add copyparty

.gitignore

@@ -3,6 +3,7 @@
 .keyring/
 .nixos-switch-log
 users/blake/dotfiles/zsh/zplug
+users/blake/dots/zsh/zplug
 users/blake/dotfiles/zsh/.zsh_history
 users/blake/dotfiles/zsh/.zcompdump
 

flake.lock

@@ -109,7 +109,7 @@
         "flake-parts": "flake-parts",
         "mnw": "mnw",
         "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-unstable"
         ],
         "systems": "systems"
       },
@@ -144,11 +144,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760240450,
+        "lastModified": 1760393368,
-        "narHash": "sha256-sa9bS9jSyc4vH0jSWrUsPGdqtMvDwmkLg971ntWOo2U=",
+        "narHash": "sha256-8mN3kqyqa2PKY0wwZ2UmMEYMcxvNTwLaOrrDsw6Qi4E=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "41fd1f7570c89f645ee0ada0be4e2d3c4b169549",
+        "rev": "ab8d56e85b8be14cff9d93735951e30c3e86a437",
         "type": "github"
       },
       "original": {

flake.nix

@@ -19,8 +19,9 @@
     };
     nvf = {
       url = "github:NotAShelf/nvf";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+    copyparty.url = "github:9001/copyparty";
   };
   outputs = { self, nixpkgs, nixpkgs-unstable, ... }@inputs: 
     let

hosts/default.nix

@@ -0,0 +1,56 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: {
+  # base system package install list
+  environment.systemPackages = with pkgs; [
+    wget
+    curl
+    rsync
+    git
+    vim
+    lf
+    age
+    fzf
+    btop
+    neofetch
+    usbutils
+  ];
+
+  # set timezone
+  time.timeZone = "America/Chicago";
+
+  # allow proprietary packages
+  nixpkgs.config.allowUnfree = true;
+
+  # enable flakes
+  nix.settings.experimental-features = ["nix-command" "flakes"];
+
+  # passwordless rebuild
+  security.sudo.extraRules = [
+    {
+      users = ["blake"];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/nixos-rebuild";
+          options = ["NOPASSWD"];
+        }
+        {
+          command = "/run/current-system/sw/bin/systemctl";
+          options = ["NOPASSWD"];
+        }
+        {
+          command = "/run/current-system/sw/bin/journalctl";
+          options = ["NOPASSWD"];
+        }
+        {
+          command = "/run/current-system/sw/bin/tailscale";
+          options = ["NOPASSWD"];
+        }
+      ];
+    }
+  ];
+}

hosts/snowbelle/configuration.nix

@@ -8,30 +8,32 @@ in
   imports =
     [ # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../users/users.nix
+      ../../hosts
+      ../../users/blake
       ../../modules/system
+      ../../modules/holocron
       ../../modules/homelab
       ../../modules/homelab/minecraft_recpro
     ];
 
-  modules = {
   system = {
     ssh.enable = true;
     backups.enable = true;
-      backups.repo = "/holocron/backups";
+    backups.repo = "/holocron/archive/devices/snowbelle";
     sops.enable = true;
     podman.enable = true;
     syncthing.enable = true;
     tailscale.enable = true;
     nvidia.enable = true;
   };
-    fileshare = {
+  holocron = {
+    copyparty.enable = true;
     zfs.enable = true;
     smb.enable = true;
     nfs.enable = true;
   };
-    homelab.enable = true;
+  homelab = {
-    services = {
+    enable = true;
     gitea.enable = true;
     glance.enable = true;
     immich.enable = true;
@@ -54,13 +56,6 @@ in
   gameservers = {
     minecraft_recpro.enable = true;
   };
-  };
-
-  # configure users & groups
-  users = {
-    blake.enable = true;            # main user, home manager
-    defaultUserShell = pkgs.zsh;    # the goat
-  };
 
   # boot (systemd is going on me)
   boot.loader.systemd-boot.enable = true;   # systemd your pretty cool ya know
@@ -95,49 +90,10 @@ in
   };
 
   
-  # set timezone
-  time.timeZone = "America/Chicago";
 
   hardware.bluetooth.enable = true;
 
-  # define shell
-  programs.zsh.enable = true;
 
-  # package install list
-  environment.systemPackages = with pkgs; [
-    git
-    age
-    rsync
-    wget
-    curl
-    fzf
-    fd
-    alejandra
-    tree
-    vim 
-    lf
-    tmux
-    btop
-    neofetch
-    usbutils
-    inetutils
-    iptables
-    bluez
-  ];
-
-
-  # allow proprietary packages
-  nixpkgs.config.allowUnfree = true;
-
-  # ld fix
-  programs.nix-ld.enable = true;
-  programs.nix-ld.libraries = with pkgs; [
-    # Add any missing dynamic libraries for unpackaged 
-    # programs here, NOT in environment.systemPackages
-  ];
-
-  # enable flakes
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
   # Open ports in the firewall.
   networking.firewall.allowedTCPPorts = [
@@ -169,6 +125,7 @@ in
     7704    # srv - hass
     7705    # srv - zigbee2mqtt
     7901    # srv - uptime kuma
+    7902    # srv - copyparty
     25777   # srv - minecraft
     25565   #        ^  ^  ^
     25566   #        |  |  |

modules/holocron/copyparty/default.nix

@@ -0,0 +1,122 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  service = "copyparty";
+  cfg = config.holocron.${service};
+  sec = config.sops.secrets;
+  homelab = config.modules.homelab;
+in {
+  options.holocron.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7902;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    imports = [inputs.copyparty.nixosModules.default];
+
+    # declare ${service} group
+    users.groups.${service} = {
+      gid = lib.mkForce cfg.ids;
+    };
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      settings = {
+      };
+      accounts = {
+      };
+      groups = {
+      };
+      volumes = {
+      };
+      flags = {
+      };
+    };
+
+#    # override umask to make permissions work out
+#    systemd.services.${service}.serviceConfig = {
+#      UMask = lib.mkForce "0007";
+#      #      User = service;
+#      #      Group = service;
+#    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["${service}.${homelab.public_domain}"];
+      extraConfig = ''
+        tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    # add to glance (local service)
+    modules.services.glance.links.system = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+    #
+    #    sops.secrets = {
+    #      "${service}_" = {
+    #        owner = ;
+    #        group = ;
+    #      };
+    #    };
+
+    # add to backups
+    modules.system.backups.baks = {
+      ${service} = {
+        paths = [cfg.data_dir];
+      };
+    };
+  };
+}

