nixos/shill: Reduce MemoryMax

2024-07-07 11:57:45 +01:00
102 changed files with 2398 additions and 3794 deletions
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -6,7 +6,7 @@ on:

 jobs:
  check:
-    name: Check, build and cache nixfiles
+    name: Check, build and cache Nix flake
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
@@ -21,27 +21,21 @@ jobs:
            # Big C++ projects fill up memory...
            cores = 6

-            extra-substituters = https://nix-cache.nul.ie
-            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
+            extra-substituters = https://nix-cache.nul.ie/main
+            extra-trusted-public-keys = main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8=
+      - name: Set up attic
+        run: |
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+            login --set-default colony https://nix-cache.nul.ie "${{ secrets.NIX_CACHE_TOKEN }}"

      - name: Check flake
-        run: nix flake check --no-build
-
-      - name: Build (and cache) the world
+        run: nix flake check
+      - name: Build the world
        id: build
-        env:
-          HARMONIA_SSH_KEY: ${{ secrets.HARMONIA_SSH_KEY }}
        run: |
-          nix eval --json --apply "builtins.attrNames" .#ci.x86_64-linux | jq -cr '.[]' | while read job; do
-            echo "::group::Build $job"
-            nix build --no-link .#ci.x86_64-linux."$job"
-            echo "::endgroup::"
-
-            echo "::group::Cache $job"
-            ci/push-to-cache.sh "$(nix eval --raw .#ci.x86_64-linux."$job")"
-            echo "::endgroup::"
-          done
-
-          echo "Building and caching CI derivation"
-          nix build --no-link .#ciDrv.x86_64-linux
-          UPDATE_PROFILE=1 ci/push-to-cache.sh "$(nix eval --raw .#ciDrv.x86_64-linux)"
+          path=$(nix build --no-link .#ci.x86_64-linux --json | jq -r .[0].outputs.out)
+          echo "path=$path" >> "$GITHUB_OUTPUT"
+      - name: Push to cache
+        run: |
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+            push main ${{ steps.build.outputs.path }}
--- a/.gitea/workflows/installer.yaml
+++ b/.gitea/workflows/installer.yaml
@@ -21,13 +21,15 @@ jobs:
            # Make sure we're using sandbox
            sandbox-fallback = false

-            extra-substituters = https://nix-cache.nul.ie
-            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
-
-      - name: Set up vars
+            extra-substituters = https://nix-cache.nul.ie/main
+            extra-trusted-public-keys = main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8=
+      - name: Set up attic
        id: setup
        run: |
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+            login --set-default colony https://nix-cache.nul.ie "${{ secrets.NIX_CACHE_TOKEN }}"
          echo "short_rev=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+
      - name: Build installer ISO
        run: |
          nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.iso
--- a/.keys/harmonia.pub
+++ b/.keys/harmonia.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXRXkYnBf2opIjN+bXE7HmhUpa4hyXJUGmBT+MRccT4 harmonia
--- a/ci/known_hosts
+++ b/ci/known_hosts
@@ -1 +0,0 @@
-object-ctr.ams1.int.nul.ie ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8
--- a/ci/push-to-cache.sh
+++ b/ci/push-to-cache.sh
@@ -1,31 +0,0 @@
-#!/bin/sh
-set -e
-
-REMOTE_STORE=/var/lib/harmonia
-SSH_HOST="harmonia@object-ctr.ams1.int.nul.ie"
-SSH_KEY=/tmp/harmonia.key
-STORE_URI="ssh-ng://$SSH_HOST?ssh-key=$SSH_KEY&remote-store=$REMOTE_STORE"
-
-remote_cmd() {
-  ssh -i "$SSH_KEY" "$SSH_HOST" env HOME=/run/harmonia NIX_REMOTE="$REMOTE_STORE" "$@"
-}
-
-umask_old=$(umask)
-umask 0066
-echo "$HARMONIA_SSH_KEY" | base64 -d > "$SSH_KEY"
-umask $umask_old
-
-mkdir -p ~/.ssh
-cp ci/known_hosts ~/.ssh/
-path="$1"
-
-echo "Pushing $path to cache..."
-nix copy --no-check-sigs --to "$STORE_URI" "$path"
-
-if [ -n "$UPDATE_PROFILE" ]; then
-  echo "Updating profile..."
-  remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
-
-  echo "Collecting garbage..."
-  remote_cmd nix-collect-garbage --delete-older-than 60d
-fi
--- a/devshell/commands.nix
+++ b/devshell/commands.nix
@@ -77,12 +77,7 @@ in
      name = "build-n-switch";
      category = "tasks";
      help = "Shortcut to nixos-rebuild for this flake";
-      command = ''
-        # HACK: Upstream changes in Git + Nix makes this necessary
-        # https://github.com/NixOS/nix/issues/10202
-        doas git config --global --add safe.directory "$PWD"
-        doas nixos-rebuild --flake . "$@"
-      '';
+      command = ''doas nixos-rebuild --flake . "$@"'';
    }
    {
      name = "run-vm";
@@ -120,17 +115,29 @@ in
      help = "Build home-manager configuration";
      command = ''nix build "''${@:2}" ".#homeConfigurations.\"$1\".activationPackage"'';
    }
+    {
+      name = "update-inputs";
+      category = "tasks";
+      help = "Update flake inputs";
+      command = ''
+        args=()
+        for f in "$@"; do
+          args+=(--update-input "$f")
+        done
+        nix flake lock "''${args[@]}"
+      '';
+    }
    {
      name = "update-nixpkgs";
      category = "tasks";
      help = "Update nixpkgs flake inputs";
-      command = ''nix flake update nixpkgs-{unstable,stable,mine,mine-stable}'';
+      command = ''update-inputs nixpkgs-{unstable,stable,mine,mine-stable}'';
    }
    {
      name = "update-home-manager";
      category = "tasks";
      help = "Update home-manager flake inputs";
-      command = ''nix flake update home-manager-{unstable,stable}'';
+      command = ''update-inputs home-manager-{unstable,stable}'';
    }
    {
      name = "update-installer";
@@ -138,15 +145,5 @@ in
      help = "Update installer tag (to trigger new release)";
      command = ''git tag -f installer && git push -f origin installer'';
    }
-    {
-      name = "deploy-multi";
-      category = "tasks";
-      help = "Deploy multiple flakes at once";
-      command = ''
-        for f in $@; do
-          deploy "$O" $f
-        done
-      '';
-    }
  ];
 }
--- a/devshell/default.nix
+++ b/devshell/default.nix
@@ -11,7 +11,7 @@ in

    NIX_USER_CONF_FILES = toString (pkgs.writeText "nix.conf"
      ''
-        experimental-features = nix-command flakes ca-derivations
+        experimental-features = nix-command flakes ca-derivations repl-flake
        connect-timeout = 5
        fallback = true
        ${lib.my.c.nix.cache.conf}
@@ -24,10 +24,10 @@ in
    coreutils
    nixVersions.stable
    rage
-    wireguard-tools
    (pkgs.writeShellScriptBin "deploy" ''
      exec ${deploy-rs.deploy-rs}/bin/deploy --skip-checks "$@"
    '')
    home-manager
+    attic-client
  ];
 }
--- a/flake.lock
+++ b/flake.lock
@@ -8,14 +8,14 @@
          "ragenix",
          "nixpkgs"
        ],
-        "systems": "systems_6"
+        "systems": "systems_8"
      },
      "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1707830867,
+        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
        "type": "github"
      },
      "original": {
@@ -24,77 +24,111 @@
        "type": "github"
      }
    },
+    "attic": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "nixpkgs-stable": [
+          "nixpkgs-stable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1711742460,
+        "narHash": "sha256-0O4v6e4a1toxXZ2gf5INhg4WPE5C5T+SVvsBt+45Mcc=",
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "rev": "4dbdbee45728d8ce5788db6461aaaa89d98081f0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "type": "github"
+      }
+    },
    "boardie": {
      "inputs": {
        "devshell": "devshell",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
-        "pyproject-nix": "pyproject-nix"
+        "poetry2nix": "poetry2nix"
      },
      "locked": {
-        "lastModified": 1757170758,
-        "narHash": "sha256-FyO+Brz5eInmdAkG8B2rJAfrNGMCsDQ8BPflKV2+r5g=",
-        "owner": "devplayer0",
-        "repo": "boardie",
-        "rev": "ed5fd520d5bf122871b5508dd3c1eda28d6e515d",
-        "type": "github"
+        "lastModified": 1718746012,
+        "narHash": "sha256-sp9vGl3vWXvD/C2JeMDi5nbW6CkKIC3Q2JMGKwexYEs=",
+        "ref": "refs/heads/master",
+        "rev": "ea24100bd4a914b9e044a2085a3785a6bd3a3833",
+        "revCount": 5,
+        "type": "git",
+        "url": "https://git.nul.ie/dev/boardie"
      },
      "original": {
-        "owner": "devplayer0",
-        "repo": "boardie",
-        "type": "github"
+        "type": "git",
+        "url": "https://git.nul.ie/dev/boardie"
      }
    },
    "borgthin": {
      "inputs": {
        "devshell": "devshell_2",
-        "flake-utils": "flake-utils_4",
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1732994213,
-        "narHash": "sha256-3v8cTsPB+TIdWmc1gmRNd0Mi0elpfi39CXRsA/2x/Oo=",
-        "owner": "devplayer0",
-        "repo": "borg",
-        "rev": "795f5009445987d42f32de1b49fdeb2d88326a64",
-        "type": "github"
-      },
-      "original": {
-        "owner": "devplayer0",
-        "repo": "borg",
-        "type": "github"
-      }
-    },
-    "copyparty": {
-      "inputs": {
-        "flake-utils": "flake-utils_5",
+        "flake-utils": "flake-utils_6",
        "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs-mine"
        ]
      },
      "locked": {
-        "lastModified": 1757362872,
-        "narHash": "sha256-juUSWjxX8y2gueU34BpkQipUlhZRFJNLFccdprle0iM=",
-        "owner": "9001",
-        "repo": "copyparty",
-        "rev": "e09f3c9e2c3dccf8f3912539e04dd840b10b51ee",
+        "lastModified": 1692446555,
+        "narHash": "sha256-Uzl8TiGKVBCjwYhkprSwbcu8xlcQwnDNIqsk9rM+P9w=",
+        "owner": "devplayer0",
+        "repo": "borg",
+        "rev": "44a3dc19b014ebc8d33db0b3e145ed7bfc9a0cb7",
        "type": "github"
      },
      "original": {
-        "owner": "9001",
-        "repo": "copyparty",
+        "owner": "devplayer0",
+        "repo": "borg",
        "type": "github"
      }
    },
    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "attic",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1725409566,
-        "narHash": "sha256-PrtLmqhM6UtJP7v7IGyzjBFhbG4eOAHT6LPYOFmYfbk=",
+        "lastModified": 1702918879,
+        "narHash": "sha256-tWJqzajIvYcaRWxn+cLUB9L9Pv4dQ3Bfit/YjU5ze3g=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "7e4586bad4e3f8f97a9271def747cf58c4b68f3c",
+        "rev": "7195c00c272fdd92fc74e7d5a0a2844b9fadb2fb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "crane_2": {
+      "inputs": {
+        "nixpkgs": [
+          "ragenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1708794349,
+        "narHash": "sha256-jX+B1VGHT0ruHHL5RwS8L21R6miBn4B6s9iVyUJsJJY=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "2c94ff9a6fbeb9f3ea0107f28688edbe9c81deaa",
        "type": "github"
      },
      "original": {
@@ -128,18 +162,18 @@
    },
    "deploy-rs": {
      "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1756719547,
-        "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
+        "lastModified": 1715699772,
+        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
+        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
        "type": "github"
      },
      "original": {
@@ -150,7 +184,7 @@
    },
    "devshell": {
      "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
        "nixpkgs": "nixpkgs"
      },
      "locked": {
@@ -169,7 +203,7 @@
    },
    "devshell-tools": {
      "inputs": {
-        "flake-utils": "flake-utils_9",
+        "flake-utils": "flake-utils_11",
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
@@ -188,8 +222,8 @@
    },
    "devshell_2": {
      "inputs": {
-        "flake-utils": "flake-utils_3",
-        "nixpkgs": "nixpkgs_2"
+        "flake-utils": "flake-utils_5",
+        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
        "lastModified": 1671489820,
@@ -207,16 +241,17 @@
    },
    "devshell_3": {
      "inputs": {
+        "flake-utils": "flake-utils_7",
        "nixpkgs": [
          "nixpkgs-unstable"
        ]
      },
      "locked": {
-        "lastModified": 1741473158,
-        "narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
+        "lastModified": 1713532798,
+        "narHash": "sha256-wtBhsdMJA3Wa32Wtm1eeo84GejtI43pMrFrmwLXrsEc=",
        "owner": "numtide",
        "repo": "devshell",
-        "rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
+        "rev": "12e914740a25ea1891ec619bb53cf5e6ca922e40",
        "type": "github"
      },
      "original": {
@@ -228,11 +263,27 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1673956053,
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
        "type": "github"
      },
      "original": {
@@ -242,15 +293,12 @@
      }
    },
    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
      "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
        "type": "github"
      },
      "original": {
@@ -278,6 +326,42 @@
      }
    },
    "flake-utils_11": {
+      "inputs": {
+        "systems": "systems_10"
+      },
+      "locked": {
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_12": {
+      "inputs": {
+        "systems": "systems_11"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_13": {
      "locked": {
        "lastModified": 1667395993,
        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
@@ -293,6 +377,24 @@
      }
    },
    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
      "inputs": {
        "systems": "systems_2"
      },
@@ -310,7 +412,25 @@
        "type": "github"
      }
    },
-    "flake-utils_3": {
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_5": {
      "locked": {
        "lastModified": 1642700792,
        "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
@@ -325,7 +445,7 @@
        "type": "github"
      }
    },
-    "flake-utils_4": {
+    "flake-utils_6": {
      "locked": {
        "lastModified": 1667395993,
        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
@@ -340,49 +460,16 @@
        "type": "github"
      }
    },
-    "flake-utils_5": {
-      "locked": {
-        "lastModified": 1678901627,
-        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_6": {
-      "inputs": {
-        "systems": "systems_4"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
    "flake-utils_7": {
      "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_6"
      },
      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
        "type": "github"
      },
      "original": {
@@ -410,15 +497,12 @@
      }
    },
    "flake-utils_9": {
-      "inputs": {
-        "systems": "systems_8"
-      },
      "locked": {
-        "lastModified": 1709126324,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
        "type": "github"
      },
      "original": {
@@ -456,16 +540,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1756679287,
-        "narHash": "sha256-Xd1vOeY9ccDf5VtVK12yM0FS6qqvfUop8UQlxEB+gTQ=",
+        "lastModified": 1716729592,
+        "narHash": "sha256-Y3bOjoh2cFBqZN0Jw1zUdyr7tjygyxl2bD/QY73GZP0=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "07fc025fe10487dd80f2ec694f1cd790e752d0e8",
+        "rev": "2c78a57c544dd19b07442350727ced097e1aa6e6",
        "type": "github"
      },
      "original": {
        "id": "home-manager",
-        "ref": "release-25.05",
+        "ref": "release-23.11",
        "type": "indirect"
      }
    },
@@ -476,11 +560,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1757075491,
-        "narHash": "sha256-a+NMGl5tcvm+hyfSG2DlVPa8nZLpsumuRj1FfcKb2mQ=",
+        "lastModified": 1717097707,
+        "narHash": "sha256-HC5vJ3oYsjwsCaSbkIPv80e4ebJpNvFKQTBOGlHvjLs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "f56bf065f9abedc7bc15e1f2454aa5c8edabaacf",
+        "rev": "0eb314b4f0ba337e88123e0b1e57ef58346aafd9",
        "type": "github"
      },
      "original": {
@@ -490,11 +574,11 @@
    },
    "impermanence": {
      "locked": {
-        "lastModified": 1737831083,
-        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "lastModified": 1708968331,
+        "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=",
        "owner": "nix-community",
        "repo": "impermanence",
-        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30",
        "type": "github"
      },
      "original": {
@@ -503,35 +587,41 @@
        "type": "github"
      }
    },
-    "libnetRepo": {
-      "flake": false,
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "boardie",
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1745053097,
-        "narHash": "sha256-BEW57utyWCqP4U+MzCXFqbvEC8LE3iZv5dsPMrmTJ9Q=",
-        "owner": "oddlama",
-        "repo": "nixos-extra-modules",
-        "rev": "7565d8554b0fc9d621851150e7939d34a3a8cd6c",
+        "lastModified": 1703863825,
+        "narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
        "type": "github"
      },
      "original": {
-        "owner": "oddlama",
-        "repo": "nixos-extra-modules",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
        "type": "github"
      }
    },
    "nixGL": {
      "inputs": {
-        "flake-utils": "flake-utils_7",
+        "flake-utils": "flake-utils_9",
        "nixpkgs": [
          "nixpkgs-unstable"
        ]
      },
      "locked": {
-        "lastModified": 1752054764,
-        "narHash": "sha256-Ob/HuUhANoDs+nvYqyTKrkcPXf4ZgXoqMTQoCK0RFgQ=",
+        "lastModified": 1713543440,
+        "narHash": "sha256-lnzZQYG0+EXl/6NkGpyIz+FEOc/DSEG57AP1VsdeNrM=",
        "owner": "nix-community",
        "repo": "nixGL",
-        "rev": "a8e1ce7d49a149ed70df676785b07f63288f53c5",
+        "rev": "310f8e49a149e4c9ea52f1adf70cdc768ec53f8a",
        "type": "github"
      },
      "original": {
@@ -558,11 +648,11 @@
    },
    "nixpkgs-mine": {
      "locked": {
-        "lastModified": 1757173087,
-        "narHash": "sha256-NYXuC8xUUbvtwbaC1aLdpQKHzQtQ2XB3VkK0hfYTPd8=",
+        "lastModified": 1719916745,
+        "narHash": "sha256-bZ7yzJ0uk9jYr4YGh8OPjhhIdJLWWe9MMVr5eVlGdxI=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "06e4c8cd503ed73806744b39368393df38b36bb7",
+        "rev": "0d56687226b3838a076a72ff8efadb288a3f9fdd",
        "type": "github"
      },
      "original": {
@@ -574,11 +664,11 @@
    },
    "nixpkgs-mine-stable": {
      "locked": {
-        "lastModified": 1757173155,
-        "narHash": "sha256-aDNAiQQsrgS/coVOqLbtILpOUouE6jp/wqAsO8Dta/o=",
+        "lastModified": 1719916783,
+        "narHash": "sha256-TdVvfSIQveEnmAk8RP0szTzGbxwq8QiitjSY8ZoTnlU=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "8a1a03f2d17918a6d51746371031a8fe4014c549",
+        "rev": "ea7add4da4c7f972b8d75a4e1abaf60b90c83cbb",
        "type": "github"
      },
      "original": {
@@ -590,26 +680,26 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1757020766,
-        "narHash": "sha256-PLoSjHRa2bUbi1x9HoXgTx2AiuzNXs54c8omhadyvp0=",
+        "lastModified": 1716991068,
+        "narHash": "sha256-Av0UWCCiIGJxsZ6TFc+OiKCJNqwoxMNVYDBChmhjNpo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "fe83bbdde2ccdc2cb9573aa846abe8363f79a97a",
+        "rev": "25cf937a30bf0801447f6bf544fc7486c6309234",
        "type": "github"
      },
      "original": {
        "id": "nixpkgs",
-        "ref": "nixos-25.05",
+        "ref": "nixos-23.11",
        "type": "indirect"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1756787288,
-        "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=",
+        "lastModified": 1716948383,
+        "narHash": "sha256-SzDKxseEcHR5KzPXLwsemyTR/kaM9whxeiJohbL04rs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d0fc30899600b9b3466ddb260fd83deb486c32f1",
+        "rev": "ad57eef4ef0659193044870c731987a6df5cf56b",
        "type": "github"
      },
      "original": {
@@ -619,6 +709,22 @@
      }
    },
    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1718632497,
+        "narHash": "sha256-YtlyfqOdYMuu7gumZtK0Kg7jr4OKfHUhJkZfNUryw68=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c58b4a9118498c1055c5908a5bbe666e56abe949",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
      "locked": {
        "lastModified": 1643381941,
        "narHash": "sha256-pHTwvnN4tTsEKkWlXQ8JMY423epos8wUOhthpwJjtpc=",
@@ -634,20 +740,6 @@
        "type": "github"
      }
    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1673606088,
-        "narHash": "sha256-wdYD41UwNwPhTdMaG0AIe7fE1bAdyHe6bB4HLUqUvck=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "37b97ae3dd714de9a17923d004a2c5b5543dfa6d",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
    "nixpkgs_4": {
      "locked": {
        "lastModified": 1709309926,
@@ -680,64 +772,63 @@
        "type": "github"
      }
    },
-    "pyproject-nix": {
+    "poetry2nix": {
      "inputs": {
-        "nixpkgs": [
-          "boardie",
-          "nixpkgs"
-        ]
+        "flake-utils": "flake-utils_4",
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": "nixpkgs_2",
+        "systems": "systems_4",
+        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1756395552,
-        "narHash": "sha256-5aJM14MpoLk2cdZAetu60OkLQrtFLWTICAyn1EP7ZpM=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "030dffc235dcf240d918c651c78dc5f158067b51",
+        "lastModified": 1718726452,
+        "narHash": "sha256-w4hJSYvACz0i5XHtxc6XNyHwbxpisN13M2kA2Y7937o=",
+        "owner": "nix-community",
+        "repo": "poetry2nix",
+        "rev": "53e534a08c0cd2a9fa7587ed1c3e7f6aeb804a2c",
        "type": "github"
      },
      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
+        "owner": "nix-community",
+        "repo": "poetry2nix",
        "type": "github"
      }
    },
    "ragenix": {
      "inputs": {
        "agenix": "agenix",
-        "crane": "crane",
-        "flake-utils": "flake-utils_8",
+        "crane": "crane_2",
+        "flake-utils": "flake-utils_10",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1731774781,
-        "narHash": "sha256-vwsUUYOIs8J6weeSK1n1mbZf8fgvygGUMsadx0JmG70=",
-        "owner": "devplayer0",
+        "lastModified": 1709831932,
+        "narHash": "sha256-WsP8rOFa/SqYNbVtYJ/l2mWWOgyDTJFbITMV8tv0biI=",
+        "owner": "yaxitech",
        "repo": "ragenix",
-        "rev": "ec4115da7b67c783b1091811e17dbcba50edd1c6",
+        "rev": "06de099ef02840ec463419f12de73729d458e1eb",
        "type": "github"
      },
      "original": {
-        "owner": "devplayer0",
-        "ref": "add-rekey-one-flag",
+        "owner": "yaxitech",
        "repo": "ragenix",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
+        "attic": "attic",
        "boardie": "boardie",
        "borgthin": "borgthin",
-        "copyparty": "copyparty",
        "deploy-rs": "deploy-rs",
        "devshell": "devshell_3",
-        "flake-utils": "flake-utils_6",
+        "flake-utils": "flake-utils_8",
        "home-manager-stable": "home-manager-stable",
        "home-manager-unstable": "home-manager-unstable",
        "impermanence": "impermanence",
-        "libnetRepo": "libnetRepo",
        "nixGL": "nixGL",
        "nixpkgs-mine": "nixpkgs-mine",
        "nixpkgs-mine-stable": "nixpkgs-mine-stable",
@@ -749,17 +840,21 @@
    },
    "rust-overlay": {
      "inputs": {
+        "flake-utils": [
+          "ragenix",
+          "flake-utils"
+        ],
        "nixpkgs": [
          "ragenix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1725675754,
-        "narHash": "sha256-hXW3csqePOcF2e/PYnpXj72KEYyNj2HzTrVNmS/F7Ug=",
+        "lastModified": 1708740535,
+        "narHash": "sha256-NCTw235XwSDbeTAtAwg/hOeNOgwYhVq7JjDdbkOgBeA=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "8cc45e678e914a16c8e224c3237fb07cf21e5e54",
+        "rev": "9b24383d77f598716fa0cbb8b48c97249f5ee1af",
        "type": "github"
      },
      "original": {
@@ -770,7 +865,7 @@
    },
    "sbt": {
      "inputs": {
-        "flake-utils": "flake-utils_11",
+        "flake-utils": "flake-utils_13",
        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
@@ -790,22 +885,22 @@
    "sharry": {
      "inputs": {
        "devshell-tools": "devshell-tools",
-        "flake-utils": "flake-utils_10",
+        "flake-utils": "flake-utils_12",
        "nixpkgs": [
          "nixpkgs-unstable"
        ],
        "sbt": "sbt"
      },
      "locked": {
-        "lastModified": 1741328331,
-        "narHash": "sha256-OtsHm9ykxfAOMRcgFDsqFBBy5Wu0ag7eq1qmTIluVcw=",
-        "owner": "eikek",
+        "lastModified": 1710796573,
+        "narHash": "sha256-23fLZFNacZU/skc8i7JExHfD//Mpkslhga6f5ATTqBA=",
+        "owner": "devplayer0",
        "repo": "sharry",
-        "rev": "6203b90f9a76357d75c108a27ad00f323d45c1d0",
+        "rev": "4e7a87880ba0807afd5d21706ce383b8b8727990",
        "type": "github"
      },
      "original": {
-        "owner": "eikek",
+        "owner": "devplayer0",
        "repo": "sharry",
        "type": "github"
      }
@@ -825,6 +920,36 @@
        "type": "github"
      }
    },
+    "systems_10": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_11": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
@@ -865,9 +990,8 @@
        "type": "github"
      },
      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
+        "id": "systems",
+        "type": "indirect"
      }
    },
    "systems_5": {
@@ -945,16 +1069,38 @@
        "type": "github"
      }
    },
-    "utils": {
+    "treefmt-nix": {
      "inputs": {
-        "systems": "systems_3"
+        "nixpkgs": [
+          "boardie",
+          "poetry2nix",
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1718522839,
+        "narHash": "sha256-ULzoKzEaBOiLRtjeY3YoGFJMwWSKRYOic6VNw2UyTls=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "68eb1dc333ce82d0ab0c0357363ea17c31ea1f81",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -3,46 +3,41 @@

  inputs = {
    flake-utils.url = "github:numtide/flake-utils";
-    # libnet.url = "github:reo101/nix-lib-net";
-    libnetRepo = {
-      url = "github:oddlama/nixos-extra-modules";
-      flake = false;
-    };
    devshell.url = "github:numtide/devshell";
    devshell.inputs.nixpkgs.follows = "nixpkgs-unstable";

    nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "nixpkgs/nixos-25.05";
+    nixpkgs-stable.url = "nixpkgs/nixos-23.11";
    nixpkgs-mine.url = "github:devplayer0/nixpkgs/devplayer0";
    nixpkgs-mine-stable.url = "github:devplayer0/nixpkgs/devplayer0-stable";

    home-manager-unstable.url = "home-manager";
    home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    home-manager-stable.url = "home-manager/release-25.05";
+    home-manager-stable.url = "home-manager/release-23.11";
    home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";

