkxUZyti
+OGlhS3V1RnFUdHhVT0JvCi0+IFgyNTUxOSBOcnEzanBFWnltMUwwd3VBd3Jablk1
+Z3hDU283RVJxSlkzKy9JQW1adVVVCmtnSjVTTSsxblpsczMzR2NldlFlTFk0S210
+T1AxV1RQRjhDSU1CQ2p6M1UKLT4gVnNOLWdyZWFzZSB1fDAgYy1xRSBESjoyIDJz
+CkdRcWxTa1NHVkJDcUVmeDlIVEZTcW13N0I4ek5jTjliQ2t6Zk9nRkloQmhSY3hG
+TUdJekhXdlRzUGJ6WU8zRXgKZXFGUGgrTndSQmVyMFcyL2J0bEdKY09paTkzRHd0
+R1ZWVVVuaDljWE4zK00rdllOdGRVTzVZTnFtT1p0WlZOYgpGdwotLS0gd3dvU08x
+SzJkdjAvQys5Mnp0dDZQUWp1dzZ3U2tuYUpqR09xeTJnSzVDTQooXx8cndfMYlmf
+7eCLssPnHKj7KKgUfiihj91X8pokJR/++wQSarMdRtFB0S0MpDs/khwgG0HkmrKp
+XB1jureGwJs7gmJ6gafKCKSkBv9Jkaw=
 -----END AGE ENCRYPTED FILE-----

secrets/toot/pds.env.age

@@ -0,0 +1,18 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBONnFw
+QVduaWJac2hVVDl0bHY5dXFQSkFUNGlWaTNUbGkxN3d1RWpSZGdRCmpBZ2pLZHZ0
+V21EenE0U3lYblp3dTFyRlRrMGVjWGpxdVVRWW5pcnpCVlUKLT4gWDI1NTE5IEx0
+QUM0aEVsbCtLd3ZmS0kyb0Q3d2RuVW1oc2pHSFpMbUZHY2VXYlhYR28KSHhraW9K
+RXArS1lia0NsMWkvRFhTVEduM1M0c2JnYmduY0ZmSjhCN1M1YwotPiAlL1lJLWdy
+ZWFzZSAhVCpkTAplMU5KckU1K2diWnBreG9LbERtbGJZQjZwK0lOZjJHcEJyMWZp
+c1lxL1UvbTE5QzRIMm9wSXFmY2xUSzhBMEJiCmgxUQotLS0gOUhYVERseXJlVksr
+SEZtby92YUIrTG4ra0hneklheFBERHhqSlFlT0YwVQr5gAYwgdPqUqW2XEtN7+ZR
+VblX1NFXjMLljiGcW+ZlMXHIaKMxizPr+S/6U183e4wiUUqcpipnznnslhm/Zkny
+iHmW37pnNC0T9kctqOXeEjqsQxAMo2YKFroxo1iK0YvN+VyoIDSYMDKu8uDe1Cna
+rabi42KfdZNDjtPLrJyHSo2cCdnDUeWalAjQ3eQqn4y85gfPZq8kZcwvK6SmurDN
+GkwxXpZpSd6MdY4fIaaBEwe7WY9hq4fE7WgcQaz5yG47F+ArCwWauAz38+309XHj
+omsDSzj1jrN7T4kr2gjtUX227NrCw3REHYRNN6IQK/6fDNyPF1wbLFpXU4dnANLT
+OdMRnsDRPafNLAOYn0pgCVcVs0KLpaJvy3KLevVt2MZEtSZe/S+ys28H3JJCB8qz
+igaX3gw9+W8by4ET864fpFgufJrpufVvdz/MZ1207YHz1URQACWRtFKwnwfzP45+
+l47Y4s+xy34V+IXLJduEQdQ0ZHqKmTv02BjEjqksBwZswjI0EbTvD3Nsiw==