modules/holocron/default.nix

@@ -9,5 +9,6 @@
     ./nfs
     ./smb
     ./zfs
+    ./copyparty
   ];
 }

modules/holocron/nfs/default.nix

@@ -6,13 +6,13 @@
 }:
 # define nfs exports
 let
-  cfg = config.modules.fileshare.nfs;
+  cfg = config.holocron.nfs;
   nfs_exports = ''
     /holocron/media *(ro,sync,no_subtree_check)
   '';
-  #/holocron/vault *(rw,sync,no_subtree_check,no_root_squash)
+  #/holocron/users *(rw,sync,no_subtree_check,no_root_squash)
 in {
-  options.modules.fileshare.nfs = {
+  options.holocron.nfs = {
     enable = lib.mkEnableOption "enables nfs";
   };
 

modules/holocron/smb/default.nix

@@ -6,10 +6,16 @@
 }:
 # define smb shares
 let
-  cfg = config.modules.fileshare.smb;
+  cfg = config.holocron.smb;
   smb_shares = {
-    vault = {
+    archives = {
-      path = "/holocron/vault";
+      path = "/holocron/archives";
+      browseable = true;
+      writable = true;
+      guestOk = false;
+    };
+    users = {
+      path = "/holocron/users";
       browseable = true;
       writable = true;
       guestOk = false;
@@ -22,7 +28,7 @@ let
     };
   };
 in {
-  options.modules.fileshare.smb = {
+  options.holocron.smb = {
     enable = lib.mkEnableOption "enables smb";
   };
 

modules/holocron/zfs/default.nix

@@ -4,9 +4,9 @@
   lib,
   ...
 }: let
-  cfg = config.modules.fileshare.zfs;
+  cfg = config.holocron.zfs;
 in {
-  options.modules.fileshare.zfs = {
+  options.holocron.zfs = {
     enable = lib.mkEnableOption "enables zfs";
   };
 
@@ -32,5 +32,20 @@ in {
       fsType = "zfs";
       options = ["nofail"];
     };
+    fileSystems."/holocron/archives" = {
+      device = "holocron/archives";
+      fsType = "zfs";
+      options = ["nofail"];
+    };
+    fileSystems."/holocron/users" = {
+      device = "holocron/users";
+      fsType = "zfs";
+      options = ["nofail"];
+    };
+    fileSystems."/holocron/media" = {
+      device = "holocron/media";
+      fsType = "zfs";
+      options = ["nofail"];
+    };
   };
 }

modules/homelab/arr/bazarr/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "bazarr";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -80,7 +80,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [{ 
       title = service; 
       url = "https://${cfg.url}"; 
       error-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
@@ -88,7 +88,7 @@ in
       icon = "di:${service}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/arr/flaresolverr/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "flaresolverr";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options

modules/homelab/arr/prowlarr/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "prowlarr";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -82,7 +82,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [{ 
       title = service; 
       url = "https://${cfg.url}"; 
       error-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
@@ -90,7 +90,7 @@ in
       icon = "di:${service}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/arr/radarr/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "radarr";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -85,7 +85,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [{ 
       title = service; 
       url = "https://${cfg.url}"; 
       error-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
@@ -93,7 +93,7 @@ in
       icon = "di:${service}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/arr/sonarr/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "sonarr";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -83,7 +83,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [{ 
       title = service; 
       url = "https://${cfg.url}"; 
       error-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
@@ -91,7 +91,7 @@ in
       icon = "di:${service}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/audiobookshelf/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "audiobookshelf";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -86,7 +86,7 @@ in
     };
 
     # add to glance public service
-    modules.services.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [{
       title = service;
       url = "https://abs.${homelab.public_domain}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -94,7 +94,7 @@ in
       icon = "di:${service}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/caddy/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "caddy";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -91,7 +91,7 @@ in
  
 
     # add to backups
-    modules.system.backups.baks = {
+   system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/default.nix

@@ -2,10 +2,10 @@
 
 
 let
-  cfg = config.modules.homelab;
+  cfg = config.homelab;
 in
 {
-  options.modules.homelab = {
+  options.homelab = {
     enable = lib.mkEnableOption "enable homelab services and configuration";
     media_user = lib.mkOption {
       default = "media";
@@ -41,7 +41,7 @@ in
 
   # the order determines the order in glance :3
   imports = [
-    ./fileshare
+    ./glance
     ./caddy
     ./home/zigbee2mqtt
     ./vaultwarden
@@ -59,7 +59,6 @@ in
     ./arr/flaresolverr
     ./home/mosquitto
     ./uptime-kuma
-    ./glance
   ];
 
   config = lib.mkIf cfg.enable {

modules/homelab/gitea/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "gitea";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -102,7 +102,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.services = [{
+    homelab.glance.links.services = [{
       title = service;
       url = "https://git.${homelab.public_domain}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -118,7 +118,7 @@ in
     };
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/glance/default.nix

@@ -12,7 +12,7 @@
           |           <8yy>            |
           V                            V
       # add to glance
-      modules.services.glance.links.mediastack = [{
+      homelab.glance.links.mediastack = [{
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -23,15 +23,15 @@
 
 let
   service = "glance";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 
   uptimekuma_url = "localhost:7901";
   uptimekuma_page = "glance";
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -137,6 +137,13 @@ in
                       {
                         type = "local";
                         name = "snowbelle";
+                        hide-mountpoints-by-default = true;
+                        mountpoints = {
+                          "/" = {name = "root"; hide = false;};
+                          "/holocron" = {name = "holocron"; hide = false;};
+                          "/holocron/media" = {name = "media"; hide = false;};
+                          "/holocron/vault" = {name = "vault"; hide = false;};
+                        };
                       }
                     ];
                   }
@@ -157,7 +164,6 @@ in
                   {
                     type = "twitch-channels";
                     channels = [
-                      "mang0"
                       "SaltSSBM"
                       "thewaffle77"
                       "ironmouse"
@@ -172,7 +178,7 @@ in
                   {
                     type = "search";
                     autofocus = true;
-                    search-engine = "https://www.ecosia.org/search?q={QUERY}";
+                    search-engine = "https://duckduckgo.com/?q={QUERY}";
                     new-tab = true;
                     bangs = [
                       {
@@ -288,14 +294,14 @@ in
     };
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = {
         paths = [ cfg.data_dir ];
       };
     };
 