    # Stuff used by the flake for build / deployment
-    # ragenix.url = "github:yaxitech/ragenix";
-    ragenix.url = "github:devplayer0/ragenix/add-rekey-one-flag";
+    ragenix.url = "github:yaxitech/ragenix";
    ragenix.inputs.nixpkgs.follows = "nixpkgs-unstable";
    deploy-rs.url = "github:serokell/deploy-rs";
    deploy-rs.inputs.nixpkgs.follows = "nixpkgs-unstable";

    # Stuff used by systems
    impermanence.url = "github:nix-community/impermanence";
-    boardie.url = "github:devplayer0/boardie";
+    boardie.url = "git+https://git.nul.ie/dev/boardie";
    boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
    nixGL.url = "github:nix-community/nixGL";
    nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";

    # Packages not in nixpkgs
-    sharry.url = "github:eikek/sharry";
+    # sharry.url = "github:eikek/sharry";
+    sharry.url = "github:devplayer0/sharry";
    sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
    borgthin.url = "github:devplayer0/borg";
-    # TODO: Update borgthin so this works
-    # borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
-    copyparty.url = "github:9001/copyparty";
-    copyparty.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
+    attic.url = "github:zhaofengli/attic";
+    attic.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    attic.inputs.nixpkgs-stable.follows = "nixpkgs-stable";
  };

  outputs =
@@ -57,7 +52,7 @@
      ...
    }:
    let
-      inherit (builtins) mapAttrs replaceStrings elem;
+      inherit (builtins) mapAttrs replaceStrings;
      inherit (lib) mapAttrs' filterAttrs nameValuePair recurseIntoAttrs evalModules;
      inherit (lib.flake) flattenTree eachDefaultSystem;
      inherit (lib.my) mkDefaultSystemsPkgs flakePackageOverlay;
@@ -65,7 +60,7 @@
      # Extend a lib with extras that _must not_ internally reference private nixpkgs. flake-utils doesn't, but many
      # other flakes (e.g. home-manager) probably do internally.
      libOverlay = final: prev: {
-        my = import ./lib { inherit inputs; lib = final; };
+        my = import ./lib { lib = final; };
        flake = flake-utils.lib;
      };
      pkgsLibOverlay = final: prev: { lib = prev.lib.extend libOverlay; };
@@ -96,12 +91,12 @@
        (_: path: mkDefaultSystemsPkgs path (system: {
          overlays = [
            pkgsLibOverlay
-
            myPkgsOverlay
            inputs.devshell.overlays.default
            inputs.ragenix.overlays.default
-            inputs.deploy-rs.overlays.default
+            inputs.deploy-rs.overlay
            (flakePackageOverlay inputs.home-manager-unstable system)
+            inputs.attic.overlays.default
          ];
        }))
        pkgsFlakes;
@@ -111,19 +106,8 @@
        (_: path: mkDefaultSystemsPkgs path (_: {
          overlays = [
            pkgsLibOverlay
-
            myPkgsOverlay
          ];
-
-          config = {
-            # RMS forgive me...
-            # Normally this is set modularly, but sometimes we need to use other pkgs
-            allowUnfreePredicate = p: elem (lib.getName p) [
-              "widevine-cdm"
-              "chromium-unwrapped"
-              "chromium"
-            ];
-          };
        }))
        pkgsFlakes;

@@ -136,7 +120,6 @@
        nixos/boxes/home/palace
        nixos/boxes/home/castle
        nixos/boxes/britway
-        nixos/boxes/britnet.nix
        nixos/boxes/kelder

        # Homes
@@ -167,7 +150,7 @@
    # Platform independent stuff
    {
      nixpkgs = pkgs';
-      inherit inputs lib nixfiles;
+      inherit lib nixfiles;

      overlays.default = myPkgsOverlay;

@@ -215,9 +198,8 @@
        systems' = mapAttrs' (n: v: nameValuePair "system-${n}" v) systems;
        packages' = mapAttrs' (n: v: nameValuePair "package-${n}" v) packages;
      in
-        homes' // systems' // packages' // {
+        pkgs.linkFarm "ci" (homes' // systems' // packages' // {
          inherit shell;
-        };
-      ciDrv = pkgs.linkFarm "ci" ci;
+        });
    }));
 }
--- a/home-manager/modules/common.nix
+++ b/home-manager/modules/common.nix
@@ -66,7 +66,7 @@ in

        lsd = {
          enable = mkDefault true;
-          enableFishIntegration = mkDefault true;
+          enableAliases = mkDefault true;
        };

        starship = {
@@ -132,8 +132,6 @@ in

        ssh = {
          enable = mkDefault true;
-          # TODO: Set after 25.11 releases
-          # enableDefaultConfig = false;
          matchBlocks = {
            nix-dev-vm = {
              user = "dev";
@@ -228,8 +226,6 @@ in
      # Note: If globalPkgs mode is on, then these will be overridden by the NixOS equivalents of these options
      nixpkgs = {
        overlays = [
-          inputs.libnet.overlays.default
-
          inputs.deploy-rs.overlay
          inputs.boardie.overlays.default
          inputs.nixGL.overlays.default
--- a/home-manager/modules/gui/default.nix
+++ b/home-manager/modules/gui/default.nix
@@ -1,8 +1,7 @@
-{ lib, pkgs', pkgs, config, ... }:
+{ lib, pkgs, config, ... }:
 let
-  inherit (lib) genAttrs mkIf mkMerge mkForce mapAttrs mkOptionDefault;
-  inherit (lib.my) mkOpt' mkBoolOpt';
-  inherit (lib.my.c) pubDomain;
+  inherit (lib) genAttrs mkIf mkMerge mkForce;
+  inherit (lib.my) mkBoolOpt';

  cfg = config.my.gui;

@@ -16,53 +15,34 @@ let
    url = "https://distro.ibiblio.org/slitaz/sources/packages/d/doom1.wad";
    hash = "sha256-HX1DvlAeZ9kn5BXguPPinDvzMHXoWXIYFvZSpSbKx3E=";
  };
-  subwaySurfers = pkgs.fetchurl {
-    url = "https://p.${pubDomain}/video/subway-surfers-smol.mkv";
-    hash = "sha256-fMe7TDRNTymRHIJOi7qG3trzu4GP8a3gCDz+FMkX1dY=";
-  };
-  minecraftParkour = pkgs.fetchurl {
-    url = "https://p.${pubDomain}/video/minecraft-parkour-smol.mkv";
-    hash = "sha256-723pRm4AsIjY/WFUyAHzTJp+JvH4Pn5hvzF9wHTnOPA=";
-  };

-  genLipsum = pkgs.writeScript "lipsum" ''
-    #!${pkgs.python3.withPackages (ps: [ ps.python-lorem ])}/bin/python
-    import lorem
-    print(lorem.get_paragraph(count=5, sep='\n\n'))
-  '';
-  doomsaver' = brainrotTextCommand: pkgs.runCommand "doomsaver" {
-    inherit (pkgs) windowtolayer tmux terminaltexteffects;
+  doomsaver = pkgs.runCommand "doomsaver" {
+    inherit (pkgs) windowtolayer;
    chocoDoom = pkgs.chocolate-doom2xx;
-    ffmpeg = pkgs.ffmpeg-full;
    python = pkgs.python3.withPackages (ps: [ ps.filelock ]);
-
    inherit doomWad;
    enojy = ./enojy.jpg;
-    inherit brainrotTextCommand subwaySurfers minecraftParkour;
  } ''
    mkdir -p "$out"/bin
    substituteAll ${./screensaver.py} "$out"/bin/doomsaver
    chmod +x "$out"/bin/doomsaver
  '';
-  doomsaver = doomsaver' cfg.screensaver.brainrotTextCommand;
 in
 {
-  options.my.gui = with lib.types; {
+  options.my.gui = {
    enable = mkBoolOpt' true "Enable settings and packages meant for graphical systems";
    manageGraphical = mkBoolOpt' false "Configure the graphical session";
    standalone = mkBoolOpt' false "Enable settings for fully Nix managed systems";
-    screensaver.brainrotTextCommand = mkOpt' (either path str) genLipsum "Command to generate brainrot text.";
  };

  config = mkIf cfg.enable (mkMerge [
      {
        home = {
          packages = with pkgs; [
-            xdg-utils
-
            font.package
-            nerd-fonts.sauce-code-pro
-            nerd-fonts.droid-sans-mono
+            (nerdfonts.override {
+              fonts = [ "DroidSansMono" "SourceCodePro" ];
+            })
            noto-fonts-emoji

            grim
@@ -82,9 +62,6 @@ in
            neofetch
            cmatrix
            doomsaver
-
-            ffmpeg-full
-            xournalpp
          ];
        };

@@ -99,7 +76,7 @@ in
          alacritty = {
            enable = true;
            settings = {
-              general.import = [ ./alacritty-xterm.toml ];
+              import = [ ./alacritty-xterm.toml ];

              font = {
                size = font.size;
@@ -118,7 +95,6 @@ in
              background_opacity = "0.65";
              tab_bar_edge = "top";
              shell_integration = "no-sudo";
-              font_features = "${font.name} -liga";
            };
          };

@@ -184,19 +160,6 @@ in
              };
              Install.RequiredBy = [ "sway-session.target" ];
            };
-
-            activate-linux = {
-              Unit = {
-                Description = "Linux activation watermark";
-                After = "graphical-session.target";
-                PartOf = "graphical-session.target";
-              };
-              Service = {
-                Type = "simple";
-                ExecStart = "${pkgs.activate-linux}/bin/activate-linux";
-              };
-              Install.RequiredBy = [ "graphical-session.target" ];
-            };
          };
        };

@@ -206,7 +169,6 @@ in
            wl-clipboard
            wev
            wdisplays
-            swaysome

            pavucontrol
            libsecret
@@ -216,11 +178,10 @@ in
          ];

          pointerCursor = {
-            package = pkgs.posy-cursors;
-            name = "Posy_Cursor";
-            size = 32;
+            package = pkgs.vanilla-dmz;
+            name = "Vanilla-DMZ";
+            size = 16;
            gtk.enable = true;
-            x11.enable = true;
          };
        };

@@ -229,36 +190,9 @@ in
        xsession.preferStatusNotifierItems = true;
        wayland = {
          windowManager = {
-            sway =
-            let
-              cfg = config.wayland.windowManager.sway.config;
-              mod = cfg.modifier;
-
-              renameWs = pkgs.writeShellScript "sway-rename-ws" ''
-                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
-                focused_num="$(jq -r ".num" <<< "$focused_ws")"
-                focused_name="$(jq -r ".name" <<< "$focused_ws")"
-                placeholder="$(sed -E 's/[0-9]+: //' <<< "$focused_name")"
-
-                name="$(rofi -dmenu -p "rename ws $focused_num" -theme+entry+placeholder "\"$placeholder\"")"
-                if [ -n "$name" ]; then
-                  swaymsg rename workspace "$focused_name" to "$focused_num: $name"
-                fi
-              '';
-              clearWsName = pkgs.writeShellScript "sway-clear-ws-name" ''
-                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
-                focused_num="$(jq -r ".num" <<< "$focused_ws")"
-                focused_name="$(jq -r ".name" <<< "$focused_ws")"
-
-                swaymsg rename workspace "$focused_name" to "$focused_num"
-              '';
-            in
-            {
+            sway = {
              enable = true;
              xwayland = true;
-              extraConfigEarly = ''
-                set $mod ${mod}
-              '';
              config = {
                input = {
                  "type:touchpad" = {
@@ -273,87 +207,23 @@ in

                modifier = "Mod4";
                terminal = "kitty";
-                keybindings = mapAttrs (k: mkOptionDefault) {
-                  "${mod}+Left" = "focus left";
-                  "${mod}+Down" = "focus down";
-                  "${mod}+Up" = "focus up";
-                  "${mod}+Right" = "focus right";
-
-                  "${mod}+Shift+Left" = "move left";
-                  "${mod}+Shift+Down" = "move down";
-                  "${mod}+Shift+Up" = "move up";
-                  "${mod}+Shift+Right" = "move right";
-
-                  "${mod}+b" = "splith";
-                  "${mod}+v" = "splitv";
-                  "${mod}+f" = "fullscreen toggle";
-                  "${mod}+a" = "focus parent";
-
-                  "${mod}+s" = "layout stacking";
-                  "${mod}+w" = "layout tabbed";
-                  "${mod}+e" = "layout toggle split";
-
-                  "${mod}+Shift+space" = "floating toggle";
-                  "${mod}+space" = "focus mode_toggle";
-
-                  "${mod}+1" = "workspace number 1";
-                  "${mod}+2" = "workspace number 2";
-                  "${mod}+3" = "workspace number 3";
-                  "${mod}+4" = "workspace number 4";
-                  "${mod}+5" = "workspace number 5";
-                  "${mod}+6" = "workspace number 6";
-                  "${mod}+7" = "workspace number 7";
-                  "${mod}+8" = "workspace number 8";
-                  "${mod}+9" = "workspace number 9";
-                  "${mod}+0" = "workspace number 10";
-
-                  "${mod}+Shift+1" =
-                    "move container to workspace number 1";
-                  "${mod}+Shift+2" =
-                    "move container to workspace number 2";
-                  "${mod}+Shift+3" =
-                    "move container to workspace number 3";
-                  "${mod}+Shift+4" =
-                    "move container to workspace number 4";
-                  "${mod}+Shift+5" =
-                    "move container to workspace number 5";
-                  "${mod}+Shift+6" =
-                    "move container to workspace number 6";
-                  "${mod}+Shift+7" =
-                    "move container to workspace number 7";
-                  "${mod}+Shift+8" =
-                    "move container to workspace number 8";
-                  "${mod}+Shift+9" =
-                    "move container to workspace number 9";
-                  "${mod}+Shift+0" =
-                    "move container to workspace number 10";
-
-                  "${mod}+Shift+minus" = "move scratchpad";
-                  "${mod}+minus" = "scratchpad show";
-
-                  "${mod}+Return" = "exec ${cfg.terminal}";
-                  "${mod}+r" = "mode resize";
+                keybindings =
+                  let
+                    cfg = config.wayland.windowManager.sway.config;
+                    mod = cfg.modifier;
+                  in
+                  lib.mkOptionDefault {
                    "${mod}+d" = null;
                    "${mod}+l" = "exec ${doomsaver}/bin/doomsaver";
-                  "${mod}+q" = "kill";
-                  "${mod}+Shift+c" = "reload";
-                  "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
-
-                  # rofi
                    "${mod}+x" = "exec ${cfg.menu}";
                    "${mod}+Shift+x" = "exec rofi -show drun";
+                    "${mod}+q" = "kill";
+                    "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
+                    "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
+                    "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
                    "${mod}+Shift+e" = "exec rofi -show emoji";
                    # Config for this doesn't seem to work :/
                    "${mod}+c" = ''exec rofi -show calc -calc-command "echo -n '{result}' | ${pkgs.wl-clipboard}/bin/wl-copy"'';
-                  "${mod}+Shift+r" = "exec ${renameWs}";
-                  "${mod}+Shift+n" = "exec ${clearWsName}";
-
-                  # Screenshots
-                  "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
-                  "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
-
-                  "XF86MonBrightnessDown" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
-                  "XF86MonBrightnessUp" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set +5%";

                    "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
                    "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
@@ -370,9 +240,6 @@ in
                menu = "rofi -show run";
                bars = mkForce [ ];
              };
-              extraConfig = ''
-                include ${./swaysome.conf}
-              '';

              swaynag = {
                enable = true;
@@ -423,7 +290,6 @@ in
            diff-so-fancy.enable = true;
            userEmail = "jackos1998@gmail.com";
            userName = "Jack O'Sullivan";
-            lfs.enable = true;
            extraConfig = {
              pull.rebase = true;
            };
@@ -431,13 +297,11 @@ in

          waybar = import ./waybar.nix { inherit lib pkgs config font; };
          rofi = {
-            package = pkgs.rofi-wayland;
            enable = true;
            font = "${font.name} ${toString font.size}";
-            plugins = with pkgs; (map (p: p.override { rofi-unwrapped = rofi-wayland-unwrapped; }) [
+            plugins = with pkgs; [
              rofi-calc
-            ]) ++ [
-              rofi-emoji-wayland
+              rofi-emoji
            ];
            extraConfig = {
              modes = "window,run,ssh,filebrowser,calc,emoji";
@@ -452,7 +316,7 @@ in

          chromium = {
            enable = true;
-            package = (pkgs'.unstable.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
+            package = (pkgs.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
              buildCommand = ''
                ${old.buildCommand}

--- a/home-manager/modules/gui/screensaver.py
+++ b/home-manager/modules/gui/screensaver.py
@@ -73,7 +73,7 @@ class TTESaver(Screensaver):

    def wait(self):
        while self.running:
-            effect_cmd = ['@terminaltexteffects@/bin/tte', random.choice(self.effects)]
+            effect_cmd = ['tte', random.choice(self.effects)]
            print(f"$ {self.cmd} | {' '.join(effect_cmd)}")
            content = subprocess.check_output(self.cmd, shell=True, env=self.env, stderr=subprocess.DEVNULL)

@@ -86,51 +86,6 @@ class TTESaver(Screensaver):
        self.running = False
        self.proc.terminate()

-class FFmpegCACASaver(Screensaver):
-    @staticmethod
-    def command(video, size):
-        return ['@ffmpeg@/bin/ffmpeg', '-hide_banner', '-loglevel', 'error',
-                '-stream_loop', '-1', '-i', video,
-                '-pix_fmt', 'rgb24', '-window_size', f'{size}x{size}',
-                '-f', 'caca', '-']
-
-    def __init__(self, video, weight=2):
-        cols, lines = os.get_terminal_size()
-        # IDK if it's reasonable to do this as "1:1"
-        size = lines - 4
-        super().__init__(
-            self.command(video, size),
-            env={'CACA_DRIVER': 'ncurses'},
-            weight=weight,
-        )
-
-    def stop(self):
-        super().stop(kill=True)
-
-class BrainrotStorySaver(Screensaver):
-    def __init__(self, video, text_command, weight=2):
-        cols, lines = os.get_terminal_size()
-        video_size = lines - 1
-        video_command = ' '.join(FFmpegCACASaver.command(video, video_size))
-        text_command = (
-            f'while true; do {text_command} | '
-            f'@terminaltexteffects@/bin/tte --wrap-text --canvas-width=80 --canvas-height={video_size//2} --anchor-canvas=c '
-            'print --final-gradient-stops=ffffff; clear; done' )
-        self.tmux_session = f'screensaver-{os.urandom(4).hex()}'
-        super().__init__(
-            ['@tmux@/bin/tmux', 'new-session', '-s', self.tmux_session, '-n', 'brainrot',
-             text_command, ';', 'split-window', '-hbl', str(lines), video_command],
-            # ['sh', '-c', text_command],
-            env={
-                'CACA_DRIVER': 'ncurses',
-                'SHELL': '/bin/sh',
-            },
-            weight=weight,
-        )
-
-    def stop(self):
-        subprocess.check_call(['@tmux@/bin/tmux', 'kill-session', '-t', self.tmux_session])
-
 class MultiSaver:
    savers = [
        DoomSaver(0),
@@ -145,9 +100,6 @@ class MultiSaver:
        TTESaver('ss -nltu'),
        TTESaver('ss -ntu'),
        TTESaver('jp2a --width=100 @enojy@'),
-
-        BrainrotStorySaver('@subwaySurfers@', '@brainrotTextCommand@'),
-        BrainrotStorySaver('@minecraftParkour@', '@brainrotTextCommand@'),
    ]
    state_filename = 'screensaver.json'

--- a/home-manager/modules/gui/swaysome.conf
+++ b/home-manager/modules/gui/swaysome.conf
@@ -1,66 +0,0 @@
-# Use (un)bindcode or (un)bindsym, depending on what you used in your main sway config file.
-# The `--no-warn` setting is only added to shortcuts that exist in the default config. You may want to add or remove
-# that flag on some bindings depending on your config.
-
-
-# Change focus between workspaces
-bindsym $mod+Alt+1 exec "swaysome focus 1"
-bindsym $mod+Alt+2 exec "swaysome focus 2"
-bindsym $mod+Alt+3 exec "swaysome focus 3"
-bindsym $mod+Alt+4 exec "swaysome focus 4"
-bindsym $mod+Alt+5 exec "swaysome focus 5"
-bindsym $mod+Alt+6 exec "swaysome focus 6"
-bindsym $mod+Alt+7 exec "swaysome focus 7"
-bindsym $mod+Alt+8 exec "swaysome focus 8"
-bindsym $mod+Alt+9 exec "swaysome focus 9"
-bindsym $mod+Alt+0 exec "swaysome focus 0"
-
-# Focus workspace groups
-bindsym --no-warn $mod+1 exec "swaysome focus-group 1"
-bindsym --no-warn $mod+2 exec "swaysome focus-group 2"
-bindsym --no-warn $mod+3 exec "swaysome focus-group 3"
-bindsym --no-warn $mod+4 exec "swaysome focus-group 4"
-bindsym --no-warn $mod+5 exec "swaysome focus-group 5"
-bindsym --no-warn $mod+6 exec "swaysome focus-group 6"
-bindsym --no-warn $mod+7 exec "swaysome focus-group 7"
-bindsym --no-warn $mod+8 exec "swaysome focus-group 8"
-bindsym --no-warn $mod+9 exec "swaysome focus-group 9"
-bindsym --no-warn $mod+0 exec "swaysome focus-group 0"
-
-# Move containers between workspaces
-bindsym $mod+Alt+Shift+1 exec "swaysome move 1"
-bindsym $mod+Alt+Shift+2 exec "swaysome move 2"
-bindsym $mod+Alt+Shift+3 exec "swaysome move 3"
-bindsym $mod+Alt+Shift+4 exec "swaysome move 4"
-bindsym $mod+Alt+Shift+5 exec "swaysome move 5"
-bindsym $mod+Alt+Shift+6 exec "swaysome move 6"
-bindsym $mod+Alt+Shift+7 exec "swaysome move 7"
-bindsym $mod+Alt+Shift+8 exec "swaysome move 8"
-bindsym $mod+Alt+Shift+9 exec "swaysome move 9"
-bindsym $mod+Alt+Shift+0 exec "swaysome move 0"
-
-# Move containers to other workspace groups
-bindsym --no-warn $mod+Shift+1 exec "swaysome move-to-group 1"
-bindsym --no-warn $mod+Shift+2 exec "swaysome move-to-group 2"
-bindsym --no-warn $mod+Shift+3 exec "swaysome move-to-group 3"
-bindsym --no-warn $mod+Shift+4 exec "swaysome move-to-group 4"
-bindsym --no-warn $mod+Shift+5 exec "swaysome move-to-group 5"
-bindsym --no-warn $mod+Shift+6 exec "swaysome move-to-group 6"
-bindsym --no-warn $mod+Shift+7 exec "swaysome move-to-group 7"
-bindsym --no-warn $mod+Shift+8 exec "swaysome move-to-group 8"
-bindsym --no-warn $mod+Shift+9 exec "swaysome move-to-group 9"
-bindsym --no-warn $mod+Shift+0 exec "swaysome move-to-group 0"
-
-# Move focused container to next output
-bindsym $mod+Alt+Right exec "swaysome next-output"
-# Move focused container to previous output
-bindsym $mod+Alt+Left exec "swaysome prev-output"
-
-# Move focused workspace group to next output
-bindsym $mod+Shift+Alt+Right exec "swaysome workspace-group-next-output"
-# Move focused workspace group to previous output
-bindsym $mod+Shift+Alt+Left exec "swaysome workspace-group-prev-output"
-
-# Init workspaces for every screen
-exec "swaysome init 1"
-
--- a/lib/constants.nix
+++ b/lib/constants.nix
@@ -13,7 +13,6 @@ rec {
      kea = 404;
      keepalived_script = 405;
      photoprism = 406;
-      copyparty = 408;
    };
    gids = {
      matrix-syncv3 = 400;
@@ -23,14 +22,12 @@ rec {
      kea = 404;
      keepalived_script = 405;
      photoprism = 406;
-      adbusers = 407;
-      copyparty = 408;
    };
  };

  kernel = {
-    lts = pkgs: pkgs.linuxKernel.packages.linux_6_12;
-    latest = pkgs: pkgs.linuxKernel.packages.linux_6_16;
+    lts = pkgs: pkgs.linuxKernel.packages.linux_6_6;
+    latest = pkgs: pkgs.linuxKernel.packages.linux_6_9;
  };

  nginx = rec {
@@ -101,10 +98,10 @@ rec {
  nix = {
    cache = rec {
      substituters = [
-        "https://nix-cache.${pubDomain}"
+        "https://nix-cache.${pubDomain}/main"
      ];
      keys = [
-        "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+        "main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8="
      ];
      conf = ''
        extra-substituters = ${concatStringsSep " " substituters}
@@ -138,9 +135,6 @@ rec {
        v4 = subnet 8 3 all.v4;
        v6 = subnet 4 3 all.v6;
      };
-      qclk = {
-        v4 = subnet 8 4 all.v4;
-      };

      cust = {
        v4 = subnet 8 100 all.v4; # single ip for routing only
@@ -176,10 +170,6 @@ rec {
      jam-ctr = host 3 prefixes.cust.v4;
    };