+-----END AGE ENCRYPTED FILE-----

secrets/user-passwd.txt.age

@@ -1,69 +1,74 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBnQUpP
-cDBxeFZBWmVlclJZdkRWOHhnK29DRzBHQ2I1ekJGeDk3WlZpenc0CmhLMVcwbGFH
-YzBHY1BEb2ZHK0FtZHEyUmw1UFVSaEsyMnR5cVUrZ1pWZXMKLT4gc3NoLWVkMjU1
-MTkgM2JCM1pnIGVuVWVnYmFmWUt4bjlwNU5oVXcvTTJZTllMTk1yQTU4YTVjYlVl
-dHh1WG8KdXBPeWdpNlYrUkJXeGVpTXlqWWhlTlJBQVduR3JhSDRqWmJuSkRjNDl2
-VQotPiBzc2gtZWQyNTUxOSBxKzBYY3cgSzFXb0g2cUxGbUxxa291cVUvK01ZRUF2
-QW5iZDA0MG9ORXlSNVBheDZtbwoyWlhIUHo0TDJWeTNOdzUzVTI3QVZVY0pEczZQ
-MXE0OVpNSktkTExWcHowCi0+IHNzaC1lZDI1NTE5IFpCM2U2USAwMkg3cmZQcTdD
-WnhPbjlmU2M3RnU5MHE4NERBUDNzVVB2Q29OeG1iR1dNCnVna1VRVTdxMHgxczk4
-aGdiZ1VhWlNsVGhrc2ZXdFNzVU92T1dxbW4rK3MKLT4gc3NoLWVkMjU1MTkgajY3
-RlhRIFFocTlvTTlJbXdKZkdqd2NlRHM3b0E0TFozTXBkWlBXa1JYWWhmM3Q4d1kK
-YitLd00xUGJReElHNm9DMFhmUGh2WFF3WDJGYW1ueXlpcEQyVWhqZUduYwotPiBz
-c2gtZWQyNTUxOSBjMFROYVEgRHhtOU1iWTduQVdjRCtRNWRMMU14a3p4V2gvek9s
-M202c2NoU0Q5ZTVIOAp5UEt0MnZ1VTZ0anVUeldSV1lBVHZvQU1CRUsrV0pHRjlw
-enJFdEVPR0tzCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyAzcWk4bnozcTN0eFgwYlQr
-dzRHekdmTlM4Wkdyd1p4Ujh4WnhJVnh5bEJVCkRnd0xlWkdXNE9BN0x0MjZyMDhM
-YlU2OVNzTnZvZGhjSE1uMWlkMUo0T2MKLT4gc3NoLWVkMjU1MTkgakk4UkFnIDFa
-QlhjWm9tZ05oYmNuanRvTkVOSUVJa09xUVFaeE41WDVRZlE3SHFZU3MKYWtkcEFP
-bkMyMytEcnVjOHZ0SVJaT3lhQmZ0amxXVVV5Qy9NTml4TWNWQQotPiBzc2gtZWQy
-NTUxOSBoTWE0bncgMGhKOHJCQTBsNng1U0FZbjVDZWUrVzFPQmJGUEhqTlJLS0Zn
-NEdPYW9TQQpCUytPOUZ6ZkhUcCtHTHQ2WmJqWjQ5MWFuaGFPRVg0SktPVGlEUEha
-Q2JNCi0+IHNzaC1lZDI1NTE5IGV5cTNkZyBrTXFLcU1oQnBtZjFuV3Q1VkpLcEt5
-aDBmY0pGb0FNMG9Sek5lTUhTWkdzCmtGanpyWXJNZDJqVjdEd1dHQk1Qc1Qyd3d4