     # add to udr to glance
-    modules.services.glance.links.system = [{
+    homelab.glance.links.system = [{
       title = "bebe";
       url = "https://bebe.lan";
       error-url = "https://10.10.0.1";

modules/homelab/home/homeassistant/default.nix

@@ -3,12 +3,12 @@
 let
   nixservice = "home-assistant";
   service = "hass";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -97,7 +97,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.services = [{
+    homelab.glance.links.services = [{
       title = "home assistant";
       url = "https://hass.${homelab.public_domain}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -105,7 +105,7 @@ in
       icon = "di:${nixservice}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/home/mosquitto/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "mosquitto";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -88,7 +88,7 @@ in
     };
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
      ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/home/zigbee2mqtt/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "zigbee2mqtt";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -104,7 +104,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.services = [{
+    homelab.glance.links.services = [{
       title = service;
       url = "https://${cfg.url}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -119,7 +119,7 @@ in
     };
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
      ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/immich/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "immich";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -85,7 +85,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.services = [{
+    homelab.glance.links.services = [{
       title = service;
       url = "https://photos.${homelab.public_domain}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -93,7 +93,7 @@ in
       icon = "di:${service}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir "/var/lib/redis-immich" ]; };
     };
   };

modules/homelab/jellyfin/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "jellyfin";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -81,7 +81,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [{
       title = service;
       url = "https://media.${homelab.public_domain}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -89,7 +89,7 @@ in
       icon = "di:${service}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/minecraft_recpro/default.nix

@@ -2,7 +2,7 @@
 
 let
   service = "minecraft_recpro";
-  cfg = config.modules.gameservers.${service};
+  cfg = config.gameservers.${service};
   sec = config.sops.secrets;
   servers = {
     velocity = { data_dir = "/var/lib/gameservers/minecraft_recpro/velocity"; ram = "2G"; };
@@ -12,7 +12,7 @@ let
   };
 in
 {
-  options.modules.gameservers.${service} = {
+  options.gameservers.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
     url = lib.mkOption {
       type = lib.types.str;
@@ -66,15 +66,13 @@ in
         WorkingDirectory = srv.data_dir;
         UMask = "0007";
         ExecStart = "${pkgs.openjdk21}/bin/java -Xmx${srv.ram} -jar server.jar nogui";
-#        ExecStart = "${pkgs.tmux}/bin/tmux new-session -d -s mc-${name} '${pkgs.openjdk21}/bin/java -Xmx${srv.ram} -jar server.jar nogui'";
-#        ExecStop = "${pkgs.tmux}/bin/tmux send-keys -t mc-${name} C-c";
         Restart = "on-failure";
         KillMode = "process";
       };
       wantedBy = [ "multi-user.target" ];
     }) servers;
 
-    environment.systemPackages = with pkgs; [ openjdk21 mcrcon tmux ];
+    environment.systemPackages = with pkgs; [ openjdk21 mcrcon ];
 
     services.mysql = {
       enable = true;
@@ -96,25 +94,6 @@ in
     # open firewall
     networking.firewall.allowedTCPPorts = [ 25777 25565 25566 25567 ];
 
-#    # internal reverse proxy entry
-#    services.nginx.virtualHosts."${cfg.url}" = {
-#      forceSSL = true;
-#      sslCertificate = sec."ssl_blakedheld_crt".path;
-#      sslCertificateKey = sec."ssl_blakedheld_key".path;
-#      locations."/" = {
-#        proxyPass = "http://127.0.0.1:${toString cfg.port}";
-#      };
-#    };
-#     # external reverse proxy entry
-#     services.nginx.virtualHosts."${service}.blakedheld.xyz" = {
-#      forceSSL = true;
-#      sslCertificate = sec."ssl_blakedheld_crt".path;
-#      sslCertificateKey = sec."ssl_blakedheld_key".path;
-#      locations."/" = {
-#        proxyPass = "http://127.0.0.1:${toString cfg.port}";
-#      };
-#    };
-#
     sops.secrets = {
       "velocity_forwarding" = {
         owner = "minecraft";
@@ -130,7 +109,7 @@ in
     };
 
     # add to backups
-    modules.system.backups.baks = lib.listToAttrs (
+    system.backups.baks = lib.listToAttrs (
       lib.mapAttrsToList (srv_name: cfg:
         {
           name = srv_name;                     # attribute key

modules/homelab/qbittorrent/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "qbittorrent";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -119,7 +119,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [{
       title = service;
       url = "https://${cfg.url}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -127,7 +127,7 @@ in
       icon = "di:${service}"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/services/.unused/nginx-proxy/default.nix