-    qclk = {
-      wgPort = 51821;
-    };
-
    firewallForwards = aa: [
      {
        port = "http";
@@ -202,20 +192,11 @@ rec {
        port = 25566;
        dst = aa.simpcraft-staging-oci.internal.ipv4.address;
      }
-      {
-        port = 25567;
-        dst = aa.kevcraft-oci.internal.ipv4.address;
-      }
-      {
-        port = 25568;
-        dst = aa.kinkcraft-oci.internal.ipv4.address;
-      }

-      # RCON... unsafe?
-      # {
-      #   port = 25575;
-      #   dst = aa.simpcraft-oci.internal.ipv4.address;
-      # }
+      {
+        port = 25575;
+        dst = aa.simpcraft-oci.internal.ipv4.address;
+      }

      {
        port = 2456;
@@ -239,33 +220,6 @@ rec {
        dst = aa.simpcraft-oci.internal.ipv4.address;
        proto = "udp";
      }
-      {
-        port = 25567;
-        dst = aa.kevcraft-oci.internal.ipv4.address;
-        proto = "udp";
-      }
-      {
-        port = 25568;
-        dst = aa.kinkcraft-oci.internal.ipv4.address;
-        proto = "udp";
-      }
-
-      {
-        port = 15636;
-        dst = aa.enshrouded-oci.internal.ipv4.address;
-        proto = "udp";
-      }
-      {
-        port = 15637;
-        dst = aa.enshrouded-oci.internal.ipv4.address;
-        proto = "udp";
-      }
-
-      {
-        port = qclk.wgPort;
-        dst = aa.qclk.internal.ipv4.address;
-        proto = "udp";
-      }
    ];

    fstrimConfig = {
@@ -289,8 +243,8 @@ rec {
      "stream"
    ];
    routersPubV4 = [
-      "109.255.108.88"
-      "109.255.108.121"
+      "188.141.14.7"
+      "109.255.252.63"
    ];

    prefixes = with lib.my.net.cidr; rec {
@@ -356,20 +310,6 @@ rec {
    assignedV6 = "2001:19f0:7402:128b:5400:04ff:feac:6e06";
  };

-  britnet = {
-    domain = "bhx1.int.${pubDomain}";
-    pubV4 = "77.74.199.67";
-    vpn = {
-      port = 51820;
-    };
-    prefixes = with lib.my.net.cidr; rec {
-      vpn = {
-        v4 = "10.200.0.0/24";
-        v6 = "fdfb:5ebf:6e84::/64";
-      };
-    };
-  };
-
  tailscale = {
    prefix = {
      v4 = "100.64.0.0/10";
@@ -419,7 +359,6 @@ rec {
    deploy = ../.keys/deploy.pub;
    rsyncNet = ../.keys/zh2855.rsync.net.pub;
    mailcowAcme = ../.keys/mailcow-acme.pub;
-    harmonia = ../.keys/harmonia.pub;
  };
  sshHostKeys = {
    mail-vm = ../.keys/mail-vm-host.pub;
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -1,11 +1,11 @@
-{ inputs, lib }:
+{ lib }:
 let
  inherit (builtins) length match elemAt filter replaceStrings substring;
  inherit (lib)
    genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
    mkOption mkOverride mkForce mkIf mergeEqualOption optional
    showWarnings concatStringsSep flatten unique optionalAttrs
-    mkBefore toLower splitString last;
+    mkBefore toLower;
  inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -23,7 +23,7 @@ rec {

  attrsToNVList = mapAttrsToList nameValuePair;

-  inherit ((import "${inputs.libnetRepo}/lib/netu.nix" { inherit lib; }).lib) net;
+  inherit (import ./net.nix { inherit lib; }) net;
  dns = import ./dns.nix { inherit lib; };
  c = import ./constants.nix { inherit lib; };

@@ -53,7 +53,7 @@ rec {
    in mkApp "${app}/bin/${app.meta.mainProgram}";
  flakePackageOverlay' = flake: pkg: system: (final: prev:
    let
-      pkg' = if pkg != null then flake.packages.${system}.${pkg} else flake.packages.${system}.default;
+      pkg' = if pkg != null then flake.packages.${system}.${pkg} else flake.defaultPackage.${system};
      name = if pkg != null then pkg else pkg'.name;
    in
    {
@@ -248,13 +248,12 @@ rec {
  in
  {
    trivial = prev.trivial // {
-      release = "25.09:u-${prev.trivial.release}";
-      codeName = "Giving";
+      release = "24.06:u-${prev.trivial.release}";
+      codeName = "Carbrain";
      revisionWithDefault = default: self.rev or default;
      versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
    };
  };
-  upstreamRelease = last (splitString "-" lib.trivial.release);

  netbootKeaClientClasses = { tftpIP, hostname, systems }:
  let
--- a/lib/net.nix
+++ b/lib/net.nix
--- a/nixos/boxes/britnet.nix
+++ b/nixos/boxes/britnet.nix
@@ -1,191 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.britnet) domain pubV4 prefixes;
-in
-{
-  nixos.systems.britnet = {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-
-    assignments = {
-      allhost = {
-        inherit domain;
-        ipv4 = {
-          address = pubV4;
-          mask = 24;
-          gateway = "77.74.199.1";
-        };
-        ipv6 = {
-          address = "2a12:ab46:5344:99::a";
-          gateway = "2a12:ab46:5344::1";
-        };
-      };
-      vpn = {
-        ipv4 = {
-          address = net.cidr.host 1 prefixes.vpn.v4;
-          gateway = null;
-        };
-        ipv6.address = net.cidr.host 1 prefixes.vpn.v6;
-      };
-    };
-
-    configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
-      let
-        inherit (lib) mkMerge mkForce;
-        inherit (lib.my) networkdAssignment;
-      in
-      {
-        imports = [
-          "${modulesPath}/profiles/qemu-guest.nix"
-        ];
-
-        config = mkMerge [
-          {
-            boot = {
-              initrd.availableKernelModules = [
-                "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "ahci" "sr_mod" "virtio_blk"
-              ];
-              loader = {
-                systemd-boot.enable = false;
-                grub = {
-                  enable = true;
-                  device = "/dev/vda";
-                };
-              };
-            };
-
-            fileSystems = {
-              "/boot" = {
-                device = "/dev/disk/by-uuid/457444a1-81dd-4934-960c-650ad16c92b5";
-                fsType = "ext4";
-              };
-              "/nix" = {
-                device = "/dev/disk/by-uuid/992c0c79-5be6-45b6-bc30-dc82e3ec082a";
-                fsType = "ext4";
-              };
-              "/persist" = {
-                device = "/dev/disk/by-uuid/f020a955-54d5-4098-98ba-d3615781d96a";
-                fsType = "ext4";
-                neededForBoot = true;
-              };
-            };
-
-            environment = {
-              systemPackages = with pkgs; [
-                wireguard-tools
-              ];
-            };
-
-            services = {
-              iperf3 = {
-                enable = true;
-                openFirewall = true;
-              };
-
-              tailscale = {
-                enable = true;
-                authKeyFile = config.age.secrets."tailscale-auth.key".path;
-                openFirewall = true;
-                interfaceName = "tailscale0";
-                extraUpFlags = [
-                  "--operator=${config.my.user.config.name}"
-                  "--login-server=https://hs.nul.ie"
-                  "--netfilter-mode=off"
-                  "--advertise-exit-node"
-                  "--accept-routes=false"
-                ];
-              };
-            };
-
-            networking = { inherit domain; };
-
-            systemd.network = {
-              netdevs = {
-                "30-wg0" = {
-                  netdevConfig = {
-                    Name = "wg0";
-                    Kind = "wireguard";
-                  };
-                  wireguardConfig = {
-                    PrivateKeyFile = config.age.secrets."britnet/wg.key".path;
-                    ListenPort = lib.my.c.britnet.vpn.port;
-                  };
-                  wireguardPeers = [
-                    {
-                      PublicKey = "EfPwREfZ/q3ogHXBIqFZh4k/1NRJRyq4gBkBXtegNkE=";
-                      AllowedIPs = [
-                        (net.cidr.host 10 prefixes.vpn.v4)
-                        (net.cidr.host 10 prefixes.vpn.v6)
-                      ];
-                    }
-                  ];
-                };
-              };
-
-              links = {
-                "10-veth0" = {
-                  matchConfig.PermanentMACAddress = "00:db:d9:62:68:1a";
-                  linkConfig.Name = "veth0";
-                };
-              };
-
-              networks = {
-                "20-veth0" = mkMerge [
-                  (networkdAssignment "veth0" assignments.allhost)
-                  {
-                    dns = [ "1.1.1.1" "1.0.0.1" ];
-                    routes = [
-                      {
-                        # Gateway is on a different network for some reason...
-                        Destination = "2a12:ab46:5344::1";
-                        Scope = "link";
-                      }
-                    ];
-                  }
-                ];
-                "30-wg0" = mkMerge [
-                  (networkdAssignment "wg0" assignments.vpn)
-                  {
-                    networkConfig.IPv6AcceptRA = mkForce false;
-                  }
-                ];
-              };
-            };
-
-            my = {
-              server.enable = true;
-              secrets = {
-                key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIEx+1EC/lN6WKIaOB+O5LJgVHRK962YpZEPQg/m78O";
-                files = {
-                  "tailscale-auth.key" = {};
-                  "britnet/wg.key" = {
-                    owner = "systemd-network";
-                  };
-                };
-              };
-
-              firewall = {
-                udp.allowed = [ lib.my.c.britnet.vpn.port ];
-                trustedInterfaces = [ "tailscale0" ];
-                extraRules = ''
-                  table inet filter {
-                    chain forward {
-                      iifname wg0 oifname veth0 accept
-                    }
-                  }
-                  table inet nat {
-                    chain postrouting {
-                      iifname { tailscale0, wg0 } oifname veth0 snat ip to ${assignments.allhost.ipv4.address}
-                      iifname { tailscale0, wg0 } oifname veth0 snat ip6 to ${assignments.allhost.ipv6.address}
-                    }
-                  }
-                '';
-              };
-            };
-          }
-        ];
-      };
-  };
-}
--- a/nixos/boxes/britway/bgp.nix
+++ b/nixos/boxes/britway/bgp.nix
@@ -11,24 +11,23 @@ in
  config = {
    my = {
      secrets.files."britway/bgp-password-vultr.conf" = {
-        owner = "bird";
-        group = "bird";
+        owner = "bird2";
+        group = "bird2";
      };
    };

    environment.etc."bird/vultr-password.conf".source = config.age.secrets."britway/bgp-password-vultr.conf".path;

    systemd = {
-      services.bird.after = [ "systemd-networkd-wait-online@veth0.service" ];
+      services.bird2.after = [ "systemd-networkd-wait-online@veth0.service" ];
      network = {
        config.networkConfig.ManageForeignRoutes = false;
      };
    };

    services = {
-      bird = {
+      bird2 = {
        enable = true;
-        package = pkgs.bird2;
        preCheckConfig = ''
          echo '"dummy"' > vultr-password.conf
        '';
--- a/nixos/boxes/britway/default.nix
+++ b/nixos/boxes/britway/default.nix
@@ -106,7 +106,7 @@ in
                  {
                    matchConfig.Name = "as211024";
                    networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                      {
                        Destination = lib.my.c.colony.prefixes.all.v4;
                        Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -123,7 +123,7 @@ in
                        Table = "ts-extra";
                      }
                    ];
-                    routingPolicyRules = [
+                    routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                      {
                        IncomingInterface = "tailscale0";
                        To = lib.my.c.colony.prefixes.all.v6;
--- a/nixos/boxes/britway/nginx.nix
+++ b/nixos/boxes/britway/nginx.nix
@@ -80,7 +80,7 @@ in
              };
            };

-            "hs.${pubDomain}" = {
+            "ts.${pubDomain}" = {
              locations."/" = {
                proxyPass = "http://localhost:${toString config.services.headscale.port}";
                proxyWebsockets = true;
--- a/nixos/boxes/britway/tailscale.nix
+++ b/nixos/boxes/britway/tailscale.nix
@@ -4,6 +4,20 @@ let
  inherit (lib.my.c) pubDomain;
  inherit (lib.my.c.britway) prefixes domain;

+  # Can't use overrideAttrs because we need to override `vendorHash` within `buildGoModule`
+  headscale = pkgs.headscale.override {
+    buildGoModule = args: pkgs.buildGoModule (args // rec {
+      version = "0.23.0-alpha2";
+      src = pkgs.fetchFromGitHub {
+        owner = "juanfont";
+        repo = "headscale";
+        rev = "v${version}";
+        hash = "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=";
+      };
+      vendorHash = "sha256-u9AmJguQ5dnJpfhOeLN43apvMHuraOrJhvlEIp9RoIc=";
+    });
+  };
+
  advRoutes = concatStringsSep "," [
    lib.my.c.home.prefixes.all.v4
    lib.my.c.home.prefixes.all.v6
@@ -25,21 +39,19 @@ in
    services = {
      headscale = {
        enable = true;
+        package = headscale;
        settings = {
          disable_check_updates = true;
          unix_socket_permission = "0770";
-          server_url = "https://hs.${pubDomain}";
-          database = {
-            type = "sqlite3";
-            sqlite.path = "/var/lib/headscale/db.sqlite3";
-          };
+          server_url = "https://ts.${pubDomain}";
+          db_type = "sqlite3";
+          db_path = "/var/lib/headscale/db.sqlite3";
          noise.private_key_path = "/var/lib/headscale/noise_private.key";
-          prefixes = with lib.my.c.tailscale.prefix; { inherit v4 v6; };
-          dns = {
-            override_local_dns = false;
+          ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ];
+          dns_config = {
            # Use IPs that will route inside the VPN to prevent interception
            # (e.g. DNS rebinding filtering)
-            nameservers.split = {
+            restricted_nameservers = {
              "${domain}" = pubNameservers;
              "${lib.my.c.colony.domain}" = with allAssignments.estuary.base; [
                ipv4.address ipv6.address
@@ -53,6 +65,7 @@ in
            };
            magic_dns = true;
            base_domain = "ts.${pubDomain}";
+            override_local_dns = false;
          };
          oidc = {
            only_start_if_oidc_is_available = true;
@@ -72,7 +85,7 @@ in
        interfaceName = "tailscale0";
        extraUpFlags = [
          "--operator=${config.my.user.config.name}"
-          "--login-server=https://hs.nul.ie"
+          "--login-server=https://ts.nul.ie"
          "--netfilter-mode=off"
          "--advertise-exit-node"
          "--advertise-routes=${advRoutes}"
--- a/nixos/boxes/colony/default.nix
+++ b/nixos/boxes/colony/default.nix
@@ -252,10 +252,10 @@ in
                  };
                  ipv6Prefixes = [
                    {
-                      Prefix = prefixes.vms.v6;
+                      ipv6PrefixConfig.Prefix = prefixes.vms.v6;
                    }
                  ];
-                  routes = [
+                  routes = map (r: { routeConfig = r; }) [
                    {
                      Destination = prefixes.ctrs.v4;
                      Gateway = allAssignments.shill.routing.ipv4.address;
@@ -264,12 +264,10 @@ in
                      Destination = prefixes.ctrs.v6;
                      Gateway = allAssignments.shill.internal.ipv6.address;
                    }
-
                    {
                      Destination = allAssignments.shill.internal.ipv4.address;
                      Gateway = allAssignments.shill.routing.ipv4.address;
                    }
-
                    {
                      Destination = lib.my.c.tailscale.prefix.v4;
                      Gateway = allAssignments.shill.routing.ipv4.address;
@@ -278,11 +276,6 @@ in
                      Destination = lib.my.c.tailscale.prefix.v6;
                      Gateway = allAssignments.shill.internal.ipv6.address;
                    }
-                    {
-                      Destination = prefixes.qclk.v4;
-                      Gateway = allAssignments.shill.routing.ipv4.address;
-                    }
-
                    {
                      Destination = prefixes.jam.v6;
                      Gateway = allAssignments.shill.internal.ipv6.address;
@@ -327,10 +320,10 @@ in
                };
                ipv6Prefixes = [
                  {
-                    Prefix = prefixes.mail.v6;
+                    ipv6PrefixConfig.Prefix = prefixes.mail.v6;
                  }
                ];
-                routes = [
+                routes = map (r: { routeConfig = r; }) [
                  {
                    Destination = prefixes.mail.v4;
                    Scope = "link";
@@ -350,10 +343,10 @@ in
                };
                ipv6Prefixes = [
                  {
-                    Prefix = prefixes.darts.v6;
+                    ipv6PrefixConfig.Prefix = prefixes.darts.v6;
                  }
                ];
-                routes = [
+                routes = map (r: { routeConfig = r; }) [
                  {
                    Destination = prefixes.darts.v4;
                    Scope = "link";
--- a/nixos/boxes/colony/vms/default.nix
+++ b/nixos/boxes/colony/vms/default.nix
@@ -133,7 +133,7 @@

              (vm.lvmDisk "media")
              (vm.lvmDisk "minio")
-              (vm.lvmDisk "nix-cache")
+              (vm.lvmDisk "nix-atticd")
              (vm.lvmDisk "jam")
            ]);
          };
--- a/nixos/boxes/colony/vms/estuary/bgp.nix
+++ b/nixos/boxes/colony/vms/estuary/bgp.nix
@@ -8,9 +8,8 @@ in
 {
  config = {
    services = {
-      bird = {
+      bird2 = {
        enable = true;
-        package = pkgs.bird2;
        # TODO: Clean up and modularise
        config = ''
          define OWNAS = 211024;
@@ -251,87 +250,41 @@ in
            neighbor 2001:7f8:10f::dc49:254 as 56393;
          }

-          protocol bgp ixp4_frysix_rs3 from ixp_bgp4 {
-            description "Frys-IX route server 3 (IPv4)";
-            neighbor 185.1.160.255 as 56393;
-          }
-          protocol bgp ixp6_frysix_rs3 from ixp_bgp6 {
-            description "Frys-IX route server 3 (IPv6)";
-            neighbor 2001:7f8:10f::dc49:1 as 56393;
-          }
-
-          protocol bgp ixp4_frysix_rs4 from ixp_bgp4 {
-            description "Frys-IX route server 4 (IPv4)";
-            neighbor 185.1.161.0 as 56393;
-          }
-          protocol bgp ixp6_frysix_rs4 from ixp_bgp6 {
-            description "Frys-IX route server 4 (IPv6)";
-            neighbor 2001:7f8:10f::dc49:2 as 56393;
-          }
-
          protocol bgp peer4_frysix_luje from peer_bgp4 {
            description "LUJE.net (on Frys-IX, IPv4)";
-            neighbor 185.1.160.152 as 212855;
+            neighbor 185.1.203.152 as 212855;
          }
          protocol bgp peer6_frysix_luje from peer_bgp6 {
            description "LUJE.net (on Frys-IX, IPv6)";
            neighbor 2001:7f8:10f::3:3f95:152 as 212855;
          }
-
          protocol bgp peer4_frysix_he from peer_bgp4 {
            description "Hurricane Electric (on Frys-IX, IPv4)";
-            neighbor 185.1.160.154 as 6939;
+            neighbor 185.1.203.154 as 6939;
          }
-
-          protocol bgp peer4_frysix_cloudflare1_old from peer_bgp4 {
-            description "Cloudflare 1 (on Frys-IX, IPv4)";
+          protocol bgp peer4_frysix_cloudflare from peer_bgp4 {
+            description "Cloudflare (on Frys-IX, IPv4)";
            neighbor 185.1.203.217 as 13335;
          }
-          protocol bgp peer4_frysix_cloudflare2_old from peer_bgp4 {
-            description "Cloudflare 2 (on Frys-IX, IPv4)";
-            neighbor 185.1.203.109 as 13335;
-          }
-          protocol bgp peer4_frysix_cloudflare1 from peer_bgp4 {
-            description "Cloudflare 1 (on Frys-IX, IPv4)";
-            neighbor 185.1.160.217 as 13335;
-          }
-          protocol bgp peer4_frysix_cloudflare2 from peer_bgp4 {
-            description "Cloudflare 2 (on Frys-IX, IPv4)";
-            neighbor 185.1.160.109 as 13335;
-          }
-          protocol bgp peer6_frysix_cloudflare1 from peer_bgp6 {
-            description "Cloudflare 1 (on Frys-IX, IPv6)";
+          protocol bgp peer6_frysix_cloudflare from peer_bgp6 {
+            description "Cloudflare (on Frys-IX, IPv6)";
            neighbor 2001:7f8:10f::3417:217 as 13335;
          }
-          protocol bgp peer6_frysix_cloudflare2 from peer_bgp6 {
-            description "Cloudflare 2 (on Frys-IX, IPv6)";
-            neighbor 2001:7f8:10f::3417:109 as 13335;
-          }
-
          protocol bgp peer4_frysix_jurrian from peer_bgp4 {
            description "AS212635 aka jurrian (on Frys-IX, IPv4)";
-            neighbor 185.1.160.134 as 212635;
+            neighbor 185.1.203.134 as 212635;
          }
          protocol bgp peer6_frysix_jurrian from peer_bgp6 {
            description "AS212635 aka jurrian (on Frys-IX, IPv6)";
            neighbor 2001:7f8:10f::3:3e9b:134 as 212635;
          }
-
-          protocol bgp peer4_frysix_meta1_old from peer_bgp4 {
+          protocol bgp peer4_frysix_meta1 from peer_bgp4 {
            description "Meta 1 (on Frys-IX, IPv4)";
            neighbor 185.1.203.225 as 32934;
          }
-          protocol bgp peer4_frysix_meta2_old from peer_bgp4 {
-            description "Meta 2 (on Frys-IX, IPv4)";
-            neighbor 185.1.203.226 as 32934;
-          }
-          protocol bgp peer4_frysix_meta1 from peer_bgp4 {
-            description "Meta 1 (on Frys-IX, IPv4)";
-            neighbor 185.1.160.225 as 32934;
-          }
          protocol bgp peer4_frysix_meta2 from peer_bgp4 {
            description "Meta 2 (on Frys-IX, IPv4)";
-            neighbor 185.1.160.226 as 32934;
+            neighbor 185.1.203.226 as 32934;
          }
          protocol bgp peer6_frysix_meta1 from peer_bgp6 {
            description "Meta 1 (on Frys-IX, IPv6)";
@@ -364,36 +317,36 @@ in
            ipv6 { preference (PREFIXP-1); };
          }