-VTJKZHhpb2xzc1NYdjZoL1kKLT4gc3NoLWVkMjU1MTkgN1dROVBBIGs2ajVzVHE4
-U2Z4TmdYQTFGL0RCL0YvNnNmTEdJNEkwTXQzR3JxbWlTVzQKUzl5aVlJTHRUbEpi
-MEFKdmNSWWpHQUl3U01QaXgrUm1rTVNKL3JRSnYyRQotPiBzc2gtZWQyNTUxOSBn
-U3hQMFEgdXAzU0NRU2J0WlJCRDFha3U3UXAreDFKb2gvVk5sTWt2L3RiWW1xUUps
-QQpvemtsNGVDUStHTnRlVVV1dHBUNys4Mm9tVlUxdG9CejkxQ3FXeEVPcWc0Ci0+
-IHNzaC1lZDI1NTE5IFZGY3c1ZyByQXlBUFhKT1VqUWhlcnVUak5VZVB4VnlXeHQ1
-ZG9iS2tHOW9iblBnTmdJCmhJU2RSU200MEJWaDF6bnU2NktZK3ZPNFVKS1hIejBq
-WW42L0Zqb1hzMjAKLT4gc3NoLWVkMjU1MTkgaGtidHZnIGpVM3h2SjJNSTNPWUFw
-VFVqOHRjUm81RGRNQUNsU1NOcXZGaDMyMUp1bTAKQjIzY3lxeWxodWtxbDNyamkv
-Y1hjcTc2NDNyMEMxNkkxUHluaGx3YWppUQotPiBzc2gtZWQyNTUxOSBldDJ6cFEg
-ZEZYQVN4TFkvQlBwSTVzNS9RVER3Wjk4NnZFa3J0OGFhQnNSMUcvUkZVbwppR3BM
-UGNoWFQza0RYQVZOcE5Ea21tYTJpMFp6UUVoMFh3Ym14dGJUUldFCi0+IHNzaC1l
-ZDI1NTE5IFpOcUlvZyBXSEhQNXRMaVBsMi9QUnZBUVNWU1RjdkRjSEF1ZGtVa1hM
-RnVocFRqeTNBCmVGWDhndHZ6VGFXZW1BR0VKQ0dPYXVQc0RBbmJtaFl6RlEzWDhI
-VmxWUjQKLT4gc3NoLWVkMjU1MTkgcUxqcXlRIFZSYkNlNDRTa0lwbGE3MXRZeWo0
-UDJnSGJDRDR3bkFPWEE1cTNwN0hPbncKU2grdG92aG5NRk9zTzd4RTAzVEo1NmlQ
-dE9JdXVCa3luUWtTNXhlUjhBYwotPiBzc2gtZWQyNTUxOSBCYVFsUmcgaHREazZj
-SmVubFlQS01WeTJ0N1NLWjBYMlFVUms1djg4Z0c5ZWQrdFJRRQpLYjhuOFVBamJR
-MlVkTGxTMFl4YWloZDc1bTJqL2hOVG9VME5SdU51R0JrCi0+IHNzaC1lZDI1NTE5
-IHMrcVJmZyBwL3NwQjhHT2JzalVCMnVjQ1RCVXdmZkVEK1hka2U1V2VSMFhqeStM
-OG5vClNiVVpUQ3NpWjhLNkQxUEVxWlpEVllST2RCamFTU1R3SXdnSWEzZHJucUkK
-LT4gc3NoLWVkMjU1MTkgNjJKY2NBIG5iUTE4MjlTT2VoUXBuTkZPVXhHMVJVck1N
-SmNGdmJvOUFwL0dpZTRoVG8KbVMveEg2aG02V0ZDdGlpMlptYUY4TjM2S2RPVGFN
-Rnd5ai9zZXBxQXBJYwotPiBzc2gtZWQyNTUxOSAvaHgvZEEgQjNGMWUrMm9ZMHBT
-ZDlFVVpLNm5lQVpaSy9WVlMrUGVDS2IvSmdWbHN3UQpscXFvZnVUVXRISHBKMjBP