@@ -1,92 +0,0 @@
-{ pkgs, config, lib, ... }:
-
-/*
-no longer in use, replaced by caddy if
-wanting to use again here is the boilerplate 
-for whatt o put in for each service
-
-    # internal reverse proxy entry
-    services.nginx.virtualHosts."${cfg.url}" = {
-      forceSSL = true;
-      sslCertificate = sec."ssl_blakedheld_crt".path;
-      sslCertificateKey = sec."ssl_blakedheld_key".path;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString cfg.port}";
-      };
-    };
-
-     # external reverse proxy entry
-     services.nginx.virtualHosts."${service}.blakedheld.xyz" = {
-      forceSSL = true;
-      sslCertificate = sec."ssl_blakedheld_crt".path;
-      sslCertificateKey = sec."ssl_blakedheld_key".path;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString cfg.port}";
-      };
-    };
-*/
-
-let
-  cfg = config.modules.homelab.nginx-proxy;
-  sec = config.sops.secrets;
-  homelab = config.modules.homelab;
-in
-{
-  options.modules.homelab.nginx-proxy = {
-    enable = lib.mkEnableOption "enables nginx-proxy";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # enable nginx proxy manager
-    services.nginx = {
-      enable = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      commonHttpConfig = ''
-        error_page 404 =302 https://www.youtube.com/watch?v=dQw4w9WgXcQ;
-      '';
-    };
-    # enable acme for auto ssl certs with lets encrypt
-    security.acme = {
-      acceptTerms = true;
-      defaults.email = "me@blakedheld.xyz";
-    };
-
-  systemd.tmpfiles.rules = [
-    "d /var/www/keys 0755 nginx nginx -"
-  ];
-
-    # static entries
-    services.nginx.virtualHosts."key.${homelab.public_domain}" = {
-      forceSSL = true;
-      sslCertificate = sec."ssl_blakedheld_crt".path;
-      sslCertificateKey = sec."ssl_blakedheld_key".path;
-      root = "/var/www/keys";
-      locations."/" = {
-        index = "klefki_pub.asc";
-        extraConfig = ''
-          add_header Content-Disposition "attachment; filename=klefki_pub.asc";  
-          default_type application/pgp-keys;
-        '';
-      };
-    };
-
-    # nginx secrets
-    sops.secrets = {
-      "ssl_blakedheld_crt" = {
-        restartUnits = [ "nginx.service" ];
-        owner = "nginx";
-        group = "nginx";
-      };
-      "ssl_blakedheld_key" = {
-        owner = "nginx";
-        group = "nginx";
-      };
-      "klefki_pub.asc" = {
-        owner = "nginx";
-        group = "nginx";
-        path = "/var/www/keys/klefki_pub.asc";
-      };
-    };
-  };
-}

modules/homelab/services/default.nix

@@ -1,13 +0,0 @@
-
-{ pkgs, config, lib, ... }:
-
-{
-
-  # services show up in glance in reverse import order lmao
-  imports = [
-  ];
-
-
-
-
-}

modules/homelab/uptime-kuma/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "uptime-kuma";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -81,7 +81,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.system = [{
+    homelab.glance.links.system = [{
       title = service;
       url = "https://${cfg.url}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -89,7 +89,7 @@ in
       icon = "di:${service}"; }];
 
      # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/vaultwarden/default.nix

@@ -2,13 +2,13 @@
 
 let
   service = "vaultwarden";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
   domain = "https://pass.blakedheld.xyz";
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -94,7 +94,7 @@ in
     };
 
     # add to glance
-    modules.services.glance.links.services = [{
+    homelab.glance.links.services = [{
       title = service;
       url = "https://pass.${homelab.public_domain}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -109,7 +109,7 @@ in
     };
 
      # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/homelab/yacreader/default.nix

@@ -2,12 +2,12 @@
 
 let
   service = "yacreader";
-  cfg = config.modules.services.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
-  homelab = config.modules.homelab;
+  homelab = config.homelab;
 in
 {
-  options.modules.services.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
@@ -89,7 +89,7 @@ in
     };
 
    # add to glance local service
-    modules.services.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [{
       title = service;
       url = "https://${cfg.url}";
       error-url = "http://${homelab.host_ip}:${toString cfg.port}";
@@ -97,7 +97,7 @@ in
       icon = "di:yac-reader"; }];
 
     # add to backups
-    modules.system.backups.baks = {
+    system.backups.baks = {
       ${service} = { paths = [ cfg.data_dir ]; };
     };
   };

modules/system/backups.nix.bak

@@ -1,102 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.modules.system.backups;
-  borg = "${pkgs.borgbackup}/bin/borg";
-  backup_paths = lib.unique config.modules.system.backups.paths;
-  passwd_file = config.sops.secrets."borg_passwd".path;
-in
-{
-  options.modules.system.backups = {
-    enable = lib.mkEnableOption "enables backups with borg";
-    paths = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [];
-      description = "list of directories to back up";
-    };
-    repo = lib.mkOption {
-      type = lib.types.path;
-      default = "/holocron/borg";
-      description = "borg repository path";
-    };
-    passphraseFile = lib.mkOption {
-      type = lib.types.path;
-      default = passwd_file;
-      description = "borg repository passphrase file";
-    };
-  };
-
-  config = lib.mkIf (cfg.enable && backup_paths != []) {
-    
-#    systemd.tmpfiles.rules = [
-#      "d ${cfg.repo} 0755 root root"
-#    ];
-
-    systemd.services.backups = {
-      description = "backup service with borg!";
-      path = [ pkgs.borgbackup ];
-      serviceConfig = {
-        Type = "oneshot";
-        EnvironmentFile = config.modules.system.backups.passphraseFile;
-        # the actual script borg is using
-        ExecStart = pkgs.writeShellScript "borg-backup" ''
-          set -euo pipefail
-          export BORG_PASSPHRASE="$(cat ${passwd_file})"
-          export BORG_REPO="${cfg.repo}"
-          timestamp="$(date +'%Y-%m-%dT%H:%M:%S')"
-
-          # Initialize repo if it doesn't exist
-          if ! borg info "$BORG_REPO" >/dev/null 2>&1; then
-            echo "init borg repo at $BORG_REPO"
-            borg init --encryption=repokey "$BORG_REPO"
-          fi
-
-          # Create backup
-          echo "starting backup..."
-          borg create \
-            --verbose \
-            --filter AME \
-            --list \
-            --stats \
-            --show-rc \
-            --compression lzma,9 \
-            "$BORG_REPO::${toString config.networking.hostName}-$timestamp" \
-            ${lib.concatStringsSep " " cfg.paths}
-
-          # Prune old backups according to retention policy
-          echo "Pruning old backups..."
-          borg prune -v --list "$BORG_REPO" \
-            --keep-daily=7 \
-            --keep-weekly=52 \
-            --keep-monthly=-1
-
-          echo "$timestamp - backup completed successfully."
-        '';
-      };
-    };
-
-    # create timer to run backups daily
-    systemd.timers.backups = {
-      description = "daily borg backup timer";
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "daily";
-        Persistent = true;
-      };
-    };
-
-    # install borg binary
-    environment.systemPackages = [ pkgs.borgbackup ];
-
-    # declare secret for repo password
-    sops.secrets = {
-      "borg_passwd" = { 
-        owner = "root";
-        group = "root";
-      };
-    };
-  };
-}
-
-# add to modules
-# modules.system.backups.paths = lib.mkIf cfg.backups [ <path> ];