-          # protocol bgp peer4_nlix_cloudflare1 from peer_bgp4 {
-          #   description "Cloudflare NL-ix 1 (IPv4)";
-          #   neighbor 193.239.117.14 as 13335;
-          #   ipv4 { preference (PREFPEER-1); };
-          # }
-          # protocol bgp peer4_nlix_cloudflare2 from peer_bgp4 {
-          #   description "Cloudflare NL-ix 2 (IPv4)";
-          #   neighbor 193.239.117.114 as 13335;
-          #   ipv4 { preference (PREFPEER-1); };
-          # }
-          # protocol bgp peer4_nlix_cloudflare3 from peer_bgp4 {
-          #   description "Cloudflare NL-ix 3 (IPv4)";
-          #   neighbor 193.239.118.138 as 13335;
-          #   ipv4 { preference (PREFPEER-1); };
-          # }
-          # protocol bgp peer6_nlix_cloudflare1 from peer_bgp6 {
-          #   description "Cloudflare NL-ix 1 (IPv6)";
-          #   neighbor 2001:7f8:13::a501:3335:1 as 13335;
-          #   ipv6 { preference (PREFPEER-1); };
-          # }
-          # protocol bgp peer6_nlix_cloudflare2 from peer_bgp6 {
-          #   description "Cloudflare NL-ix 2 (IPv6)";
-          #   neighbor 2001:7f8:13::a501:3335:2 as 13335;
-          #   ipv6 { preference (PREFPEER-1); };
-          # }
-          # protocol bgp peer6_nlix_cloudflare3 from peer_bgp6 {
-          #   description "Cloudflare NL-ix 3 (IPv6)";
-          #   neighbor 2001:7f8:13::a501:3335:3 as 13335;
-          #   ipv6 { preference (PREFPEER-1); };
-          # }
+          protocol bgp peer4_nlix_cloudflare1 from peer_bgp4 {
+            description "Cloudflare NL-ix 1 (IPv4)";
+            neighbor 193.239.117.14 as 13335;
+            ipv4 { preference (PREFPEER-1); };
+          }
+          protocol bgp peer4_nlix_cloudflare2 from peer_bgp4 {
+            description "Cloudflare NL-ix 2 (IPv4)";
+            neighbor 193.239.117.114 as 13335;
+            ipv4 { preference (PREFPEER-1); };
+          }
+          protocol bgp peer4_nlix_cloudflare3 from peer_bgp4 {
+            description "Cloudflare NL-ix 3 (IPv4)";
+            neighbor 193.239.118.138 as 13335;
+            ipv4 { preference (PREFPEER-1); };
+          }
+          protocol bgp peer6_nlix_cloudflare1 from peer_bgp6 {
+            description "Cloudflare NL-ix 1 (IPv6)";
+            neighbor 2001:7f8:13::a501:3335:1 as 13335;
+            ipv6 { preference (PREFPEER-1); };
+          }
+          protocol bgp peer6_nlix_cloudflare2 from peer_bgp6 {
+            description "Cloudflare NL-ix 2 (IPv6)";
+            neighbor 2001:7f8:13::a501:3335:2 as 13335;
+            ipv6 { preference (PREFPEER-1); };
+          }
+          protocol bgp peer6_nlix_cloudflare3 from peer_bgp6 {
+            description "Cloudflare NL-ix 3 (IPv6)";
+            neighbor 2001:7f8:13::a501:3335:3 as 13335;
+            ipv6 { preference (PREFPEER-1); };
+          }
          protocol bgp peer4_nlix_jurrian from peer_bgp4 {
            description "AS212635 aka jurrian (on NL-ix, IPv4)";
            neighbor 193.239.117.55 as 212635;
--- a/nixos/boxes/colony/vms/estuary/default.nix
+++ b/nixos/boxes/colony/vms/estuary/default.nix
@@ -164,9 +164,11 @@ in
                    };
                    wireguardPeers = [
                      {
+                        wireguardPeerConfig = {
                          PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
                          AllowedIPs = [ allAssignments.kelder.estuary.ipv4.address ];
                          PersistentKeepalive = 25;
+                        };
                      }
                    ];
                  };
@@ -219,9 +221,6 @@ in
              mkMerge
              [
                (mkIXPConfig "frys-ix" "185.1.203.196/24" "2001:7f8:10f::3:3850:196/64")
-                # FrysIX is migrating to a /23
-                { "85-frys-ix".address = [ "185.1.160.196/23" ]; }
-
                (mkIXPConfig "nl-ix" "193.239.116.145/22" "2001:7f8:13::a521:1024:1/64")
                (mkIXPConfig "fogixp" "185.1.147.159/24" "2001:7f8:ca:1::159/64")
              {
@@ -279,10 +278,11 @@ in
                    };
                    ipv6Prefixes = [
                      {
-                        Prefix = prefixes.base.v6;
+                        ipv6PrefixConfig.Prefix = prefixes.base.v6;
                      }
                    ];
-                    routes = flatten ([
+                    routes = map (r: { routeConfig = r; }) (flatten
+                      ([
                        {
                          Destination = prefixes.vip1;
                          Gateway = allAssignments.colony.routing.ipv4.address;
@@ -308,11 +308,6 @@ in
                          Destination = lib.my.c.tailscale.prefix.v6;
                          Gateway = allAssignments.colony.internal.ipv6.address;
                        }
-
-                      {
-                        Destination = prefixes.qclk.v4;
-                        Gateway = allAssignments.colony.routing.ipv4.address;
-                      }
                      ] ++
                      (map (pName: [
                        {
@@ -323,7 +318,7 @@ in
                          Destination = prefixes."${pName}".v6;
                          Gateway = allAssignments.colony.internal.ipv6.address;
                        }
-                    ]) [ "vms" "ctrs" "oci" ]));
+                      ]) [ "vms" "ctrs" "oci" ])));
                  }
                ];

@@ -332,7 +327,7 @@ in
                  {
                    matchConfig.Name = "as211024";
                    networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                      {
                        Destination = lib.my.c.home.prefixes.all.v4;
                        Gateway = lib.my.c.home.vips.as211024.v4;
@@ -344,8 +339,10 @@ in
                  matchConfig.Name = "kelder";
                  routes = [
                    {
+                      routeConfig = {
                        Destination = allAssignments.kelder.estuary.ipv4.address;
                        Scope = "link";
+                      };
                    }
                  ];
                };
@@ -402,19 +399,14 @@ in

                      ip6 daddr ${aa.middleman.internal.ipv6.address} tcp dport { http, https, 8448 } accept
                      ${matchInet "tcp dport { http, https } accept" "git"}
-                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport 25565 accept
+                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport { 25565, 25575 } accept
                      ip6 daddr ${aa.simpcraft-staging-oci.internal.ipv6.address} tcp dport 25565 accept
-                      ip6 daddr ${aa.kevcraft-oci.internal.ipv6.address} tcp dport 25567 accept
-                      ip6 daddr ${aa.kinkcraft-oci.internal.ipv6.address} tcp dport 25568 accept
                      return
                    }
                    chain routing-udp {
                      ip6 daddr ${aa.valheim-oci.internal.ipv6.address} udp dport { 2456-2457 } accept
                      ip6 daddr ${aa.waffletail.internal.ipv6.address} udp dport 41641 accept
                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} udp dport 25565 accept
-                      ip6 daddr ${aa.enshrouded-oci.internal.ipv6.address} udp dport { 15636-15637 } accept
-                      ip6 daddr ${aa.kevcraft-oci.internal.ipv6.address} udp dport 25567 accept
-                      ip6 daddr ${aa.kinkcraft-oci.internal.ipv6.address} udp dport 25568 accept
                      return
                    }
                    chain filter-routing {
--- a/nixos/boxes/colony/vms/estuary/dns.nix
+++ b/nixos/boxes/colony/vms/estuary/dns.nix
@@ -14,7 +14,7 @@ in
          owner = "pdns";
          group = "pdns";
        };
-        "estuary/pdns/recursor.yml" = {
+        "estuary/pdns/recursor.conf" = {
          owner = "pdns-recursor";
          group = "pdns-recursor";
        };
@@ -31,7 +31,7 @@ in

      pdns.recursor = {
        enable = true;
-        extraSettingsFile = config.age.secrets."estuary/pdns/recursor.yml".path;
+        extraSettingsFile = config.age.secrets."estuary/pdns/recursor.conf".path;
      };
    };

@@ -44,37 +44,34 @@ in
      };

      pdns-recursor = {
-        yaml-settings = {
-          incoming = {
-            listen = [
+        dns = {
+          address = [
            "127.0.0.1" "::1"
            assignments.base.ipv4.address assignments.base.ipv6.address
          ];
-            allow_from = [
+          allowFrom = [
            "127.0.0.0/8" "::1/128"
            prefixes.all.v4 prefixes.all.v6
          ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
-
-            # DNS NOTIFY messages override TTL
-            allow_notify_for = authZones;
-            allow_notify_from = [ "127.0.0.0/8" "::1/128" ];
        };

-          outgoing = {
-            source_address = [
+        settings = {
+          query-local-address = [
            assignments.internal.ipv4.address
            assignments.internal.ipv6.address
            assignments.base.ipv6.address
          ];
-          };
+          forward-zones = map (z: "${z}=127.0.0.1:5353") authZones;

-          recursor = {
-            forward_zones = map (z: {
-              zone = z;
-              forwarders = [ "127.0.0.1:5353" ];
-            }) authZones;
+          # DNS NOTIFY messages override TTL
+          allow-notify-for = authZones;
+          allow-notify-from = [ "127.0.0.0/8" "::1/128" ];

-            lua_dns_script = pkgs.writeText "pdns-script.lua" ''
+          webserver = true;
+          webserver-address = "::";
+          webserver-allow-from = [ "127.0.0.1" "::1" ];
+
+          lua-dns-script = pkgs.writeText "pdns-script.lua" ''
            function preresolve(dq)
              if dq.qname:equal("nix-cache.nul.ie") then
                dq:addAnswer(pdns.CNAME, "http.${config.networking.domain}.")
@@ -87,13 +84,6 @@ in
            end
          '';
        };
-
-          webservice = {
-            webserver = true;
-            address = "::";
-            allow_from = [ "127.0.0.1" "::1" ];
-          };
-        };
      };
    };

@@ -163,11 +153,6 @@ in
            simpcraft IN AAAA ${allAssignments.simpcraft-oci.internal.ipv6.address}
            simpcraft-staging IN A ${assignments.internal.ipv4.address}
            simpcraft-staging IN AAAA ${allAssignments.simpcraft-staging-oci.internal.ipv6.address}
-            enshrouded IN A ${assignments.internal.ipv4.address}
-            kevcraft IN A ${assignments.internal.ipv4.address}
-            kevcraft IN AAAA ${allAssignments.kevcraft-oci.internal.ipv6.address}
-            kinkcraft IN A ${assignments.internal.ipv4.address}
-            kinkcraft IN AAAA ${allAssignments.kinkcraft-oci.internal.ipv6.address}

            mail-vm IN A ${net.cidr.host 0 prefixes.mail.v4}
            mail-vm IN AAAA ${net.cidr.host 1 prefixes.mail.v6}
--- a/nixos/boxes/colony/vms/git/default.nix
+++ b/nixos/boxes/colony/vms/git/default.nix
@@ -4,7 +4,7 @@ let
  inherit (lib) mkMerge mkDefault;
  inherit (lib.my) net;
  inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.colony) domain prefixes firewallForwards;
+  inherit (lib.my.c.colony) domain prefixes;
  inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
 in
 {
@@ -197,7 +197,6 @@ in

              firewall = {
                tcp.allowed = [ 19999 "http" "https" ];
-                nat.forwardPorts."${allAssignments.estuary.internal.ipv4.address}" = firewallForwards allAssignments;
                extraRules = ''
                  table inet filter {
                    chain forward {
--- a/nixos/boxes/colony/vms/git/gitea-actions.nix
+++ b/nixos/boxes/colony/vms/git/gitea-actions.nix
@@ -35,11 +35,6 @@ in
          ];
          url = "https://git.${pubDomain}";
          tokenFile = config.age.secrets."gitea/actions-runner.env".path;
-          settings = {
-            runner = {
-              timeout = "8h";
-            };
-          };
        };
      };
    };
--- a/nixos/boxes/colony/vms/shill/containers-ext.nix
+++ b/nixos/boxes/colony/vms/shill/containers-ext.nix
@@ -47,10 +47,10 @@ in
        };
        ipv6Prefixes = [
          {
-            Prefix = prefixes.jam.v6;
+            ipv6PrefixConfig.Prefix = prefixes.jam.v6;
          }
        ];
-        routes = [
+        routes = map (r: { routeConfig = r; }) [
          {
            Destination = prefixes.jam.v4;
            Scope = "link";
@@ -64,8 +64,8 @@ in

        serviceConfig = {
          CPUQuota = "400%";
-          MemoryHigh = "infinity";
-          MemoryMax = "4G";
+          MemoryHigh = "4G";
+          MemoryMax = "4.1G";
        };

        wantedBy = [ "machines.target" ];
--- a/nixos/boxes/colony/vms/shill/containers/chatterbox.nix
+++ b/nixos/boxes/colony/vms/shill/containers/chatterbox.nix
@@ -50,6 +50,11 @@ in
                  group = "matrix-synapse";
                };

+                "chatterbox/syncv3.env" = {
+                  owner = "matrix-syncv3";
+                  group = "matrix-syncv3";
+                };
+
                "chatterbox/mautrix-whatsapp.env" = {
                  owner = "mautrix-whatsapp";
                  group = "mautrix-whatsapp";
@@ -75,21 +80,32 @@ in
              matrix-synapse.extraGroups = [
                "mautrix-whatsapp"
              ];
+              matrix-syncv3 = {
+                isSystemUser = true;
+                uid = uids.matrix-syncv3;
+                group = "matrix-syncv3";
+              };
+            };
+            groups = {
+              matrix-syncv3.gid = gids.matrix-syncv3;
            };
-            groups = { };
          };

          systemd = {
            network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
-            services = { } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
+            services = {
+              matrix-sliding-sync.serviceConfig = {
+                # Needs to be able to read its secrets
+                DynamicUser = mkForce false;
+                User = "matrix-syncv3";
+                Group = "matrix-syncv3";
+              };
+            } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
              # ffmpeg needed to convert GIFs to video
              path = with pkgs; [ ffmpeg ];
            }));
          };

-          # TODO/FIXME: https://github.com/NixOS/nixpkgs/issues/336052
-          nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
-
          services = {
            netdata.enable = true;
            matrix-synapse = {
@@ -177,10 +193,20 @@ in
                app_service_config_files = [
                  "/var/lib/heisenbridge/registration.yml"
                  config.age.secrets."chatterbox/doublepuppet.yaml".path
+                  "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
                ];
              };

            };
+            matrix-sliding-sync = {
+              enable = true;
+              createDatabase = false;
+              environmentFile = config.age.secrets."chatterbox/syncv3.env".path;
+              settings = {
+                SYNCV3_BINDADDR = "[::]:8009";
+                SYNCV3_SERVER = "http://localhost:8008";
+              };
+            };

            heisenbridge = {
              enable = true;
@@ -259,12 +285,10 @@ in
                      avatar = "mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak";
                    };
                  };
-                  network = {
-                    mode = "messenger";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
-                  };
+                  meta.mode = "messenger";
                  bridge = {
                    username_template = "fbm2_{{.}}";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
                    personal_filtering_spaces = true;
                    delivery_receipts = true;
                    management_room_text.welcome = "Hello, I'm a Messenger bridge bot.";
@@ -307,12 +331,10 @@ in
                      avatar = "mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv";
                    };
                  };
-                  network = {
-                    mode = "instagram";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
-                  };
+                  meta.mode = "instagram";
                  bridge = {
                    username_template = "ig_{{.}}";
+                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
                    personal_filtering_spaces = true;
                    delivery_receipts = true;
                    management_room_text.welcome = "Hello, I'm an Instagram bridge bot.";
@@ -328,7 +350,6 @@ in
                    };
                    permissions = {
                      "@dev:nul.ie" = "admin";
-                      "@adzerq:nul.ie" = "user";
                    };
                  };
                };
--- a/nixos/boxes/colony/vms/shill/containers/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/default.nix
@@ -8,6 +8,5 @@
    ./object.nix
    ./toot.nix
    ./waffletail.nix
-    ./qclk
  ];
 }
--- a/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
@@ -23,7 +23,7 @@ in
      };
    };

-    configuration = { lib, pkgs, config, allAssignments, ... }:
+    configuration = { lib, pkgs, config, ... }:
    let
      inherit (lib) mkForce;
    in
@@ -39,20 +39,10 @@ in
            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPUv1ntVrZv5ripsKpcOAnyDQX2PHjowzyhqWK10Ml53";
            files = {
              "jackflix/photoprism-pass.txt" = {};
-              "jackflix/copyparty-pass.txt" = {
-                owner = "copyparty";
-                group = "copyparty";
            };
          };
        };

-          firewall = {
-            tcp.allowed = [
-              3923
-            ];
-          };
-        };
-
        users = with lib.my.c.ids; {
          users = {
            "${config.my.user.config.name}".extraGroups = [ "media" ];
@@ -70,16 +60,11 @@ in
              uid = uids.photoprism;
              group = "photoprism";
            };
-            copyparty = {
-              uid = uids.copyparty;
-              extraGroups = [ "media" ];
-            };
          };
          groups = {
            media.gid = 2000;
            jellyseerr.gid = gids.jellyseerr;
            photoprism.gid = gids.photoprism;
-            copyparty.gid = gids.copyparty;
          };
        };

@@ -138,7 +123,6 @@ in
            };
          };

-          flaresolverr.enable = true;
          jackett.enable = true;
          radarr.enable = true;
          sonarr.enable = true;
@@ -166,50 +150,6 @@ in
              PHOTOPRISM_DATABASE_DRIVER = "sqlite";
            };
          };
-
-          copyparty = {
-            enable = true;
-            package = pkgs.copyparty.override {
-              withMagic = true;
-            };
-            settings = {
-              name = "dev-stuff";
-              no-reload = true;
-              j = 8; # cores
-              http-only = true;
-              xff-src =
-                with allAssignments.middleman.internal;
-                [ "${ipv4.address}/32" prefixes.ctrs.v6 ];
-              rproxy = 1; # get if from x-forwarded-for
-              magic = true; # enable checking file magic on upload
-              hist = "/var/cache/copyparty";
-              shr = "/share"; # enable share creation
-              ed = true; # enable dotfiles
-              chmod-f = 664;
-              chmod-d = 775;
-              e2dsa = true; # file indexing
-              e2t = true; # metadata indexing
-              og-ua = "(Discord|Twitter|Slack)bot"; # embeds
-              theme = 6;
-            };
-            accounts.dev.passwordFile = config.age.secrets."jackflix/copyparty-pass.txt".path;
-            volumes = {
-              "/" = {
-                path = "/mnt/media/public";
-                access = {
-                  A = "dev";
-                  "r." = "*";
-                };
-                flags = {
-                  shr_who = "no"; # no reason to have shares here
-                };
-              };
-              "/priv" = {
-                path = "/mnt/media/stuff";
-                access.A = "dev"; # dev has admin access
-              };
-            };
-          };
        };
      };
    };
--- a/nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix
+++ b/nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix
@@ -71,12 +71,14 @@ in
              RouteTable = routeTable;
            };
            wireguardPeers = [
-              # AirVPN NL
              {
+                # AirVPN NL
+                wireguardPeerConfig = {
                  Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
                  PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
                  PresharedKeyFile = config.age.secrets."${pskFile}".path;
                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                };
              }
            ];
          };
@@ -92,7 +94,7 @@ in
              matchConfig.Name = "vpn";
              address = [ "10.182.97.37/32" "fd7d:76ee:e68f:a993:735d:ef5e:6907:b122/128" ];
              dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = [
+              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                {
                  Family = "both";
                  SuppressPrefixLength = 0;
--- a/nixos/boxes/colony/vms/shill/containers/middleman/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/default.nix
@@ -239,9 +239,6 @@ in
              ];

              recommendedTlsSettings = true;
-              recommendedBrotliSettings = true;
-              # Uh so nginx is hanging with zstd enabled... maybe let's not for now
-              # recommendedZstdSettings = true;
              clientMaxBodySize = "0";
              serverTokens = true;
              resolver = {
@@ -251,9 +248,6 @@ in
              proxyResolveWhileRunning = true;
              sslDhparam = config.age.secrets."dhparams.pem".path;

-              appendConfig = ''
-                worker_processes auto;
-              '';
              # Based on recommended*Settings, but probably better to be explicit about these
              appendHttpConfig = ''
                ${baseHttpConfig}
--- a/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
@@ -2,7 +2,7 @@
 let
  inherit (builtins) mapAttrs toJSON;
  inherit (lib) mkMerge mkDefault genAttrs flatten concatStringsSep;
-  inherit (lib.my.c) pubDomain home;
+  inherit (lib.my.c) pubDomain;
  inherit (lib.my.c.nginx) proxyHeaders;
  inherit (config.networking) domain;

@@ -35,6 +35,7 @@ let
      # For clients
      (mkWellKnown "matrix/client" (toJSON {
        "m.homeserver".base_url = "https://matrix.nul.ie";
+        "org.matrix.msc3575.proxy".url = "https://matrix-syncv3.nul.ie";
      }))
    ];
  };
@@ -49,7 +50,6 @@ let
    "/.well-known/webfinger".return = "301 https://toot.nul.ie$request_uri";
    "/.well-known/nodeinfo".return = "301 https://toot.nul.ie$request_uri";
    "/.well-known/host-meta".return = "301 https://toot.nul.ie$request_uri";
-    "/.well-known/atproto-did".return = "301 https://pds.nul.ie$request_uri";
  };
 in
 {
@@ -80,10 +80,6 @@ in
                  sha256 = "018wh6ps19n7323fi44njzj9yd4wqslc90dykbwfyscv7bgxhlar";
                };
              }
-              {
-                name = "ssh.pub";
-                path = lib.my.c.sshKeyFiles.me;
-              }
            ];
          }
          wellKnown
@@ -149,7 +145,7 @@ in

      "pass.${pubDomain}" =
      let
-        upstream = "http://vaultwarden-ctr.${domain}:8080";
+        upstream = "http://vaultwarden-ctr.${domain}";
      in
      {
        locations = {
@@ -186,6 +182,10 @@ in
        ];
        useACMEHost = pubDomain;
      };
+      "matrix-syncv3.${pubDomain}" = {
+        locations."/".proxyPass = "http://chatterbox-ctr.${domain}:8009";
+        useACMEHost = pubDomain;
+      };

      "element.${pubDomain}" =
      let
@@ -327,15 +327,6 @@ in
        useACMEHost = pubDomain;
      };

-      "pds.nul.ie" = {
-        locations."/" = {
-          proxyPass = "http://toot-ctr.${domain}:3000";
-          proxyWebsockets = true;
-          extraConfig = proxyHeaders;
-        };
-        useACMEHost = pubDomain;
-      };
-
      "share.${pubDomain}" = {
        locations."/" = {
          proxyPass = "http://object-ctr.${domain}:9090";
@@ -347,13 +338,16 @@ in

      "stuff.${pubDomain}" = {
        locations."/" = {
-          proxyPass = "http://jackflix-ctr.${domain}:3923";
+          basicAuthFile = config.age.secrets."middleman/htpasswd".path;
+          root = "/mnt/media/stuff";
+          extraConfig = ''
+            fancyindex on;
+            fancyindex_show_dotfiles on;
+          '';
        };
        useACMEHost = pubDomain;
      };
      "public.${pubDomain}" = {
-        onlySSL = false;
-        addSSL = true;
        serverAliases = [ "p.${pubDomain}" ];
        locations."/" = {
          root = "/mnt/media/public";
@@ -374,11 +368,6 @@ in
        useACMEHost = pubDomain;
      };

-      "mc-map-kink.${pubDomain}" = {
-        locations."/".proxyPass = "http://kinkcraft-oci.${domain}:8100";
-        useACMEHost = pubDomain;
-      };
-
      "librespeed.${domain}" = {
        locations."/".proxyPass = "http://localhost:8989";
      };
@@ -407,36 +396,6 @@ in
        };
        useACMEHost = pubDomain;
      };
-
-      "pront.${pubDomain}" = mkMerge [
-        {
-          locations."/" = mkMerge [
-            {
-              proxyPass = "http://stream-hi.${home.domain}:5000";
-              proxyWebsockets = true;
-              extraConfig = proxyHeaders;
-            }
-            (ssoLoc "generic")
-          ];
-          locations."~* ^/webcam/(.*)" = mkMerge [
-            {
-              proxyPass = "http://stream-hi.${home.domain}:5050/$1$is_args$args";
-              extraConfig = proxyHeaders;
-            }
-            (ssoLoc "generic")
-          ];
-          useACMEHost = pubDomain;
-        }
-        (ssoServer "generic")
-      ];
-      "hass.${pubDomain}" = {
-        locations."/" = {
-          proxyPass = "http://hass-ctr.${home.domain}:8123";
-          proxyWebsockets = true;
-          extraConfig = proxyHeaders;
-        };
-        useACMEHost = pubDomain;
-      };
    };

    minio =
@@ -448,13 +407,10 @@ in
        ignore_invalid_headers off;
      '';

-      nixCacheableRegex = ''^\/(\S+\.narinfo|nar\/\S+\.nar.*|serve\/.+)$'';
+      nixCacheableRegex = ''^\/(\S+\.narinfo|nar\/\S+\.nar\.\S+)$'';
      nixCacheHeaders = ''
        add_header Cache-Control $nix_cache_control;
        add_header Expires $nix_expires;
-
-        brotli on;
-        brotli_types application/x-nix-archive;
      '';
    in
    {
@@ -496,11 +452,9 @@ in

      "nix-cache.${pubDomain}" = {
        locations = {
-          "/" = {
-            proxyPass = "http://${host}:5000";
-          };
+          "/".proxyPass = "http://${host}:8069";
          "~ ${nixCacheableRegex}" = {
-            proxyPass = "http://${host}:5000";
+            proxyPass = "http://${host}:8069";
            extraConfig = nixCacheHeaders;
          };
        };
--- a/nixos/boxes/colony/vms/shill/containers/object.nix
+++ b/nixos/boxes/colony/vms/shill/containers/object.nix
@@ -31,13 +31,6 @@ in
    {
      config = mkMerge [
        {
-          fileSystems = {
-            "/var/lib/harmonia" = {
-              device = "/mnt/nix-cache";
-              options = [ "bind" ];
-            };
-          };
-
          my = {
            deploy.enable = false;
            server.enable = true;
@@ -55,7 +48,6 @@ in
                  group = config.my.user.config.group;
                };
                "object/atticd.env" = {};
-                "nix-cache.key" = {};
                "object/hedgedoc.env" = {};
                "object/wastebin.env" = {};
              };
@@ -66,7 +58,6 @@ in
                9000 9001
                config.services.sharry.config.bind.port
                8069
-                5000
                config.services.hedgedoc.settings.port
                8088
              ];
@@ -77,26 +68,14 @@ in
            };
          };