-dGVyOU4xV3d6dFhQZGJOY0E2NnhFSjduaUVFCi0+IHNzaC1lZDI1NTE5IFd6TEdI
-QSBMa2k0V3ZvZ01oVmdBd0RlZ0NNSWYzZjI1disyL21lelFxdWE4UzJqTzBRCkll
-VHBvZFB2T0pFRWlsOVdpQ3ZQTnZEaW4rUzlWQWp1aTJwSzgrcEc0bnMKLT4gc3No
-LWVkMjU1MTkgSEovSjdBIE5YVC84RG5wT0pHb3E1YUJaTS84VzVrNlNWSVdSd1ZJ
-Y1FEbUlGV3NqMjgKYThMSHdzQkZxSWlLS3NnM25uVXRnMGN6MEdheHFNN1liV0lZ
-bk1JTmtVdwotPiBzc2gtZWQyNTUxOSBPRXFNc2cgSkx3QlNMTUFLQThDRkdweWxX
-eEhLNHRheGZycFdIWXRjLzNSZmFOTUZqVQpKYS9FSS9FQkdheGQ2OVpaT1Y2MGRG
-Y1l5OXJZWnRETkowM3dzNDYrQUVRCi0+IHNzaC1lZDI1NTE5IC9FSlh2ZyBHeTI5
-cmowT2xDU2EyNjV1djEyOXM1b1Myd2RCbmU2YjJ5ZFNKVk1UYkR3Ck9ad1RReFNM
-U3JWSTdKV2FLbVIzaGIzR1BDN09UME83aGxsUkxpOU1PbE0KLT4gWDI1NTE5IG9z
-VHgwWXhINTZndXpTSXdGMmdkdFpPRy8rQlJZUldDeFBVcUNvbUQrMm8KUytDdm5z
-bTJTUnFwQnVkWXRrNkIrVnp4OTdZMUJqMkNnVVdGS0tJMjJiawotPiAoRCciTWs7
-LWdyZWFzZSBHPWFYZC1lCjNiejRKNTB1cUlzc1FtanlLQ1AwNmhUTkNuZHptLzBK
-My9FZi9uVUd0ZlR1d04zS3BjVFJHZDR1cmNmNWx0YjcKQmdLbk16UW9DRE12UnVy
-Y2twSS8KLS0tIDhENUJrVVQ2RWR0MTlhbksxODZYUWpnZFJJTTFWcnpoenEzVVpJ
-SDlJTkUKjRfkdYqpB50PeibFrP5Xl930/HjYfKNpFGS7n2i8dwtVC/hFem8GshQJ
-NwgE1/GIPq5gKVRKaVYLaQIKCrRZl9+SDTPQB4HcKKxOD/gW0cshXyjIqiY30keZ
-ThF1h3sZbOkyGwNg/RGUFihEy+dZ7o/rpDKMAVkPzSFEN0fnS5N9GpJkuTIH074w
-dA==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHNqUFR5ZyBlbHl0
+S0lQbXBKVGpNNnJOUS9TSlp0U0EvYWFVanN3N0RMb1JudEdwYVQ4CnJGdklzeEFy
+RmxjamNyUWszYjFGb0ZZbk9EQVdERERtckpqczVscjdmUE0KLT4gc3NoLWVkMjU1
+MTkgRExNZUZnIGR4czhRYjUyU29JbnFnRk5IeXliNzZzMVMya1ZuS2tkUlFVTkxU
+aFd0VWsKenprWWQ0UEdaUGhvRlJUbnU1T2h1czZBK1dpOGwwcjJxc2p6ejV1RnM0
+RQotPiBzc2gtZWQyNTUxOSAzYkIzWmcgMHB6dzVFQ3FtaWErVWNyRXo3WnNhT2NF
+eldUVWtOaVlWOTVwcVVaOUlGMApJUDUzNmhKbUxleTV6SjV0Zmk3dno0STVIRDIv
+SUkyd1M2Z21mdUtMUXIwCi0+IHNzaC1lZDI1NTE5IHErMFhjdyBnRFBPRnNSa0Nn