modules/system/backups/default.nix

@@ -15,12 +15,12 @@ in a borg archive to the specified repo
 */
 
 let
-  cfg = config.modules.system.backups;
+  cfg = config.system.backups;
   sec = config.sops.secrets;
   borg = "${pkgs.borgbackup}/bin/borg";
 in
 {
-  options.modules.system.backups = {
+  options.system.backups = {
     enable = lib.mkEnableOption "enables backups with borg";
     baks = lib.mkOption {
       type = lib.types.attrsOf (lib.types.attrsOf (lib.types.listOf lib.types.path));
@@ -29,7 +29,7 @@ in
     };
     repo = lib.mkOption {
       type = lib.types.path;
-      default = "/holocron/borg";
+      default = "/holocron/archives/devices/snowbelle";
       description = "borg repository path";
     };
     passwd_file = lib.mkOption {
@@ -148,7 +148,7 @@ in
     };
 
     # install borg binary
-    environment.systemPackages = [ pkgs.borgbackup ];
+    environment.systemPackages = with pkgs; [ borgbackup ];
 
     # declare secret for repo password
     sops.secrets = {

modules/system/default.nix

@@ -1,32 +1,29 @@
-{ pkgs, config, lib, ... }:
-
 {
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
   imports = [
-    ./ssh.nix
+    ./ssh
-    ./backups.nix
+    ./backups
-    ./sops.nix
+    ./sops
-    ./docker.nix
+    ./docker
-    ./podman.nix
+    ./podman
-    ./tailscale.nix
+    ./tailscale
-    ./vpns.nix
+    ./vpns
-    ./vpn-confinement.nix
+    ./vpn-confinement
-    ./syncthing.nix
+    ./syncthing
-    ./nvidia.nix
+    ./nvidia
   ];
 
-  modules.system.ssh.enable = lib.mkDefault true;
+  system.ssh.enable = lib.mkDefault true;
-  modules.system.backups.enable = lib.mkDefault true;
+  system.backups.enable = lib.mkDefault true;
-  modules.system.sops.enable = lib.mkDefault true;
+  system.sops.enable = lib.mkDefault true;
-  modules.system.docker.enable = lib.mkDefault false;
+  system.docker.enable = lib.mkDefault false;
-  modules.system.tailscale.enable = lib.mkDefault true;
+  system.tailscale.enable = lib.mkDefault true;
-  modules.system.vpns.enable = lib.mkDefault false;
+  system.vpns.enable = lib.mkDefault false;
-  modules.system.vpn-confinement.enable = lib.mkDefault false;
+  system.vpn-confinement.enable = lib.mkDefault false;
-  modules.system.syncthing.enable = lib.mkDefault false;
+  system.syncthing.enable = lib.mkDefault false;
-  modules.system.nvidia.enable = lib.mkDefault false;
+  system.nvidia.enable = lib.mkDefault false;
-
-
-
-#  modules.system.backups.baks = {
-#    ${service} = { paths = [ cfg.data_dir ]; };
-#  };
 }

modules/system/docker/default.nix

@@ -1,10 +1,10 @@
 { pkgs, config, lib, ... }:
 
 let
-  cfg = config.modules.system.docker;
+  cfg = config.system.docker;
 in
 {
-  options.modules.system.docker = {
+  options.system.docker = {
     enable = lib.mkEnableOption "enables docker";
   };
 

modules/system/nvidia/default.nix

@@ -1,10 +1,10 @@
 { pkgs, config, lib, ... }:
 
 let
-  cfg = config.modules.system.nvidia;
+  cfg = config.system.nvidia;
 in
 {
-  options.modules.system.nvidia = {
+  options.system.nvidia = {
     enable = lib.mkEnableOption "enables nvidia";
   };
 

modules/system/podman/default.nix

@@ -1,10 +1,10 @@
 { pkgs, config, lib, ... }:
 
 let
-  cfg = config.modules.system.podman;
+  cfg = config.system.podman;
 in
 {
-  options.modules.system.podman = {
+  options.system.podman = {
     enable = lib.mkEnableOption "enables podman";
   };
 

modules/system/sops/default.nix

@@ -1,25 +1,25 @@
 { pkgs, config, lib, inputs, ... }:
 
 let
-  cfg = config.modules.system.sops;
+  cfg = config.system.sops;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
-  options.modules.system.sops = {
+  options.system.sops = {
     enable = lib.mkEnableOption "enables sops";
   };
 
   config = lib.mkIf cfg.enable {
     # enable and configure sops for secrets
     sops = {
-      defaultSopsFile = ../../secrets/secrets.yaml;
+      defaultSopsFile = ../../../secrets/secrets.yaml;
       defaultSopsFormat = "yaml";
 #      age.keyFile = "/home/blake/.config/sops/age/keys.txt";
       age.keyFile = "/etc/sops/keys.txt";
 
       secrets = {
-        "blake_passwd" = lib.mkIf config.users.blake.enable { 
+        "blake_passwd" =  { 
           owner = "root";
           group = "root";
           neededForUsers = true;

modules/system/ssh/default.nix

@@ -1,10 +1,10 @@
 { pkgs, config, lib, ... }:
 
 let
-  cfg = config.modules.system.ssh;
+  cfg = config.system.ssh;
 in
 {
-  options.modules.system.ssh = {
+  options.system.ssh = {
     enable = lib.mkEnableOption "enables ssh";
   };
 