-          users = with lib.my.c.ids; mkMerge [
-            (let inherit (config.services.atticd) user group; in {
+          users = with lib.my.c.ids; let inherit (config.services.atticd) user group; in {
            users."${user}" = {
              isSystemUser = true;
              uid = uids.atticd;
              group = group;
            };
            groups."${user}".gid = gids.atticd;
-            })
-            {
-              users = {
-                harmonia = {
-                  shell = pkgs.bashInteractive;
-                  openssh.authorizedKeys.keyFiles = [
-                    lib.my.c.sshKeyFiles.harmonia
-                  ];
          };
-              };
-            }
-          ];

          systemd = {
            network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
@@ -114,9 +93,7 @@ in
                  MINIO_BROWSER_REDIRECT_URL = "https://minio.nul.ie";
                };
              };
-
              sharry = awaitPostgres;
-
              atticd = mkMerge [
                awaitPostgres
                {
@@ -127,15 +104,6 @@ in
                  };
                }
              ];
-              harmonia = {
-                environment.NIX_REMOTE = "/var/lib/harmonia";
-                preStart = ''
-                  ${config.nix.package}/bin/nix store ping
-                '';
-                serviceConfig = {
-                  StateDirectory = "harmonia";
-                };
-              };
            };
          };

@@ -215,8 +183,8 @@ in
            };

            atticd = {
-              enable = false;
-              environmentFile = config.age.secrets."object/atticd.env".path;
+              enable = true;
+              credentialsFile = config.age.secrets."object/atticd.env".path;
              settings = {
                listen = "[::]:8069";
                allowed-hosts = [ "nix-cache.${pubDomain}" ];
@@ -235,14 +203,6 @@ in
              };
            };

-            harmonia = {
-              enable = true;
-              signKeyPaths = [ config.age.secrets."nix-cache.key".path ];
-              settings = {
-                priority = 30;
-              };
-            };
-
            hedgedoc = {
              enable = true;
              environmentFile = config.age.secrets."object/hedgedoc.env".path;
--- a/nixos/boxes/colony/vms/shill/containers/qclk/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/qclk/default.nix
@@ -1,115 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.colony) domain prefixes qclk;
-in
-{
-  nixos.systems.qclk = { config, ... }: {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    rendered = config.configuration.config.my.asContainer;
-
-    assignments = {
-      internal = {
-        name = "qclk-ctr";
-        inherit domain;
-        ipv4.address = net.cidr.host 10 prefixes.ctrs.v4;
-        ipv6 = {
-          iid = "::a";
-          address = net.cidr.host 10 prefixes.ctrs.v6;
-        };
-      };
-      qclk = {
-        ipv4 = {
-          address = net.cidr.host 1 prefixes.qclk.v4;
-          gateway = null;
-        };
-      };
-    };
-
-    configuration = { lib, pkgs, config, assignments, ... }:
-    let
-      inherit (lib) concatStringsSep mkMerge mkIf mkForce;
-      inherit (lib.my) networkdAssignment;
-
-      apiPort = 8080;
-
-      instances = [
-        {
-          host = 2;
-          wgKey = "D7z1FhcdxpnrGCE0wBW5PZb5BKuhCu6tcZ/5ZaYxdwQ=";
-        }
-      ];
-      ipFor = i: net.cidr.host i.host prefixes.qclk.v4;
-    in
-    {
-      config = {
-        environment = {
-          systemPackages = with pkgs; [
-            wireguard-tools
-          ];
-        };
-
-        my = {
-          deploy.enable = false;
-          server.enable = true;
-
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC1kcfvahYmSk8IJKaUIcGkhxf/8Yse2XnU7Qqgcglyq";
-            files = {
-              "qclk/wg.key" = {
-                group = "systemd-network";
-                mode = "440";
-              };
-            };
-          };
-
-          firewall = {
-            udp.allowed = [ qclk.wgPort ];
-            extraRules = ''
-              table inet filter {
-                chain input {
-                  iifname management tcp dport ${toString apiPort} accept
-                }
-                chain forward {
-                  iifname host0 oifname management ip saddr { ${concatStringsSep ", " lib.my.c.as211024.trusted.v4} } accept
-                }
-              }
-              table inet nat {
-                chain postrouting {
-                  iifname host0 oifname management snat ip to ${assignments.qclk.ipv4.address}
-                }
-              }
-            '';
-          };
-        };
-
-        systemd = {
-          network = {
-            netdevs."30-management" = {
-              netdevConfig = {
-                Name = "management";
-                Kind = "wireguard";
-              };
-              wireguardConfig = {
-                PrivateKeyFile = config.age.secrets."qclk/wg.key".path;
-                ListenPort = qclk.wgPort;
-              };
-              wireguardPeers = map (i: {
-                PublicKey = i.wgKey;
-                AllowedIPs = [ (ipFor i) ];
-              }) instances;
-            };
-            networks = {
-              "30-container-host0" = networkdAssignment "host0" assignments.internal;
-
-              "30-management" = networkdAssignment "management" assignments.qclk;
-            };
-          };
-        };
-
-        services = { };
-      };
-    };
-  };
-}
--- a/nixos/boxes/colony/vms/shill/containers/toot.nix
+++ b/nixos/boxes/colony/vms/shill/containers/toot.nix
@@ -26,8 +26,6 @@ in
    let
      inherit (lib) mkMerge mkIf genAttrs;
      inherit (lib.my) networkdAssignment systemdAwaitPostgres;
-
-      pdsPort = 3000;
    in
    {
      config = mkMerge [
@@ -38,7 +36,7 @@ in

            secrets = {
              key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSslLkDe54AKYzxdtKD70zcU72W0EpYsfbdJ6UFq0QK";
-              files = (genAttrs
+              files = genAttrs
                (map (f: "toot/${f}") [
                  "postgres-password.txt"
                  "secret-key.txt"
@@ -50,12 +48,7 @@ in
                (_: with config.services.mastodon; {
                  owner = user;
                  inherit group;
-                })) // {
-                  "toot/pds.env" = {
-                    owner = "pds";
-                    group = "pds";
-                  };
-                };
+                });
            };

            firewall = {
@@ -63,7 +56,6 @@ in
                19999

                "http"
-                pdsPort
              ];
            };
          };
@@ -87,7 +79,7 @@ in
            netdata.enable = true;
            mastodon = mkMerge [
              rec {
-                enable = false;
+                enable = true;
                localDomain = extraConfig.WEB_DOMAIN; # for nginx config
                extraConfig = {
                  LOCAL_DOMAIN = "nul.ie";
@@ -95,9 +87,7 @@ in
                };

                secretKeyBaseFile = config.age.secrets."toot/secret-key.txt".path;
-                # TODO: This was removed at some point.
-                # If we want to bring Mastodon back, this will probably need to be addressd.
-                # otpSecretFile = config.age.secrets."toot/otp-secret.txt".path;
+                otpSecretFile = config.age.secrets."toot/otp-secret.txt".path;
                vapidPrivateKeyFile = config.age.secrets."toot/vapid-key.txt".path;
                vapidPublicKeyFile = toString (pkgs.writeText
                  "vapid-pubkey.txt"
@@ -165,32 +155,6 @@ in
                };
              };
            };
-
-            bluesky-pds = {
-              enable = true;
-              environmentFiles = [ config.age.secrets."toot/pds.env".path ];
-              settings = {
-                PDS_HOSTNAME = "pds.nul.ie";
-                PDS_PORT = pdsPort;
-
-                PDS_BLOBSTORE_DISK_LOCATION = null;
-                PDS_BLOBSTORE_S3_BUCKET = "pds";
-                PDS_BLOBSTORE_S3_ENDPOINT = "https://s3.nul.ie/";
-                PDS_BLOBSTORE_S3_REGION = "eu-central-1";
-                PDS_BLOBSTORE_S3_ACCESS_KEY_ID = "pds";
-                PDS_BLOB_UPLOAD_LIMIT = "52428800";
-
-                PDS_EMAIL_FROM_ADDRESS = "pds@nul.ie";
-
-                PDS_DID_PLC_URL = "https://plc.directory";
-                PDS_INVITE_REQUIRED = 1;
-                PDS_BSKY_APP_VIEW_URL = "https://api.bsky.app";
-                PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";
-                PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";
-                PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";
-                PDS_CRAWLERS = "https://bsky.network";
-              };
-            };
          };
        }
        (mkIf config.my.build.isDevVM {
--- a/nixos/boxes/colony/vms/shill/containers/vaultwarden.nix
+++ b/nixos/boxes/colony/vms/shill/containers/vaultwarden.nix
@@ -83,7 +83,7 @@ in
                DOMAIN = "https://pass.${lib.my.c.pubDomain}";

                ROCKET_ADDRESS = "::";
-                ROCKET_PORT = 8080;
+                ROCKET_PORT = 80;

                SMTP_HOST = "mail.nul.ie";
                SMTP_FROM = "pass@nul.ie";
@@ -99,8 +99,6 @@ in
            };

            borgbackup.jobs.vaultwarden = {
-              readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];
-
              paths = [ vwData ];
              repo = "zh2855@zh2855.rsync.net:borg/vaultwarden2";
              doInit = true;
--- a/nixos/boxes/colony/vms/shill/containers/waffletail.nix
+++ b/nixos/boxes/colony/vms/shill/containers/waffletail.nix
@@ -86,7 +86,7 @@ in
            interfaceName = "tailscale0";
            extraUpFlags = [
              "--operator=${config.my.user.config.name}"
-              "--login-server=https://hs.nul.ie"
+              "--login-server=https://ts.nul.ie"
              "--netfilter-mode=off"
              "--advertise-exit-node"
              "--advertise-routes=${advRoutes}"
--- a/nixos/boxes/colony/vms/shill/default.nix
+++ b/nixos/boxes/colony/vms/shill/default.nix
@@ -94,8 +94,8 @@ in
                device = "/dev/disk/by-label/minio";
                fsType = "xfs";
              };
-              "/mnt/nix-cache" = {
-                device = "/dev/disk/by-label/nix-cache";
+              "/mnt/atticd" = {
+                device = "/dev/disk/by-label/atticd";
                fsType = "ext4";
              };
            };
@@ -140,10 +140,10 @@ in
                    };
                    ipv6Prefixes = [
                      {
-                        Prefix = prefixes.ctrs.v6;
+                        ipv6PrefixConfig.Prefix = prefixes.ctrs.v6;
                      }
                    ];
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                      {
                        Destination = lib.my.c.tailscale.prefix.v4;
                        Gateway = allAssignments.waffletail.internal.ipv4.address;
@@ -152,11 +152,6 @@ in
                        Destination = lib.my.c.tailscale.prefix.v6;
                        Gateway = allAssignments.waffletail.internal.ipv6.address;
                      }
-
-                      {
-                        Destination = prefixes.qclk.v4;
-                        Gateway = allAssignments.qclk.internal.ipv4.address;
-                      }
                    ];
                  }
                ];
@@ -211,12 +206,11 @@ in
                  object = {
                    bindMounts = {
                      "/mnt/minio".readOnly = false;
-                      "/mnt/nix-cache".readOnly = false;
+                      "/mnt/atticd".readOnly = false;
                    };
                  };
                  toot = {};
                  waffletail = {};
-                  qclk = {};
                };
              in
              mkMerge [
--- a/nixos/boxes/colony/vms/whale2/default.nix
+++ b/nixos/boxes/colony/vms/whale2/default.nix
@@ -52,9 +52,6 @@ in
      valheim-oci = 2;
      simpcraft-oci = 3;
      simpcraft-staging-oci = 4;
-      enshrouded-oci = 5;
-      kevcraft-oci = 6;
-      kinkcraft-oci = 7;
    };

    configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -69,7 +66,6 @@ in

          ./valheim.nix
          ./minecraft
-          # ./enshrouded.nix
        ];

        config = mkMerge [
--- a/nixos/boxes/colony/vms/whale2/enshrouded.nix
+++ b/nixos/boxes/colony/vms/whale2/enshrouded.nix
@@ -1,35 +0,0 @@
-{ lib, config, allAssignments, ... }:
-let
-  inherit (lib) concatStringsSep;
-  inherit (lib.my) dockerNetAssignment;
-in
-{
-  config = {
-    virtualisation.oci-containers.containers = {
-      enshrouded = {
-        image = "sknnr/enshrouded-dedicated-server@sha256:f163e8ba9caa2115d8a0a7b16c3696968242fb6fba82706d9a77a882df083497";
-
-        environment = {
-          SERVER_NAME = "UWUshrouded";
-          # SERVER_IP = "::"; # no IPv6?? :(
-          TZ = "Europe/Dublin";
-        };
-        environmentFiles = [ config.age.secrets."whale2/enshrouded.env".path ];
-
-        volumes = [
-          "enshrouded:/home/steam/enshrouded/savegame"
-        ];
-
-        extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "enshrouded-oci"}''
-        ];
-      };
-    };
-
-    my = {
-      secrets.files = {
-        "whale2/enshrouded.env" = {};
-      };
-    };
-  };
-}
--- a/nixos/boxes/colony/vms/whale2/minecraft/default.nix
+++ b/nixos/boxes/colony/vms/whale2/minecraft/default.nix
@@ -5,13 +5,12 @@ let

  # devplayer0
  op = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
-  kev = "703b378a-09f9-4c1d-9876-1c9305728c49";
  whitelist = concatStringsSep "," [
    op
    "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56" # Elderlypug
    "fcb26db2-c3ce-41aa-b588-efec79d37a8a" # Jesthral_
    "1d366062-12c0-4e29-aba7-6ab5d8c6bb05" # shr3kas0ras
-    kev
+    "703b378a-09f9-4c1d-9876-1c9305728c49" # OROURKEIRE
    "f105bbe6-eda6-4a13-a8cf-894e77cab77b" # Adzerq
    "1fc94979-41fb-497a-81e9-34ae24ca537a" # johnnyscrims
    "d53c91df-b6e6-4463-b106-e8427d7a8d01" # BossLonus
@@ -105,87 +104,6 @@ in
      #     ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
      #   ];
      # };
-
-      kevcraft = {
-        # 2025.2.1-java21-alpine
-        image = "itzg/minecraft-server@sha256:57e319c15e9fee63f61029a65a33acc3de85118b21a2b4bb29f351cf4a915027";
-
-        environment = {
-          TYPE = "VANILLA";
-          VERSION = "1.20.1";
-          SERVER_PORT = "25567";
-          QUERY_PORT = "25567";
-
-          EULA = "true";
-          ENABLE_QUERY = "true";
-          ENABLE_RCON = "true";
-          MOTD = "§4§k----- §9K§ae§bv§cc§dr§ea§ff§6t §4§k-----";
-          ICON = "/ext/icon.png";
-
-          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
-          WHITELIST = whitelist;
-          EXISTING_OPS_FILE = "SYNCHRONIZE";
-          OPS = concatStringsSep "," [ op kev ];
-          DIFFICULTY = "normal";
-          SPAWN_PROTECTION = "0";
-          # VIEW_DISTANCE = "20";
-
-          MAX_MEMORY = "4G";
-
-          TZ = "Europe/Dublin";
-        };
-        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
-
-        volumes = [
-          "kevcraft_data:/data"
-          "${./kev.png}:/ext/icon.png:ro"
-        ];
-
-        extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "kevcraft-oci"}''
-        ];
-      };
-
-      kinkcraft = {
-        # 2025.5.1-java21-alpine
-        image = "itzg/minecraft-server@sha256:de26c7128e3935f3be48fd30283f0b5a6da1b3d9f1a10c9f92502ee1ba072f7b";
-
-        environment = {
-          TYPE = "MODRINTH";
-          SERVER_PORT = "25568";
-          QUERY_PORT = "25568";
-
-          EULA = "true";
-          ENABLE_QUERY = "true";
-          ENABLE_RCON = "true";
-          MOTD = "§4§k----- §9K§ai§bn§ck§dc§er§fa§6f§5t §4§k-----";
-          ICON = "/ext/icon.png";
-
-          EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
-          WHITELIST = whitelist;
-          EXISTING_OPS_FILE = "SYNCHRONIZE";
-          OPS = op;
-          DIFFICULTY = "normal";
-          SPAWN_PROTECTION = "0";
-          VIEW_DISTANCE = "20";
-
-          MAX_MEMORY = "6G";
-          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/NGutsQSd/Simpcraft-0.2.1.mrpack";
-
-          TZ = "Europe/Dublin";
-        };
-        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
-
-        volumes = [
-          "kinkcraft_data:/data"
-          "${./icon.png}:/ext/icon.png:ro"
-        ];
-
-        extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "kinkcraft-oci"}''
-        ];
-      };
-
    };

    services = {
@@ -205,7 +123,6 @@ in
          within = "12H";
          hourly = 48;
        };
-        readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];

        # Avoid Minecraft poking the files while we back up
        preHook = rconCommand "save-off";
--- a/nixos/boxes/colony/vms/whale2/minecraft/kev.png
+++ b/nixos/boxes/colony/vms/whale2/minecraft/kev.png
--- a/nixos/boxes/home/castle/default.nix
+++ b/nixos/boxes/home/castle/default.nix
@@ -36,7 +36,7 @@ in
          cpu = {
            amd.updateMicrocode = true;
          };
-          graphics.extraPackages = with pkgs; [
+          opengl.extraPackages = with pkgs; [
            intel-media-driver
          ];
          bluetooth.enable = true;
@@ -75,8 +75,6 @@ in
              };
            };
          };
-
-          binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
        };

        fileSystems = {
@@ -150,15 +148,10 @@ in
          mstflint
          qperf
          ethtool
-          android-tools
        ];

        nix = {
          gc.automatic = false;
-          settings = {
-            experimental-features = [ "recursive-nix" ];
-            system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" "recursive-nix" ];
-          };
        };

        systemd = {
--- a/nixos/boxes/home/palace/vms/default.nix
+++ b/nixos/boxes/home/palace/vms/default.nix
@@ -188,13 +188,6 @@
                hostBDF = "44:00.4";
              };
            };
-            qemuFlags = [
-              "device qemu-xhci,id=xhci"
-              # Front-right port?
-              "device usb-host,hostbus=1,hostport=4"
-              # Front-left port
-              "device usb-host,hostbus=1,hostport=3"
-            ];
          };
        };
      };
--- a/nixos/boxes/home/palace/vms/sfh/containers/default.nix
+++ b/nixos/boxes/home/palace/vms/sfh/containers/default.nix
@@ -1,6 +1,5 @@
 {
  imports = [
    ./unifi.nix
-    ./hass.nix
  ];
 }
--- a/nixos/boxes/home/palace/vms/sfh/containers/hass.nix
+++ b/nixos/boxes/home/palace/vms/sfh/containers/hass.nix
@@ -1,262 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.home) domain prefixes vips hiMTU;
-in
-{
-  nixos.systems.hass = { config, ... }: {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    rendered = config.configuration.config.my.asContainer;
-
-    assignments = {
-      hi = {
-        name = "hass-ctr";
-        altNames = [ "frigate" ];
-        inherit domain;
-        mtu = hiMTU;
-        ipv4 = {
-          address = net.cidr.host 103 prefixes.hi.v4;
-          mask = 22;
-          gateway = vips.hi.v4;
-        };
-        ipv6 = {
-          iid = "::5:3";
-          address = net.cidr.host (65536*5+3) prefixes.hi.v6;
-        };
-      };
-      lo = {
-        name = "hass-ctr-lo";
-        inherit domain;
-        mtu = 1500;
-        ipv4 = {
-          address = net.cidr.host 103 prefixes.lo.v4;
-          mask = 21;
-          gateway = null;
-        };
-        ipv6 = {
-          iid = "::5:3";
-          address = net.cidr.host (65536*5+3) prefixes.lo.v6;
-        };
-      };
-    };
-
-    configuration = { lib, config, pkgs, assignments, allAssignments, ... }:
-    let
-      inherit (lib) mkMerge mkIf mkForce;
-      inherit (lib.my) networkdAssignment;
-
-      hassCli = pkgs.writeShellScriptBin "hass-cli" ''
-        export HASS_SERVER="http://localhost:${toString config.services.home-assistant.config.http.server_port}"
-        export HASS_TOKEN="$(< ${config.age.secrets."hass/cli-token.txt".path})"
-        exec ${pkgs.home-assistant-cli}/bin/hass-cli "$@"
-      '';
-    in
-    {
-      config = {
-        my = {
-          deploy.enable = false;
-          server.enable = true;
-
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpYX2WbYwUqHp8bFFf0eHFrqrR8xp8IheguA054F8V4";
-            files = {
-              "hass/cli-token.txt" = {
-                owner = config.my.user.config.name;
-              };
-            };
-          };
-
-          firewall = {
-            tcp.allowed = [ "http" 1883 ];
-          };
-        };
-
-        environment = {
-          systemPackages = with pkgs; [
-            usbutils
-            hassCli
-          ];
-        };
-
-        systemd = {
-          network.networks = {
-            "80-container-host0" = networkdAssignment "host0" assignments.hi;
-            "80-container-lan-lo" = networkdAssignment "lan-lo" assignments.lo;
-          };
-        };
-
-        services = {
-          mosquitto = {
-            enable = true;
-            listeners = [
-              {
-                omitPasswordAuth = true;
-                settings = {
-                  allow_anonymous = true;
-                };
-              }
-            ];
-          };
-
-          go2rtc = {
-            enable = true;
-            settings = {
-              streams = {
-                reolink_living_room = [
-                  # "http://reolink-living-room.${domain}/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=admin#video=copy#audio=copy#audio=opus"
-                  "rtsp://admin:@reolink-living-room:554/h264Preview_01_main"
-                ];
-                webcam_office = [
-                  "ffmpeg:device?video=/dev/video0&video_size=1024x576#video=h264"
-                ];
-              };
-            };
-          };
-
-          frigate = {
-            enable = true;
-            hostname = "frigate.${domain}";
-            settings = {
-              mqtt = {
-                enabled = true;
-                host = "localhost";
-                topic_prefix = "frigate";
-              };
-
-              cameras = {
-                reolink_living_room = {
-                  ffmpeg.inputs = [
-                    {
-                      path = "rtsp://127.0.0.1:8554/reolink_living_room";
-                      input_args = "preset-rtsp-restream";
-                      roles = [ "record" "detect" ];
-                    }
-                  ];
-                  detect = {
-                    enabled = false;
-                  };
-                  record = {
-                    enabled = true;
-                    retain.days = 1;
-                  };
-                };
-
-                webcam_office = {
-                  ffmpeg.inputs = [
-                    {
-                      path = "rtsp://127.0.0.1:8554/webcam_office";
-                      input_args = "preset-rtsp-restream";
-                      roles = [ "record" "detect" ];
-                    }
-                  ];
-                  detect.enabled = false;
-                  record = {
-                    enabled = true;
-                    retain.days = 1;
-                  };
-                };
-              };
-            };
-          };
-
-          home-assistant =
-          let
-            cfg = config.services.home-assistant;
-
-            pyirishrail = ps: ps.buildPythonPackage rec {
-              pname = "pyirishrail";
-              version = "0.0.2";
-              src = pkgs.fetchFromGitHub {
-                owner = "ttroy50";
-                repo = "pyirishrail";
-                tag = version;
-                hash = "sha256-NgARqhcXP0lgGpgBRiNtQaSn9JcRNtCcZPljcL7t3Xc=";
-              };
-
-              dependencies = with ps; [
-                requests
-              ];
-
-              pyproject = true;
-              build-system = [ ps.setuptools ];
-            };
-          in
-          {
-            enable = true;
-
-            extraComponents = [
-              "default_config"
-              "esphome"
-              "google_translate"
-
-              "met"
-              "zha"
-              "denonavr"
-              "webostv"
-              "androidtv_remote"
-              "heos"
-              "mqtt"
-              "wled"
-            ];
-            extraPackages = python3Packages: with python3Packages; [
-              zlib-ng
-              isal
-
-              gtts
-              (pyirishrail python3Packages)
-            ];
-            customComponents = with pkgs.home-assistant-custom-components; [
-              alarmo
-              frigate
-            ];
-
-            configWritable = false;
-            openFirewall = true;
-            config = {
-              default_config = {};
-              homeassistant = {
-                name = "Home";
-                unit_system = "metric";
-                currency = "EUR";
-                country = "IE";
-                time_zone = "Europe/Dublin";
-                external_url = "https://hass.${pubDomain}";
-                internal_url = "http://hass-ctr.${domain}:${toString cfg.config.http.server_port}";
-              };
-              http = {
-                use_x_forwarded_for = true;
-                trusted_proxies = with allAssignments.middleman.internal; [
-                  ipv4.address
-                  ipv6.address
-                ];
-                ip_ban_enabled = false;
-              };
-              automation = "!include automations.yaml";
-              script = "!include scripts.yaml";
-              scene = "!include scenes.yaml";
-
-              sensor = [
-                {
-                  platform = "irish_rail_transport";
-                  name = "To Work from Home";
-                  station = "Glenageary";
-                  stops_at = "Dublin Connolly";
-                  direction = "Northbound";
-                }
-                {
-                  platform = "irish_rail_transport";
-                  name = "To Home from Work";
-                  station = "Dublin Connolly";
-                  stops_at = "Glenageary";
-                  direction = "Southbound";
-                }
-              ];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/nixos/boxes/home/palace/vms/sfh/containers/unifi.nix
+++ b/nixos/boxes/home/palace/vms/sfh/containers/unifi.nix
@@ -55,8 +55,7 @@ in
          unifi = {
            enable = true;
            openFirewall = true;
-            unifiPackage = pkgs.unifi;
-            mongodbPackage = pkgs.mongodb-7_0;
+            unifiPackage = pkgs.unifi8;
          };
        };
      };
--- a/nixos/boxes/home/palace/vms/sfh/default.nix
+++ b/nixos/boxes/home/palace/vms/sfh/default.nix
@@ -29,7 +29,7 @@ in

    configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
    let
-      inherit (lib) mapAttrs mkMerge mkForce;
+      inherit (lib) mapAttrs mkMerge;
      inherit (lib.my) networkdAssignment;
      inherit (lib.my.c) networkd;
      inherit (lib.my.c.home) domain;
@@ -83,12 +83,6 @@ in
          };
        };