+UTlpR1Y4OU1UQmNLRnRWaGxzU3RBV0c1bG90K2I5QUQ0CjArUFlGS1B2RkVKSEtP
+ajRpUUNlMkRPN3pxaEkrZ1M3RndxRDZ6U09Wc2cKLT4gc3NoLWVkMjU1MTkgWkIz
+ZTZRIFRPdXRTeEVvUTM1dlQzMll2VDFkUlY2eEFRcnRrc1lNeDZDbFE1a3BjaDgK
+MytBM0Y2Mmo2M1JOWExLQy8xTm9SR05WcmxrV2xBZ0RpeXQxeGVkZ1VZcwotPiBz
+c2gtZWQyNTUxOSBqNjdGWFEgYUw5cnJabnhhdU9lN0NPVXVUazRnVWpzcUVtM3VR
+bWQxNVVSQTN5N3hXRQp0blhXUC94TlRPbS9Ba2N1eVM0QkNNblJBa1hJYjZ1Y1lM
+UDhWbUd5bWNVCi0+IHNzaC1lZDI1NTE5IGMwVE5hUSA0TXowVjA0N2FvcER6OEts
+VTVwa0UzUEtsY005WDhmaU8zZ3VLaXQvaVRJCjB4cjJiMHVGM3hyWlg0OHhaT0lu
+K2NJQWVndzYrSDAyK25NMklSVUI4S28KLT4gc3NoLWVkMjU1MTkgbjhDcFV3IFNE
+Q1NZbnpqUkdiaktnYkxZdzZrYUVqWDEvYnMvOTJqSUpybERTNk9uQ0kKYlMzZkVu
+SXVtaWk2WEtDMEpwZFM3ZVIyWHQwUWNOZjVRS0I0ZjN5MklHYwotPiBzc2gtZWQy
+NTUxOSBqSThSQWcgWTZIMCtNMCtzTFpROHpBMnA3b2s2UFE2dDZGbnlxU2VxMlkz
+aGJFUzV6awpKNDhobHQrTCs4cUVpNE5wblJMako3bU5tVldjVDBjVlJOOHhkUTNk
+NFdrCi0+IHNzaC1lZDI1NTE5IFQrc2JHQSBTbVlBTXIzQ09SOHRJakZXK3NkT1Uy
+RFgrUTZncSsyK3p5WlVDSFNwM2lFClErRHk4Qmp2VlIvZW8rV2lNME53ZFlIUmVC
+bXF5RlVvV2FUM3ZmeWpaQzgKLT4gc3NoLWVkMjU1MTkgaE1hNG53IDBINGhyMDBy
+bkp0RWpTU0F6Uk1kaXllRHBHbXF2QWUwNkN1U0tEWE53VGsKdi9QRlhwRCtyQkRq
+cng1Wk1rZkx2NnJTMUxGajN3b2Z3SG0zd0ptcklCZwotPiBzc2gtZWQyNTUxOSBl
+eXEzZGcgcnQ4WUFMcGRtL1BvYTkxWU12WTdkT1lLRmJlZXZ4cWtHNG54QVo0dDYw
+RQp2NkMwbTROZTBuRUVLNEs3L3BmOTZ2S3dDL0hUbm5OaHZXbjVCRG15bExnCi0+
+IHNzaC1lZDI1NTE5IDdXUTlQQSBPL0t1ZWptTm5YQXIwc3ZNUGhkaVM5QU1DMkNL
+NU1WSFlTT05KOWR3dGhJCmdTTEIrNEZma3E0UzArMndqVEgzWnVLNzl0TjhsbG9P
+OE9aRVk1Ung1cEkKLT4gc3NoLWVkMjU1MTkgZ1N4UDBRIGJNazFtRThSVVVvb3dP
+RHV5WGxCbktDK3c5aEhiYkphNU4zUnVNUVNNV2sKbWZJYkNSZFMvTDI1WVg5SnJV
+bUFSY2JsNDJBc253dlN5Y2Nqdm9TbU9IawotPiBzc2gtZWQyNTUxOSBWRmN3NWcg