modules/system/syncthing.nix

@@ -1,38 +0,0 @@
-{ pkgs, config, lib, ... }:
-
-let
-  cfg = config.modules.system.syncthing;
-in
-{
-  options.modules.system.syncthing = {
-    enable = lib.mkEnableOption "enables syncthing";
-
-#    mode = lib.mkOption {
-#      type = lib.types.enum [ "server" "client" ];
-#      default = "client";
-#      description = "whether syncthing should run as a client (user) or server (system-wide).";
-#    };
-#
-#    data_dir = lib.mkOption {
-#      type = lib.types.str;
-#      default = if cfg.mode == "server"
-#                then "/var/lib/syncthing"
-#                else "/home/blake/.local/state/syncthing";
-#      description = "optional override for syncthing data directory.";
-#    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    
-#    systemd.tmpfiles.rules = lib.optionals (cfg.mode == "server") ["d /var/lib/syncthing 0775 blake blake -"];
-
-    services.syncthing = {
-      enable = true;
-#      user = "blake";
-#      group = "blake";
-#      dataDir = "/var/lib/syncthing";
-      guiAddress = "0.0.0.0:2222";
-#      openDefaultPorts = true;
-    };
-  };
-}

modules/system/syncthing/default.nix

@@ -0,0 +1,21 @@
+{ pkgs, config, lib, ... }:
+
+let
+  cfg = config.system.syncthing;
+in
+{
+  options.system.syncthing = {
+    enable = lib.mkEnableOption "enables syncthing";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+#      user = "blake";
+#      group = "blake";
+#      dataDir = "/var/lib/syncthing";
+      guiAddress = "0.0.0.0:2222";
+#      openDefaultPorts = true;
+    };
+  };
+}

modules/system/tailscale/default.nix

@@ -4,10 +4,10 @@
   lib,
   ...
 }: let
-  cfg = config.modules.system.tailscale;
+  cfg = config.system.tailscale;
   authkey_file = config.sops.secrets."tailscale_authkey".path;
 in {
-  options.modules.system.tailscale = {
+  options.system.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
   };
 

modules/system/vpn-confinement/default.nix

@@ -1,10 +1,10 @@
 { pkgs, config, lib, ... }:
 
 let
-  cfg = config.modules.system.vpn-confinement;
+  cfg = config.system.vpn-confinement;
 in
 {
-  options.modules.system.vpn-confinement = {
+  options.system.vpn-confinement = {
     enable = lib.mkEnableOption "enables vpn-confinement";
   
     # toggle for mullvad mexico w/ openvpn

modules/system/vpns/default.nix

@@ -1,10 +1,10 @@
 { pkgs, config, lib, ... }:
 
 let
-  cfg = config.modules.system.vpns;
+  cfg = config.system.vpns;
 in
 {
-  options.modules.system.vpns = {
+  options.system.vpns = {
     enable = lib.mkEnableOption "enables vpns";
   
     # toggle for pia mexico w/ openvpn

users/blake/blake.nix

@@ -1,74 +0,0 @@
-{ config, lib, pkgs, inputs, ... }:
-
-
-let
-  cfg = config.users.blake;
-in
-{
-  options.users.blake = {
-    enable = lib.mkEnableOption "enable blake user";
-    username = lib.mkOption {
-      default = "blake";
-      description = ''
-        username
-      '';
-    };
-  };
-
-
-  config = lib.mkIf cfg.enable {
-    # create blake user
-    users.users.${cfg.username} = {
-      isNormalUser = true;
-      extraGroups = [ "wheel" "networkmanager" "docker" "media" "podman" "minecraft" ]; # Enable ‘sudo’ for the user.
-      uid = 1000;
-      shell = pkgs.zsh;
-      group = "blake";
-      hashedPasswordFile = config.sops.secrets."blake_passwd".path;
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBK0AGJfZGyqW8/krvQV+PL7axcDW/EnKyHy9M8wryQx klefki"
-        "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPdC9cCX8awvA19Ri65fvbYjZYe8X1Ef+nOZAIv92AS6u4SkJYqOvPYfqRHXORNDpbzjTV6nackyCKvV5EO4niv4MFIgdkEQwuVHcYX32/dOsWdDoeXBT/l2sFFM7JESwQ== blake@zygarde"
-      ];
-    };
-
-    # define home-manager user
-    home-manager = {
-      useUserPackages = true;
-      useGlobalPkgs = true;      
-      extraSpecialArgs = { inherit inputs; };
-      users = {
-        "blake" = import ./home.nix;
-      };
-    };
-
-    # define blake group
-    users.groups.blake = {
-      gid = 1000;
-    };
-
-  # passwordless rebuild
-    security.sudo.extraRules = [
-      {
-        users = [ "blake" ];
-        commands = [
-          {
-           command = "/run/current-system/sw/bin/nixos-rebuild";
-           options = [ "NOPASSWD" ];
-          }
-          {
-           command = "/run/current-system/sw/bin/systemctl";
-           options = [ "NOPASSWD" ];
-          }
-          {
-           command = "/run/current-system/sw/bin/journalctl";
-           options = [ "NOPASSWD" ];
-          }
-          {
-           command = "/run/current-system/sw/bin/tailscale";
-           options = [ "NOPASSWD" ];
-          }
-        ];
-      }
-    ];
-  };
-}

users/blake/default.nix

@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}: {
+  # create blake user
+  users = {
+    users = {
+      blake = {
+        isNormalUser = true;
+        extraGroups = ["wheel" "networkmanager" "docker" "media" "podman" "minecraft"]; # Enable ‘sudo’ for the user.
+        uid = 1000;
+        shell = pkgs.zsh;
+        group = "blake";
+        hashedPasswordFile = config.sops.secrets."blake_passwd".path;
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBK0AGJfZGyqW8/krvQV+PL7axcDW/EnKyHy9M8wryQx klefki"
+          "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPdC9cCX8awvA19Ri65fvbYjZYe8X1Ef+nOZAIv92AS6u4SkJYqOvPYfqRHXORNDpbzjTV6nackyCKvV5EO4niv4MFIgdkEQwuVHcYX32/dOsWdDoeXBT/l2sFFM7JESwQ== blake@zygarde"
+        ];
+      };
+    };
+    groups.blake = { gid = 1000; };
+  };
+
+  # define home-manager user
+  home-manager = {
+    extraSpecialArgs = {inherit inputs;};
+    backupFileExtension = "bak";
+    useUserPackages = true;
+    useGlobalPkgs = true;
+    users = {
+      "blake" = import ./home.nix;
+    };
+  };
+
+  nix.settings.trusted-users = ["blake"];
+  programs.zsh.enable = true;
+
+}