-        environment = {
-          systemPackages = with pkgs; [
-            usbutils
-          ];
-        };
-
        systemd.network = {
          links = {
            "10-lan-hi" = {
@@ -111,13 +105,6 @@ in
                MTUBytes = toString lib.my.c.home.hiMTU;
              };
            };
-            "10-lan-lo-ctrs" = {
-              matchConfig = {
-                Driver = "virtio_net";
-                PermanentMACAddress = "52:54:00:a5:7e:93";
-              };
-              linkConfig.Name = "lan-lo-ctrs";
-            };
          };

          networks = {
@@ -131,28 +118,8 @@ in
              linkConfig.RequiredForOnline = "no";
              networkConfig = networkd.noL3;
            };
-            "30-lan-lo-ctrs" = {
-              matchConfig.Name = "lan-lo-ctrs";
-              linkConfig.RequiredForOnline = "no";
-              networkConfig = networkd.noL3;
          };
        };
-        };
-
-        systemd.nspawn = {
-          hass = {
-            networkConfig = {
-              MACVLAN = mkForce "lan-hi-ctrs:host0 lan-lo-ctrs:lan-lo";
-            };
-          };
-        };
-
-        systemd.services = {
-          "systemd-nspawn@hass".serviceConfig.DeviceAllow = [
-            "char-ttyUSB rw"
-            "char-video4linux rw"
-          ];
-        };

        my = {
          secrets = {
@@ -174,17 +141,7 @@ in
          containers.instances =
          let
            instances = {
-              # unifi = {};
-              hass = {
-                bindMounts = {
-                  "/dev/bus/usb/001/002".readOnly = false;
-                  "/dev/video0".readOnly = false;
-                  "/dev/serial/by-id/usb-Nabu_Casa_Home_Assistant_Connect_ZBT-1_ce549704fe38ef11a2c2e5d154516304-if00-port0" = {
-                    readOnly = false;
-                    mountPoint = "/dev/ttyUSB0";
-                  };
-                };
-              };
+              unifi = {};
            };
          in
          mkMerge [
--- a/nixos/boxes/home/routing-common/default.nix
+++ b/nixos/boxes/home/routing-common/default.nix
@@ -141,8 +141,8 @@ in
                  onState = [ "configured" ];
                  script = ''
                  #!${pkgs.runtimeShell}
-                  if [ "$IFACE" = "wan-ifb" ]; then
-                    ${pkgs.iproute2}/bin/tc filter add dev wan parent ffff: matchall action mirred egress redirect dev "$IFACE"
+                  if [ $IFACE = "wan-ifb" ]; then
+                    ${pkgs.iproute2}/bin/tc filter add dev wan parent ffff: matchall action mirred egress redirect dev $IFACE
                  fi
                  '';
                };
@@ -227,7 +227,7 @@ in
                  networkConfig = networkd.noL3;
                  extraConfig = ''
                    [CAKE]
-                    Bandwidth=490M
+                    Bandwidth=235M
                    RTTSec=50ms
                    PriorityQueueingPreset=besteffort
                    # DOCSIS preset
@@ -251,7 +251,7 @@ in
                    extraConfig = ''
                      [CAKE]
                      Parent=root
-                      Bandwidth=48M
+                      Bandwidth=24M
                      RTTSec=50ms
                    '';
                  }
@@ -276,7 +276,7 @@ in
                  {
                    matchConfig.Name = "as211024";
                    networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                      {
                        Destination = lib.my.c.colony.prefixes.all.v4;
                        Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -301,7 +301,7 @@ in

              {
                "60-lan-hi" = {
-                  routes = [
+                  routes = map (r: { routeConfig = r; }) [
                    {
                      Destination = elemAt routersPubV4 otherIndex;
                      Gateway = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
--- a/nixos/boxes/home/routing-common/dns-blocklist.txt
+++ b/nixos/boxes/home/routing-common/dns-blocklist.txt
@@ -1,74 +0,0 @@
-# Blocklist for LG WebOS Services (US)
-ad.lgappstv.com
-ibis.lgappstv.com
-info.lgsmartad.com
-lgtvsdp.com
-ngfts.lge.com
-rdx2.lgtvsdp.com
-smartshare.lgtvsdp.com
-lgappstv.com
-us.ad.lgsmartad.com
-us.ibs.lgappstv.com
-us.info.lgsmartad.com
-us.lgtvsdp.com
-
-# Community Contributions
-lgad.cjpowercast.com
-edgesuite.net
-yumenetworks.com
-smartclip.net
-smartclip.com
-
-# Non-US Entries
-rdx2.lgtvsdp.com
-info.lgsmartad.com
-ibs.lgappstv.com
-lgtvsdp.com
-lgappstv.com
-smartshare.lgtvsdp.com
-
-# Full Block for Europe and Other Regions
-de.ad.lgsmartad.com
-de.emp.lgsmartplatform.com
-de.ibs.lgappstv.com
-de.info.lgsmartad.com
-de.lgeapi.com
-de.lgtvsdp.com
-de.rdx2.lgtvsdp.com
-eu.ad.lgsmartad.com
-eu.ibs.lgappstv.com
-eu.info.lgsmartad.com
-app-lgwebos.pluto.tv
-it.lgtvsdp.com
-it.lgeapi.com
-it.emp.lgsmartplatform.com
-
-# LG ThinQ Services
-eic.common.lgthinq.com
-eic.iotservice.lgthinq.com
-eic.service.lgthinq.com
-eic.ngfts.lge.com
-eic.svc-lgthinq-com.aws-thinq-prd.net
-eic.cdpsvc.lgtvcommon.com
-eic.cdpbeacon.lgtvcommon.com
-eic.cdplauncher.lgtvcommon.com
-eic.homeprv.lgtvcommon.com
-eic.lgtviot.com
-eic.nudge.lgtvcommon.com
-eic.rdl.lgtvcommon.com
-eic.recommend.lgtvcommon.com
-eic.service.lgtvcommon.com
-gb-lgeapi-com.esi-prd.net
-gb.lgeapi.com
-lgtvonline.lge.com
-lg-channelplus-de-beacons.xumo.com
-lg-channelplus-de-mds.xumo.com
-lg-channelplus-eu-beacons.xumo.com
-lg-channelplus-eu-mds.xumo.com
-kr-op-v2.lgthinqhome.com
-ngfts.lge.com
-noti.lgthinq.com
-objectcontent.lgthinq.com
-
-# Update Server Block
-#snu.lge.com
--- a/nixos/boxes/home/routing-common/dns.nix
+++ b/nixos/boxes/home/routing-common/dns.nix
@@ -19,7 +19,7 @@ in
          owner = "pdns";
          group = "pdns";
        };
-        "home/pdns/recursor.yml" = {
+        "home/pdns/recursor.conf" = {
          owner = "pdns-recursor";
          group = "pdns-recursor";
        };
@@ -28,79 +28,53 @@ in

      pdns.recursor = {
        enable = true;
-        extraSettingsFile = config.age.secrets."home/pdns/recursor.yml".path;
+        extraSettingsFile = config.age.secrets."home/pdns/recursor.conf".path;
      };
    };

    services = {
      pdns-recursor = {
-        yaml-settings = {
-          incoming = {
-            listen = [
+        dns = {
+          address = [
            "127.0.0.1" "::1"
            assignments.hi.ipv4.address assignments.hi.ipv6.address
            assignments.lo.ipv4.address assignments.lo.ipv6.address
          ];
-            allow_from = [
+          allowFrom = [
            "127.0.0.0/8" "::1/128"
            prefixes.hi.v4 prefixes.hi.v6
            prefixes.lo.v4 prefixes.lo.v6
          ] ++ (with lib.my.c.tailscale.prefix; [ v4 v6 ]);
+        };
+
+        settings = {
+          query-local-address = [
+            "0.0.0.0"
+            "::"
+          ];
+          forward-zones = map (z: "${z}=127.0.0.1:5353") authZones;

          # DNS NOTIFY messages override TTL
-            allow_notify_for = authZones;
-            allow_notify_from = [ "127.0.0.0/8" "::1/128" ];
-          };
+          allow-notify-for = authZones;
+          allow-notify-from = [ "127.0.0.0/8" "::1/128" ];

-          outgoing = {
-            source_address = [ "0.0.0.0" "::" ];
-          };
-
-          recursor = {
-            forward_zones = map (z: {
-              zone = z;
-              forwarders = [ "127.0.0.1:5353" ];
-            }) authZones;
-
-            lua_dns_script = pkgs.writeText "pdns-script.lua" ''
-              blocklist = newDS()
+          webserver = true;
+          webserver-address = "::";
+          webserver-allow-from = [ "127.0.0.1" "::1" ];

+          lua-dns-script = pkgs.writeText "pdns-script.lua" ''
+            -- Disney+ doesn't like our IP space...
            function preresolve(dq)
              local name = dq.qname:toString()
-
-                -- Disney+ doesn't like our IP space...
              if dq.qtype == pdns.AAAA and (string.find(name, "disneyplus") or string.find(name, "disney-plus") or string.find(name , "disney.api")) then
                dq.rcode = 0
                return true
              end

-                if blocklist:check(dq.qname) then
-                  if dq.qtype == pdns.A then
-                    dq:addAnswer(dq.qtype, "127.0.0.1")
-                  elseif dq.qtype == pdns.AAAA then
-                    dq:addAnswer(dq.qtype, "::1")
-                  end
-                  return true
-                end
-
              return false
            end
-
-              for line in io.lines("${./dns-blocklist.txt}") do
-                entry = line:gsub("%s+", "")
-                if entry ~= "" and string.sub(entry, 1, 1) ~= "#" then
-                  blocklist:add(entry)
-                end
-              end
          '';
        };
-
-          webservice = {
-            webserver = true;
-            address = "::";
-            allow_from = [ "127.0.0.1" "::1" ];
-          };
-        };
      };
    };

@@ -196,8 +170,8 @@ in
              hostname = "${otherName}.${config.networking.domain}";
              server = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
            }}
-            ${elemAt routers 0} IN AAAA ${allAssignments."${elemAt routers 0}".as211024.ipv6.address}
-            ${elemAt routers 1} IN AAAA ${allAssignments."${elemAt routers 1}".as211024.ipv6.address}
+            ${elemAt routers 0} IN AAAA ${net.cidr.host 1 prefixes.hi.v6}
+            ${elemAt routers 1} IN AAAA ${net.cidr.host 2 prefixes.hi.v6}
            boot IN CNAME river-hi.${config.networking.domain}.

            @ IN NS ns1
@@ -232,9 +206,6 @@ in
            ups IN A ${net.cidr.host 20 prefixes.lo.v4}
            palace-kvm IN A ${net.cidr.host 21 prefixes.lo.v4}

-            reolink-living-room IN A ${net.cidr.host 45 prefixes.lo.v4}
-            nixlight IN A ${net.cidr.host 46 prefixes.lo.v4}
-
            ${lib.my.dns.fwdRecords {
              inherit allAssignments names;
              domain = config.networking.domain;
--- a/nixos/boxes/home/routing-common/dns_update.py
+++ b/nixos/boxes/home/routing-common/dns_update.py
@@ -2,7 +2,7 @@
 import argparse
 import subprocess

-import cloudflare
+import CloudFlare

 def main():
    parser = argparse.ArgumentParser(description='Cloudflare DNS update script')
@@ -19,22 +19,17 @@ def main():
    if args.api_token_file:
        with open(args.api_token_file) as f:
            cf_token = f.readline().strip()
-    cf = cloudflare.Cloudflare(api_token=cf_token)

-    zones = list(cf.zones.list(name=args.zone))
+    cf = CloudFlare.CloudFlare(token=cf_token)
+    zones = cf.zones.get(params={'name': args.zone})
    assert zones, f'Zone {args.zone} not found'
-    assert len(zones) == 1, f'More than one zone found for {args.zone}'
-    zone = zones[0]
-
-    records = list(cf.dns.records.list(zone_id=zone.id, name=args.record, type='A'))
+    records = cf.zones.dns_records.get(zones[0]['id'], params={'name': args.record})
    assert records, f'Record {args.record} not found in zone {args.zone}'
-    assert len(records) == 1, f'More than one record found for {args.record}'
-    record = records[0]

    print(f'Updating {args.record} -> {address}')
-    cf.dns.records.edit(
-        zone_id=zone.id, dns_record_id=record.id,
-        type='A', content=address)
+    cf.zones.dns_records.patch(
+        zones[0]['id'], records[0]['id'],
+        data={'type': 'A', 'name': args.record, 'content': address})

 if __name__ == '__main__':
    main()
--- a/nixos/boxes/home/routing-common/kea.nix
+++ b/nixos/boxes/home/routing-common/kea.nix
@@ -132,37 +132,6 @@ in
                  hw-address = "24:8a:07:a8:fe:3a";
                  ip-address = net.cidr.host 40 prefixes.lo.v4;
                }
-
-                {
-                  # avr
-                  hw-address = "8c:a9:6f:30:03:6b";
-                  ip-address = net.cidr.host 41 prefixes.lo.v4;
-                }
-                {
-                  # tv
-                  hw-address = "00:a1:59:b8:4d:86";
-                  ip-address = net.cidr.host 42 prefixes.lo.v4;
-                }
-                {
-                  # android tv
-                  hw-address = "b8:7b:d4:95:c6:74";
-                  ip-address = net.cidr.host 43 prefixes.lo.v4;
-                }
-                {
-                  # hass-panel
-                  hw-address = "80:30:49:cd:d7:51";
-                  ip-address = net.cidr.host 44 prefixes.lo.v4;
-                }
-                {
-                  # reolink-living-room
-                  hw-address = "ec:71:db:30:69:a4";
-                  ip-address = net.cidr.host 45 prefixes.lo.v4;
-                }
-                {
-                  # nixlight
-                  hw-address = "00:4b:12:3b:d3:14";
-                  ip-address = net.cidr.host 46 prefixes.lo.v4;
-                }
              ];
            }
          ];
--- a/nixos/boxes/home/routing-common/keepalived.nix
+++ b/nixos/boxes/home/routing-common/keepalived.nix
@@ -36,6 +36,10 @@ let
    virtualRouterId = routerId;
    virtualIps = vrrpIPs family;
    trackScripts = [ "${family}Alive" ];
+    extraConfig = ''
+      notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
+      notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
+    '';
  };
 in
 {
@@ -62,12 +66,7 @@ in
      };
      vrrpInstances = {
        v4 = mkVRRP "v4" 51;
-        v6 = (mkVRRP "v6" 52) // {
-          extraConfig = ''
-            notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
-            notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
-          '';
-        };
+        v6 = mkVRRP "v6" 52;
      };
      # Actually disable this for now, don't want to fault IPv4 just because IPv6 is broken...
      # extraConfig = ''
--- a/nixos/boxes/home/routing-common/mstpd.nix
+++ b/nixos/boxes/home/routing-common/mstpd.nix
@@ -24,8 +24,8 @@ in
        onState = [ "routable" ];
        script = ''
          #!${pkgs.runtimeShell}
-          if [ "$IFACE" = "lan" ]; then
-            ${mstpd}/sbin/mstpctl setforcevers "$IFACE" rstp
+          if [ $IFACE = "lan" ]; then
+            ${mstpd}/sbin/mstpctl setforcevers $IFACE rstp
          fi
        '';
      };
--- a/nixos/boxes/home/stream.nix
+++ b/nixos/boxes/home/stream.nix
@@ -43,38 +43,6 @@
          };
        };

-        services = {
-          mjpg-streamer = {
-            enable = false;
-            inputPlugin = "input_uvc.so";
-            outputPlugin = "output_http.so -w @www@ -n -p 5050";
-          };
-          octoprint = {
-            enable = false;
-            host = "::";
-            extraConfig = {
-              plugins = {
-                classicwebcam = {
-                  snapshot = "/webcam/?action=snapshot";
-                  stream = "/webcam/?action=stream";
-                  streamRatio = "4:3";
-                };
-              };
-              serial = {
-                port = "/dev/ttyACM0";
-                baudrate = 115200;
-              };
-              temperature.profiles = [
-                {
-                  bed = 60;
-                  extruder = 215;
-                  name = "PLA";
-                }
-              ];
-            };
-          };
-        };
-
        systemd.network = {
          netdevs = {
            "25-lan" = {
--- a/nixos/boxes/kelder/containers/acquisition/default.nix
+++ b/nixos/boxes/kelder/containers/acquisition/default.nix
@@ -26,7 +26,7 @@ in

      config = {
        # Hardware acceleration for Jellyfin
-        hardware.graphics = {
+        hardware.opengl = {
          enable = true;
          extraPackages = with pkgs; [
            vaapiIntel
@@ -78,14 +78,6 @@ in
          };
        };

-        nixpkgs.config.permittedInsecurePackages = [
-          # FIXME: This is needed for Sonarr
-          "aspnetcore-runtime-wrapped-6.0.36"
-          "aspnetcore-runtime-6.0.36"
-          "dotnet-sdk-wrapped-6.0.428"
-          "dotnet-sdk-6.0.428"
-        ];
-
        services = {
          transmission = {
            enable = true;
--- a/nixos/boxes/kelder/containers/acquisition/networking.nix
+++ b/nixos/boxes/kelder/containers/acquisition/networking.nix
@@ -73,12 +73,14 @@ in
              RouteTable = routeTable;
            };
            wireguardPeers = [
-              # AirVPN IE
              {
+                # AirVPN IE
+                wireguardPeerConfig = {
                  Endpoint = "146.70.94.2:1637";
                  PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
                  PresharedKeyFile = config.age.secrets."${pskFile}".path;
                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                };
              }
            ];
          };
@@ -95,7 +97,7 @@ in
              matchConfig.Name = "vpn";
              address = [ "10.161.170.28/32" "fd7d:76ee:e68f:a993:b12d:6d15:c80a:9516/128" ];
              dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = [
+              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                {
                  Family = "both";
                  SuppressPrefixLength = 0;
--- a/nixos/boxes/kelder/containers/spoder/default.nix
+++ b/nixos/boxes/kelder/containers/spoder/default.nix
@@ -92,14 +92,12 @@ in

          nextcloud = {
            enable = true;
-            # TODO: Might need to do some bullshit to go from Nextcloud 28 (?) to 30
-            package = pkgs.nextcloud30;
+            package = pkgs.nextcloud29;
            datadir = "/mnt/storage/nextcloud";
            hostName = "cloud.${domain}";
            https = true;
            config = {
              adminpassFile = config.age.secrets."kelder/nextcloud-root.txt".path;
-              dbtype = "sqlite";
            };
            settings = {
              updatechecker = false;
--- a/nixos/boxes/kelder/default.nix
+++ b/nixos/boxes/kelder/default.nix
@@ -121,7 +121,8 @@ in

            samba = {
              enable = true;
-              settings = {
+              enableNmbd = true;
+              shares = {
                storage = {
                  path = "/mnt/storage";
                  browseable = "yes";
@@ -130,8 +131,6 @@ in
                  "directory mask" = "0775";
                };
              };
-
-              nmbd.enable = true;
            };
            samba-wsdd.enable = true;

@@ -181,10 +180,12 @@ in
                  };
                  wireguardPeers = [
                    {
+                      wireguardPeerConfig = {
                        PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
                        Endpoint = "${allAssignments.estuary.internal.ipv4.address}:${toString lib.my.c.kelder.vpn.port}";
                        AllowedIPs = [ "0.0.0.0/0" ];
                        PersistentKeepalive = 25;
+                      };
                    }
                  ];
                };
@@ -212,7 +213,7 @@ in
                  address = with assignments.estuary; [
                    (with ipv4; "${address}/${toString mask}")
                  ];
-                  routingPolicyRules = [
+                  routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                    {
                      Family = "both";
                      SuppressPrefixLength = 0;
--- a/nixos/boxes/tower/default.nix
+++ b/nixos/boxes/tower/default.nix
@@ -14,7 +14,7 @@
          cpu = {
            intel.updateMicrocode = true;
          };
-          graphics.extraPackages = with pkgs; [
+          opengl.extraPackages = with pkgs; [
            intel-media-driver
          ];
          bluetooth.enable = true;
@@ -177,7 +177,7 @@
              programs = {
                fish = {
                  shellAbbrs = {
-                    tsup = "doas tailscale up --login-server=https://hs.nul.ie --accept-routes";
+                    tsup = "doas tailscale up --login-server=https://ts.nul.ie --accept-routes";
                  };
                };
              };
--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -23,7 +23,7 @@ let
      pkgs = pkgs'.${config'.nixpkgs}.${config'.system};
      allPkgs = mapAttrs (_: p: p.${config'.system}) pkgs';

-      modules' = [ hmFlakes.${config'.home-manager}.nixosModules.default ] ++ (attrValues cfg.modules);
+      modules' = [ hmFlakes.${config'.home-manager}.nixosModule ] ++ (attrValues cfg.modules);
    in
    # Import eval-config ourselves since the flake now force-sets lib
    import "${pkgsFlake}/nixos/lib/eval-config.nix" {
@@ -35,7 +35,7 @@ let
      system = null;

      # Put the inputs in specialArgs to avoid infinite recursion when modules try to do imports
-      specialArgs = { inherit self inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
+      specialArgs = { inherit inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };

      # `baseModules` informs the manual which modules to document
      baseModules =
--- a/nixos/installer.nix
+++ b/nixos/installer.nix
@@ -31,10 +31,8 @@
            server.enable = true;
          };

-          image = {
-            baseName = "jackos-installer";
-          };
          isoImage = {
+            isoBaseName = "jackos-installer";
            volumeID = "jackos-${config.system.nixos.release}-${pkgs.stdenv.hostPlatform.uname.processor}";
            edition = "devplayer0";
            appendToMenuLabel = " /dev/player0 Installer";
@@ -63,8 +61,8 @@
          };

          networking = {
-            # Will be set dynamically, but need something to satisfy `/etc/os-release` stuff
-            hostName = "installer";
+            # Will be set dynamically
+            hostName = "";
            useNetworkd = false;
          };

--- a/nixos/modules/_list.nix
+++ b/nixos/modules/_list.nix
@@ -14,7 +14,7 @@
    network = ./network.nix;
    pdns = ./pdns.nix;
    nginx-sso = ./nginx-sso.nix;
-    gui = ./gui;
+    gui = ./gui.nix;
    l2mesh = ./l2mesh.nix;
    borgthin = ./borgthin.nix;
    nvme = ./nvme;
--- a/nixos/modules/borgthin.nix
+++ b/nixos/modules/borgthin.nix
@@ -1,4 +1,4 @@
-{ inputs, lib, pkgs, config, ... }:
+{ lib, pkgs, config, ... }:
 let
  inherit (builtins) substring match;
  inherit (lib)
@@ -127,9 +127,7 @@ in
    enable = mkBoolOpt' false "Whether to enable borgthin jobs";
    lvmPackage = mkOpt' package pkgs.lvm2 "Packge containing LVM tools";
    thinToolsPackage = mkOpt' package pkgs.thin-provisioning-tools "Package containing thin-provisioning-tools";
-    # Really we should use the version from the overlay, but the package is quite far behind...
-    # Not bothering to update until Borg 2.0 releases
-    package = mkOpt' package inputs.borgthin.packages.${config.nixpkgs.system}.borgthin "borgthin package";
+    package = mkOpt' package pkgs.borgthin "borgthin package";
    jobs = mkOpt' (attrsOf jobType) { } "borgthin jobs";
  };