+eEo0dmRNWVpuVGdxRHpXc09tUDZldFRKcTBIMVVWcXdmVFRhZnZmenBETQpJWHVp
+NWJNRWhacHlMbHlQcjEzdEZWdUVpbGg0N2pqMjcvTk92UDJpNUlvCi0+IHNzaC1l
+ZDI1NTE5IGhrYnR2ZyB0SFJGRE03T3lnTUJZakVCcnQxVklPNXhzak94eU5KUzNX
+L216SCtUWEVzCmRrS2Rlc1JiNEg1KzExaUsrNHJuSDlTcU5Oa0J4QVZKVmNBRGFP
+ZWlqUjAKLT4gc3NoLWVkMjU1MTkgZXQyenBRIEFhMFVxZ3RRbk4za2t5cWtwVjVi
+Qm9ucVdMekVsSHEwSWlML0JIdmQ2SFkKWW5mWnQvRWlaT3hJLzJyTE5RdTNUMWNM
+SDB4TjVKZCtDN0tCR1NhdnRqbwotPiBzc2gtZWQyNTUxOSBaYkxKV0EgV1loMWZx
+OHhKelNvNzErMDc4cUE5amgycTFTem5lVmlGYTk5bUM2T2dEUQpkMVQ0VS80Y3Jt
+QTZUVnNZV0daczM0Titvc3Q1T2JiTVZYV2tXOW4xV0VRCi0+IHNzaC1lZDI1NTE5
+IFpOcUlvZyAzMnZ2NjR1R2R2UlJNZjNvOU9RckR0MEtnbllyYVJPSUZtUDNWSU5k
+U3c4Ckgza2txalJhOW14c1dGZ0VTc3EzK2NpOUJaVWhqN2lMWU9HL3hMSWlJUVkK
+LT4gc3NoLWVkMjU1MTkgcUxqcXlRIHMxNStVTnY1TUZJaHlXQnNTSFhXditsWnVF
+Y2ZKRWZ5UXVPZUVKY2VjakEKV1N3ODVFYXROTzFReWE5Y1A5MkpXUjJVc00wVVd3
+ZUpzTC9rRGdOWUpxWQotPiBzc2gtZWQyNTUxOSBCYVFsUmcganpkWlpaWlRVQ3Vp
+Y2hvbkpld2kzdzVtdERHajBNUTEyM0NOWlp0WkxtRQp1MEJUKzFUSW9tWjluVU9Y
+clBzNFpzdU83MXdGN2dJSGducnplbEd4M1JNCi0+IHNzaC1lZDI1NTE5IHMrcVJm
+ZyBSRW1pZWFhQkpQRTFYTG9IZnVmWmx6S2pNUll4MGhtRFd1Y0ZhS25JNFZVCjhU
+UDhoOTlTUEtqbytZMjZ2NlozcnZTNXVNcVA3cU1TRmtsL1g4bEhKUzgKLT4gc3No
+LWVkMjU1MTkgNjJKY2NBIElSSXZjc3J5cWNwOHFNV281YzBrVzc2TlVwMnRwb0NJ
+dEdST0s4MEhmQnMKaTNEdkFjRktCZHNCY3FsWE5UbFo1R3lXSlI2NE5MR25neWJ4
+NTlsSllxWQotPiBzc2gtZWQyNTUxOSAvaHgvZEEgOExaRjJiNTJkUGFxZllSK1Uz
+eWxQTmtxOVFPZkVFb2w2Z0tmZVpwTndDWQpuRFlqZWdaQjZaT1BZSmllVzB5NWhY
+MmhHaWtZOXFERzhSRWRXWk5TR1RRCi0+IHNzaC1lZDI1NTE5IFd6TEdIQSBtZW04
+eWlNWU9JOXYvcVlsb1JXM2JKRlREeXJXNHd6MlkvazZrSzdscG5BCnZzWUFwb3lK
+dUhkcDZNakFPN0RMRG5LQzdqU1UzNlJ6eGRGSGlhYUx0YXMKLT4gc3NoLWVkMjU1