users/blake/dots/git/default.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: {
+  # configure git
+  programs.git = {
+    enable = true;
+    userName = "blake";
+    userEmail = "me@blakedheld.xyz";
+    extraConfig = {
+      init.defaultBranch = "trunk";
+      core.editor = "nvim";
+      pull.rebase = true;
+      push.autoSetupRemote = true;
+    };
+  };
+}

users/blake/dots/zsh/.zshenv

@@ -0,0 +1,8 @@
+# home manager envs
+. "/etc/profiles/per-user/blake/etc/profile.d/hm-session-vars.sh"
+
+# Only source this once
+if [[ -z "$__HM_ZSH_SESS_VARS_SOURCED" ]]; then
+  export __HM_ZSH_SESS_VARS_SOURCED=1
+  
+fi

users/blake/dots/zsh/.zshrc

@@ -0,0 +1,206 @@
+# blake's zsh config file
+# 'source .zshrc' to load the config after editing
+
+# prompt
+#PS1='%B%S%F{004}[%n@%m]:%f%s%F{015}%~%f%S%F{004}$%f%s%b '
+
+# blakes prompt
+PS1='%F{0}%K{126}%B[%n@%m]%b%k%f:%F{015}%B[%~]%b%f%F{015}%S$%s%f '
+
+# --- defaults ---
+export EDITOR=nvim
+export PAGER=less
+
+# --- history ---
+HISTSIZE=10000
+SAVEHIST=10000
+HISTFILE=~/.config/zsh/.zsh_history
+setopt append_history
+setopt inc_append_history
+unsetopt share_history 
+
+# --- tab complete ---
+autoload -Uz compinit && compinit
+setopt no_menu_complete
+compinit
+
+# --- aliases ---
+
+# zsh
+alias cfz='nvim $HOME/.config/zsh/.zshrc'
+alias src='source $HOME/.config/zsh/.zshrc'
+
+# config editing
+alias cfh='nvim $HOME/.config/hypr/hyprland.conf'
+alias cfl='nvim $HOME/.config/lf/lfrc'
+
+# navigation
+setopt autocd
+set -o vi
+alias ls='ls --color=auto --group-directories-first'
+alias ll='ls -lh --color=auto --group-directories-first'
+alias la='ls -Alh --color=auto --group-directories-first'
+alias ..='cd ..'
+alias ...='cd ../..'
+alias fs='du -h | sort -h'
+alias ds='du -hs'
+
+# shortcuts
+alias vswap='cd ~/.local/state/nvim/swap'
+alias rswap='rm ~/.local/state/nvim/swap/*'
+alias tn='lf ~/documents/holocron/notes/tech'
+alias nhc='lf ~/documents/holocron/work/nhc'
+alias diary='cd ~/documents/holocron/notes/journal/diary'
+alias screenies='lf ~/pictures/screenshots'
+alias holo='lf ~/documents/holocron'
+
+# safety
+alias cp='cp -iv'
+alias mv='mv -iv'
+alias rm='rm -Iv'
+
+# colors
+alias grep='grep --color=auto'
+alias fgrep='fgrep --color=auto'
+alias egrep='egrep --color=auto'
+
+# scripts
+alias rebuild='sh ~/.nix/bin/rebuild.sh'
+alias perms='sudo sh ~/.nix/bin/perms.sh'
+alias bb='sudo sh ~/.nix/bin/backup_browse.sh'
+
+# tools
+alias v='nvim'
+alias sv='sudo nvim'
+alias vim='nvim'
+alias wifi='nmtui'
+alias bt='bluetuith --no-warning'
+alias audio='pulsemixer'
+alias img='nsxiv'
+alias vid='mpv'
+alias pdf='zathura'
+alias fw='sudo ufw status verbose'
+alias sec='sops ~/.nix/secrets/secrets.yaml'
+
+# git
+alias status='git status'
+alias add='git add'
+alias commit='git commit -am'
+alias push='git push'
+alias pull='git pull'
+alias dotfiles='/usr/bin/git --git-dir=$HOME/.dotfiles --work-tree=$HOME'
+alias dtf='/usr/bin/git --git-dir=$HOME/.dotfiles --work-tree=$HOME'
+
+# systemd
+alias stat='sudo systemctl status'
+alias restart='sudo systemctl restart'
+alias start='sudo systemctl start'
+alias stop='sudo systemctl stop'
+alias jou='sudo journalctl -xeu'
+alias live='sudo journalctl -o short-iso -n 50 -fu'
+
+# shortcuts
+alias chil='nvim ~/documents/holocron/tech/devices/yveltal/chilton'
+alias school='nvim ~/documents/holocron/school/school.md'
+
+# system
+alias peace='systemctl poweroff'
+alias love='systemctl reboot'
+alias lock='loginctl lock-session'
+
+# ssh
+alias nebby='ssh nebula'
+
+# wild shit
+alias mgdrive='rclone mount gdrive: /media/gdrive --daemon --vfs-cache-mode writes'
+alias micloud='rclone mount icloud: /media/icloud --daemon --vfs-cache-mode writes'
+alias smp='mcrcon -H 10.0.0.104 -P 25575 -p WoopaGangaRecProGamingPassLmaoJkJk'
+alias mcap='sudo umount /media/microsd ; sudo cryptsetup luksClose /dev/mapper/capsule ; sudo cryptsetup luksOpen UUID=a9e81f14-1e74-4777-a37a-81a0a43ae8d9 capsule --key-file ~/.config/cred/capsule.keyfile ; sudo mount -a'
+
+# --- ssh auth sock ---
+export GPG_TTY=$(tty)
+export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
+gpgconf --launch gpg-agent
+
+# --- path ---
+
+# Define directories to add to PATH
+ADDTOPATHS=(
+    "$HOME/.local/bin"
+    "$HOME/.local/bin/timecapsule"
+)
+
+for ADDTOPATH in "${ADDTOPATHS[@]}"; do
+    if [ -d "$ADDTOPATH" ]; then
+        case ":${PATH}:" in
+            *:"${ADDTOPATH}":*) 
+                ;;
+            *) 
+                PATH="${PATH}:${ADDTOPATH}"
+                ;;
+        esac
+    else
+    fi
+done
+export PATH
+
+# --- scripts ---
+# make lf change the working directory upon exit
+alias lf='lfcd'
+lfcd () {cd "$(command lf -print-last-dir "$@")"}
+
+# --- plugins ---
+# you really hate the idea of your zshrc auto cloning 
+# and installling the plugin manager. To do so manually:
+# git clone https://github.com/zplug/zplug "$HOME/.config/zsh/zplug"
+
+export ZPLUG_HOME="$HOME/.config/zsh/zplug/"  # Change this to your custom directory
+if [ -d "$HOME/.config/zsh/zplug" ]; then
+    export ZPLUG_INSTALLED="1"
+    source "$HOME/.config/zsh/zplug/init.zsh"
+else
+    if [[ $- == *i* ]]; then
+        echo "⚠️  zplug is not installed. Run: git clone https://github.com/zplug/zplug $HOME/.config/zsh/zplug"
+    fi
+fi
+
+# init zplug
+if [ -n "ZPLUG_INSTALLED" ]; then
+    zplug "zsh-users/zsh-syntax-highlighting", defer:2
+    zplug "zsh-users/zsh-history-substring-search"
+    zplug "zsh-users/zsh-autosuggestions"  # Command suggestions as you type
+    zplug "zsh-users/zsh-completions"      # Additional completions for more commands
+    zplug "olivierverdier/zsh-git-prompt"
+    zplug load
+    # install if there are new plugins 
+    if ! zplug check --verbose; then
+        zplug install
+        zplug load
+    fi
+fi
+
+# -- syntax highlighting --
+# Adjusted zsh-syntax-highlighting colors for red-green color blindness
+ZSH_HIGHLIGHT_STYLES[default]=none
+ZSH_HIGHLIGHT_STYLES[unknown-token]=fg=magenta  # (Was red)
+ZSH_HIGHLIGHT_STYLES[reserved-word]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[alias]=fg=blue  # (Was green)
+ZSH_HIGHLIGHT_STYLES[builtin]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[function]=fg=blue  # (Was green)
+ZSH_HIGHLIGHT_STYLES[command]=fg=blue,bold  # (Was green)
+ZSH_HIGHLIGHT_STYLES[precommand]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[commandseparator]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[hashed-command]=fg=blue  # (Was green)
+ZSH_HIGHLIGHT_STYLES[path]=fg=cyan,underline  # This ensures paths are underlined
+ZSH_HIGHLIGHT_STYLES[globbing]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[history-expansion]=fg=magenta  # (Was red)
+ZSH_HIGHLIGHT_STYLES[single-hyphen-option]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[double-hyphen-option]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[back-quoted-argument]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[single-quoted-argument]=fg=white,bold
+ZSH_HIGHLIGHT_STYLES[double-quoted-argument]=fg=white
+ZSH_HIGHLIGHT_STYLES[dollar-quoted-argument]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[back-double-quoted-argument]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[assign]=fg=cyan
+ZSH_HIGHLIGHT_STYLES[comment]=fg=yellow
+