--- a/nixos/modules/build.nix
+++ b/nixos/modules/build.nix
@@ -221,8 +221,8 @@ in
      memorySize = dummyOption;
      qemu.options = dummyOption;
    };
-    image.baseName = dummyOption;
    isoImage = {
+      isoBaseName = dummyOption;
      volumeID = dummyOption;
      edition = dummyOption;
      appendToMenuLabel = dummyOption;
--- a/nixos/modules/common.nix
+++ b/nixos/modules/common.nix
@@ -1,4 +1,4 @@
-{ lib, pkgsFlake, pkgs, pkgs', self, inputs, config, ... }:
+{ lib, pkgsFlake, pkgs, pkgs', inputs, config, ... }:
 let
  inherit (lib) mkIf mkDefault mkMerge;
  inherit (lib.my) mkDefault';
@@ -12,7 +12,7 @@ in
    inputs.impermanence.nixosModule
    inputs.ragenix.nixosModules.age
    inputs.sharry.nixosModules.default
-    inputs.copyparty.nixosModules.default
+    inputs.attic.nixosModules.atticd
  ];

  config = mkMerge [
@@ -41,7 +41,6 @@ in

      nix = {
        package = pkgs'.mine.nix;
-        channel.enable = false;
        settings = with lib.my.c.nix; {
          trusted-users = [ "@wheel" ];
          experimental-features = [ "nix-command" "flakes" "ca-derivations" ];
@@ -66,12 +65,10 @@ in
      };
      nixpkgs = {
        overlays = [
-          inputs.deploy-rs.overlays.default
+          inputs.deploy-rs.overlay
          inputs.sharry.overlays.default
-          # TODO: Re-enable when borgthin is updated
-          # inputs.borgthin.overlays.default
+          inputs.borgthin.overlays.default
          inputs.boardie.overlays.default
-          inputs.copyparty.overlays.default
        ];
        config = {
          allowUnfree = true;
@@ -130,9 +127,6 @@ in
        };
      };

-      environment.etc = {
-        "nixos/flake.nix".source = "/run/nixfiles/flake.nix";
-      };
      environment.systemPackages = with pkgs; mkMerge [
        [
          bash-completion
@@ -148,10 +142,7 @@ in
        fish.enable = mkDefault true;
        # TODO: This is expecting to look up the channel for the database...
        command-not-found.enable = mkDefault false;
-        vim = {
-          enable = true;
-          defaultEditor = true;
-        };
+        vim.defaultEditor = true;
      };

      services = {
@@ -218,35 +209,14 @@ in
            # python.d plugin script does #!/usr/bin/env bash
            path = with pkgs; [ bash ];
          };
-
-          nixfiles-mutable = {
-            description = "Mutable nixfiles";
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-            };
-
-            path = with pkgs; [ util-linux ];
-            script = ''
-              nixfilesDir="${self}"
-
-              mkdir -p /run/nixfiles{,/.rw,/.work}
-              mount -t overlay overlay -o lowerdir="$nixfilesDir",upperdir=/run/nixfiles/.rw,workdir=/run/nixfiles/.work /run/nixfiles
-              chmod -R u+w /run/nixfiles
-            '';
-            preStop = ''
-              umount /run/nixfiles
-              rm -rf /run/nixfiles
-            '';
-
-            wantedBy = [ "multi-user.target" ];
-          };
        };
      };
    }
    (mkIf config.services.kmscon.enable {
      fonts.fonts = with pkgs; [
-        nerd-fonts.sauce-code-pro
+        (nerdfonts.override {
+          fonts = [ "SourceCodePro" ];
+        })
      ];
    })
  ];
--- a/nixos/modules/containers.nix
+++ b/nixos/modules/containers.nix
@@ -15,7 +15,6 @@ let
    passAsFile = [ "code" ];
    code = ''
      #include <stdio.h>
-      #include <stdlib.h>
      #include <signal.h>
      #include <unistd.h>
      #include <systemd/sd-daemon.h>
--- a/nixos/modules/gui/default.nix
+++ b/nixos/modules/gui/default.nix
@@ -4,12 +4,6 @@ let
  inherit (lib.my) mkBoolOpt';

  cfg = config.my.gui;
-
-  androidUdevRules = pkgs.runCommand "udev-rules-android" {
-    rulesFile = ./android-udev.rules;
-  } ''
-    install -D "$rulesFile" "$out"/lib/udev/rules.d/51-android.rules
-  '';
 in
 {
  options.my.gui = with lib.types; {
@@ -18,7 +12,7 @@ in

  config = mkIf cfg.enable {
    hardware = {
-      graphics.enable = mkDefault true;
+      opengl.enable = mkDefault true;
    };

    systemd = {
@@ -32,12 +26,6 @@ in
      pam.services.swaylock-plugin = {};
    };

-    users = {
-      groups = {
-        adbusers.gid = lib.my.c.ids.gids.adbusers;
-      };
-    };
-
    environment.systemPackages = with pkgs; [
      # for pw-jack
      pipewire.jack
@@ -56,12 +44,8 @@ in
      gnome = {
        gnome-keyring.enable = true;
      };
-      udisks2.enable = true;

      udev = {
-        packages = [
-          androidUdevRules
-        ];
        extraRules = ''
          # Nvidia
          SUBSYSTEM=="usb", ATTR{idVendor}=="0955", MODE="0664", GROUP="wheel"
@@ -69,8 +53,6 @@ in
          SUBSYSTEM=="usb", ATTR{idVendor}=="057e", MODE="0664", GROUP="wheel"
          # FT
          SUBSYSTEM=="usb", ATTR{idVendor}=="0403", MODE="0664", GROUP="wheel"
-          # /dev/player0
-          SUBSYSTEM=="usb", ATTR{idVendor}=="6969", MODE="0664", GROUP="wheel"
        '';
      };
    };
@@ -104,13 +86,5 @@ in
        ];
      };
    };
-
-    my = {
-      user = {
-        config = {
-          extraGroups = [ "adbusers" ];
-        };
-      };
-    };
  };
 }
--- a/nixos/modules/gui/android-udev.rules
+++ b/nixos/modules/gui/android-udev.rules
--- a/nixos/modules/l2mesh.nix
+++ b/nixos/modules/l2mesh.nix
@@ -44,8 +44,10 @@ let
      toString (mesh.baseMTU - overhead);

      bridgeFDBs = mapAttrsToList (n: peer: {
+        bridgeFDBConfig = {
          MACAddress = "00:00:00:00:00:00";
          Destination = peer.addr;
+        };
      }) otherPeers;
    };
  };
--- a/nixos/modules/netboot/default.nix
+++ b/nixos/modules/netboot/default.nix
@@ -5,23 +5,10 @@ let

  cfg = config.my.netboot;

-  # Newer releases don't boot on desktop?
-  ipxe = pkgs.ipxe.overrideAttrs (o: rec {
-    version = "1.21.1-unstable-2024-06-27";
-    src = pkgs.fetchFromGitHub {
-      owner = "ipxe";
-      repo = "ipxe";
-      rev = "b66e27d9b29a172a097c737ab4d378d60fe01b05";
-      hash = "sha256-TKZ4WjNV2oZIYNefch7E7m1JpeoC/d7O1kofoNv8G40=";
-    };
-
-    # This upstream patch (in newer versions) is needed for newer GCC
-    patches = (if (o ? patches) then o.patches else []) ++ [ ./fix-uninitialised-var.patch ];
-  });
  tftpRoot = pkgs.linkFarm "tftp-root" [
    {
      name = "ipxe-x86_64.efi";
-      path = "${ipxe}/ipxe.efi";
+      path = "${pkgs.ipxe}/ipxe.efi";
    }
  ];
  menuFile = pkgs.runCommand "menu.ipxe" {
@@ -30,11 +17,10 @@ let
    substituteAll ${./menu.ipxe} "$out"
  '';

-  bootBuilder = pkgs.replaceVarsWith {
+  bootBuilder = pkgs.substituteAll {
    src = ./netboot-loader-builder.py;
    isExecutable = true;

-    replacements = {
    inherit (pkgs) python3;
    bootspecTools = pkgs.bootspec;
    nix = config.nix.package.out;
@@ -49,7 +35,6 @@ let
      fi
    '';
  };
-  };
 in
 {
  options.my.netboot = with lib.types; {
--- a/nixos/modules/netboot/fix-uninitialised-var.patch
+++ b/nixos/modules/netboot/fix-uninitialised-var.patch
@@ -1,48 +0,0 @@
-From 7f75d320f6d8ac7ec5185b2145da87f698aec273 Mon Sep 17 00:00:00 2001
-From: Michael Brown <mcb30@ipxe.org>
-Date: Mon, 2 Sep 2024 12:24:57 +0100
-Subject: [PATCH] [etherfabric] Fix use of uninitialised variable in
- falcon_xaui_link_ok()
-
-The link status check in falcon_xaui_link_ok() reads from the
-FCN_XX_CORE_STAT_REG_MAC register only on production hardware (where
-the FPGA version reads as zero), but modifies the value and writes
-back to this register unconditionally.  This triggers an uninitialised
-variable warning on newer versions of gcc.
-
-Fix by assuming that the register exists only on production hardware,
-and so moving the "modify-write" portion of the "read-modify-write"
-operation to also be covered by the same conditional check.
-
-Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
- src/drivers/net/etherfabric.c | 15 +++++++++------
- 1 file changed, 9 insertions(+), 6 deletions(-)
-
-diff --git a/src/drivers/net/etherfabric.c b/src/drivers/net/etherfabric.c
-index b40596beae7..be30b71f79f 100644
--- a/src/drivers/net/etherfabric.c
-+++ b/src/drivers/net/etherfabric.c
-@@ -2225,13 +2225,16 @@ falcon_xaui_link_ok ( struct efab_nic *efab )
- 		sync = ( sync == FCN_XX_SYNC_STAT_DECODE_SYNCED );
- 		
- 		link_ok = align_done && sync;
-	}
- 
-	/* Clear link status ready for next read */
-	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_COMMA_DET, FCN_XX_COMMA_DET_RESET );
-	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_CHARERR, FCN_XX_CHARERR_RESET);
-	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_DISPERR, FCN_XX_DISPERR_RESET);
-	falcon_xmac_writel ( efab, &reg, FCN_XX_CORE_STAT_REG_MAC );
-+		/* Clear link status ready for next read */
-+		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_COMMA_DET,
-+				       FCN_XX_COMMA_DET_RESET );
-+		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_CHARERR,
-+				       FCN_XX_CHARERR_RESET );
-+		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_DISPERR,
-+				       FCN_XX_DISPERR_RESET );
-+		falcon_xmac_writel ( efab, &reg, FCN_XX_CORE_STAT_REG_MAC );
-+	}
- 
- 	has_phyxs = ( efab->phy_op->mmds & ( 1 << MDIO_MMD_PHYXS ) );
- 	if ( link_ok && has_phyxs ) {
--- a/nixos/modules/network.nix
+++ b/nixos/modules/network.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config, ... }:
 let
-  inherit (lib) flatten optional mkIf mkDefault mkMerge versionAtLeast;
+  inherit (lib) flatten optional mkIf mkDefault mkMerge;
 in
 {
  config = mkMerge [
@@ -12,6 +12,14 @@ in
        useNetworkd = mkDefault true;
      };

+      systemd = {
+        additionalUpstreamSystemUnits = [
+          # TODO: NixOS has its own version of this, but with `network` instead of `networkd`. Is this just a typo? It
+          # hasn't been updated in 2 years...
+          "systemd-networkd-wait-online@.service"
+        ];
+      };
+
      services.resolved = {
        domains = [ config.networking.domain ];
        # Explicitly unset fallback DNS (Nix module will not allow for a blank config)
--- a/nixos/modules/nvme/default.nix
+++ b/nixos/modules/nvme/default.nix
@@ -4,6 +4,11 @@ let
  inherit (lib.my) mkOpt';

  cfg = config.my.nvme;
+  nvme-cli = pkgs.nvme-cli.override {
+    libnvme = pkgs.libnvme.overrideAttrs (o: {
+      patches = (if (o ? patches) then o.patches else [ ]) ++ [ ./libnvme-hostconf.patch ];
+    });
+  };

  hostNQN = "nqn.2014-08.org.nvmexpress:uuid:${cfg.uuid}";
  etc = prefix: {
@@ -23,7 +28,7 @@ in
  config = mkIf (cfg.uuid != null) {
    environment = {
      systemPackages = [
-        pkgs.nvme-cli
+        nvme-cli
      ];
      etc = etc "";
    };
@@ -39,6 +44,10 @@ in
            ip = "${iproute2}/bin/ip";
            nvme = "${nvme-cli}/bin/nvme";
          };
+          extraConfig = ''
+            DefaultTimeoutStartSec=20
+            DefaultDeviceTimeoutSec=20
+          '';

          network = {
            enable = true;
@@ -53,25 +62,14 @@ in

            serviceConfig = {
              Type = "oneshot";
-              ExecStart = "${pkgs.nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn} -q ${hostNQN}";
+              ExecStart = "${nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn}";
              Restart = "on-failure";
              RestartSec = 10;
            };

            wantedBy = [ "initrd-root-device.target" ];
          };
-        # TODO: Remove when 25.11 releases
-        } // (if (lib.versionAtLeast lib.my.upstreamRelease "25.11") then {
-          settings.Manager = {
-            DefaultTimeoutStartSec = 20;
-            DefaultDeviceTimeoutSec = 20;
        };
-        } else {
-          extraConfig = ''
-            DefaultTimeoutStartSec=20
-            DefaultDeviceTimeoutSec=20
-          '';
-        });
      };
    };
  };
--- a/nixos/modules/pdns.nix
+++ b/nixos/modules/pdns.nix
@@ -1,7 +1,7 @@
 { lib, pkgs, config, ... }:
 let
  inherit (builtins) isList;
-  inherit (lib) mkMerge mkIf mkDefault mapAttrsToList concatMapStringsSep concatStringsSep getExe;
+  inherit (lib) mkMerge mkIf mkDefault mapAttrsToList concatMapStringsSep concatStringsSep;
  inherit (lib.my) mkBoolOpt' mkOpt';

  # Yoinked from nixos/modules/services/networking/pdns-recursor.nix
@@ -165,7 +165,7 @@ let

  extraSettingsOpt = with lib.types; mkOpt' (nullOr str) null "Path to extra settings (e.g. for secrets).";
  baseAuthSettings = pkgs.writeText "pdns.conf" (settingsToLines cfg.auth.settings);
-  baseRecursorSettings = (pkgs.formats.yaml { }).generate "pdns-recursor.yaml" config.services.pdns-recursor.yaml-settings;
+  baseRecursorSettings = pkgs.writeText "pdns-recursor.conf" (settingsToLines config.services.pdns-recursor.settings);
  generateSettings = type: base: dst: if (cfg."${type}".extraSettingsFile != null) then ''
    oldUmask="$(umask)"
    umask 006
@@ -174,14 +174,6 @@ let
  '' else ''
    cp "${base}" "${dst}"
  '';
-  generateYamlSettings = type: base: dst: if (cfg."${type}".extraSettingsFile != null) then ''
-    oldUmask="$(umask)"
-    umask 006
-    ${getExe pkgs.yaml-merge} "${base}" "${cfg."${type}".extraSettingsFile}" > "${dst}"
-    umask "$oldUmask"
-  '' else ''
-    cp "${base}" "${dst}"
-  '';

  namedConf = pkgs.writeText "pdns-named.conf" ''
    options {
@@ -323,9 +315,9 @@ in
    (mkIf cfg.recursor.enable {
      systemd.services.pdns-recursor = {
        preStart = ''
-          ${generateYamlSettings "recursor" baseRecursorSettings "/run/pdns-recursor/recursor.yml"}
+          ${generateSettings "recursor" baseRecursorSettings "/run/pdns-recursor/recursor.conf"}
        '';
-        serviceConfig.ExecStart = [ "" "${pkgs.pdns-recursor}/bin/pdns_recursor --config-dir=/run/pdns-recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no" ];
+        serviceConfig.ExecStart = [ "" "${pkgs.pdns-recursor}/bin/pdns_recursor --config-dir=/run/pdns-recursor" ];
      };

      services.pdns-recursor = {
--- a/nixos/modules/tmproot.nix
+++ b/nixos/modules/tmproot.nix
@@ -147,15 +147,6 @@ in
            "/var/lib/systemd"

            { directory = "/root/.cache/nix"; mode = "0700"; }
-            # Including these unconditionally due to infinite recursion problems...
-            {
-              directory = "/etc/lvm/archive";
-              mode = "0700";
-            }
-            {
-              directory = "/etc/lvm/backup";
-              mode = "0700";
-            }
          ];
          files = [
            "/etc/machine-id"
@@ -269,6 +260,18 @@ in
        my.tmproot.persistence.config.files =
          concatMap (k: [ k.path "${k.path}.pub" ]) config.services.openssh.hostKeys;
      })
+      (mkIf config.services.lvm.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/etc/lvm/archive";
+            mode = "0700";
+          }
+          {
+            directory = "/etc/lvm/backup";
+            mode = "0700";
+          }
+        ];
+      })
      (mkIf (config.security.acme.certs != { }) {
        my.tmproot.persistence.config.directories = [
          {
@@ -536,73 +539,6 @@ in
          }
        ];
      })
-      (persistSimpleSvc "octoprint")
-      (mkIf (config.services.borgbackup.jobs != { }) {
-        my.tmproot.persistence.config.directories = [
-          "/var/lib/borgbackup"
-          "/var/cache/borgbackup"
-        ];
-
-        services.borgbackup.package = pkgs.borgbackup.overrideAttrs (o: {
-          makeWrapperArgs = o.makeWrapperArgs ++ [
-            "--set-default BORG_BASE_DIR /var/lib/borgbackup"
-            "--set-default BORG_CONFIG_DIR /var/lib/borgbackup/config"
-            "--set-default BORG_CACHE_DIR /var/cache/borgbackup"
-          ];
-        });
-      })
-      (mkIf (config.services ? "bluesky-pds" && config.services.bluesky-pds.enable) {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/pds";
-            mode = "0750";
-            user = "pds";
-            group = "pds";
-          }
-        ];
-      })
-      (mkIf config.services.home-assistant.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = config.services.home-assistant.configDir;
-            mode = "0750";
-            user = "hass";
-            group = "hass";
-          }
-        ];
-      })
-      (mkIf config.services.frigate.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/frigate";
-            mode = "0755";
-            user = "frigate";
-            group = "frigate";
-          }
-          {
-            directory = "/var/cache/frigate";
-            mode = "0755";
-            user = "frigate";
-            group = "frigate";
-          }
-        ];
-      })
-      (mkIf config.services.copyparty.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/copyparty";
-            mode = "0755";
-            user = "copyparty";
-            group = "copyparty";
-          }
-          {
-            directory = "/var/cache/copyparty";
-            mode = "0755";
-            user = "copyparty";
-            group = "copyparty";
-          }
-        ];
-      })
    ]))
  ]);

--- a/nixos/modules/user.nix
+++ b/nixos/modules/user.nix
@@ -82,10 +82,6 @@ in
      # NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
      # passed to it
      home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
-
-      systemd.services.nixfiles-mutable.script = ''
-        chown -R ${user'.name} /run/nixfiles
-      '';
    }
    (mkIf (cfg.passwordSecret != null) {
      my = {
--- a/pkgs/chocolate-doom2xx/default.nix
+++ b/pkgs/chocolate-doom2xx/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, autoreconfHook, pkg-config, SDL1, SDL_mixer, SDL_net
+{ lib, stdenv, autoreconfHook, pkg-config, SDL, SDL_mixer, SDL_net
 , fetchFromGitHub, fetchpatch, python3 }:

 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    # for documentation
    python3
  ];
-  buildInputs = [ (SDL1.override { cacaSupport = true; }) SDL_mixer SDL_net ];
+  buildInputs = [ (SDL.override { cacaSupport = true; }) SDL_mixer SDL_net ];
  enableParallelBuilding = true;

  meta = {
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -7,8 +7,10 @@ in
  monocraft' = callPackage ./monocraft.nix { };
  vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
  librespeed-go = callPackage ./librespeed-go.nix { };
-  # modrinth-app = callPackage ./modrinth-app { };
+  modrinth-app = callPackage ./modrinth-app { };
+  glfw-minecraft = callPackage ./glfw-minecraft { };
  chocolate-doom2xx = callPackage ./chocolate-doom2xx { };
  windowtolayer = callPackage ./windowtolayer.nix { };
  swaylock-plugin = callPackage ./swaylock-plugin.nix { };
+  terminaltexteffects = callPackage ./terminaltexteffects.nix { };
 }
--- a/pkgs/glfw-minecraft/default.nix
+++ b/pkgs/glfw-minecraft/default.nix
@@ -0,0 +1,6 @@
+{ lib, glfw-wayland-minecraft, ... }:
+glfw-wayland-minecraft.overrideAttrs (o: {
+  patches = [
+    ./suppress-wayland-errors.patch
+  ];
+})
--- a/pkgs/glfw-minecraft/suppress-wayland-errors.patch
+++ b/pkgs/glfw-minecraft/suppress-wayland-errors.patch
@@ -0,0 +1,43 @@
+diff --git a/src/wl_window.c b/src/wl_window.c
+index 7c509896..db9a6451 100644
+--- a/src/wl_window.c
+++ b/src/wl_window.c
+@@ -2115,25 +2115,21 @@ void _glfwSetWindowTitleWayland(_GLFWwindow* window, const char* title)
+ void _glfwSetWindowIconWayland(_GLFWwindow* window,
+                                int count, const GLFWimage* images)
+ {
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the window icon");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window icon\n");
+ }
+ 
+ void _glfwGetWindowPosWayland(_GLFWwindow* window, int* xpos, int* ypos)
+ {
+     // A Wayland client is not aware of its position, so just warn and leave it
+     // as (0, 0)
+-
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not provide the window position");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not provide the window position\n");
+ }
+ 
+ void _glfwSetWindowPosWayland(_GLFWwindow* window, int xpos, int ypos)
+ {
+     // A Wayland client can not set its position, so just warn
+ 
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the window position");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the window position\n");
+ }
+ 
+ void _glfwGetWindowSizeWayland(_GLFWwindow* window, int* width, int* height)
+@@ -2359,8 +2355,7 @@ void _glfwRequestWindowAttentionWayland(_GLFWwindow* window)
+ 
+ void _glfwFocusWindowWayland(_GLFWwindow* window)
+ {
+-    _glfwInputError(GLFW_FEATURE_UNAVAILABLE,
+-                    "Wayland: The platform does not support setting the input focus");
+    fprintf(stderr, "!!! Ignoring Error: Wayland: The platform does not support setting the input focus\n");
+ }
+ 
+ void _glfwSetWindowMonitorWayland(_GLFWwindow* window,
--- a/pkgs/terminaltexteffects.nix
+++ b/pkgs/terminaltexteffects.nix
@@ -0,0 +1,19 @@
+{ lib
+, python3Packages
+, fetchPypi
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "terminaltexteffects";
+  version = "0.10.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-NyWPfdgLeXAxKPJOzB7j4aT+zjrURN59CGcv0Vt99y0=";
+  };
+
+  build-system = with python3Packages; [
+    poetry-core
+  ];
+}
--- a/pkgs/windowtolayer.nix
+++ b/pkgs/windowtolayer.nix
@@ -1,25 +1,18 @@
 { lib
 , fetchFromGitLab
 , rustPlatform
-, python3
-, rustfmt
 }:
 rustPlatform.buildRustPackage rec {
  pname = "windowtolayer";
-  version = "97ebd079";
-
-  nativeBuildInputs = [
-    python3
-    rustfmt
-  ];
+  version = "a5b89c3c";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "mstoeckl";
    repo = pname;
-    rev = "97ebd0790b13bf00afb0c53a768397882fd2e831";
-    hash = "sha256-XjbhZEoE5NPBofyJe7OSsE7MWgzjyRjBqiEzaQEuRrU=";
+    rev = "a5b89c3c047297fd574932860a6c89e9ea02ba5d";
+    hash = "sha256-rssL2XkbTqUvJqfUFhzULeE4/VBzjeBC5iZWSJ8MJ+M=";
  };