+MTkgSEovSjdBIDBaNzZGVkdaVWlWNk4yVW5UdnFCZ2xWUEtIc2QzQmJTMnlINVF1
+V093UmsKcXNhSnlnWHQrRzVSU296NENDN29aMUN5VlRIcittdGNySGhvMHZlT0xl
+NAotPiBzc2gtZWQyNTUxOSBPRXFNc2cgNUFSc045eUVqQWI3MXB4Tkd2RndDS2Na
+VGJrblFLaENPVlZucFdGRGFDTQp6dlRHTnRLSFkxb1RFdmxGS09Jenh2Q25VZ2ha
+QWQ4YUNjdVNJbW8vVGVrCi0+IHNzaC1lZDI1NTE5IC9FSlh2ZyBGM2lrUG1DWUx3
+YndZWWdobVo3TjZHTDNabmdsa3ZHcndwUXVZSVg5T0VZCjNYdlFYSHBsWjBTWXlS
+V0lSZkpwVE05eU1LcFBEbWdXWEZ0U0tSTkthQnMKLT4gWDI1NTE5IDF5SmczUWpo
+bkdmWS9SamxtTTF1eVJnc1QxUGJiUjQwR1VSTmdxMEtqQzAKeTF0NWp6dG1CWGNy
+VVVXVGFLV3dkWWo2YTVkZmtXcHRZai9FSDVBSmJhbwotPiAmJC1ncmVhc2UgaWU3
+YGkpVSBNV0ZfIDM1fltQdzBcCmZYRXB1NEVMNkVqWVF3Ci0tLSB2RVRFYmVGVklB
+bGFiUTBKYlMrRitvN2NnUkhScTMvWml6ZzRKU3ZIeEtvChoKB2c5roTC97pdDOi6
+aPFIaTyOu9NZ4ESwwRjpEgB0D6GP2r7YR3CnxVyXa4sCFUnTF8dLUkABFnSeNeQZ
+M64tM6J+tZAyJa9IKaTgSqvQaGYHHYinygNvf6BShCK4nPUJu0cV6gFtqFle0MWA
+Rez5eRMFH/M2aubhwBeDyHG4WRelkt7oMVXyY6U=
 -----END AGE ENCRYPTED FILE-----

secrets/whale2/enshrouded.env.age

@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC9FSlh2ZyBQc3dL
+bkttTXJPWnZzYVJ6OUc2cjJvZWJLWHk2QXYvRU9TL3RBTmFmQ1dNClRtaUwvcDJa
+c3h6eXpPR3dKSVZDVHJzNjR4b0Y5K3Zadk5vTkZiZS9RYkEKLT4gWDI1NTE5IE9R
+Y0g2bEJsNmdLaVJteDJaakFMZEdxRU55N2pNbzhkakxuRVFmdVN0ajQKZXZrRHdu
+WFFwMUFkUmJQbm9ONlFRWGdMWmtsWHlOaWVjMGtMdVM1YmdoUQotPiAwIm5PWS1n
+cmVhc2UgUUosbyl4CkFIWDA4L3YwOFBYVUFMZnB6U3VkNFJQVFlEMThVeTV4bHlu
+QmF2TFBobmtJS1hERUtSZld2UEZyb29nNEdGdWEKenliMmhQL1VrY2dFS3VzSEZB
+dm1jT2xOQkxnbCtBV21WT3ZMVjl0WEpPWQotLS0gckNCZEp3VU56eTFFR1ZzbTc3
+WTRIcVZGY0Z1YlNUS3l0cWJ1TW5YUjF6SQoqTDq/up9Q3tQnNJdsnfiwYqA5LW6G
+nKJXGbpnt3dpXxv/1+KRgF6pVKVQtyNFncQW7SC6K4uFw7iv6A==
+-----END AGE ENCRYPTED FILE-----