users/blake/dots/zsh/default.nix

@@ -0,0 +1,21 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  # just using the normal lfrc
+  programs.lf = {
+    enable = false;
+  };
+
+  # install it to userspace
+  home.packages = with pkgs; [lf ctpv trashy];
+
+  # link configs
+  xdg.configFile."lf/lfrc" = {
+    source = config.lib.file.mkOutOfStoreSymlink "/home/blake/.nix/users/blake/dots/lf/lfrc";
+  };
+  xdg.configFile."ctpv/config" = {
+    source = config.lib.file.mkOutOfStoreSymlink "/home/blake/.nix/users/blake/dots/lf/ctpv_config";
+  };
+}

users/blake/home.nix

@@ -1,10 +1,14 @@
-{ config, lib, pkgs, inputs, ... }:
-
 {
-
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}: {
   imports = [
     ./dots/neovim
     ./dots/lf
+    ./dots/git
   ];
 
   # general config
@@ -22,12 +26,11 @@
     usbutils
   ];
 
-
   # setup zsh
   home.sessionVariables.ZDOTDIR = "$HOME/.config/zsh";
   programs.zsh = {
     enable = true;
-#    dotDir = ".config/zsh";
+    #    dotDir = ".config/zsh";
   };
   # link dotfiles
   xdg.configFile."zsh" = {
@@ -64,18 +67,19 @@
   home.file.".ssh/id_snowbelle".source = config.lib.file.mkOutOfStoreSymlink /home/blake/.nix/.keyring/ssh/id_snowbelle;
   home.file.".ssh/id_snowbelle.pub".source = config.lib.file.mkOutOfStoreSymlink /home/blake/.nix/.keyring/ssh/id_snowbelle.pub;
 
-  # configure git
+  #    # manage secrets with sops
-  programs.git = {
+  #    sops.secrets = {
-    enable = true;
+  #      "id_snowbelle" = {
-    userName = "blake";
+  #        owner = "blake";
-    userEmail = "me@blakedheld.xyz";
+  #        group = "blake";
-    extraConfig = {
+  #        mode = "0600";
-      init.defaultBranch = "trunk";
+  #        path = "/home/blake/.ssh/id_snowbelle";
-      core.editor = "nvim";
+  #      };
-      pull.rebase = true;
+  #      "id_snowbelle.pub" = {
-      push.autoSetupRemote = true;
+  #        owner = "blake";
-    };
+  #        group = "blake";
-  };
+  #        mode = "644";
-
+  #        path = "/home/blake/.ssh/id_snowbelle.pub";
-
+  #      };
+  #    };
 }

users/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, config, lib, ... }:
+
+{
+  imports = [
+    ./blake
+  ];
+
+
+}

users/users.nix

@@ -1,10 +0,0 @@
-{ pkgs, config, lib, ... }:
-
-{
-  imports = [
-    ./blake/blake.nix
-  ];
-
-  users.blake.enable = lib.mkDefault true;
-
-}