-  cargoHash = "sha256-M0BVSUEFGvjgX+vSpwzvaEGs0i80XOTCzvbV4SzYpLc=";
+  cargoHash = "sha256-XHmLsx9qdjlBz4xJFFiO24bR9CMw1o5368K+YMpMIBA=";
 }
--- a/secrets/britnet/wg.key.age
+++ b/secrets/britnet/wg.key.age
@@ -1,13 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHNqUFR5ZyBVVkI0
-dE5YN1pJWExzLzltcmhna2tJUmdRNjZ1Y1hwbzdtRE0wa2hReTNBCk4ydmNFK0FF
-b0RUdVl3a3d4amhKSEVhZWZPeHZDenBiTXpkVVFiNXFXNGsKLT4gWDI1NTE5IG9i
-K0ZrNEc5SVlyWU1EbXdlbWppRG1DdjFRbTBCREY2OUxrMmVqNHhSazQKVnRaVmVn
-MFBRL1dWeFNOaEwyU2szb1lOVzF1enQwdmVZZWRJcHd5MHdFbwotPiB2Wy1gUV8/
-LWdyZWFzZSBdSDFebHsgKkBkVzl+KnggJTEKdlhrdzVpMHYxUUliQnhaYXNaVWNR
-S3NxbjhFMEFGamZkRU1RNURhcmwzOGxFbGxXelhOdDBWTHBSY1hBcGFtUwpkampi
-WnhzMDcxTk1seWZ6VURZb1l1QU1GdwotLS0gRFNpcXpDUFZLTXFJN3Z0bEJQd280
-WGROWUVvdSt3ZUdBbmRNcGFhRE9BWQoDDlPEY/t2eapa4Xbv8FcW6gdLzQn7Y2cH
-5UwD+0CTF3JdUpxWUIx9RWFleHekkt8j1+2/oO+m7+24yCg5mdqTJ3ZIwu9uk1eI
-0As8IA==
-----END AGE ENCRYPTED FILE-----
--- a/secrets/chatterbox/syncv3.env.age
+++ b/secrets/chatterbox/syncv3.env.age
@@ -0,0 +1,16 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpCM2U2USBQMEJB
+VVhIL2ViVUx1Ym9IbFV1UW52NjZYMmJlYmpjY0RuMzhiclJVS0ZnCkY5dEZHTHlC
+K29uamorWWNJSVV0VlVJNG1VNm9GQ3VPdldJRDNSODVoOVUKLT4gWDI1NTE5IEM0
+UVQvLzFYRTRRMldWSnNnd3V3aXJTeS8vZ1hkdENYVHk1QVVaQVEyQnMKVmN4OUFH
+WCtVSW9tREV5RExycnFJejk5UW91dzd5Rm8vcFBTT0ZCdytFWQotPiBCPC0lLTJW
+LS1ncmVhc2UgRSBjOlg5a0pdQSBSb2YKN0pkalY4VlFDMm8vZzJpQUV4TmdSRHA2
+dnB4UzJaWTRXeDdmKzFrUGVMSEFlbFhlNFFycFRQU005d1I2Si9VUQpHbDVxcGxn
+SVdjZzduSGluYlZnY3lmZmtnOWJYKzkydDhKU0VCNmNvV0EKLS0tIGdaUkpGNy9P
+Y3BGVGVJenJkTG51c3Z3WFU0eTFXT09pSVFseGRLMmxJVU0KhH9EjbL0zv821Yox
+FXc54SXGEkq97qPi3xIoPydWd3FbIuftAhe0xPFGfUOO5/zDni4h+PoNJs2hnkOK
+kHhxtaOj1S6RulI/eYLK/fJjl2aRrTaRFN0TGhFwz5X8HOQe2+Qrq/9wT7pyzOFU
+LsMwe71OhTjA5XrBTawU9QkWjPx2LZyb/WEkzlLOCGoHTUm4X03xY/1UeHVYZt2k
+wbLses0JHK1h2ttWnO5y68LovZWJqFdIjoCCkgfo0nNUD5i+e51xEju9OBJMngj+
+LnPb6YCqFh4Fxy09WORD0A==
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/recursor.conf.age
+++ b/secrets/estuary/pdns/recursor.conf.age
@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyA4bGQr
+dzJZbU4reWI1Sk45QTR3UkRoc0NvaDBFcUwrVWlCYWUrcWtYZGpNCm1PWjVzRVlt
+UDFKY2ZSZTg4S2pVZ0pDNzR1WklYQ3pEclJZLy9kKzdGTGsKLT4gWDI1NTE5IHFO
+TXVRK2d3azg2cHpRanhUNXp6YnRsZW1MUDJqc3l1bnNYNUhHaTIzMVkKWXp1M09H
+TnJIazRmb0tOSnE1Q0E1dERiaHZCQkh2YzE1cS9zRUhwaEovMAotPiBzPj5nLWdy
+ZWFzZQozSThRWnJCcVFFRHpoSi9tZnZMdnJoRlFud2VISHBHSThMem9qZVVWdS9C
+VFBDVEVzbUVCdFU2Qy9PaGdyc0FaCmk3UFZma2ZiR3hmWG1sa053bDBnY04yZ1VZ
+TW9jZwotLS0gMDVSaE5aakxHenFPVXpXa1JxczlWQ2x2VGNuQzdwaWZFTTFTaUp6
+cnRmZwoomylfwjD5A3N21/mk1Wtt8f4bsK747iZz7KT34kqmoX597rbGYxyip5lg
+VLZV6CY4LLRjnnSKoC2hIXU0dgudAmvxhztuaQ42fOc=
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/estuary/pdns/recursor.yml.age
+++ b/secrets/estuary/pdns/recursor.yml.age
@@ -1,12 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IG44Q3BVdyB0RnVq
-RUpSZy9qZ29DemdnWjdscHMvelRYUGF0YVZlNDFtdzFRdVljbGpZCjdWcE50ck44
-NVBsbVk3SmR6cHhHdkJ0TWI2S2ppOUtnK3pMK28xeTc0KzgKLT4gWDI1NTE5IHIy
-SEUxOCtjK3VFMEozblB1T00yRTE3c3dRSXIydmJHdmEvL25yMStOUVEKbE1XdU4z
-L1lLcEJWY2w2WXRWbmVIN0ZBRVl1R1dhNk10MWtheTRCYjloZwotPiBXXXRKcS1n
-cmVhc2UgRUBEWyBwamZsOVQKZ09pVGdWUG02WmxUcGNBN3RnbE42V05xRDE2azMr
-WHd3VEt0NmwvZnI1dXdiSjNvaStsNTZmUEhwbUp5cVlieQpSYmhUVm1GbEJVdXo3
-ZwotLS0gSkFZMFdiRHBjWFJsR3pqcytYZkEza3dsZ0ZyaDkxdmliZ3RUOFErUXlt
-cwq9gj+Fg4p2D1548J+bhvJ0re9uVm9TZ9lJSqmj5tMxWRS9aN1j9BlhmK/RnEG9
-KcodvBiyqibzauS4KC18xLLu986hK2gn3857waXn/AIp+p8BIA2J9M2M
-----END AGE ENCRYPTED FILE-----
--- a/secrets/hass/cli-token.txt.age
+++ b/secrets/hass/cli-token.txt.age
@@ -1,16 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFQrc2JHQSBmTlVp
-RnlKNE9ySGo4L2h3VXBXRzIyZGdqU0RtUWk4ZmJVcGNKZ3BqTmpjCjJtQjUyTmJN
-dkpsbVI3M01mQlNPSEI0U1lVeUJTMVlXUlpheGxVblhUbUkKLT4gWDI1NTE5IG5K
-K0F3QWxJaW5CbW5TZElEVklIeUJxS0JCc2IxaFI5dVZrbDc3NDZGV2MKOVR6M0k5
-eW5HWDQrT3Rtb0tIM1EyajI1V0dKbHBLb0tVNU9nb21OUjcxYwotPiA5anw6bk56
-dC1ncmVhc2UgPCVeLiZyIH4KTGFRWHBGZFBJUElONUZLb3pJeXNZeXhoakYwT3BM
-TW9kUXBhOGhNbHh1Q1RPRTlCRnhSckg5NEUxWk5MVHJucQp4YlFDcVRzK2V5bWVT
-V0xLQjN1SjVTaWNJajJaTjRrQTd2VHlMRy82TExXbAotLS0gVE5YZVhTWXl4VUN2
-WUpidkJLV1JDU0R2QkdHZE5ZbCt2K2FlbGNjK0ZlNApzDh+kgAy4SBqC51mJi+VX
-ON8wbwLVTQRs1H30eyWNzt/3MO++eS4AoZUKQZUxURwXfhV0t0zd5/MlByBsqaHR
-+W6O/9Dp8e/8GYSX3D892r1LKN0AYHgcKeKwEtJojt5CTNJS2IgU6UxZhTliqAEc
-NkfxvcoAEHhGhPOudEIX2SgjrgVGJA8MYm6/46zAolZws3TWim3NEgJpb9tWXpvi
-1f/MXuxiowplF+PqCsd1EGzpXKsvADq6Rwyxpo6CbJzrq+GhFrTHF+LRkzjWx6JE
-LUsZwDqOZUY=
-----END AGE ENCRYPTED FILE-----
--- a/secrets/home/pdns/recursor.conf.age
+++ b/secrets/home/pdns/recursor.conf.age
@@ -0,0 +1,14 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBlODZr
+RHpJcFdFaVNYM0x1d3QxVmhKTFBkMndrakFYS3FxWk00YWxXejNzCkFqWFlCWUt2
+cGluRGtxODQzbElhRWt1TGFVeTE1UU5SSkdZejJzNVdhZ3cKLT4gc3NoLWVkMjU1
+MTkgcytxUmZnIFRpeVNsT2Jqc2I4dzB3cEFWK2ZEZlpJQklWSnhJM3o0Ukhsc1lz
+REZ0VFkKWWJPckVSNlZHREJIVVgwNVNBSkpSbHRPcUxIWVo4ZTlyVkovTGRpZThL
+MAotPiBYMjU1MTkgUGxhR2d3TVh1dnJwQjNoY0pjV09halZKZFhybVk3Vjk3Tmwr
+bDd5ckp6MApBcW8zbUl1SnhmOXZwOFRNUG1EZUNacDlXdXJSbWFUeG5GNjM3eXJo
+RmR3Ci0+IDstZ3JlYXNlICRoICVbfmU2fQpFYzNyZXBxVU5jT3JSY1NFMGEzUnVF
+WFQ2MmR2SGQ0Vnd6V0VxQlp5bE5LZ2NML2hyd09LOEVPL2lGREdLR3FMCmVGN09J
+OUNscVh1d0VSdwotLS0gbTB1NnZ4Q3B6WE1KVzJjbmVwL2dEVjc4WnRXZTlYbFBG
+T3htUHBWang2awr0OgkUO6XPZji5ZBNpqGwOlwpa605t38QCmFSXvPQhvT4Gj/0+
+rUvg7zWf5Yb4c86EDD05CsqGEUQTOKEz08z0lewN5kuFfZmrYQY=
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/home/pdns/recursor.yml.age
+++ b/secrets/home/pdns/recursor.yml.age
@@ -1,14 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpOcUlvZyBJSU1V
-M1QyaWcvcFJlUlJEcDVvblJGcXJDWk11RDhCZzBkY2Qyc2lDQW5jCjJVRVBWMTZy
-SHNTZG9ZSnZ3RjRqUE9Ub3JKZERkcTZpeEhSUlppTmVsZm8KLT4gc3NoLWVkMjU1
-MTkgcytxUmZnIFFsbm1oNk1jNndoU0J3SkdFSkNhSGNVRjdQb2JSUFBnczVwdlF0
-bDVhaVUKaFBzSHF3THNiL09Ib2ZhOFlyNVY0Q1ZwOUMwczZiQW9jVlNwanRYek1P
-WQotPiBYMjU1MTkgcEppMVBpbmRGS1h5RUgwNkZPZ0dXWVpkdXlZcFc5S3dQaDA4
-THdhUm9oTQpLbUpTaVVuQ29Zc3FuQ2MyaFcvTkxVK1l1T3V0L3FZSXZBS2dlY2hM
-VUNVCi0+IENcLWdyZWFzZSAnNGJjfiB1IHB3QDpUIHsoQi57Ilw9CnkxdFRqWVZi
-ZFdHQXJwNGZuNDg2Q3cKLS0tIDJSNmthczc1U2xxSlVKZDBLc1BHNnFMV3MwK3Qr
-ckJDL204d210NW1Pb2sKCC+sa8uPupC3Rv+o12XT/wTmLsKhtaE/bbshPCDIHUFn
-cpTwpY96JsCShAjSb6n7Xt6FgTKTFt2iDsGQ6+sLp0AJ2quxRaoxmqaFVsz4p8BL
-gF0On7LgZg==
-----END AGE ENCRYPTED FILE-----
--- a/secrets/jackflix/copyparty-pass.txt.age
+++ b/secrets/jackflix/copyparty-pass.txt.age
@@ -1,11 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhNYTRudyA4Qk8z
-SkhFWWMyaGM1c2luVzZzbWNvT0ZsS09yN0w1N01oY0tldWFXZnhVCkM0YzBVZUM1
-MmRzdFlCL1o5ZTdkTjkxQ1YyQ0kwbnJ0eVRuYUpQNWw2c0EKLT4gWDI1NTE5IGli
-dkp5RjZRSmROMEtQeWJiVkt2UktxdTAwUzZBRW9XajFDblFqZ3ZVR0EKYzFubnp0
-UHo5WlViYTNwbXFBd01qM0R4Wk82MTV1TzJsVVczdGRNSFRBQQotPiAnLWdyZWFz
-ZSAuPzVDCm1SZkdDMHRjT2NBVXI5ektKZ1R3dXhMUEVRblhBdC9mclFZSitSODI0
-OHZzZThEQnlBY25lVnFTQXRaV2FIYTIKeHkrY1NRCi0tLSBhUFgvd1BUbFlJeEFO
-RWRBQzcrT0ZFMG5SZVliNlZnK2N2VDJVV05UTkhBCrZM7RtMrOVIGIpod8aU4GLn
-0KBGTSq6kE01+f1kmTZDAKHx/LhiWgHYKLxTLW4VpYnUCg==
-----END AGE ENCRYPTED FILE-----
--- a/secrets/middleman/htpasswd.age
+++ b/secrets/middleman/htpasswd.age
@@ -1,13 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyBRQlp2
-ajRjbFlJcnYxY1ViYmxLS0hWcTIzdTM4aXpzRkNER3NDVEp1UkdnCkNkQUkzWlZh
-Qy9RdmIrdEtRZk5aNDI2ajVCNDZvQ3VCcGpha1QwUHMxamcKLT4gWDI1NTE5IHc5
-bzhCNVFvalpaa3Frc0U3UE5GT0V3Y0MySGdBeHNTdzBNMWJtTnNmeDAKOS9KTSs1
-eitCUHNlSnBMSWVkOEdaSEt4MFRoTTVsVldnNnoyNk5hRStORQotPiBzZzNrSyVj
-LWdyZWFzZSBgTiBxXlosJTYlYiBBYyZVIy03Cm96UFpTSGR1S25UVzExTnZNRFdB
-L0UzR1FKSzA5VXYva1EKLS0tIEM1QXFXcFJPUEJRTmJVK25jNFM2eUkzd3VSaVpJ
-MW0wTTlDZGFmMFhBMVEKRHzl+MWwD1N16bywVC9LFKmLTJeTVLww0pa20th9HEhE
-AePSzNsp2xUhESxBDmQDjS3E+s88oCd0D8y3pFmV4Nmf2yPNxbMu8gPVvNmhLAFA
-UR6aTjnfUFJpIXQgPgTncT99kF1YPgF0/X5hqe1DjZneRRTLgPp83me2cF43RDqf
-C4QhJWaqKf8ofqNKfqxvmcKmXNhJG1KEokMyKqPzaw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZGY3c1ZyB1YlJt
+UDI5MStrbTBGNzZhMTdvTm5wczBRdXd1dlFSYitOTmpMcytXdHlBCkR5aHpSSWRJ
+OWp2RzlNZFRFUkxoOTZzcTQ1VDVuYmxKbTQrS29pR1gyb28KLT4gWDI1NTE5IDVz
+aEJyU3R0Z0Njd283QjVJK1gvRUxFVllYdStEbElPSG9yNmc2TnZaemsKaVFNOEd5
+L3hNVlFSUGhoMUxPSE5tK0JUU1FnMGtRNXkvODl0bmNiY0F5RQotPiBwdiR3UD8t
+Z3JlYXNlIGpBbSNeVSBMYVogdFxFZicgTiNDOgpJQnNyMFEKLS0tIEdDZ3oxbDZ0
+VkxETUVnSHRuTDFjTGVYSE9jcWhWT2RCOExDeitKcmZ4TXMKyClXNLb/8j0JtKrc
+OQ2Fd4Ej16Pe8aEfHmwd1VT/XKyE9bOYE4tY5wAhGYLbO6A3SxzeKlZPvfKA4/el
+dCh8mOBvBMV9m/RYvjux7mCQNzXiq38IVYE+BqD9fJIXw2iGMDwpYOmz2J+41CMd
+EiuA1Ms2OlELFw==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/nix-cache.key.age
+++ b/secrets/nix-cache.key.age
@@ -1,12 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBpdExl
-TlRVTE44RlA1NVhHWGZoQWc0bWpCOHFySytnVmJsZlE4SXFQVnp3CjRoSXE4WWhr
-N1djTEtqNDFZdTJUcFVOc3RKUlpndHFBMFNQMnFBdVBpbzQKLT4gWDI1NTE5IEFV
-eHlMUTJlL3Bad1gxTFpJaTFONEkrc2dNUk55dVJqYmNubXNUcGtDRTQKRzRmWTVp
-L3FuaTg2UXpQbVdzTzk5R09VZzVTZzJHM010MUpadEZzU2d6SQotPiAuOlBBNGEt
-Z3JlYXNlIEI3VmMzNCQKUzFLS2NBeVloTnNvMTE2QgotLS0gY1ZuZFdnTmMzOUc0
-TzQyU3RSREE1a3RXZkJ1dXFmc0FqT0dKNVNoUklEUQoXL7+OqcAg1iXZUO1Hhh9T
-BD7Yk9PKVyq7KGDeXMo4HtYll8sWig14PmR7+XOr9Al/1w1WYOD5AAtIkk3G7veq
-TtWlJ76Lu9GZpaNR/47d/z0AzFbBBmu9F+WVWBiZqFEx7m4ZlvyiKgZK6E9IyioK
-8lT5QYaw8WhXcHPoE8a+DOnd9mY93D8MV0ob
-----END AGE ENCRYPTED FILE-----
--- a/secrets/qclk/wg.key.age
+++ b/secrets/qclk/wg.key.age
@@ -1,13 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFpiTEpXQSBPQjFB
-R3p6OGZYOTlZcHV0djlnY2tPTVk2SDNaazM2Nm0vMytSTWJ0THo4CnNSUW4zR2Vo
-V3hsVVFIOEhRM1ZpSnVmcmd6WFhKdGVNQk9IYlRoZFBGUjgKLT4gWDI1NTE5IDJs
-NzlrMXQ5Ty9sdTkwNFpUVnp5MWlucUJLZWtWbGpMd1NTZm1UendPa0EKeWVTa2p6
-ejROR29UYU5GcWlxb1hjWnV6V1BOK29pL2pZRFVUZkU5NU9EUQotPiBfPk5oe0Fq
-LWdyZWFzZSA2Jy1xCnhpYThsOVlMWTZEWVFYemlvQ1lKZlVnc0xnT29WVEtXUHF1
-SDJ1TmJ0Qmg0R1o2UTBFanAwcXVpbGtKR21UbXoKYVNUTXVweDhQUmU2TzFOc1M4
-Z3d6YjdIT29meHVUU0tTV2NnSkljcgotLS0gRFRZNlc3cmRVS25wU0ZZeEpKNmZS
-Q1YxQkcyOGRDQ0VMSC9Ec2xka2NMOAppbDQ9/xJxLUc0OuOFq4b6r+fYCB4hm4ZB
-aEF8B3csbjrIHoboxCNaYGNh1DibseZaaWygsDfMbAmbRw2xvBNgI/oq2/RjSda9
-dZm+1A==
-----END AGE ENCRYPTED FILE-----
--- a/secrets/tailscale-auth.key.age
+++ b/secrets/tailscale-auth.key.age
@@ -1,18 +1,16 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHNqUFR5ZyArUnBS
-MCtjZERmK2IwTm16eGcrZFF5QlpYZU9VbUNzbHZ2VDBoZkJkam0wCndDdmhHc2pu
-TFFiT3MzcU13YklrdFpiRW1ZSU4zUGFQbXF3ellUU3U3bUkKLT4gc3NoLWVkMjU1
-MTkgRExNZUZnIE9EbUtYRFg0Z0xuVGNRM2pad3FFVGRDVTA3ZE50SHlvT1ZrU1NW
-b3VYREkKL0dPV3RGMHYyUW9jSlJhTU5yTnR3L0pHVjZTNWpoaGJiSmlPVWlDYlFv
-RQotPiBzc2gtZWQyNTUxOSBPRXFNc2cgRkwrZEY4RjAxYzhpbEE2eU0ya2N4emE5
-T0NlUnJwUi8vdVlJWlVOWEZESQo0OFdldUdML0hoR0NENHp2UktCTFhOYkxUZyti
-OGlhS3V1RnFUdHhVT0JvCi0+IFgyNTUxOSBOcnEzanBFWnltMUwwd3VBd3Jablk1
-Z3hDU283RVJxSlkzKy9JQW1adVVVCmtnSjVTTSsxblpsczMzR2NldlFlTFk0S210
-T1AxV1RQRjhDSU1CQ2p6M1UKLT4gVnNOLWdyZWFzZSB1fDAgYy1xRSBESjoyIDJz
-CkdRcWxTa1NHVkJDcUVmeDlIVEZTcW13N0I4ek5jTjliQ2t6Zk9nRkloQmhSY3hG
-TUdJekhXdlRzUGJ6WU8zRXgKZXFGUGgrTndSQmVyMFcyL2J0bEdKY09paTkzRHd0
-R1ZWVVVuaDljWE4zK00rdllOdGRVTzVZTnFtT1p0WlZOYgpGdwotLS0gd3dvU08x
-SzJkdjAvQys5Mnp0dDZQUWp1dzZ3U2tuYUpqR09xeTJnSzVDTQooXx8cndfMYlmf
-7eCLssPnHKj7KKgUfiihj91X8pokJR/++wQSarMdRtFB0S0MpDs/khwgG0HkmrKp
-XB1jureGwJs7gmJ6gafKCKSkBv9Jkaw=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyB4Y2th
+ZnZhNE42ZjJSWGx2OWQyY3lxeGc4eDdReHl1bDFXSGVnR2Q4TFhFCnRGLzJpWDVT
+NmN3bElxZmpYMEhPQnBtODYyTHJPTmFpaVppL1JkODFRVVEKLT4gc3NoLWVkMjU1
+MTkgT0VxTXNnIGlyMmlTV1Fvd3lXNFI1ZHdGNnk0R0RCN2ZOV3ExZHFLd2k3QnUr
+T2hyUTgKMzhlZEZ2alVnM1RHWW1xUE1FQXJlQjc0S0EyYmxscURKQWtybEFWdTA4
+TQotPiBYMjU1MTkgVDVkYmwzQTg0TDNnNVloeEtuS2R6OW42MFBNSys3bzVuSHY3
+OHpIMi9UNAplbmE3MTZCQ3U2VHVLL1ZQSkd4YnM4a0xnSmpuRnFxcUlnT1lESDMr
+MDU0Ci0+ICZUZShrPi1ncmVhc2UgSjIxRCA/U34Kd1ZFb1ZPTFJVeWs2bk1Tbktn
+aW1mUXRIWkthb0JFcnlCdHRmRFZ6Zm9CbnNtWmNZUytoR2w5M28xMUViamNtQQpO
+b2poelZ6cjY5ZUZjSnBJem1zeGlSQmUrQ1dUNyt6Mm5aZzNiSkt4S2tuT0JTdWRx
+ZGJvQ1gwR0h5QWtpRUlPClRCSQotLS0gT1BLSmFaRS84V1BKNVMrSG9rMUZMZWZY
+SlUvWnozb21JZmtPQkJVc1VTQQpuOl0YXqAckAY7DmUrZGjzFg1m6zmNKE2KBcin
+sd/Dn+pZpkPk/OID6XwCRTDJB6saD5mLMPooKAYYz0oEy1UA9z+S/Xn1E4X1yktV
+FQDy0wQ=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/toot/pds.env.age
+++ b/secrets/toot/pds.env.age
@@ -1,18 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDYySmNjQSBONnFw
-QVduaWJac2hVVDl0bHY5dXFQSkFUNGlWaTNUbGkxN3d1RWpSZGdRCmpBZ2pLZHZ0
-V21EenE0U3lYblp3dTFyRlRrMGVjWGpxdVVRWW5pcnpCVlUKLT4gWDI1NTE5IEx0
-QUM0aEVsbCtLd3ZmS0kyb0Q3d2RuVW1oc2pHSFpMbUZHY2VXYlhYR28KSHhraW9K
-RXArS1lia0NsMWkvRFhTVEduM1M0c2JnYmduY0ZmSjhCN1M1YwotPiAlL1lJLWdy
-ZWFzZSAhVCpkTAplMU5KckU1K2diWnBreG9LbERtbGJZQjZwK0lOZjJHcEJyMWZp
-c1lxL1UvbTE5QzRIMm9wSXFmY2xUSzhBMEJiCmgxUQotLS0gOUhYVERseXJlVksr
-SEZtby92YUIrTG4ra0hneklheFBERHhqSlFlT0YwVQr5gAYwgdPqUqW2XEtN7+ZR
-VblX1NFXjMLljiGcW+ZlMXHIaKMxizPr+S/6U183e4wiUUqcpipnznnslhm/Zkny
-iHmW37pnNC0T9kctqOXeEjqsQxAMo2YKFroxo1iK0YvN+VyoIDSYMDKu8uDe1Cna
-rabi42KfdZNDjtPLrJyHSo2cCdnDUeWalAjQ3eQqn4y85gfPZq8kZcwvK6SmurDN
-GkwxXpZpSd6MdY4fIaaBEwe7WY9hq4fE7WgcQaz5yG47F+ArCwWauAz38+309XHj
-omsDSzj1jrN7T4kr2gjtUX227NrCw3REHYRNN6IQK/6fDNyPF1wbLFpXU4dnANLT
-OdMRnsDRPafNLAOYn0pgCVcVs0KLpaJvy3KLevVt2MZEtSZe/S+ys28H3JJCB8qz
-igaX3gw9+W8by4ET864fpFgufJrpufVvdz/MZ1207YHz1URQACWRtFKwnwfzP45+
-l47Y4s+xy34V+IXLJduEQdQ0ZHqKmTv02BjEjqksBwZswjI0EbTvD3Nsiw==
-----END AGE ENCRYPTED FILE-----
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXRXkYnBf2opIjN+bXE7HmhUpa4hyXJUGmBT+MRccT4 harmonia`
				`@@ -1 +0,0 @@`
				`object-ctr.ams1.int.nul.ie ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8`